Linux Command Cheat Sheet

List files with hidden entries and human-readable sizes.

ls -lah /var/log

Change directory; cd - returns to the previous one.

cd /etc/nginx && cd -

Print the current working directory.

pwd

Copy directories recursively; -a keeps permissions and timestamps.

cp -a /etc/nginx /backup/nginx

Move or rename files and directories.

mv app.log app.log.bak

Recursive forced delete. Destructive: list the path first.

rm -rf /tmp/build

Create directories recursively, including missing parents.

mkdir -p /data/app/logs

Create an empty file or update timestamps.

touch /tmp/health.ok

Create a symbolic link, handy for versioned releases.

ln -s /opt/app-1.2.0 /opt/app-current

Show permissions, size, and timestamps of a file.

stat /etc/nginx/nginx.conf

Identify the real type of a file from its content.

file /data/export.bin

Print a directory tree limited to two levels.

tree -L 2 -I node_modules

Find files by name with wildcard support.

find /var/log -name "*.log" -size +100M

Delete files last modified more than seven days ago.

find /tmp -name "*.tmp" -mtime +7 -delete

Look up paths from an index, much faster than find.

sudo updatedb && locate nginx.conf

Print a whole file; fine for small ones.

cat /etc/os-release

Page through large files; slash searches, q quits.

less /var/log/nginx/access.log

Show the first lines of a file.

head -n 20 access.log

Follow the end of a file in real time.

tail -f /var/log/nginx/error.log

Search recursively and show line numbers.

grep -rn --include="*.ts" "TODO" src/

Invert the match and print non-matching lines.

grep -v "^#" nginx.conf

Replace in place; -i edits the file directly.

sed -i "s/8080/8081/g" config.yml

Print only a range of lines.

sed -n "10,20p" app.log

Extract fields by column; $0 is the whole line.

awk "{print $1}" access.log | sort | uniq -c

Cut columns by delimiter, good for fixed formats.

cut -d: -f1 /etc/passwd

Sort and dedupe; -n numeric, -r reverse.

sort -nr access.log | head

Count adjacent duplicates; sort first.

sort access.log | uniq -c | sort -nr

Count lines; -c counts bytes.

wc -l access.log

Convert Windows CRLF line endings to Unix LF.

dos2unix win.txt

Squeeze repeated characters, handy for extra spaces.

tr -s " " < in.txt > out.txt

Build command arguments from standard input.

find . -name "*.tmp" | xargs rm -f

Write to both stdout and a file.

echo "1.2.3" | sudo tee /etc/app/version

Compare two files in unified format.

diff -u old.conf new.conf

Set permissions: owner rwx, others read and execute.

chmod -R 755 /var/www/html

Make files readable by all and writable by owner only.

chmod -R 644 /etc/app/*.conf

Change owner and group recursively.

chown -R www-data:www-data /var/www

Change only the group.

chgrp developers /srv/project

Set the default permission mask for new files.

umask 022

Create a user with a home directory and login shell.

useradd -m -s /bin/bash ada

Append a user to a supplementary group; without -a the others are replaced.

usermod -aG docker ada

Change the password of a user.

sudo passwd ada

Switch user and load that environment.

su - postgres

Start a login shell as root.

sudo -i

Show the current uid, gid, and groups.

id

List all groups a user belongs to.

groups www-data

Snapshot all processes; filter with grep.

ps aux | grep -v grep | grep nginx

Live CPU and memory view; M sorts by memory.

top -b -n 1 | head -20

Friendlier interactive process viewer; install separately.

htop

Send SIGTERM to ask a process to exit gracefully.

kill 12345

Force kill; may lose data, use only when SIGTERM fails.

kill -9 12345

Kill processes matching the full command line.

pkill -f "java -jar app.jar"

Kill all processes with the given name.

killall -HUP nginx

List background jobs and move them between foreground and background.

jobs -l

Keep a process running after logout, logging to nohup.out.

nohup ./start.sh > app.log 2>&1 &

Start with lower priority to avoid starving key services.

nice -n 10 tar -czf backup.tgz /data

Adjust the priority of a running process.

sudo renice -n -5 -p 12345

Re-run a command every two seconds.

watch -n 2 "df -h /"

List files and sockets opened by a process.

lsof -p 12345 | head

Show kernel version and architecture.

uname -a

Show uptime and load averages.

uptime

Show memory and swap usage.

free -h

Report CPU, memory, IO, and context switches every second.

vmstat 1 5

Show per-disk IO utilization and wait.

iostat -x 1

Print all environment variables.

env | grep PATH

Set an environment variable for the current session only.

export NODE_ENV=production

Show command history; !! repeats the last command.

history | grep systemctl

Define a command alias.

alias ll="ls -lah"

Format a timestamp as a date.

date -d "@1700000000" "+%F %T"

Show and set timezone and NTP sync state.

timedatectl set-timezone Asia/Shanghai

Show or set the file descriptor limit.

ulimit -n 65535

Temporarily change a kernel parameter.

sysctl -w net.ipv4.ip_forward=1

Edit the crontab of the current user.

crontab -l

Show interfaces and addresses; replaces ifconfig.

ip -br addr

Show the routing table and default gateway.

ip route get 8.8.8.8

List listening ports with owning processes.

ss -tulpn | grep 8080

Show all connections; still common on older systems.

netstat -anp | grep ESTABLISHED

Connectivity test with four packets.

ping -c 4 8.8.8.8

Show the route hop by hop.

traceroute example.com

Query DNS records, useful for resolution issues.

dig +short example.com A

Query a specific DNS server.

nslookup example.com 8.8.8.8

Fetch response headers only.

curl -I -L https://example.com

Send a JSON request body.

curl -X POST -H "Content-Type: application/json" -d "{}" http://localhost:8080/api

Download with resume support.

wget -c https://example.com/big.iso

Log in to a remote host with a key.

ssh -i ~/.ssh/id_ed25519 ada@10.0.0.5

Copy directories recursively between hosts.

scp -r ./dist root@10.0.0.5:/var/www

Incremental sync; --delete mirrors the source.

rsync -avz --delete ./dist/ deploy@10.0.0.5:/var/www/

Check whether a remote port is reachable.

nc -zv 10.0.0.5 8080

Capture packets on a port; -w writes a file.

tcpdump -i any -nn port 8080 -w dump.pcap

Show disk usage per filesystem.

df -h

Summarize sizes of entries in the current directory.

du -sh /* 2>/dev/null | sort -h

Show block devices and mount points as a tree.

lsblk -f

List disks and partition tables.

sudo fdisk -l

Mount a device at a directory.

mount -o ro /dev/sdb1 /mnt

Unmount; if busy, find the user with lsof first.

umount /data

Format a partition. Destroys existing data.

mkfs.ext4 -L data /dev/sdb1

Check and repair a filesystem; unmount first.

fsck -y /dev/sdb1

Create a gzipped tar archive.

tar -czf backup-$(date +%F).tgz /data/app

Extract an archive into a directory.

tar -xzf app.tgz -C /opt

Create a zip archive recursively.

zip -r site.zip ./dist

Compress with a high ratio at the cost of speed.

xz -9 -T0 big.sql

Start a service; enable makes it start on boot.

systemctl enable --now nginx

Show service status and recent logs.

systemctl status nginx

List units that failed to start.

systemctl list-units --failed

Show logs of a unit.

journalctl -u nginx --since "1 hour ago"

Follow the system journal.

journalctl -f -p err

Read the kernel ring buffer.

dmesg -T | tail -50

Debian family index and package upgrade.

sudo apt update && sudo apt upgrade -y

Install a package.

sudo apt install -y curl

List installed packages and versions.

dpkg -l | grep nginx

Install on RHEL family; older releases use yum.

sudo dnf install -y nginx

Trace system calls of a process to find where it hangs.

strace -p 12345 -f -e trace=network

Find the process using a port.

sudo lsof -i :8080

Summarize socket counts.

ss -s

List firewall rules with line numbers.

iptables -L INPUT -n --line-numbers

Allow a port with the simplified firewall.

ufw status verbose

Listen on a local port for connectivity tests.

nc -l 9000

Follow the system log; the path varies by distribution.

tail -f /var/log/messages

Grep error lines across logs.

grep -iE "error|fail" /var/log/app/*.log | tail -30

SIGTERM: request a graceful shutdown, the default.

kill -15 12345

SIGKILL: the kernel kills it immediately, no cleanup.

kill -9 12345

SIGHUP: services often reload their configuration.

kill -1 $(cat /run/nginx.pid)

SIGINT: same as pressing Ctrl+C.

kill -2 12345

SIGQUIT: the JVM dumps thread stacks and exits.

kill -3 12345

SIGCONT and SIGSTOP: resume and pause a process.

kill -19 12345 && kill -18 12345

SIGUSR1: user-defined, for example reopening logs in Nginx.

kill -10 <nginx master pid>

List all signal numbers and names.

kill -l