Linux
Linux System Administrator Master Cheat Sheet
Comprehensive guide covering essential Linux CLI utilities for file operations, text processing, process management, user permissions, network diagnostics, and system monitoring.
Total Items: 0
| Category | Environment / Scope | Name / Utility | Syntax / Combo | Common Flags / Options | Real Usage Example | Description & Functionality |
|---|---|---|---|---|---|---|
| 8. Services & Packages | Debian/Ubuntu | apt / dpkg | apt update && apt install |
update, upgrade, install, purge, dpkg -i | sudo apt update && sudo apt install -y htop |
Package management suite for Debian and Ubuntu based distributions. |
| 8. Services & Packages | POSIX / All | at / nohup | at [time] / nohup cmd & |
nohup.out redirection | nohup python3 script.py > app.log 2>&1 & |
Executes one-time delayed jobs (at) or runs tasks detached from terminal SIGHUP disconnects (nohup). |
| 3. Text Processing | POSIX / All | awk | awk 'program' file |
-F [delimiter], print $N, BEGIN/END blocks | awk -F':' '{print $1, $7}' /etc/passwd |
Pattern scanning language optimized for parsing columnated log files and structured text. |
| 5. Process & Memory | POSIX / All | bg / fg / jobs | bg [%job] / fg [%job] / jobs |
-l (show PIDs) | jobs -l && fg %1 |
Lists suspended jobs and manages foreground/background process execution in current shell. |
| 3. Text Processing | POSIX / All | cat | cat [options] file |
-n (line numbers), -A (show non-printing) | cat -n /etc/hosts |
Concatenates file contents and prints directly to standard output. |
| 2. File & Directory | POSIX / All | cd | cd [dir] |
- (previous dir), ~ (home) | cd /etc/nginx && cd - |
Changes active directory location. cd - toggles back to previous path. |
| 4. Permissions & Users | POSIX / All | chgrp | chgrp group file |
-R (recursive) | chgrp -R developers /opt/project |
Changes group ownership of target files and directories. |
| 4. Permissions & Users | POSIX / All | chmod | chmod [mode] file |
755, 644, +x, -R (recursive) | chmod +x deploy.sh && chmod 600 id_rsa |
Modifies file mode bits for Owner, Group, and Others using octal (755) or symbolic (+x) notation. |
| 4. Permissions & Users | POSIX / All | chown | chown owner:group file |
-R (recursive), --reference | chown -R www-data:www-data /var/www |
Changes target file or directory system user ownership and group assignment. |
| 3. Text Processing | POSIX / All | cmp | cmp [options] file1 file2 |
-l (list byte numbers), -s (silent mode) | cmp -s file1.bin file2.bin |
Compares two files byte by byte to check for identical binary data. |
| 2. File & Directory | POSIX / All | cp | cp [options] src dst |
-r (recursive), -p (preserve permissions), -a (archive) | cp -a /etc/nginx /etc/nginx.bak |
Copies files and directories. Option -a preserves ownership, mode, and timestamps. |
| 8. Services & Packages | POSIX / All | crontab | crontab [options] |
-e (edit), -l (list), -r (remove), -u [user] | crontab -e / crontab -l |
Schedules automated recurring background tasks using cron timing syntax. |
| 1. Terminal Keys | Shortcut | Cut Line / Kill Buffer | Ctrl + U / Ctrl + K |
Readline Cut Buffer | Ctrl + U (Cut to start) |
Cuts line from cursor to beginning (Ctrl+U) or cursor to end (Ctrl+K). Paste with Ctrl+Y. |
| 7. Networking | POSIX / All | curl / wget | curl [opts] URL / wget [opts] URL |
-I (headers), -X (POST/PUT), -O, -c (continue download) | curl -Is https://api.github.com |
Downloads web assets and interacts with REST APIs over HTTP/HTTPS/FTP. |
| 3. Text Processing | POSIX / All | cut | cut [options] file |
-d [delimiter], -f [fields], -c [characters] | cut -d',' -f1,3 data.csv |
Extracts specific character ranges or delimited fields from lines in text files. |
| 6. System & Storage | POSIX / All | df | df [options] |
-h (human-readable), -T (fs type), -i (inodes) | df -hT |
Displays total disk space usage and free capacity for all mounted filesystems. |
| 3. Text Processing | POSIX / All | diff | diff [options] file1 file2 |
-u (unified output), -y (side-by-side), -r (recursive) | diff -u config.orig config.new |
Compares two text files line by line and outputs differences (used to generate patch files). |
| 7. Networking | POSIX / All | dig / nslookup | dig [domain] [type] / nslookup |
+short, @server, MX, TXT, AAAA | dig example.com MX +short |
Queries DNS servers for record resolution (A, CNAME, MX, TXT) and troubleshooting. |
| 6. System & Storage | POSIX / All | dmesg | dmesg [options] |
-T (human timestamps), -l (level: err,warn) | dmesg -T -l err,crit |
Prints kernel ring buffer messages to diagnose boot errors, drive failures, and hardware faults. |
| 8. Services & Packages | RHEL/Fedora | dnf / rpm | dnf install [pkg] |
install, check-update, remove, rpm -qa | sudo dnf install -y nginx |
Package management suite for Red Hat Enterprise Linux, Fedora, and Rocky Linux. |
| 2. File & Directory | POSIX / All | du | du [options] [path] |
-s (summary), -h (human readable), -d [depth] | du -sh /var/log/* | sort -hr |
Estimates and prints disk space consumption for specified directory paths. |
| 6. System & Storage | POSIX / All | fdisk / parted | fdisk [device] / parted |
-l (list partitions) | sudo fdisk -l /dev/sda |
Low-level partition manipulation utilities for creating and resizing MBR and GPT disk tables. |
| 2. File & Directory | POSIX / All | file | file [options] filename |
-b (brief mode), -i (mime type string) | file -i archive.tar.gz |
Inspects file magic headers to determine true file type (binary, text, encoding, archive). |
| 2. File & Directory | POSIX / All | find | find [path] [expression] |
-name, -type (f/d), -mtime, -size, -exec | find /var/log -name "*.log" -mtime +30 -delete |
Recursively searches directory trees based on name, age, size, permissions, or executes actions. |
| 5. Process & Memory | POSIX / All | free | free [options] |
-h (human-readable), -m (MB), -g (GB), -s [delay] | free -h |
Displays total, used, free, shared, buffer/cache, and available RAM memory and Swap space. |
| 6. System & Storage | POSIX / All | fsck | fsck [options] device |
-y (auto repair), -f (force check) | sudo fsck -f -y /dev/sda1 |
Checks and repairs corrupted filesystem blocks and inode structure errors. Drive must be unmounted. |
| 3. Text Processing | POSIX / All | grep | grep [options] pattern file |
-i (ignorecase), -r (recursive), -n (line num), -v (invert) | grep -rnw "Failed password" /var/log/auth.log |
Searches files or stdin for lines matching regular expression patterns. |
| 4. Permissions & Users | POSIX / All | groupadd | groupadd [options] groupname |
-g (custom GID), -r (system group) | groupadd -r sysadmins |
Creates new user group definitions inside `/etc/group`. |
| 3. Text Processing | POSIX / All | head | head [options] file |
-n [lines], -c [bytes] | head -n 20 /var/log/auth.log |
Prints top N lines (default 10) of input files or pipeline stream. |
| 6. System & Storage | POSIX / All | hostname / hostnamectl | hostnamectl [cmd] |
status, set-hostname | sudo hostnamectl set-hostname node-01 |
Queries and sets machine network hostname and system metadata. |
| 1. Terminal Keys | Shortcut | Insert Last Argument | Alt + . or Esc + . |
Readline Argument | mkdir my_dir -> cd [Alt+.] |
Cycles and pastes the final argument from previous commands. Saves typing long paths. |
| 1. Terminal Keys | Shortcut | Interrupt Signal | Ctrl + C |
SIGINT Signal | Ctrl + C |
Sends SIGINT to immediately stop and terminate the foreground process. |
| 7. Networking | POSIX / All | ip | ip [object] [command] |
addr, link, route, -c (color) | ip -c addr show eth0 / ip route |
Modern utility to view/configure network interfaces, IP addresses, and routing tables (replaces ifconfig). |
| 8. Services & Packages | Systemd | journalctl | journalctl [options] |
-u [unit], -f (follow), -p [err], --since "1 hour ago" | journalctl -u docker -f --since "10 min ago" |
Queries and filters systemd binary journal log files. |
| 5. Process & Memory | POSIX / All | kill / killall | kill [signal] PID / killall name |
-15 (SIGTERM), -9 (SIGKILL), -1 (SIGHUP) | kill -15 1234 / killall -9 nginx |
Sends specified termination signals to processes by process PID or binary name string. |
| 3. Text Processing | POSIX / All | less | less [options] file |
-N (line numbers), -S (chop long lines), +F (live tail) | less -N /var/log/syslog |
Interactive file pager supporting backward navigation and keyword searching. |
| 1. Terminal Keys | Shortcut | Line Start / End Jump | Ctrl + A / Ctrl + E |
Readline Shortcut | Ctrl + A (Start) / Ctrl + E (End) |
Moves cursor instantly to beginning (Ctrl+A) or end (Ctrl+E) of command line. |
| 2. File & Directory | POSIX / All | ln | ln [options] target link |
-s (symbolic link), -f (force override) | ln -s /etc/nginx/sites-avail/app /etc/nginx/sites-enabled/ |
Creates soft (symbolic) or hard filesystem links to target files/directories. |
| 2. File & Directory | POSIX / All | locate | locate [options] pattern |
-i (ignore case), -r (regex search) | locate nginx.conf |
Fast indexed search using internal mlocate database. Requires running updatedb to refresh. |
| 2. File & Directory | POSIX / All | ls | ls [options] [path] |
-l (long), -a (all), -h (human), -t (time sort) | ls -la --color=auto /var/log |
Lists directory contents including permissions, owner, size, and mod dates. |
| 6. System & Storage | POSIX / All | lsblk / blkid | lsblk [opts] / blkid [dev] |
-f (filesystems), -p (full path) | lsblk -f && sudo blkid |
Displays block devices tree hierarchy, drive partition layout, filesystems, and device UUIDs. |
| 6. System & Storage | POSIX / All | lscpu / lsusb / lspci | lscpu / lsusb / lspci |
-v (verbose), -t (tree mode) | lscpu | grep "Model name" |
Enumerates hardware details for CPU sockets/cores, USB controller buses, and PCI express cards. |
| 7. Networking | POSIX / All | lsof | lsof [options] |
-i:[port], -u [user], -p [PID], +D [path] | sudo lsof -i :80 |
Lists all open files, directory locks, and associated network sockets held by processes. |
| 2. File & Directory | POSIX / All | mkdir | mkdir [options] dir |
-p (parents), -m (mode) | mkdir -p /var/www/site/public |
Creates directories. Option -p creates parent subdirectories recursively if missing. |
| 6. System & Storage | POSIX / All | mkfs | mkfs.[type] [device] |
-t (type: ext4, xfs, btrfs), -L (label) | sudo mkfs.ext4 -L "DATA" /dev/sdb1 |
Formats specified disk partition with a Linux filesystem (ext4, xfs, btrfs, vfat). |
| 6. System & Storage | POSIX / All | mount / umount | mount [dev] [dir] / umount |
-a (all fstab), -t (type), -o (options: ro,rw) | sudo mount -o ro /dev/sdb1 /mnt/data |
Attaches or unmounts storage device filesystems into designated mount directories. |
| 2. File & Directory | POSIX / All | mv | mv [options] src dst |
-i (interactive prompt), -n (no clobber), -v (verbose) | mv config.tmp config.yaml |
Moves or renames files and directories within or across filesystems. |
| 7. Networking | POSIX / All | nc (netcat) | nc [options] host port |
-z (zero-I/O port scan), -v (verbose), -l (listen) | nc -zv 192.168.1.50 22-80 |
Swiss-army knife for TCP/UDP socket testing, banner grabbing, and port connectivity verification. |
| 5. Process & Memory | POSIX / All | nice / renice | nice -n [val] cmd / renice -n PID |
Priority range -20 (highest) to +19 (lowest) | nice -n 19 tar -czf backup.tar.gz /data |
Sets or alters process CPU scheduling priority to balance resource usage against foreground tasks. |
| 7. Networking | POSIX / All | nmap | nmap [options] target |
-sS (SYN scan), -p [ports], -A (aggressive/OS detection) | nmap -sV -p 22,80,443 192.168.1.0/24 |
Network exploration security scanner for host discovery, open port detection, and OS fingerprinting. |
| 4. Permissions & Users | POSIX / All | passwd | passwd [options] [username] |
-l (lock), -u (unlock), -e (expire password) | sudo passwd devuser |
Updates local user account password authentication credentials. |
| 5. Process & Memory | POSIX / All | pgrep / pkill | pgrep [opts] pattern / pkill |
-f (full command line), -u (user), -9 (SIGKILL) | pkill -9 -f "python3 server.py" |
Looks up processes by regex name (pgrep) or sends termination signals matching full command string. |
| 7. Networking | POSIX / All | ping | ping [options] host |
-c [count], -i [interval], -4 (IPv4), -6 (IPv6) | ping -c 4 1.1.1.1 |
Sends ICMP ECHO_REQUEST packets to verify reachability and measure round-trip latency. |
| 5. Process & Memory | POSIX / All | ps | ps [options] |
aux, -ef, --sort=-%cpu, --sort=-%mem | ps aux --sort=-%mem | head -n 10 |
Takes a static snapshot of active system processes, showing PID, CPU/RAM usage, and TTY. |
| 2. File & Directory | POSIX / All | pwd | pwd [options] |
-P (physical), -L (logical) | pwd -P |
Prints current working directory absolute path, resolving symlinks with -P. |
| 1. Terminal Keys | Shortcut | Reverse History Search | Ctrl + R |
Bash / Zsh History | (reverse-i-search)`ssh': ... |
Interactively searches command history backwards as you type characters. |
| 2. File & Directory | POSIX / All | rm | rm [options] path |
-r (recursive), -f (force), -i (interactive) | rm -rf /tmp/cache_* |
Deletes files or directories recursively. Use extreme caution with -rf. |
| 2. File & Directory | POSIX / All | rmdir | rmdir [options] dir |
-p (parents), --ignore-fail-on-non-empty | rmdir -p old_dir/sub_dir |
Removes empty directories from the filesystem hierarchy. |
| 7. Networking | POSIX / All | scp / rsync | rsync [opts] src user@host:dst |
-a (archive), -v (verbose), -z (compress), -P (progress) | rsync -avzP ./build/ user@remote:/var/www/html/ |
Transfers and synchronizes files over SSH, updating only modified block deltas. |
| 3. Text Processing | POSIX / All | sed | sed [options] 'script' file |
-i (in-place write), -e (expression), s/pattern/replace/g | sed -i 's/Port 22/Port 2222/g' /etc/ssh/sshd_config |
Stream editor for inline text parsing, string search and replace, and line filtering. |
| 8. Services & Packages | POSIX / All | shutdown / reboot | shutdown [opts] [time] |
-h (halt now), -r (reboot), +N (delay minutes) | sudo shutdown -h +15 "Server maintenance" |
Safely signals processes and shuts down or reboots the OS kernel. |
| 3. Text Processing | POSIX / All | sort | sort [options] file |
-n (numeric), -r (reverse), -k [column], -u (unique) | sort -t: -k3 -n /etc/passwd |
Sorts lines of text files alphabetically or numerically across designated key columns. |
| 7. Networking | POSIX / All | ss / netstat | ss [options] / netstat [options] |
-t (tcp), -u (udp), -l (listen), -p (process), -n (numeric) | ss -tulpn | grep :80 |
Displays active listening sockets, open network connections, and associated PIDs. |
| 7. Networking | POSIX / All | ssh | ssh [options] user@host |
-i [key], -p [port], -L (local tunnel), -D (SOCKS proxy) | ssh -i ~/.ssh/id_ed25519 user@10.0.0.5 -p 2222 |
Connects securely to remote host command lines over encrypted channels. |
| 2. File & Directory | POSIX / All | stat | stat [options] file |
-f (filesystem), -c (format specification) | stat /etc/passwd |
Displays detailed inode metadata, file size, access permissions, owner UID, and timestamps. |
| 4. Permissions & Users | POSIX / All | su / sudo | su - [user] / sudo [cmd] |
-i (login shell), -u (user target), -v (validate) | sudo -i / su - postgres |
Switches target user shell environment or elevates command privileges using sudo policies. |
| 1. Terminal Keys | Shortcut | Suspend Job | Ctrl + Z |
SIGTSTP Signal | Ctrl + Z (Then run 'bg') |
Suspends active job and pushes it to background. Resume with fg or bg. |
| 8. Services & Packages | Systemd | systemctl | systemctl [cmd] [service] |
status, start, stop, restart, enable, disable, reload | sudo systemctl restart nginx |
Controls systemd init services, daemons, and target runlevels. |
| 3. Text Processing | POSIX / All | tail | tail [options] file |
-f (follow live stream), -n [lines], --retry | tail -100f /var/log/nginx/error.log |
Outputs trailing lines of files. Option -f monitors file growth in real-time. |
| 8. Services & Packages | POSIX / All | tar | tar [options] archive.tar.gz |
-c (create), -x (extract), -z (gzip), -v, -f (file) | tar -czvf backup.tar.gz /var/www |
Bundles files into tape archives and compresses/extracts using gzip or bzip2. |
| 7. Networking | POSIX / All | tcpdump | tcpdump [options] [filter] |
-i [interface], -nn (no resolve), -w [file.pcap], port [N] | sudo tcpdump -i eth0 -nn port 80 -w http.pcap |
Command-line packet analyzer that captures network traffic for Wireshark inspection. |
| 3. Text Processing | POSIX / All | tee | tee [options] file |
-a (append mode), -i (ignore signals) | echo "data" | sudo tee -a /etc/config |
Reads standard input and writes simultaneously to standard output and disk files. |
| 5. Process & Memory | POSIX / All | top / htop | top / htop |
-u [user], -p [PID], -d [delay] | htop -u www-data |
Dynamic real-time monitoring interface for CPU utilization, RAM consumption, and process trees. |
| 2. File & Directory | POSIX / All | touch | touch [options] file |
-a (access time), -m (mod time), -c (no create) | touch /var/www/app/index.php |
Creates empty file if missing or updates file access and modification timestamps. |
| 3. Text Processing | POSIX / All | tr | tr [options] set1 [set2] |
-d (delete), -s (squeeze repeats) | cat file.txt | tr 'a-z' 'A-Z' |
Translates, squeezes, or deletes characters from standard input stream. |
| 7. Networking | POSIX / All | traceroute / mtr | traceroute host / mtr host |
-n (numeric IP), -T (TCP packets) | mtr --report 8.8.8.8 |
Traces network packet hop paths and pinpoints latency bottlenecks or packet loss. |
| 2. File & Directory | POSIX / All | tree | tree [options] [path] |
-L [depth], -d (dirs only), -a (all files) | tree -L 2 /var/www |
Displays directory tree structure visually in depth-indented format. |
| 7. Networking | POSIX / All | ufw / iptables | ufw status / iptables -L |
allow [port], deny, -t nat, -A INPUT | sudo ufw allow 22/tcp && sudo ufw enable |
Manages Linux kernel netfilter packet filtering rules and firewall policies. |
| 4. Permissions & Users | POSIX / All | umask | umask [mask] |
-S (symbolic output) | umask 022 |
Sets default access permission masking mode for newly created files and directories. |
| 6. System & Storage | POSIX / All | uname | uname [options] |
-a (all details), -r (kernel release), -m (arch) | uname -a |
Prints kernel name, hostname, OS version, architecture (x86_64/aarch64), and build details. |
| 3. Text Processing | POSIX / All | uniq | uniq [options] [input] |
-c (count), -d (duplicates only), -u (unique only) | sort access.log | uniq -c | sort -nr |
Filters adjacent duplicate lines from sorted text streams and reports occurrence counts. |
| 2. File & Directory | POSIX / All | updatedb | updatedb [options] |
--output, --prunepaths | sudo updatedb |
Rebuilds mlocate search index database across mounted local filesystems. |
| 5. Process & Memory | POSIX / All | uptime | uptime [options] |
-p (pretty format), -s (since timestamp) | uptime -p |
Shows running duration, active users, and 1, 5, 15 minute system load averages. |
| 4. Permissions & Users | POSIX / All | useradd | useradd [options] username |
-m (create home), -s (shell), -g (group), -G (groups) | useradd -m -s /bin/bash -G sudo devuser |
Creates a new user account, setting up home directories and initial group memberships. |
| 4. Permissions & Users | POSIX / All | userdel | userdel [options] username |
-r (remove home directory and mail spool) | userdel -r olduser |
Deletes user account and optionally wipes home directory files with -r. |
| 4. Permissions & Users | POSIX / All | usermod | usermod [options] username |
-aG (append groups), -s (change shell), -L (lock) | usermod -aG docker devuser |
Modifies user account parameters, secondary group affiliations, or login shells. |
| 3. Text Processing | POSIX / All | vim / nano | vim [file] / nano [file] |
+line, -R (read-only mode) | sudo vim /etc/fstab |
Terminal text editors for modifying configuration files directly on headless servers. |
| 4. Permissions & Users | POSIX / All | visudo | visudo [options] |
-c (check syntax), -f [file] | sudo visudo |
Safely opens `/etc/sudoers` in an editor with syntax validation checks to prevent lockouts. |
| 5. Process & Memory | POSIX / All | vmstat | vmstat [delay] [count] |
-s (event counters), -d (disk stats) | vmstat 2 5 |
Reports virtual memory, swap-in/swap-out paging, process queues, I/O blocks, and CPU states. |
| 4. Permissions & Users | POSIX / All | w / who / last | w / who / last |
-n [lines], -f [file] | w && last -n 10 |
Inspects active SSH sessions, logged-in terminal users, system load, and recent boot history. |
| 2. File & Directory | POSIX / All | wc | wc [options] [file] |
-l (lines), -w (words), -c (bytes) | wc -l /etc/passwd |
Prints line, word, character, and byte count totals from input files or pipes. |
| 4. Permissions & Users | POSIX / All | whoami / id | whoami / id [user] |
-u (UID), -g (GID), -G (all groups) | id -u root |
Prints effective username (whoami) or full numeric UID/GID and group assignments (id). |
| 8. Services & Packages | POSIX / All | zip / unzip | zip archive.zip file / unzip |
-r (recursive), -q (quiet), -d (destination) | unzip archive.zip -d /tmp/extracted |
Compresses and extracts standard zip archive files. |
Command Structure & Syntax Anatomy
$ command -flags --long-option [argument_source] [argument_target] | pipeline_next
1. Binary / Alias
The executable file located in $PATH (e.g. /usr/bin/rsync) or custom shell alias.
2. Short / Long Flags
Short options use single dash (-a -v or combined -av). Long options use double dashes (--archive).
3. Arguments
Operands passed to the program, such as file targets, string regex patterns, or network host IP addresses.
4. Redirection / Pipe
Chains stdout output into stdin of the next process using | or redirects streams to disk with >, >>.
Standard I/O Streams
File Mode Bits (Octal)
Process Signals
System Administrator Pro-Tips
Re-run Last Command as Root
Forgot to prepend
sudo to a privileged system command? Use history substitution:
sudo !!
Executes the exact last command line with elevated privileges.
Fast Directory Navigation
Quickly toggle back to your previous working directory without typing full paths:
cd -
Swaps instantly between your current path and previous $OLDPWD.
Monitor Active Connections Live
Combine process and network socket monitors with continuous update interval tracking:
watch -n 1 "ss -tulpn"
Refreshes open listening port status output every 1.0 second.
System Administration Golden Rules
Safety First CLI Principles
- Dry-Run Verification: Always run non-destructive flags first (e.g.,
rsync --dry-runorrm -i) before executing bulk operations. - Avoid Blind chmod 777: Never grant world-writable permissions to fix permission errors; use exact group grants (e.g.,
755or644). - Use Absolute Paths in Scripts: Cron jobs and systemd service units do not inherit your user shell's
$PATHenvironment. Always specify full binary paths (e.g./usr/bin/python3).
Production Log Extraction Pipeline Example
High-efficiency pipeline combining process filtering, sorting, and field selection:
ps aux --sort=-%mem | grep -v "grep" | head -n 10 | awk '{print $2, $4, $11}'