§ ref Quick reference 101 commands

Linux Cheat Sheet

The commands you reach for to get through a box and find what’s wrong — process, disk, network, logs, containers. Print it, pin it, or bookmark it. Hover a row to copy nothing—just read; every command is copy-safe as written.

01 Finding your way / system facts

`uname -a`	Kernel, hostname, architecture — everything at a glance
`hostnamectl`	Hostname, OS, kernel, virtualization, machine-id
`uptime`	How long up + load averages (1/5/15 min)
`lsb_release -a`	Distro name and version
`cat /etc/os-release`	Distro details when lsb_release is missing
`id && groups`	Who am I, and which groups do I belong to
`whoami && hostname -I`	Current user and all IPs on the box
`timedatectl`	Time, timezone, NTP sync status

02 CPU / memory / load

`top`	Live process/CPU/memory — the reflex first look
`htop`	Friendlier top; sortable, tree view (F5), kill (F9)
`free -h`	Memory + swap in human units
`vmstat 1`	CPU/memory/IO per second — spot pressure
`mpstat -P ALL 1`	Per-core CPU usage (sysstat)
`nproc`	How many CPU cores are available
`ps aux --sort=-%mem \| head`	Top memory hogs right now
`ps aux --sort=-%cpu \| head`	Top CPU hogs right now
`uptime; cat /proc/loadavg`	Load averages — compare to core count

03 Disk / filesystem / inodes

`df -h`	Free space per mounted filesystem
`df -i`	Free inodes — the "disk full but df -h looks fine" case
`du -sh *`	Size of each item in the current dir
`du -h --max-depth=1 / \| sort -h`	Find what is eating a filesystem, largest last
`ncdu /`	Interactive disk-usage explorer (install ncdu)
`lsblk -f`	Block devices, filesystems, mountpoints, UUIDs
`mount \| column -t`	What is mounted, where, with which options
`findmnt`	Mount tree — clearer than mount
`lsof +D /path`	Which processes hold files under a directory
`du -xh / \| sort -h \| tail -20`	Biggest dirs on the root fs only (no crossing mounts)

04 Processes / signals

`ps -ef`	Full process list, parent PIDs
`pgrep -a nginx`	PIDs (and cmdline) matching a name
`pstree -p`	Process tree with PIDs
`kill -TERM <pid>`	Ask a process to stop cleanly
`kill -9 <pid>`	Force kill (last resort — no cleanup)
`pkill -f "pattern"`	Kill by matching the full command line
`nice -n 10 cmd`	Start a process with lower CPU priority
`renice 10 -p <pid>`	Re-prioritize a running process
`strace -p <pid>`	Trace syscalls of a running process

05 Ports / connections / sockets

`ss -tulpn`	Listening TCP/UDP ports + owning process — the modern netstat
`ss -tn state established`	All established TCP connections
`lsof -i :443`	What is using a specific port
`fuser 8080/tcp`	PID holding a TCP port
`ip -br a`	Interfaces + IPs, one line each
`ip route`	Routing table — where does traffic go
`ping -c4 1.1.1.1`	Basic reachability test
`mtr 1.1.1.1`	Live traceroute + loss per hop
`dig +short example.com`	Resolve a name fast
`curl -I https://host`	Headers only — check status without body
`nc -zv host 22`	Is a remote TCP port open

06 Logs / journald

`journalctl -xe`	Recent logs with explanations — first stop after a failure
`journalctl -u nginx -f`	Follow one service's logs live
`journalctl -u ssh --since "1 hour ago"`	Time-boxed service logs
`journalctl -p err -b`	Only errors, this boot
`journalctl --disk-usage`	How much space the journal uses
`dmesg -T \| tail`	Kernel ring buffer (OOM kills, disk errors) with timestamps
`tail -f /var/log/syslog`	Follow the classic syslog
`grep -ri "error" /var/log \| tail`	Sweep logs for errors

07 systemd / services

`systemctl status svc`	Is it running, PID, recent log lines
`systemctl restart svc`	Restart a unit
`systemctl enable --now svc`	Start now + on boot
`systemctl list-units --failed`	Everything that failed to start
`systemctl daemon-reload`	Reload unit files after editing them
`systemd-analyze blame`	What made boot slow
`systemctl cat svc`	Show the effective unit file + drop-ins

08 Users / permissions

`sudo -l`	What can I run with sudo
`chmod 640 file`	Set permissions (owner rw, group r)
`chown user:group file`	Change ownership
`stat file`	Perms, owner, size, timestamps
`getent passwd user`	Look up a user across passwd/LDAP
`passwd -S user`	Password/lock status for an account
`umask`	Default permission mask for new files

09 Files / search / text

`find / -name "*.conf" 2>/dev/null`	Locate files by name, hide permission noise
`find . -type f -mmin -60`	Files changed in the last hour
`grep -rn "needle" .`	Recursive search with line numbers
`rg "needle"`	ripgrep — much faster grep -r
`sed -n '10,20p' file`	Print a line range
`awk '{print $1}' file`	Pull the first column
`tail -f file`	Follow a growing file
`watch -n2 "cmd"`	Re-run a command every 2s and diff visually
`diff -u a b`	Unified diff of two files

10 Archives / transfer

`tar czf out.tgz dir/`	Create a gzip tarball
`tar xzf out.tgz`	Extract a gzip tarball
`rsync -avP src/ host:/dst/`	Sync with progress + resume
`scp file host:/path`	Copy a file over SSH
`wget -c URL`	Download, resuming if interrupted
`sha256sum file`	Verify a download's checksum

11 Docker / containers

`docker ps`	Running containers
`docker ps -a`	All containers, including stopped
`docker logs -f --tail=100 name`	Follow a container's logs
`docker exec -it name bash`	Shell into a running container
`docker stats`	Live CPU/mem/net per container
`docker inspect name`	Full JSON config of a container
`docker system df`	Space used by images/containers/volumes
`docker system prune -f`	Reclaim space (dangling data)
`docker compose up -d`	Bring a stack up detached

12 Emergency / when it's on fire

`dmesg -T \| grep -i oom`	Did the kernel OOM-kill something
`df -h && df -i`	Space AND inodes — the two "disk full" causes
`ss -s`	Socket summary — connection exhaustion
`journalctl -p err -b --no-pager`	All errors since boot, no pager
`systemctl list-units --failed`	What is broken right now
`sync; echo 3 > /proc/sys/vm/drop_caches`	Drop caches to test real memory pressure (root)
`last -x \| head`	Recent logins/reboots/shutdowns
`who -b`	Exact time of last boot