Linux Scenario Commands

# Prints the current directory. Run it before any delete or move so you know exactly where you are.
$ pwd

# Lists files and folders in the current directory.
$ ls

# Long listing: permissions, owner, group, size and modified date.
$ ls -l

# Long listing with hidden files and readable sizes (K, M, G).
$ ls -lah

# Newest files first. Useful to see what changed recently.
$ ls -lt

# Lists the folder and everything inside its sub-folders.
$ ls -R

# Absolute path. Works no matter where you start.
$ cd /var/log

# Relative path. Works only if "logs" is inside the current directory.
$ cd logs

# Go one level up.
$ cd ..

# Go two levels up.
$ cd ../..

# Go to your home directory. Typing cd with nothing after it does the same.
$ cd ~

# Jump back to the directory you were in before.
$ cd -

# Check where you actually are. Most of the time the path is relative and you are in the wrong place.
$ pwd

# See what is really in this directory. Linux is case-sensitive, so Notes.txt and notes.txt are different.
$ ls

# Use the full absolute path to stop depending on the current location.
$ cd /home/user/practice

# Shows hidden files such as .bashrc and .hidden_config.
$ ls -a

# Lists only the hidden entries.
$ ls -d .*

# Shows all hidden config files in your home directory.
$ ls -la ~

# Reads a hidden config file. Hidden files are normal settings files, not secret ones.
$ cat ~/.bashrc

# Creates empty files. If the file already exists it only updates the timestamp, so it is safe.
$ touch notes.txt todo.txt

# Creates a hidden file. Anything starting with a dot is hidden.
$ touch .hidden_config

# Writes text into a file. A single > overwrites what was there.
$ echo "Hello Linux" > notes.txt

# Adds a line at the end. Double >> appends instead of overwriting.
$ echo "Second line" >> notes.txt

# Prints the whole file. Good for short files.
$ cat notes.txt

# Same, with line numbers.
$ cat -n notes.txt

# Opens a big file page by page. Press q to quit, /word to search, space to go down.
$ less bigfile.log

# First 20 lines. Handy to check the header of a CSV.
$ head -n 20 app.log

# Last 50 lines. The newest entries in a log are at the bottom.
$ tail -n 50 app.log

# Follows the file live as new lines are written. Press Ctrl+C to stop.
$ tail -f app.log

# Tells you the real type: ASCII text, script, executable, gzip data and so on.
$ file notes.txt

# Confirms it is a shell script and not a binary.
$ file script.sh

# Full details: size, permissions, owner, and access, modify and change times.
$ stat notes.txt

# Counts lines. Use wc -w for words.
$ wc -l notes.txt

# Creates one directory.
$ mkdir practice

# Creates the parent and three sub-folders together. The {} braces expand into three names.
$ mkdir -p practice/{docs,images,backup}

# Same idea for dated folders.
$ mkdir -p logs/{2026-01,2026-02,2026-03}

# Draws the tree so you can verify it (install the tree package if missing).
$ tree practice

# Limits the drawing to two levels.
$ tree -L 2

# Shows the permissions of the directory itself, not its contents.
$ ls -ld practice

# The parent folders a and b did not exist. -p creates all of them.
$ mkdir -p a/b/c

# Works only when the folder is completely empty.
$ rmdir images

# Check what is inside, including hidden files that block rmdir.
$ ls -A images

# Removes the folder and everything inside. Think before pressing Enter.
$ rm -r images

# Start from the home directory.
$ cd ~

# Build the tree.
$ mkdir -p practice/{docs,images,backup}

# Move into docs using a relative path.
$ cd practice/docs

# Create two normal files and one hidden file.
$ touch notes.txt todo.txt .hidden_config

# Put some content in notes.txt.
$ echo "Hello Linux" > notes.txt

# Copy to another folder.
$ cp notes.txt ../backup/

# Copy inside the same folder under a new name.
$ cp notes.txt notes_copy.txt

# Rename. Same folder, new name.
$ mv todo.txt tasks.txt

# Move the file to the images folder.
$ mv tasks.txt ../images/

# Go back to the top of the tree.
$ cd ~/practice

# View the whole tree to confirm every step.
$ ls -R

# Delete a single file.
$ rm docs/notes_copy.txt

# Delete a folder with its contents.
$ rm -r backup

# Fails because images is not empty. Empty it first or use rm -r.
$ rmdir images

# Copying a folder needs -r (recursive). Without it you see "omitting directory".
$ cp -r docs docs_backup

# Archive copy. Keeps permissions, owner and timestamps. Best for config backups.
$ cp -a /etc/nginx /etc/nginx.bak

# Asks before overwriting b.txt.
$ cp -i a.txt b.txt

# Never overwrites an existing file.
$ cp -n a.txt b.txt

# Prints each file as it is copied.
$ cp -v *.txt backup/

# Asks before replacing a file that already exists.
$ mv -i old.txt new.txt

# Plain rename.
$ mv report.txt report_final.txt

# Renames many files at once from .txt to .bak.
$ for f in *.txt; do mv "$f" "${f%.txt}.bak"; done

# Always list the pattern first and see exactly what will go.
$ ls *.tmp

# Then delete the same pattern.
$ rm *.tmp

# Asks for confirmation on each file.
$ rm -i file.txt

# Forces deletion without asking, also for write-protected files.
$ rm -f file.txt

# Quote names that contain spaces, or the shell treats them as two files.
$ rm "my file.txt"

# Deletes a file whose name starts with a dash. The -- tells rm that options have ended.
$ rm -- -report.txt

# Makes rm ask every time. Add it to ~/.bashrc to keep it.
$ alias rm='rm -i'

# Files under /etc modified in the last day.
$ find /etc -type f -mtime -1

# Files modified in the last 30 minutes.
$ find . -type f -mmin -30

# Log files larger than 100 MB.
$ find /var/log -name "*.log" -size +100M

# Lists temp files. Run this first before deleting.
$ find . -type f -name "*.tmp"

# Deletes what the previous command listed.
$ find . -type f -name "*.tmp" -delete

# Deletes logs older than 7 days.
$ find /var/log/app -name "*.log" -mtime +7 -exec rm {} \;

# Searches every file under the folder, showing file name and line number.
$ grep -rn "DB_PASSWORD" /opt/app/

# Only prints the names of files that match, ignoring case.
$ grep -rli "timeout" /etc/

# Shows a config file without comment lines and blank lines.
$ grep -v "^#" app.conf | grep -v "^$"

# Counts matching lines.
$ grep -c "ERROR" app.log

# Shows two lines before and after each match for context.
$ grep -B2 -A2 "ERROR" app.log

# Shows the path of the program that will run.
$ which python3

# Tells you if a name is a program, an alias or a shell built-in.
$ type ls

# Finds the binary, source and man page locations.
$ whereis nginx

# Very fast name search using a database (run updatedb to refresh it).
$ locate nginx.conf

# Read the latest 100 lines first.
$ tail -n 100 app.log

# Watch the log live while you reproduce the problem.
$ tail -f /var/log/app.log

# Counts the number of error lines.
$ grep "ERROR" app.log | wc -l

# Only entries from 2 PM on that date.
$ grep "2026-11-02 14:" app.log

# Groups errors by one column and shows the most frequent first.
$ grep "ERROR" app.log | awk '{print $5}' | sort | uniq -c | sort -nr | head

# Searches rotated logs that are already compressed.
$ zgrep "ERROR" app.log.2.gz

# Prints only lines 10 to 20.
$ sed -n '10,20p' app.log

# Top 10 IP addresses hitting the server.
$ awk '{print $1}' access.log | sort | uniq -c | sort -nr | head

# Count of each HTTP status code.
$ awk '{print $9}' access.log | sort | uniq -c | sort -nr

# URLs that return 500 errors most often.
$ awk '$9 == 500 {print $7}' access.log | sort | uniq -c | sort -nr | head

# Errors since the last boot.
$ journalctl -p err -b

# Everything logged in the last hour.
$ journalctl --since "1 hour ago"

# Recent kernel messages with readable time.
$ dmesg -T | tail -20

# Failed SSH logins on Ubuntu or Debian (use /var/log/secure on RHEL).
$ sudo grep "Failed password" /var/log/auth.log

# Takes columns 1 and 3 from a comma-separated file.
$ cut -d',' -f1,3 users.csv

# Lists all usernames on the system.
$ cut -d: -f1 /etc/passwd

# Lists real users, skipping system accounts.
$ awk -F: '$3 >= 1000 {print $1}' /etc/passwd

# Adds up the second column.
$ awk '{sum+=$2} END {print sum}' sales.txt

# Joins two files side by side.
$ paste file1.txt file2.txt

# Sorts by column 2 as numbers.
$ sort -k2 -n data.txt

# Sorts and removes duplicate lines.
$ sort -u file.txt

# Shows only the lines that repeat.
$ sort file.txt | uniq -d

# Counts how many times each line appears.
$ sort file.txt | uniq -c

# Converts text to upper case.
$ tr 'a-z' 'A-Z' < file.txt

# Number of lines.
$ wc -l file.txt

# Shows what is different between two files.
$ diff dev.conf prod.conf

# Unified format, easier to read.
$ diff -u dev.conf prod.conf

# Replaces text in the file and keeps a .bak backup of the original.
$ sed -i.bak 's/8080/9090/g' app.conf

# Prints a range of lines without changing the file.
$ sed -n '10,20p' app.log

# Shows each filesystem with used and free space.
$ df -h

# Size of each folder under /var, smallest to largest.
$ du -sh /var/* | sort -h

# Ten biggest files or folders in the log directory.
$ du -ah /var/log | sort -rh | head -10

# Large files on the current filesystem, hiding permission errors.
$ find / -xdev -type f -size +500M 2>/dev/null

# Empties a log file without deleting it. Safe for a running application.
$ > bigfile.log

# Shows inode usage. 100% here means too many small files.
$ df -i

# Counts files in a suspect folder.
$ find /tmp -type f | wc -l

# Lists files that were deleted but are still held open by a process.
$ lsof +L1

# Same check using grep.
$ lsof | grep deleted

# Restarting the process releases the space.
$ systemctl restart myapp

# Look at the permission string first.
$ ls -l deploy.sh

# Makes the script executable.
$ chmod +x deploy.sh

# Owner full access, others read and execute.
$ chmod 755 deploy.sh

# Normal file: owner writes, everyone reads.
$ chmod 644 notes.txt

# Owner read/write, group read, others nothing. Good for passwords.
$ chmod 640 secrets.conf

# Gives the owner write permission.
$ chmod u+w file

# Shows permissions in both letter and number form.
$ stat file.txt

# Changes owner and group of a folder and everything in it.
$ chown appuser:appgroup /opt/app -R

# Changes only the group.
$ chgrp devs report.txt

# Shows the default permission mask applied to new files.
$ umask

# Check the folder permissions.
$ ls -ld /shared

# See which groups the user belongs to.
$ id username

# Group write plus setgid, so new files inherit the folder's group.
$ chmod g+ws /shared

# Sticky bit. Users can delete only their own files, like /tmp.
$ chmod +t /shared

# Load average for the last 1, 5 and 15 minutes.
$ uptime

# Live view. Press M to sort by memory and P to sort by CPU, q to quit.
$ top

# A friendlier version of top, if installed.
$ htop

# Top memory-consuming processes.
$ ps aux --sort=-%mem | head

# Top CPU-consuming processes.
$ ps aux --sort=-%cpu | head

# Find a particular process and its PID.
$ ps -ef | grep java

# Memory and swap usage.
$ free -h

# Sends SIGTERM, a polite request to shut down.
$ kill 1234

# Sends SIGKILL. Forced stop, with no cleanup. Use only if kill did not work.
$ kill -9 1234

# Kills processes by name.
$ pkill -f myapp

# Shows which process is listening on the port.
$ ss -tulnp | grep 8080

# Another way to see the same thing.
$ lsof -i :8080

# Stop the process holding the port.
$ kill <PID>

# Samples every 2 seconds, 5 times. Watch the wa (I/O wait) column.
$ vmstat 2 5

# Disk statistics. A high await value means a slow disk.
$ iostat -x 2

# Shows which process is hammering the disk.
$ iotop

# Checks if the kernel killed something for lack of memory.
$ dmesg | grep -i "out of memory"

# Starts a job with lower priority.
$ nice -n 10 ./heavy_job.sh

# Runs in the background of the current terminal.
$ ./script.sh &

# Keeps running even if your SSH session drops.
$ nohup ./script.sh &

# Lists background jobs of this terminal.
$ jobs

# Checks if the host answers at all.
$ ping -c 4 10.0.0.20

# Shows where the path stops (tracepath if traceroute is missing).
$ traceroute 10.0.0.20

# Tests if a specific port is open.
$ nc -zv 10.0.0.20 5432

# Checks that the name resolves.
$ nslookup db.company.com

# Quick DNS answer.
$ dig +short db.company.com

# Your IP addresses and network interfaces.
$ ip a

# Routing table and default gateway.
$ ip route

# Which DNS servers this machine uses.
$ cat /etc/resolv.conf

# Headers only, including the status code.
$ curl -I https://example.com

# Prints just the status code and the response time.
$ curl -s -o /dev/null -w "%{http_code} %{time_total}s\n" https://example.com

# Verbose output showing the full request and response.
$ curl -v http://localhost:8080/health

# Sends a JSON POST request to test an API.
$ curl -X POST -H "Content-Type: application/json" -d '{"id":1}' http://localhost:8080/api

# Downloads a file and resumes if interrupted.
$ wget -c https://example.com/file.iso

# All listening TCP and UDP ports with the process name.
$ ss -tulnp

# Same view from lsof.
$ sudo lsof -i -P -n | grep LISTEN

# Firewall status and rules on Ubuntu.
$ sudo ufw status verbose

# Opens port 8080.
$ sudo ufw allow 8080/tcp

# Current rules on RHEL, CentOS and Rocky.
$ sudo firewall-cmd --list-all

# Adds the port so it survives a reboot.
$ sudo firewall-cmd --add-port=8080/tcp --permanent

# Applies the permanent changes.
$ sudo firewall-cmd --reload

# Lists the low-level rules without resolving names.
$ sudo iptables -L -n

# From another machine, confirm the port is now reachable.
$ nc -zv server-ip 8080

# Current state and the last few log lines.
$ systemctl status nginx

# Start it now.
$ systemctl start nginx

# Start automatically on every boot.
$ systemctl enable nginx

# Stop and start again.
$ systemctl restart nginx

# Re-read the config without dropping connections.
$ systemctl reload nginx

# Tests the config for syntax errors before you reload.
$ nginx -t

# All services that failed.
$ systemctl list-units --failed

# Last 50 log lines for that service.
$ journalctl -u nginx -n 50

# Only the last hour.
$ journalctl -u nginx --since "1 hour ago"

# Follow the log live.
$ journalctl -u nginx -f

# Needed after editing a unit file in /etc/systemd/system, otherwise the change is ignored.
$ systemctl daemon-reload

# Creates the user with a home folder, a shell and a group.
$ sudo useradd -m -s /bin/bash -G devs ravi

# Sets the password.
$ sudo passwd ravi

# Adds to one more group without removing the others.
$ sudo usermod -aG docker ravi

# Confirms the groups.
$ id ravi

# Shows password expiry details.
$ sudo chage -l ravi

# Locks the account.
$ sudo passwd -l ravi

# Deletes the user and the home directory.
$ sudo userdel -r ravi

# Users logged in now.
$ who

# Same, plus what each person is running.
$ w

# Last 10 logins.
$ last -n 10

# Failed login attempts.
$ sudo lastb

# Edit the sudoers file. It checks syntax so you do not lock yourself out.
$ sudo visudo

# Shows what commands that user may run with sudo.
$ sudo -l -U ravi

# Edit your cron jobs.
$ crontab -e

# List them.
$ crontab -l

# Every day at 2:00, with output saved to a log.
0 2 * * * /opt/scripts/backup.sh >> /var/log/backup.log 2>&1

# Every 15 minutes.
*/15 * * * * /opt/scripts/check.sh

# Weekdays at 9:00.
0 9 * * 1-5 /opt/scripts/report.sh

# Find the full path to use inside the script. Cron has a very small PATH.
$ which python3

# Make sure the script is executable.
$ chmod +x /opt/scripts/backup.sh

# Cron activity on Debian and Ubuntu (RHEL uses /var/log/cron).
$ grep CRON /var/log/syslog

# Schedules a command for later. Type the command, then Ctrl+D.
$ at now + 10 minutes

# Lists pending at jobs.
$ atq

# Lists all environment variables.
$ env

# Where the shell looks for commands.
$ echo $PATH

# Sets a variable for this session and its child processes.
$ export APP_ENV=production

# Shows one variable.
$ printenv APP_ENV

# Reloads the settings after editing.
$ source ~/.bashrc

# Exit code of the last command. 0 means success.
$ echo $?

# Output to a file, overwriting it.
$ command > out.log

# Output added to the end of the file.
$ command >> out.log

# Output and errors both go to the same file.
$ command > out.log 2>&1

# Hide the error messages.
$ command 2>/dev/null

# Show on screen and save to a file at the same time.
$ command | tee out.log

# Run cmd2 only if cmd1 worked.
$ cmd1 && cmd2

# Run cmd2 only if cmd1 failed.
$ cmd1 || cmd2

# Run both, no matter what.
$ cmd1 ; cmd2

# Creates a shortcut. Add to ~/.bashrc to keep it.
$ alias ll='ls -lah'

# Refresh the package list, then install (Ubuntu and Debian).
$ sudo apt update && sudo apt install -y htop

# Check if a package is installed.
$ apt list --installed | grep nginx

# Installed version versus the available version.
$ apt-cache policy nginx

# Removes the package and keeps its config.
$ sudo apt remove nginx

# Removes the package and its config.
$ sudo apt purge nginx

# Install on RHEL-family systems (dnf works the same way).
$ sudo yum install -y htop

# List installed packages matching a name.
$ rpm -qa | grep nginx

# Which package owns this file.
$ rpm -qf /usr/sbin/nginx

# What was installed or removed, and when.
$ yum history

# Lists disks and partitions, and where they are mounted.
$ lsblk

# Partition details.
$ sudo fdisk -l

# Formats the partition. This erases all data on it.
$ sudo mkfs.ext4 /dev/sdb1

# Create the mount point.
$ sudo mkdir /data

# Mount the disk.
$ sudo mount /dev/sdb1 /data

# Confirm it is mounted with the right size.
$ df -h /data

# Shows the UUID to use in /etc/fstab.
$ blkid /dev/sdb1

# Tests the fstab entries before you reboot.
$ sudo mount -a

# Backup of a folder with today's date in the name.
$ cp -a /etc/nginx /etc/nginx.bak_$(date +%F)

# Creates a compressed archive.
$ tar -czvf backup_$(date +%F).tar.gz /opt/app

# Lists the contents without extracting.
$ tar -tzf backup.tar.gz

# Extracts into a chosen folder.
$ tar -xzvf backup.tar.gz -C /tmp/restore

# Zip format, useful for Windows users.
$ zip -r app.zip /opt/app

# Unzips into a given folder.
$ unzip app.zip -d /tmp/app

# Simple one-time copy over SSH.
$ scp backup.tar.gz user@10.0.0.5:/backup/

# Syncs a folder and transfers only the changes.
$ rsync -avz /opt/app/ user@10.0.0.5:/backup/app/

# Run on both machines and compare to confirm the file arrived intact.
$ sha256sum file.tar.gz

# Creates the symbolic link.
$ ln -s /opt/app/release_v2 /opt/app/current

# Switches the link to a new release. To roll back, point it to the old folder.
$ ln -sfn /opt/app/release_v3 /opt/app/current

# Shows current -> release_v3.
$ ls -l /opt/app/

# Prints the real path behind the link.
$ readlink -f /opt/app/current

# Creates a hard link, a second name for the same file.
$ ln original.txt hardlink.txt

# Creates a key pair.
$ ssh-keygen -t ed25519

# Installs your public key on the server.
$ ssh-copy-id user@10.0.0.5

# Logs in without a password.
$ ssh user@10.0.0.5

# Uses a specific key file.
$ ssh -i ~/.ssh/mykey.pem user@10.0.0.5

# Local port forward, a tunnel to a service on the server.
$ ssh -L 8080:localhost:80 user@10.0.0.5

# Private keys must be readable only by you.
$ chmod 600 ~/.ssh/id_ed25519

# The .ssh folder must be private as well.
$ chmod 700 ~/.ssh

# Same rule on the server side.
$ chmod 600 ~/.ssh/authorized_keys

# Very detailed debug output showing why the login failed.
$ ssh -vvv user@10.0.0.5

# IPs with the most failed SSH logins.
$ sudo grep "Failed password" /var/log/auth.log | awk '{print $(NF-3)}' | sort | uniq -c | sort -nr | head

# Recent successful logins.
$ last -n 20

# Anything listening that should not be.
$ sudo ss -tulnp

# Distribution name and version.
$ cat /etc/os-release

# Kernel version.
$ uname -r

# Everything about the kernel and hostname in one line.
$ uname -a

# The server name. Check it before running risky commands.
$ hostname

# IP addresses of the server.
$ hostname -I

# CPU model and number of cores.
$ lscpu

# Just the number of CPU cores.
$ nproc

# Memory in readable units.
$ free -h

# Time since boot and load average.
$ uptime

# Exact time of the last boot.
$ uptime -s

# History of reboots.
$ last reboot

# Logs from the previous boot, to see why it went down.
$ journalctl -b -1

# Timezone and whether time sync is working.
$ timedatectl

# Current date and time on the server.
$ date

# Full manual for a command. Press q to leave.
$ man tar

# Short summary of the options.
$ tar --help

# Finds commands by description when you forgot the name.
$ apropos "copy files"

# Same search.
$ man -k copy

# List of previous commands.
$ history

# Only the last 20.
$ history 20

# Find an old command.
$ history | grep tar

# Repeat the last command.
$ !!

# Repeat the last command with sudo, when you forgot it.
$ sudo !!

# Search your history while typing.
Ctrl+R

# Autocompletes file names and avoids typing mistakes.
Tab

# Re-runs a command every 2 seconds.
$ watch -n 2 df -h

# A terminal session that keeps running even when SSH disconnects.
$ tmux

# Creates a 1 GB test file quickly.
$ fallocate -l 1G test.img

# Clears the screen. Ctrl+L does the same.
$ clear

# Run before any delete, move or recursive change.
$ pwd

# See the list before you delete it.
$ ls pattern, then rm pattern

# Back up a file before editing it.
$ cp -a file file.bak

# Confirm which server you are on before running anything serious.
$ hostname