Linux cheat sheet

find /var/log -type f -mtime -1 -size +1M   # modified in the last day, larger than 1 MB
find . -name "*.conf" -not -path "./tmp/*"  # by name, excluding a path
grep -rn "error" /etc/nginx                  # search file contents recursively
type -a python3                              # which executable runs

cp -a src/ dst/              # copy keeping permissions and links
mv old new                   # rename or move
ln -sfn target linkname      # replace a symlink to a directory safely
readlink -f linkname         # resolve the final path

useradd -m -s /bin/bash deploy        # create a user with a home directory
usermod -aG docker deploy             # add to a group (keep existing ones)
passwd -l olduser                     # lock an account
getent passwd deploy                  # look up through all name sources

ps aux --sort=-%mem | head            # top memory users
ps -eo pid,ppid,stat,cmd | grep defunct   # find zombies
top -o %CPU                           # live view sorted by CPU
kill -TERM 1234                       # polite stop
kill -KILL 1234                       # last resort, cannot be caught
pgrep -af nginx                       # find by name with full command

systemctl status nginx                # state and recent log lines
systemctl enable --now nginx          # start now and at boot
systemctl restart nginx
systemctl list-units --failed         # everything that failed
systemctl daemon-reload               # after editing a unit file

df -hT                                # space per filesystem with type
df -i                                 # inode usage (full inodes also stop writes)
lsblk -f                              # block devices and filesystems
findmnt /data                         # where and how a path is mounted
du -xh / --max-depth=1 2>/dev/null | sort -h | tail
lsof +L1                              # deleted files still held open

journalctl -u nginx --since "1 hour ago"
journalctl -p err -b                  # errors since boot
journalctl -f -u myapp                # follow live
tail -f /var/log/syslog
dmesg -T | tail                       # kernel messages with readable time

uptime                                # load averages
vmstat 1 5                            # run queue, swap, I/O wait
free -h                               # memory and swap
iostat -xz 1 3                        # disk utilization and latency
ss -s                                 # socket summary
sar -n DEV 1 3                        # network throughput per interface

grep -rn --include='*.conf' 'listen' /etc/nginx
grep -c 'ERROR' app.log
grep -v '^#' /etc/ssh/sshd_config | sed '/^$/d'
awk -F: '$3 >= 1000 {print $1, $3}' /etc/passwd
awk '{s+=$NF} END {print s}' sizes.txt
sed -n '20,40p' file.txt
sed 's/old/new/g' file.txt
cut -d, -f1,3 data.csv
sort data.txt | uniq -c | sort -rn | head
tr -s ' ' < file.txt
wc -l *.log
diff -u old.conf new.conf
xargs -a hosts.txt -P4 -I{} ping -c1 {}
tee -a out.log < input.txt

tar -czf backup.tar.gz /srv/app
tar -tzf backup.tar.gz | head
tar -xzf backup.tar.gz -C /restore
zip -r site.zip site/
unzip -l site.zip
rsync -avh --dry-run src/ user@host:/dst/
rsync -avh --delete src/ user@host:/dst/
scp file.txt user@host:/tmp/
curl -fsSLO https://example.com/file.tgz
sha256sum file.tgz

stat -c '%a %U:%G %n' /etc/passwd
chmod u+x script.sh
chmod -R g+rX /srv/shared
chown -R app:app /srv/app
setfacl -m u:alice:rx /srv/data
getfacl /srv/data
umask
sudo -l
lsattr file
chattr +i /etc/important.conf

ip -br addr
ip route
ss -tulpn
ss -s
ping -c3 1.1.1.1
dig +short example.com
curl -sS -o /dev/null -w '%{http_code} %{time_total}s\n' https://example.com
traceroute -n example.com
nc -zv host 443
sudo tcpdump -i eth0 -nn port 53 -c 20