Linux

Top 100+ Linux Sysadmin Commands & Shortcuts

Linux System Administrator Master Cheat Sheet

Comprehensive guide covering essential Linux CLI utilities for file operations, text processing, process management, user permissions, network diagnostics, and system monitoring.

Total Items: 0
Category Environment / Scope Name / Utility Syntax / Combo Common Flags / Options Real Usage Example Description & Functionality
8. Services & Packages Debian/Ubuntu apt / dpkg apt update && apt install update, upgrade, install, purge, dpkg -i sudo apt update && sudo apt install -y htop Package management suite for Debian and Ubuntu based distributions.
8. Services & Packages POSIX / All at / nohup at [time] / nohup cmd & nohup.out redirection nohup python3 script.py > app.log 2>&1 & Executes one-time delayed jobs (at) or runs tasks detached from terminal SIGHUP disconnects (nohup).
3. Text Processing POSIX / All awk awk 'program' file -F [delimiter], print $N, BEGIN/END blocks awk -F':' '{print $1, $7}' /etc/passwd Pattern scanning language optimized for parsing columnated log files and structured text.
5. Process & Memory POSIX / All bg / fg / jobs bg [%job] / fg [%job] / jobs -l (show PIDs) jobs -l && fg %1 Lists suspended jobs and manages foreground/background process execution in current shell.
3. Text Processing POSIX / All cat cat [options] file -n (line numbers), -A (show non-printing) cat -n /etc/hosts Concatenates file contents and prints directly to standard output.
2. File & Directory POSIX / All cd cd [dir] - (previous dir), ~ (home) cd /etc/nginx && cd - Changes active directory location. cd - toggles back to previous path.
4. Permissions & Users POSIX / All chgrp chgrp group file -R (recursive) chgrp -R developers /opt/project Changes group ownership of target files and directories.
4. Permissions & Users POSIX / All chmod chmod [mode] file 755, 644, +x, -R (recursive) chmod +x deploy.sh && chmod 600 id_rsa Modifies file mode bits for Owner, Group, and Others using octal (755) or symbolic (+x) notation.
4. Permissions & Users POSIX / All chown chown owner:group file -R (recursive), --reference chown -R www-data:www-data /var/www Changes target file or directory system user ownership and group assignment.
3. Text Processing POSIX / All cmp cmp [options] file1 file2 -l (list byte numbers), -s (silent mode) cmp -s file1.bin file2.bin Compares two files byte by byte to check for identical binary data.
2. File & Directory POSIX / All cp cp [options] src dst -r (recursive), -p (preserve permissions), -a (archive) cp -a /etc/nginx /etc/nginx.bak Copies files and directories. Option -a preserves ownership, mode, and timestamps.
8. Services & Packages POSIX / All crontab crontab [options] -e (edit), -l (list), -r (remove), -u [user] crontab -e / crontab -l Schedules automated recurring background tasks using cron timing syntax.
1. Terminal Keys Shortcut Cut Line / Kill Buffer Ctrl + U / Ctrl + K Readline Cut Buffer Ctrl + U (Cut to start) Cuts line from cursor to beginning (Ctrl+U) or cursor to end (Ctrl+K). Paste with Ctrl+Y.
7. Networking POSIX / All curl / wget curl [opts] URL / wget [opts] URL -I (headers), -X (POST/PUT), -O, -c (continue download) curl -Is https://api.github.com Downloads web assets and interacts with REST APIs over HTTP/HTTPS/FTP.
3. Text Processing POSIX / All cut cut [options] file -d [delimiter], -f [fields], -c [characters] cut -d',' -f1,3 data.csv Extracts specific character ranges or delimited fields from lines in text files.
6. System & Storage POSIX / All df df [options] -h (human-readable), -T (fs type), -i (inodes) df -hT Displays total disk space usage and free capacity for all mounted filesystems.
3. Text Processing POSIX / All diff diff [options] file1 file2 -u (unified output), -y (side-by-side), -r (recursive) diff -u config.orig config.new Compares two text files line by line and outputs differences (used to generate patch files).
7. Networking POSIX / All dig / nslookup dig [domain] [type] / nslookup +short, @server, MX, TXT, AAAA dig example.com MX +short Queries DNS servers for record resolution (A, CNAME, MX, TXT) and troubleshooting.
6. System & Storage POSIX / All dmesg dmesg [options] -T (human timestamps), -l (level: err,warn) dmesg -T -l err,crit Prints kernel ring buffer messages to diagnose boot errors, drive failures, and hardware faults.
8. Services & Packages RHEL/Fedora dnf / rpm dnf install [pkg] install, check-update, remove, rpm -qa sudo dnf install -y nginx Package management suite for Red Hat Enterprise Linux, Fedora, and Rocky Linux.
2. File & Directory POSIX / All du du [options] [path] -s (summary), -h (human readable), -d [depth] du -sh /var/log/* | sort -hr Estimates and prints disk space consumption for specified directory paths.
6. System & Storage POSIX / All fdisk / parted fdisk [device] / parted -l (list partitions) sudo fdisk -l /dev/sda Low-level partition manipulation utilities for creating and resizing MBR and GPT disk tables.
2. File & Directory POSIX / All file file [options] filename -b (brief mode), -i (mime type string) file -i archive.tar.gz Inspects file magic headers to determine true file type (binary, text, encoding, archive).
2. File & Directory POSIX / All find find [path] [expression] -name, -type (f/d), -mtime, -size, -exec find /var/log -name "*.log" -mtime +30 -delete Recursively searches directory trees based on name, age, size, permissions, or executes actions.
5. Process & Memory POSIX / All free free [options] -h (human-readable), -m (MB), -g (GB), -s [delay] free -h Displays total, used, free, shared, buffer/cache, and available RAM memory and Swap space.
6. System & Storage POSIX / All fsck fsck [options] device -y (auto repair), -f (force check) sudo fsck -f -y /dev/sda1 Checks and repairs corrupted filesystem blocks and inode structure errors. Drive must be unmounted.
3. Text Processing POSIX / All grep grep [options] pattern file -i (ignorecase), -r (recursive), -n (line num), -v (invert) grep -rnw "Failed password" /var/log/auth.log Searches files or stdin for lines matching regular expression patterns.
4. Permissions & Users POSIX / All groupadd groupadd [options] groupname -g (custom GID), -r (system group) groupadd -r sysadmins Creates new user group definitions inside `/etc/group`.
3. Text Processing POSIX / All head head [options] file -n [lines], -c [bytes] head -n 20 /var/log/auth.log Prints top N lines (default 10) of input files or pipeline stream.
6. System & Storage POSIX / All hostname / hostnamectl hostnamectl [cmd] status, set-hostname sudo hostnamectl set-hostname node-01 Queries and sets machine network hostname and system metadata.
1. Terminal Keys Shortcut Insert Last Argument Alt + . or Esc + . Readline Argument mkdir my_dir -> cd [Alt+.] Cycles and pastes the final argument from previous commands. Saves typing long paths.
1. Terminal Keys Shortcut Interrupt Signal Ctrl + C SIGINT Signal Ctrl + C Sends SIGINT to immediately stop and terminate the foreground process.
7. Networking POSIX / All ip ip [object] [command] addr, link, route, -c (color) ip -c addr show eth0 / ip route Modern utility to view/configure network interfaces, IP addresses, and routing tables (replaces ifconfig).
8. Services & Packages Systemd journalctl journalctl [options] -u [unit], -f (follow), -p [err], --since "1 hour ago" journalctl -u docker -f --since "10 min ago" Queries and filters systemd binary journal log files.
5. Process & Memory POSIX / All kill / killall kill [signal] PID / killall name -15 (SIGTERM), -9 (SIGKILL), -1 (SIGHUP) kill -15 1234 / killall -9 nginx Sends specified termination signals to processes by process PID or binary name string.
3. Text Processing POSIX / All less less [options] file -N (line numbers), -S (chop long lines), +F (live tail) less -N /var/log/syslog Interactive file pager supporting backward navigation and keyword searching.
1. Terminal Keys Shortcut Line Start / End Jump Ctrl + A / Ctrl + E Readline Shortcut Ctrl + A (Start) / Ctrl + E (End) Moves cursor instantly to beginning (Ctrl+A) or end (Ctrl+E) of command line.
2. File & Directory POSIX / All ln ln [options] target link -s (symbolic link), -f (force override) ln -s /etc/nginx/sites-avail/app /etc/nginx/sites-enabled/ Creates soft (symbolic) or hard filesystem links to target files/directories.
2. File & Directory POSIX / All locate locate [options] pattern -i (ignore case), -r (regex search) locate nginx.conf Fast indexed search using internal mlocate database. Requires running updatedb to refresh.
2. File & Directory POSIX / All ls ls [options] [path] -l (long), -a (all), -h (human), -t (time sort) ls -la --color=auto /var/log Lists directory contents including permissions, owner, size, and mod dates.
6. System & Storage POSIX / All lsblk / blkid lsblk [opts] / blkid [dev] -f (filesystems), -p (full path) lsblk -f && sudo blkid Displays block devices tree hierarchy, drive partition layout, filesystems, and device UUIDs.
6. System & Storage POSIX / All lscpu / lsusb / lspci lscpu / lsusb / lspci -v (verbose), -t (tree mode) lscpu | grep "Model name" Enumerates hardware details for CPU sockets/cores, USB controller buses, and PCI express cards.
7. Networking POSIX / All lsof lsof [options] -i:[port], -u [user], -p [PID], +D [path] sudo lsof -i :80 Lists all open files, directory locks, and associated network sockets held by processes.
2. File & Directory POSIX / All mkdir mkdir [options] dir -p (parents), -m (mode) mkdir -p /var/www/site/public Creates directories. Option -p creates parent subdirectories recursively if missing.
6. System & Storage POSIX / All mkfs mkfs.[type] [device] -t (type: ext4, xfs, btrfs), -L (label) sudo mkfs.ext4 -L "DATA" /dev/sdb1 Formats specified disk partition with a Linux filesystem (ext4, xfs, btrfs, vfat).
6. System & Storage POSIX / All mount / umount mount [dev] [dir] / umount -a (all fstab), -t (type), -o (options: ro,rw) sudo mount -o ro /dev/sdb1 /mnt/data Attaches or unmounts storage device filesystems into designated mount directories.
2. File & Directory POSIX / All mv mv [options] src dst -i (interactive prompt), -n (no clobber), -v (verbose) mv config.tmp config.yaml Moves or renames files and directories within or across filesystems.
7. Networking POSIX / All nc (netcat) nc [options] host port -z (zero-I/O port scan), -v (verbose), -l (listen) nc -zv 192.168.1.50 22-80 Swiss-army knife for TCP/UDP socket testing, banner grabbing, and port connectivity verification.
5. Process & Memory POSIX / All nice / renice nice -n [val] cmd / renice -n PID Priority range -20 (highest) to +19 (lowest) nice -n 19 tar -czf backup.tar.gz /data Sets or alters process CPU scheduling priority to balance resource usage against foreground tasks.
7. Networking POSIX / All nmap nmap [options] target -sS (SYN scan), -p [ports], -A (aggressive/OS detection) nmap -sV -p 22,80,443 192.168.1.0/24 Network exploration security scanner for host discovery, open port detection, and OS fingerprinting.
4. Permissions & Users POSIX / All passwd passwd [options] [username] -l (lock), -u (unlock), -e (expire password) sudo passwd devuser Updates local user account password authentication credentials.
5. Process & Memory POSIX / All pgrep / pkill pgrep [opts] pattern / pkill -f (full command line), -u (user), -9 (SIGKILL) pkill -9 -f "python3 server.py" Looks up processes by regex name (pgrep) or sends termination signals matching full command string.
7. Networking POSIX / All ping ping [options] host -c [count], -i [interval], -4 (IPv4), -6 (IPv6) ping -c 4 1.1.1.1 Sends ICMP ECHO_REQUEST packets to verify reachability and measure round-trip latency.
5. Process & Memory POSIX / All ps ps [options] aux, -ef, --sort=-%cpu, --sort=-%mem ps aux --sort=-%mem | head -n 10 Takes a static snapshot of active system processes, showing PID, CPU/RAM usage, and TTY.
2. File & Directory POSIX / All pwd pwd [options] -P (physical), -L (logical) pwd -P Prints current working directory absolute path, resolving symlinks with -P.
1. Terminal Keys Shortcut Reverse History Search Ctrl + R Bash / Zsh History (reverse-i-search)`ssh': ... Interactively searches command history backwards as you type characters.
2. File & Directory POSIX / All rm rm [options] path -r (recursive), -f (force), -i (interactive) rm -rf /tmp/cache_* Deletes files or directories recursively. Use extreme caution with -rf.
2. File & Directory POSIX / All rmdir rmdir [options] dir -p (parents), --ignore-fail-on-non-empty rmdir -p old_dir/sub_dir Removes empty directories from the filesystem hierarchy.
7. Networking POSIX / All scp / rsync rsync [opts] src user@host:dst -a (archive), -v (verbose), -z (compress), -P (progress) rsync -avzP ./build/ user@remote:/var/www/html/ Transfers and synchronizes files over SSH, updating only modified block deltas.
3. Text Processing POSIX / All sed sed [options] 'script' file -i (in-place write), -e (expression), s/pattern/replace/g sed -i 's/Port 22/Port 2222/g' /etc/ssh/sshd_config Stream editor for inline text parsing, string search and replace, and line filtering.
8. Services & Packages POSIX / All shutdown / reboot shutdown [opts] [time] -h (halt now), -r (reboot), +N (delay minutes) sudo shutdown -h +15 "Server maintenance" Safely signals processes and shuts down or reboots the OS kernel.
3. Text Processing POSIX / All sort sort [options] file -n (numeric), -r (reverse), -k [column], -u (unique) sort -t: -k3 -n /etc/passwd Sorts lines of text files alphabetically or numerically across designated key columns.
7. Networking POSIX / All ss / netstat ss [options] / netstat [options] -t (tcp), -u (udp), -l (listen), -p (process), -n (numeric) ss -tulpn | grep :80 Displays active listening sockets, open network connections, and associated PIDs.
7. Networking POSIX / All ssh ssh [options] user@host -i [key], -p [port], -L (local tunnel), -D (SOCKS proxy) ssh -i ~/.ssh/id_ed25519 user@10.0.0.5 -p 2222 Connects securely to remote host command lines over encrypted channels.
2. File & Directory POSIX / All stat stat [options] file -f (filesystem), -c (format specification) stat /etc/passwd Displays detailed inode metadata, file size, access permissions, owner UID, and timestamps.
4. Permissions & Users POSIX / All su / sudo su - [user] / sudo [cmd] -i (login shell), -u (user target), -v (validate) sudo -i / su - postgres Switches target user shell environment or elevates command privileges using sudo policies.
1. Terminal Keys Shortcut Suspend Job Ctrl + Z SIGTSTP Signal Ctrl + Z (Then run 'bg') Suspends active job and pushes it to background. Resume with fg or bg.
8. Services & Packages Systemd systemctl systemctl [cmd] [service] status, start, stop, restart, enable, disable, reload sudo systemctl restart nginx Controls systemd init services, daemons, and target runlevels.
3. Text Processing POSIX / All tail tail [options] file -f (follow live stream), -n [lines], --retry tail -100f /var/log/nginx/error.log Outputs trailing lines of files. Option -f monitors file growth in real-time.
8. Services & Packages POSIX / All tar tar [options] archive.tar.gz -c (create), -x (extract), -z (gzip), -v, -f (file) tar -czvf backup.tar.gz /var/www Bundles files into tape archives and compresses/extracts using gzip or bzip2.
7. Networking POSIX / All tcpdump tcpdump [options] [filter] -i [interface], -nn (no resolve), -w [file.pcap], port [N] sudo tcpdump -i eth0 -nn port 80 -w http.pcap Command-line packet analyzer that captures network traffic for Wireshark inspection.
3. Text Processing POSIX / All tee tee [options] file -a (append mode), -i (ignore signals) echo "data" | sudo tee -a /etc/config Reads standard input and writes simultaneously to standard output and disk files.
5. Process & Memory POSIX / All top / htop top / htop -u [user], -p [PID], -d [delay] htop -u www-data Dynamic real-time monitoring interface for CPU utilization, RAM consumption, and process trees.
2. File & Directory POSIX / All touch touch [options] file -a (access time), -m (mod time), -c (no create) touch /var/www/app/index.php Creates empty file if missing or updates file access and modification timestamps.
3. Text Processing POSIX / All tr tr [options] set1 [set2] -d (delete), -s (squeeze repeats) cat file.txt | tr 'a-z' 'A-Z' Translates, squeezes, or deletes characters from standard input stream.
7. Networking POSIX / All traceroute / mtr traceroute host / mtr host -n (numeric IP), -T (TCP packets) mtr --report 8.8.8.8 Traces network packet hop paths and pinpoints latency bottlenecks or packet loss.
2. File & Directory POSIX / All tree tree [options] [path] -L [depth], -d (dirs only), -a (all files) tree -L 2 /var/www Displays directory tree structure visually in depth-indented format.
7. Networking POSIX / All ufw / iptables ufw status / iptables -L allow [port], deny, -t nat, -A INPUT sudo ufw allow 22/tcp && sudo ufw enable Manages Linux kernel netfilter packet filtering rules and firewall policies.
4. Permissions & Users POSIX / All umask umask [mask] -S (symbolic output) umask 022 Sets default access permission masking mode for newly created files and directories.
6. System & Storage POSIX / All uname uname [options] -a (all details), -r (kernel release), -m (arch) uname -a Prints kernel name, hostname, OS version, architecture (x86_64/aarch64), and build details.
3. Text Processing POSIX / All uniq uniq [options] [input] -c (count), -d (duplicates only), -u (unique only) sort access.log | uniq -c | sort -nr Filters adjacent duplicate lines from sorted text streams and reports occurrence counts.
2. File & Directory POSIX / All updatedb updatedb [options] --output, --prunepaths sudo updatedb Rebuilds mlocate search index database across mounted local filesystems.
5. Process & Memory POSIX / All uptime uptime [options] -p (pretty format), -s (since timestamp) uptime -p Shows running duration, active users, and 1, 5, 15 minute system load averages.
4. Permissions & Users POSIX / All useradd useradd [options] username -m (create home), -s (shell), -g (group), -G (groups) useradd -m -s /bin/bash -G sudo devuser Creates a new user account, setting up home directories and initial group memberships.
4. Permissions & Users POSIX / All userdel userdel [options] username -r (remove home directory and mail spool) userdel -r olduser Deletes user account and optionally wipes home directory files with -r.
4. Permissions & Users POSIX / All usermod usermod [options] username -aG (append groups), -s (change shell), -L (lock) usermod -aG docker devuser Modifies user account parameters, secondary group affiliations, or login shells.
3. Text Processing POSIX / All vim / nano vim [file] / nano [file] +line, -R (read-only mode) sudo vim /etc/fstab Terminal text editors for modifying configuration files directly on headless servers.
4. Permissions & Users POSIX / All visudo visudo [options] -c (check syntax), -f [file] sudo visudo Safely opens `/etc/sudoers` in an editor with syntax validation checks to prevent lockouts.
5. Process & Memory POSIX / All vmstat vmstat [delay] [count] -s (event counters), -d (disk stats) vmstat 2 5 Reports virtual memory, swap-in/swap-out paging, process queues, I/O blocks, and CPU states.
4. Permissions & Users POSIX / All w / who / last w / who / last -n [lines], -f [file] w && last -n 10 Inspects active SSH sessions, logged-in terminal users, system load, and recent boot history.
2. File & Directory POSIX / All wc wc [options] [file] -l (lines), -w (words), -c (bytes) wc -l /etc/passwd Prints line, word, character, and byte count totals from input files or pipes.
4. Permissions & Users POSIX / All whoami / id whoami / id [user] -u (UID), -g (GID), -G (all groups) id -u root Prints effective username (whoami) or full numeric UID/GID and group assignments (id).
8. Services & Packages POSIX / All zip / unzip zip archive.zip file / unzip -r (recursive), -q (quiet), -d (destination) unzip archive.zip -d /tmp/extracted Compresses and extracts standard zip archive files.

Command Structure & Syntax Anatomy

$ command -flags --long-option [argument_source] [argument_target] | pipeline_next

1. Binary / Alias

The executable file located in $PATH (e.g. /usr/bin/rsync) or custom shell alias.

2. Short / Long Flags

Short options use single dash (-a -v or combined -av). Long options use double dashes (--archive).

3. Arguments

Operands passed to the program, such as file targets, string regex patterns, or network host IP addresses.

4. Redirection / Pipe

Chains stdout output into stdin of the next process using | or redirects streams to disk with >, >>.

Standard I/O Streams

stdin (0) stdout (1) stderr (2) 2>&1 /dev/null

File Mode Bits (Octal)

4 = Read (r) 2 = Write (w) 1 = Execute (x) 755 (rwxr-xr-x) 644 (rw-r--r--)

Process Signals

SIGHUP (1) SIGINT (2) SIGTERM (15) SIGKILL (9)

System Administrator Pro-Tips

Re-run Last Command as Root
Forgot to prepend sudo to a privileged system command? Use history substitution: sudo !! Executes the exact last command line with elevated privileges.
Fast Directory Navigation
Quickly toggle back to your previous working directory without typing full paths: cd - Swaps instantly between your current path and previous $OLDPWD.
Monitor Active Connections Live
Combine process and network socket monitors with continuous update interval tracking: watch -n 1 "ss -tulpn" Refreshes open listening port status output every 1.0 second.

System Administration Golden Rules

Safety First CLI Principles
  • Dry-Run Verification: Always run non-destructive flags first (e.g., rsync --dry-run or rm -i) before executing bulk operations.
  • Avoid Blind chmod 777: Never grant world-writable permissions to fix permission errors; use exact group grants (e.g., 755 or 644).
  • Use Absolute Paths in Scripts: Cron jobs and systemd service units do not inherit your user shell's $PATH environment. Always specify full binary paths (e.g. /usr/bin/python3).
Production Log Extraction Pipeline Example

High-efficiency pipeline combining process filtering, sorting, and field selection:

ps aux --sort=-%mem | grep -v "grep" | head -n 10 | awk '{print $2, $4, $11}'

Crafted with for System Administrators, DevOps Engineers & Site Reliability Engineers.

Linux® is the registered trademark of Linus Torvalds in the U.S. and other countries.

All rights reserved 2026 | Made with in Los Angeles, CA | Built by Tyler N.