50 Essential Linux Commands for DevOps Engineers: The Complete 2025 Cheat Sheet

# Basic listing
ls -la

# Sort by modification time
ls -lt

# Human-readable file sizes
ls -lh

# Show hidden files
ls -a

# Navigate to home directory
cd ~

# Go back to previous directory
cd -

# Navigate up two levels
cd ../../

pwd

# Create directory
mkdir /opt/myapp

# Create nested directories
mkdir -p /opt/myapp/{logs,config,data}

# Set permissions while creating
mkdir -m 755 /opt/secure-app

# Copy file with backup
cp -b app.conf app.conf.backup

# Copy directory recursively
cp -r /source/dir /destination/dir

# Preserve timestamps and permissions
cp -p config.yml /etc/myapp/

# Rename file
mv old-config.yml new-config.yml

# Move with backup
mv -b app.log /var/log/

# Remove file safely
rm -i important-file.txt

# Remove directory and contents
rm -rf /tmp/old-deployment

# Remove files older than 7 days
find /var/log -name "*.log" -mtime +7 -delete

# Find files by name
find /opt -name "*.jar" -type f

# Find files modified in last 24 hours
find /var/log -mtime -1

# Find large files (>100MB)
find / -size +100M -type f

# Find and execute command
find /opt -name "*.log" -exec gzip {} \;

# Update database and search
updatedb && locate nginx.conf

# Find executable path
which python3
which docker

# Show all processes
ps aux

# Show process tree
ps auxf

# Show processes for specific user
ps -u nginx

# Show processes with specific command
ps aux | grep nginx

# Standard top
top

# Show specific user processes
top -u username

# Show process threads
top -H

# Interactive process viewer
htop

# Show tree view
htop -t

# Graceful termination
kill -TERM 1234

# Force kill
kill -9 1234

# Kill by process name
killall nginx

# Kill processes by pattern
pkill -f "java.*myapp"

# Run command that survives logout
nohup ./deploy.sh > deployment.log 2>&1 &

# Check background jobs
jobs

# Bring job to foreground
fg %1

# Start service
systemctl start nginx

# Enable service at boot
systemctl enable nginx

# Check service status
systemctl status nginx

# Reload service configuration
systemctl reload nginx

# Show all failed services
systemctl --failed

# Show disk usage in human-readable format
df -h

# Show inode usage
df -i

# Show specific filesystem type
df -t ext4

# Show directory sizes
du -h /var/log

# Show top-level directories only
du -h --max-depth=1 /opt

# Sort by size
du -h /var/log | sort -hr

# Show memory in human-readable format
free -h

# Show memory every 2 seconds
free -s 2

# Show memory in MB
free -m

# Show I/O stats every 2 seconds
iostat -x 2

# Show CPU and I/O stats
iostat -c 1 5

# Show CPU usage for last 24 hours
sar -u

# Show memory usage
sar -r

# Show network statistics
sar -n DEV

# Show system stats every 2 seconds
vmstat 2

# Show memory in MB
vmstat -S M

# Show CPU details
lscpu

# Show CPU cache information
lscpu --cache

# Show all listening ports
netstat -tuln

# Show established connections
netstat -tuna

# Show process using specific port
netstat -tulnp | grep :80

# Show listening TCP ports
ss -tln

# Show processes using sockets
ss -tlnp

# Show socket summary
ss -s

# Basic HTTP request
curl -I https://api.example.com/health

# POST request with JSON
curl -X POST -H "Content-Type: application/json" \
     -d '{"key":"value"}' https://api.example.com/data

# Download file
curl -O https://releases.example.com/app-v1.2.tar.gz

# Follow redirects and show progress
curl -L --progress-bar -o file.zip https://example.com/file.zip

# Download file
wget https://example.com/file.tar.gz

# Download with custom user agent
wget --user-agent="DevOps-Bot/1.0" https://example.com/file

# Mirror website
wget --mirror --no-parent https://docs.example.com/

# Ping with count
ping -c 4 google.com

# Ping with specific interval
ping -i 0.5 192.168.1.1

# Ping IPv6
ping6 google.com

# Trace route to destination
traceroute google.com

# Use TCP instead of ICMP
traceroute -T google.com

# Simple DNS lookup
dig google.com

# Query specific record type
dig google.com MX

# Reverse DNS lookup
dig -x 8.8.8.8

# Use specific DNS server
dig @8.8.8.8 google.com

# Search in files
grep -r "ERROR" /var/log/

# Case-insensitive search
grep -i "warning" application.log

# Show line numbers
grep -n "exception" error.log

# Exclude patterns
grep -v "DEBUG" application.log

# Show context around matches
grep -A 3 -B 3 "ERROR" application.log

# Print specific columns
awk '{print $1, $3}' /var/log/access.log

# Sum values in column
awk '{sum+=$3} END {print sum}' data.txt

# Process CSV files
awk -F',' '{print $2}' data.csv

# Filter based on conditions
awk '$3 > 100 {print $0}' metrics.txt

# Replace text in file
sed 's/old-value/new-value/g' config.yml

# Delete lines containing pattern
sed '/DEBUG/d' application.log

# Insert line after match
sed '/\[database\]/a connection_timeout=30' config.ini

# In-place editing
sed -i 's/localhost/production-db/g' app-config.yml

# Sort file contents
sort /etc/passwd

# Numeric sort
sort -n numbers.txt

# Reverse sort
sort -r data.txt

# Sort by specific field
sort -k 3 -n data.txt

# Remove consecutive duplicates
uniq data.txt

# Count occurrences
uniq -c access.log

# Show only duplicates
uniq -d data.txt

# Count lines, words, characters
wc file.txt

# Count only lines
wc -l access.log

# Count files in directory
ls | wc -l

# Show first 10 lines
head application.log

# Show first 20 lines
head -n 20 error.log

# Monitor file changes
head -f deployment.log

# Show last 10 lines
tail error.log

# Follow file changes
tail -f application.log

# Show last 50 lines from multiple files
tail -n 50 /var/log/*.log

# Create archive
tar -czf backup-$(date +%Y%m%d).tar.gz /opt/myapp

# Extract archive
tar -xzf backup.tar.gz

# List archive contents
tar -tzf backup.tar.gz

# Create archive excluding files
tar --exclude='*.log' -czf app-backup.tar.gz /opt/myapp

# Compress file
gzip large-log.txt

# Decompress file
gunzip large-log.txt.gz

# Keep original file while compressing
gzip -k application.log

# Create zip archive
zip -r app-backup.zip /opt/myapp

# Extract zip archive
unzip app-backup.zip

# List zip contents
unzip -l app-backup.zip

# Set permissions using octal notation
chmod 755 script.sh

# Add execute permission
chmod +x deploy.sh

# Remove write permission for group and others
chmod go-w config.yml

# Recursive permission change
chmod -R 644 /opt/myapp/config/

# Change owner and group
chown nginx:nginx /var/www/html

# Change owner only
chown jenkins deploy.sh

# Recursive ownership change
chown -R app:app /opt/myapp

# Change group ownership
chgrp developers project-files

# Recursive group change
chgrp -R ops /opt/monitoring

# Show all system information
uname -a

# Show kernel version
uname -r

# Show machine architecture
uname -m

# Show uptime and load average
uptime

# Show uptime in pretty format
uptime -p

# Show current username
whoami

# Show user and group information
id

# Show all logs
journalctl

# Show logs for specific service
journalctl -u nginx

# Follow logs in real-time
journalctl -f

# Show logs since yesterday
journalctl --since yesterday

# Show only error priority logs
journalctl -p err

# Show kernel messages
dmesg

# Show recent messages
dmesg | tail

# Filter by facility
dmesg --facility=daemon

# Edit cron jobs
crontab -e

# List cron jobs
crontab -l

# Remove all cron jobs
crontab -r

# Edit cron jobs for specific user
crontab -u username -e

# Check if service is running and restart if needed
systemctl is-active nginx || systemctl restart nginx

# Monitor log for specific errors
tail -f /var/log/application.log | grep -i error

# Find processes consuming high CPU
ps aux --sort=-%cpu | head -10

# Check disk usage and alert if over 80%
df -h | awk '$5 > 80 {print $0}'

# Create deployment backup
tar -czf "backup-$(date +%Y%m%d-%H%M%S).tar.gz" /opt/myapp

# Deploy new version with rollback capability
cp -r /opt/myapp /opt/myapp.backup.$(date +%Y%m%d) && \
tar -xzf new-version.tar.gz -C /opt/myapp

# Check application health after deployment
curl -f http://localhost:8080/health || echo "Deployment failed"

# Find top 10 IP addresses in access log
awk '{print $1}' /var/log/nginx/access.log | sort | uniq -c | sort -nr | head -10

# Search for errors in the last hour
find /var/log -name "*.log" -mmin -60 -exec grep -l "ERROR" {} \;

# Monitor real-time log with filtering
tail -f /var/log/application.log | grep --line-buffered -v "DEBUG"

# Good
/usr/bin/systemctl restart nginx

# Avoid
systemctl restart nginx

#!/bin/bash
set -euo pipefail  # Exit on error, undefined variables, pipe failures

if ! systemctl is-active nginx > /dev/null; then
    echo "Nginx is not running, starting..."
    systemctl start nginx
fi

# Add timestamps to deployment logs
echo "$(date '+%Y-%m-%d %H:%M:%S') - Starting deployment" >> /var/log/deployment.log

# Verify service health before proceeding
curl -f http://localhost:8080/health || {
    echo "Service health check failed"
    exit 1
}

# Find all log files modified in last 24 hours
find /var/log -name "*.log" -mtime -1

# Find files larger than 100MB to clean up disk space
find /opt -size +100M -type f -exec ls -lh {} \;

# Find and delete temporary files older than 7 days
find /tmp -name "*.tmp" -mtime +7 -delete

# Create timestamped backup before deployment
tar -czf "app-backup-$(date +%Y%m%d-%H%M%S).tar.gz" /opt/myapp

# Extract with progress display
tar -xzf backup.tar.gz --verbose

# List archive contents without extracting
tar -tzf backup.tar.gz | head -10

# Sync local directory to remote server
rsync -av --progress /local/app/ user@server:/opt/app/

# Backup with deletion of removed files
rsync -av --delete /source/ /backup/

# Dry run to preview changes
rsync -av --dry-run /source/ /dest/

# Set script executable for deployment
chmod +x deploy.sh

# Secure configuration files (owner read/write only)
chmod 600 /etc/myapp/database.conf

# Set proper web directory permissions
chmod -R 755 /var/www/html

# Create symbolic link for current application version
ln -sf /opt/myapp-v2.1.0 /opt/myapp-current

# Link configuration to standard location
ln -s /opt/myapp/config/app.conf /etc/myapp.conf

# Create backup hard link before modification
ln important-config.yml important-config.yml.backup

# Start service and enable auto-start
systemctl start nginx && systemctl enable nginx

# Check service status with detailed output
systemctl status postgresql --no-pager

# Reload configuration without restart
systemctl reload nginx

# Show failed services for troubleshooting
systemctl --failed

# Show all listening TCP services with processes
ss -tlnp

# Monitor established connections to specific port
ss -tn state established '( dport = :80 or sport = :80 )'

# Show socket summary statistics
ss -s

# Find process using specific port
ss -tlnp | grep :3306

# Health check with timeout and status code
curl -f -m 10 https://api.myapp.com/health || echo "Service down"

# POST JSON data to API
curl -X POST -H "Content-Type: application/json" \
     -d '{"deployment":"v1.2.0"}' https://webhook.example.com

# Download with progress bar and retry
curl -L --progress-bar --retry 3 -o app.tar.gz https://releases.example.com/app-v1.2.tar.gz

# Show all processes with full details
ps aux --sort=-%cpu | head -20

# Monitor specific application processes
ps -ef | grep java | grep myapp

# Show process tree to understand relationships
ps auxf

# Find memory-heavy processes
ps aux --sort=-%mem | head -10

# Graceful shutdown with cleanup
kill -TERM $(pgrep java | head -1)

# Force kill unresponsive process
kill -9 1234

# Restart service by killing all instances
killall nginx && systemctl start nginx

# Kill processes matching pattern
pkill -f "java.*myapp"

# Edit current user's cron jobs
crontab -e

# Example entries for automation:
# Daily backup at 2 AM
0 2 * * * /opt/scripts/backup.sh >> /var/log/backup.log 2>&1

# Health check every 5 minutes
*/5 * * * * curl -f http://localhost:8080/health || /opt/scripts/restart-app.sh

# Weekly log rotation on Sundays
0 3 * * 0 /opt/scripts/rotate-logs.sh

# Find errors in application logs
grep -i "error\|exception\|fatal" /var/log/myapp/*.log

# Count specific events
grep -c "successful login" /var/log/auth.log

# Show context around errors
grep -A 5 -B 5 "OutOfMemoryError" /var/log/application.log

# Real-time log monitoring
tail -f /var/log/nginx/access.log | grep -E "5[0-9]{2}"

# Extract IP addresses from access logs
awk '{print $1}' /var/log/nginx/access.log | sort | uniq -c | sort -nr

# Calculate total response times
awk '{sum += $10} END {print "Average response time:", sum/NR "ms"}' access.log

# Parse CSV and filter data
awk -F',' '$3 > 100 {print $1, $2}' metrics.csv

# Generate simple report
awk '{users[$1]++} END {for (user in users) print user, users[user]}' login.log

# Update configuration during deployment
sed -i 's/debug=true/debug=false/g' /opt/myapp/config.yml

# Replace database connection string
sed -i 's/localhost:3306/prod-db:3306/g' application.properties

# Remove sensitive data from logs
sed 's/password=[^&]*/password=****/g' application.log

# Add configuration entry after specific line
sed -i '/\[database\]/a timeout=30' config.ini

# Follow specific service logs in real-time
journalctl -u nginx -f

# Show logs from last deployment
journalctl --since "2025-07-29 10:00:00" --until "2025-07-29 11:00:00"

# Filter by priority (errors only)
journalctl -p err

# Show boot logs for system issues
journalctl -b -1

# Export logs in JSON format for analysis
journalctl -u myapp -o json | jq .