Linux Commands

The Linux command line is the DevOps engineer’s primary instrument — it’s where you diagnose a stuck host, tail a failing service, reclaim a full disk, and trace a network problem. This reference is organized by the task you’re doing, and every category has a searchable table so you can filter to the exact command in a second. The prose focuses on the commands with real nuance and the ones that can ruin your day if you get them wrong.

File management

find is the workhorse — it filters by name, age, size, and type, and can act on matches:

find /var/log -name '*.log' -size +100M           # large logs
find . -type f -mtime +30 -print                  # files not modified in 30 days
find /tmp -type f -mtime +7 -delete               # ...and delete them (dry-run first!)

Text processing

The Unix philosophy in practice: small tools piped together. grep finds, sed edits streams, awk processes columns, and the rest reshape text.

# Top 10 client IPs in an access log
awk '{print $1}' access.log | sort | uniq -c | sort -rn | head

# Find-and-replace across a project (in place, with a .bak safety copy)
grep -rl 'oldName' src/ | xargs sed -i.bak 's/oldName/newName/g'

Filesystems and storage

The commands you reach for when a disk fills up or you’re provisioning storage.

When a host reports “disk full,” check three things in order:

df -h                              # which filesystem is full?
df -i                              # or is it inodes (millions of tiny files)?
du -h --max-depth=1 /var | sort -h # what in there is large?

Processes

Networking

The first-response toolkit for “is it a network problem?”

ss -tulpn | grep :443            # what's listening on 443, and which PID?
nc -zv db.internal 5432          # can I even reach the DB port?
dig +short api.example.com       # what does DNS resolve to right now?
curl -sS -o /dev/null -w '%{http_code} %{time_total}s\n' https://api.example.com/health

System services (systemd)

On modern Linux, services are systemd units. systemctl controls them; journalctl reads their logs.

systemctl status nginx                       # is it running? why did it stop?
journalctl -u nginx --since '10 min ago'     # what did it log?
systemctl list-units --failed                # what's broken on this host?

Permissions and ownership

Numeric mode is owner|group|other, each a sum of read (4) + write (2) + execute (1): 644 = owner rw, group/other r; 755 = owner rwx, group/other rx.

Archives and compression

The classic mnemonic: create, extract, test/list; add z for gzip, f for the filename. tar tzf (list) before tar xzf (extract) tells you where an archive will unpack — some tarballs extract into the current directory rather than a subfolder.

System information

Troubleshooting

When something is wrong and you don’t yet know what, these open the black box.

lsof -i :8080                      # "address already in use" — who has the port?
dmesg -T | grep -i 'killed process'   # did the OOM killer strike?
strace -f -e trace=openat -p 4242  # why can't the process find its config file?

Troubleshooting specific errors

Common Linux errors, each with a dedicated guide:

• cannot open shared object file — a missing .so; resolve with ldd/ldconfig.
• cannot allocate memory — overcommit, ulimits, or genuine exhaustion.
• cannot assign requested address — binding/port/ephemeral-range issues.
• kernel panic: unable to mount root — boot/initramfs/root-device failures.

For a specific message, search the DevOps error library.

Production checklist

• Quote every variable in scripts ("$path"), especially before rm, find -delete, dd.
• df -h and df -i both — inode exhaustion looks like “disk full” with free bytes.
• SIGTERM before SIGKILL; give services a moment to shut down cleanly.
• Fix ownership, not chmod 777. Scope recursive chmod/chown carefully.
• lsblk before dd/mkfs. Confirm the device; there is no undo.
• Prefer ip/ss/dig over the deprecated ifconfig/netstat/nslookup.
• Scope strace/tcpdump on production; they cost performance and can capture secrets.

Frequently asked questions

What replaced ifconfig and netstat? ip (addresses/routes) and ss (sockets). On modern kernels they’re faster and more accurate, and they’re what ships by default. ss -tulpn shows listening sockets with the owning process.

My disk says it’s full but du shows free space — why? Two common causes: inode exhaustion (df -i — millions of tiny files) or a deleted-but-still-open file (a process holding a deleted log; lsof | grep deleted). Restart the holder or truncate the file.

How do I safely find-and-replace across many files? grep -rl 'old' path | xargs sed -i.bak 's/old/new/g' — the .bak gives you a rollback, and grep -rl limits sed to files that actually match.

What’s the difference between kill and kill -9? kill sends SIGTERM (catchable — the process cleans up and exits). kill -9 sends SIGKILL (uncatchable — instant stop, possible corruption). Try SIGTERM first.

Why does my sed -i fail on macOS? BSD sed requires a backup-suffix argument: sed -i '' 's/.../.../'. Use sed -i.bak for a form that works on both GNU and BSD.

How do I see why a service won’t start? systemctl status <svc> for the summary and journalctl -u <svc> --since '10 min ago' for the detail. systemctl list-units --failed shows everything currently broken.

Related resources

• Guide: Bash Scripting — turn these commands into safe, reusable automation.
• Academy: Ubuntu 26.04 AI Infrastructure and the Kali Linux path go deeper on Linux for DevOps and security.
• Error library: the 800+ DevOps error guides cover specific Linux failures step by step.