D

Linux

Core Linux commands for files, processes, networking, services and logs.

Updated 2026-09-03

On this page

Files & Directories

ls -lah

Lists files with permissions, owner, human-readable size, and includes hidden files.

find . -name '*.log' -mtime +7

Finds files matching a name pattern, modified more than 7 days ago.

cp -r SOURCE_DIR DEST_DIR

Copies a directory recursively.

rm -rf DIR_NAME
destructive

Deletes a directory and everything in it, without confirmation. No undo, no trash — verify the path before running this.

tar -czvf archive.tar.gz DIR_NAME

Creates a gzip-compressed tarball of a directory.

tar -xzvf archive.tar.gz

Extracts a gzip-compressed tarball into the current directory.

Permissions

chmod 755 script.sh

Sets owner read/write/execute, group and others read/execute — the standard mode for an executable script others need to run but not modify.

chown user:group FILE_NAME

Changes a file's owning user and group.

chmod -R

Applies a permission change recursively through a directory tree — combine with a mode, e.g. chmod -R 644 DIR_NAME.

Processes

ps aux

Lists every process on the system with CPU/memory usage, owning user, and command line.

ps aux | grep nginx

Filters the process list to a specific name.

top

Live, auto-refreshing view of processes sorted by CPU usage.

kill PID

Sends SIGTERM to a process, requesting graceful shutdown.

kill -9 PID
destructive

Sends SIGKILL — terminates immediately with no chance for the process to clean up, close files, or flush buffers. Use only after a plain kill hasn't worked.

nohup ./long-task.sh &

Runs a command immune to hangup signals and detached into the background, so it survives the terminal session closing.

CPU & Memory

top

Shows live per-process CPU and memory usage, plus system-wide load average.

free -m

Shows total, used, and free memory and swap in megabytes.

uptime

Shows how long the system has been up and the 1/5/15-minute load averages.

nproc

Prints the number of available CPU cores — useful context for interpreting a load average.

Disk Usage

df -h

Shows disk space usage per mounted filesystem in human-readable units.

du -sh *

Shows the disk usage of each item in the current directory, summarized rather than listing every file inside.

du -sh /var/log/* | sort -rh | head -10

Finds the 10 largest items under a directory — the fastest way to locate what's actually eating disk space.

lsof +L1

Lists open files with a link count of zero — a deleted-but-still-open file, which keeps holding disk space until the process closes it.

Networking

ip addr

Shows network interfaces and their assigned IP addresses.

ss -tulpn

Lists listening TCP/UDP sockets with the owning process — the modern replacement for netstat.

curl -I https://example.com

Fetches only the response headers, for a quick check that a service is up and what it's returning.

ping -c 4 8.8.8.8

Sends 4 ICMP echo requests to test basic reachability.

traceroute example.com

Shows the network hops a packet takes to reach a host — useful for isolating where latency or a drop is happening.

SSH

ssh user@host

Opens an interactive SSH session.

ssh -i ~/.ssh/key.pem user@host

Connects using a specific private key instead of the default identity.

scp file.txt user@host:/remote/path/

Copies a local file to a remote host over SSH.

ssh-keygen -t ed25519 -C 'you@example.com'

Generates a new SSH keypair using the modern ed25519 algorithm.

Services (systemd)

systemctl status nginx

Shows whether a service is running, its recent log lines, and its enabled/disabled state.

systemctl start nginx

Starts a service immediately.

systemctl restart nginx

Stops and starts a service in one step — the usual way to apply a config change.

systemctl enable nginx

Configures a service to start automatically on boot, without starting it now.

systemctl daemon-reload

Reloads systemd's unit files after editing one — required before a changed unit file takes effect.

Logs

journalctl -u nginx

Shows the systemd journal for a specific service.

journalctl -u nginx -f

Streams a service's journal live, like tail -f.

journalctl --since '1 hour ago'

Filters the journal to a relative time window across all units.

tail -f /var/log/syslog

Streams a plain log file live. Use /var/log/messages on RHEL-family distributions instead.

Packages

apt update && apt install PACKAGE_NAME

Refreshes the package index, then installs a package (Debian/Ubuntu).

yum install PACKAGE_NAME

Installs a package on RHEL/CentOS-family distributions.

dpkg -l | grep PACKAGE_NAME

Checks whether a package is installed and its version (Debian/Ubuntu).

Find & Grep

find / -type f -name '*.conf' 2>/dev/null

Finds files by name across the filesystem, discarding permission-denied noise.

grep -rn 'ERROR' /var/log/app/

Searches recursively for a pattern, printing matching line numbers.

grep -c 'timeout' access.log

Counts matching lines instead of printing them.

Cron

crontab -e

Opens the current user's crontab for editing.

crontab -l

Lists the current user's scheduled cron jobs.

Cron syntax

minute hour day-of-month month day-of-week command0 3 * * * runs daily at 03:00, */15 * * * * runs every 15 minutes.

See the Linux Troubleshooting tab for disk-full and high-load diagnostic walkthroughs.

Official documentation