Essential Linux Commands for Server Administrators

# Where are we right now?
pwd

# List all files including hidden ones with sizes
ls -lah

# Find the largest files in /var to identify disk issues
ls -lhS /var/log | head -20
                            

# Find all .conf files modified in the last 7 days
find /etc -name '*.conf' -mtime -7

# Find files larger than 100MB anywhere on the system
find / -size +100M -type f 2>/dev/null

# Find files owned by a specific user
find /var/www -user www-data -type f

# Search inside files: find all lines with 'error' in nginx logs
grep -i 'error' /var/log/nginx/error.log

# Search recursively in a directory, show filename and line number
grep -rn 'database_host' /etc/myapp/

# Find temp files older than 3 days and delete them
find /tmp -name '*.tmp' -mtime +3 | xargs rm -f
                            

# Create a compressed archive of the /etc directory
tar -czvf etc-backup-$(date +%F).tar.gz /etc

# Extract an archive into /opt/
tar -xzvf myapp-v2.tar.gz -C /opt/

# List contents of an archive without extracting
tar -tzvf backup.tar.gz

# Compress a single large log file, then decompress it
gzip largefile.log
gunzip largefile.log.gz
                            

# Create a service account with no login shell (best practice for app users)
useradd -r -s /sbin/nologin -d /opt/myapp myapp

# Lock an account without deleting it
usermod -L username

# Unlock an account
usermod -U username

# Show all users on the system
cut -d: -f1 /etc/passwd

# Check what sudo privileges a user has
sudo -l -U username
                            

# Run a command with elevated privileges
sudo apt update

# Run a command as a specific user
sudo -u www-data php artisan migrate

# Open a root shell (use sparingly — stay in sudo for auditing)
sudo -i

# Edit the sudoers file safely — validates syntax before saving
visudo

# Give the 'deploy' user permission to restart nginx without a password
# Add this to /etc/sudoers.d/deploy :
# deploy ALL=(ALL) NOPASSWD: /bin/systemctl restart nginx
                            

# Find the top 10 memory-eating processes
ps aux --sort=-%mem | head -10

# Find the top 10 CPU consumers
ps aux --sort=-%cpu | head -10

# Find exactly which process is using port 80
ss -tlnp | grep ':80'

# Alternative using lsof
lsof -i :80
                            

# Run a process that survives SSH disconnection
nohup ./long-script.sh > /tmp/script.log 2>&1 &

# The better approach: tmux (a terminal multiplexer)
# Create a named session
tmux new -s deploy
# ... run your commands ...
# Detach without killing: press Ctrl+b, then d
# Reattach later from any SSH session:
tmux attach -t deploy

# List all tmux sessions
tmux ls
                            

# System load, uptime, and number of logged-in users
uptime
# The three numbers are load averages: last 1, 5, and 15 minutes
# A load of 1.0 on a single-core server means 100% CPU utilized

# Memory usage summary
free -h

# Disk usage on all mounted filesystems
df -h

# How much space is a directory consuming?
du -sh /var/log
du -sh /var/log/* | sort -rh | head -20

# CPU, memory, disk I/O statistics sampled over time
vmstat 2 5     # Sample every 2 seconds, 5 samples

# Per-disk I/O statistics in real time
iostat -xz 1
                            

# Full workflow: install, enable, start, verify
sudo apt install nginx
sudo systemctl enable nginx
sudo systemctl start nginx
sudo systemctl status nginx

# If a service fails to start, read why:
journalctl -u nginx.service -n 50 --no-pager

# If you create or edit a unit file, reload systemd first:
sudo systemctl daemon-reload
                            

# Follow nginx logs live (like tail -f but with structured filtering)
journalctl -u nginx.service -f

# Show logs from a specific service since a specific time
journalctl -u nginx.service --since '2026-03-20 08:00:00'

# Show only error-level messages from the last boot
journalctl -p err -b

# Show all kernel messages from the current boot
journalctl -k -b

# Show logs from the previous boot — very useful after a crash
journalctl -b -1

# How much space are journals consuming?
journalctl --disk-usage

# Trim old journals to reclaim space
sudo journalctl --vacuum-size=500M
                            

# Show all network interfaces with IP addresses
ip addr show
ip a           # Shorthand

# Show the routing table
ip route show

# Show packet and error statistics for an interface
ip -s link show eth0
                            

# Basic connectivity test
ping -c 4 google.com

# Trace the route packets take to a destination
traceroute google.com

# MTR: live combined traceroute + ping view (install: apt install mtr)
mtr google.com

# DNS resolution — what does this hostname resolve to?
dig google.com +short

# Reverse DNS lookup
dig -x 8.8.8.8

# Test if a specific port is reachable on a remote host
nc -zv 10.0.1.50 3306
# Output: Connection to 10.0.1.50 3306 port [tcp/mysql] succeeded!

# Test an HTTP endpoint
curl -I https://yourdomain.com
                            

# Show all listening TCP ports and which process owns them
ss -tlnp

# Show all established connections
ss -tnp state established

# Show UDP ports
ss -ulnp

# Find what process is using a specific port
ss -tlnp | grep ':443'
lsof -i :443

# Count connections to port 80 grouped by TCP state
ss -tan | awk 'NR>1 {print $1}' | sort | uniq -c | sort -rn
                            

# Always allow SSH before enabling ufw, or you will lock yourself out
sudo ufw allow 22/tcp
sudo ufw enable
sudo ufw status verbose

# Allow HTTP and HTTPS
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp

# Restrict SSH to a specific IP address only
sudo ufw allow from 203.0.113.10 to any port 22

# Remove a rule
sudo ufw delete allow 8080
                            

# Check status
sudo firewall-cmd --state
sudo firewall-cmd --list-all

# Allow a service permanently
sudo firewall-cmd --permanent --add-service=https

# Allow a specific port
sudo firewall-cmd --permanent --add-port=8080/tcp

# Apply changes (required after --permanent flags)
sudo firewall-cmd --reload
                            

# Connect to a remote server
ssh user@192.168.1.100

# Connect on a non-standard port
ssh -p 2222 user@192.168.1.100

# Connect using a specific private key
ssh -i ~/.ssh/deploy_key user@192.168.1.100

# Copy files securely to a remote server
scp localfile.tar.gz user@192.168.1.100:/opt/app/

# Sync directories — only transfers what has changed
rsync -avz --progress /local/dir/ user@remote:/remote/dir/

# Port forwarding: access remote MySQL locally on port 3307
ssh -L 3307:127.0.0.1:3306 user@192.168.1.100 -N

# Generate a modern ed25519 SSH key pair
ssh-keygen -t ed25519 -C 'deploy@leoservers.com'

# Install your public key on a remote server
ssh-copy-id user@192.168.1.100
                            

# How full are all mounted filesystems?
df -h

# Which directories are eating the most space?
du -sh /var/log/* | sort -rh | head -20
du -sh /home/* | sort -rh | head -10

# Quick scan for all files over 500MB
find / -xdev -size +500M -exec ls -lh {} + 2>/dev/null

# Check inode usage — a full inode table causes 'No space left on device'
# even when df shows free space
df -i

# Monitor disk read/write I/O in real time
iostat -xz 2
iotop -o        # Show only processes actively doing I/O
                            

# List all block devices
lsblk

# Detailed partition info for a specific disk
sudo fdisk -l /dev/sdb

# Format a new partition as ext4
sudo mkfs.ext4 /dev/sdb1

# Or as XFS (common on RHEL-based systems, better for large files)
sudo mkfs.xfs /dev/sdb1

# Mount it temporarily
sudo mount /dev/sdb1 /mnt/data

# To make it permanent across reboots, add to /etc/fstab
# Get the UUID first:
sudo blkid /dev/sdb1
# Then add a line like this to /etc/fstab:
# UUID=xxxxxxxx-xxxx-xxxx  /mnt/data  ext4  defaults  0  2
                            

# Show physical volumes, volume groups, and logical volumes
pvs && vgs && lvs

# Extend a logical volume by 20GB
sudo lvextend -L +20G /dev/mapper/ubuntu--vg-ubuntu--lv

# Grow the ext4 filesystem to use the new space
sudo resize2fs /dev/mapper/ubuntu--vg-ubuntu--lv

# For XFS (XFS can only grow, not shrink):
sudo xfs_growfs /mnt/data
                            

# Refresh the package index from all configured repositories
sudo apt update

# Upgrade all installed packages to their latest versions
sudo apt upgrade

# Install one or more packages
sudo apt install nginx php8.3-fpm mariadb-server

# Remove a package but keep its configuration files
sudo apt remove nginx

# Remove package AND its configuration files
sudo apt purge nginx

# Remove automatically installed dependencies that are no longer needed
sudo apt autoremove

# Search for a package
apt search 'web server'

# Show detailed info about a package (version, deps, description)
apt show nginx

# List all installed packages
dpkg -l | grep '^ii'
                            

# Update all packages (dnf supersedes yum on RHEL 8 and later)
sudo dnf update

# Install a package
sudo dnf install nginx

# Remove a package
sudo dnf remove nginx

# Search and get info
dnf search php
dnf info nginx

# List all installed packages
dnf list installed

# Enable the EPEL repository (Extra Packages for Enterprise Linux)
sudo dnf install epel-release
                            

#!/bin/bash
# Script: disk_alert.sh
# Purpose: Send an alert if any filesystem is over 85% full

set -euo pipefail
# -e  = exit immediately on error
# -u  = treat unset variables as errors
# -o pipefail = catch failures in pipe chains

THRESHOLD=85
ALERT_EMAIL='admin@yourdomain.com'
HOSTNAME=$(hostname -f)

df -h | awk 'NR>1 {gsub(/%/,"",$5); if ($5+0 >= THRESHOLD+0) print $0}' \
  THRESHOLD=$THRESHOLD | while read -r line; do
    echo "DISK ALERT on $HOSTNAME: $line" | \
      mail -s "Disk Space Warning: $HOSTNAME" "$ALERT_EMAIL"
  done

echo 'Disk check complete.'
                            

#!/bin/bash

APP_DIR='/opt/myapp'

# Conditional: check if a directory exists, create it if not
if [ -d "$APP_DIR" ]; then
    echo "App directory exists"
else
    mkdir -p "$APP_DIR"
    echo "Created $APP_DIR"
fi

# Check if a command succeeded or failed
if systemctl restart nginx; then
    echo 'nginx restarted successfully'
else
    echo 'ERROR: nginx failed to restart' >&2
    exit 1
fi

# Loop over all enabled nginx config files and test each one
for config in /etc/nginx/sites-enabled/*; do
    nginx -t -c "$config" && echo "$config: OK"
done
                            

# Edit the crontab for the current user
crontab -e

# Crontab format:
# .──────────── minute       (0–59)
# | .────────── hour         (0–23)
# | | .──────── day of month (1–31)
# | | | .────── month        (1–12)
# | | | | .──── day of week  (0=Sunday)
# | | | | |
# * * * * * command to execute

# Run a backup every day at 2:00 AM
0 2 * * * /opt/scripts/backup.sh >> /var/log/backup.log 2>&1

# Attempt Let's Encrypt certificate renewal twice per day
0 */12 * * * /usr/bin/certbot renew --quiet

# Clear temp files older than 7 days every Sunday at 3 AM
0 3 * * 0 find /tmp -mtime +7 -delete

# System-wide cron jobs go in /etc/cron.d/
                            

# Count HTTP response codes in your Nginx access log
awk '{print $9}' /var/log/nginx/access.log | sort | uniq -c | sort -rn

# Find the top 10 IP addresses hitting your server
awk '{print $1}' /var/log/nginx/access.log | sort | uniq -c | sort -rn | head -10

# Extract log lines from the last hour only
grep "$(date +'%d/%b/%Y:%H')" /var/log/nginx/access.log

# Replace a string in a config file in-place
sed -i 's/old_hostname/new_hostname/g' /etc/hosts

# Show only lines 100–200 of a large log file
sed -n '100,200p' /var/log/syslog

# Parse PHP-FPM errors and extract unique file paths
grep 'PHP Fatal error' /var/log/php-fpm/error.log | awk -F'in ' '{print $2}' | sort -u
                            

# strace: trace every system call a process makes (powerful for debugging)
strace -p 1234         # Attach to a running process by PID
strace -c php-fpm      # Summary of system calls during execution

# lsof: list all open files for a specific process
lsof -p 1234

# What files are preventing unmounting of /mnt/data?
lsof /mnt/data

# Check for Out-Of-Memory kills in the kernel ring buffer
journalctl -k | grep -i 'oom\|killed process'
dmesg | grep -i 'out of memory'

# Benchmark raw disk write speed
dd if=/dev/zero of=/tmp/testfile bs=1G count=1 oflag=dsync

# Generate a CPU performance report with sar
sar -u 2 30
                            

# Check who is currently logged into the server
w

# See recent logins
last -20

# See recent failed login attempts
lastb | head -20

# Find which IPs are brute-forcing SSH
grep 'Failed password' /var/log/auth.log | awk '{print $11}' | sort | uniq -c | sort -rn | head

# Check for SUID files (can be used as privilege escalation paths)
find / -perm -4000 -type f 2>/dev/null

# Look for unexpected outbound connections
ss -tnp state established

# Check SSL certificate expiry for a domain
echo | openssl s_client -connect yourdomain.com:443 2>/dev/null | openssl x509 -noout -dates

# Generate a strong random password
openssl rand -base64 24
                            

# 1. Is nginx running?
sudo systemctl status nginx

# 2. Is PHP-FPM running?
sudo systemctl status php8.3-fpm

# 3. What does the nginx error log say?
sudo tail -50 /var/log/nginx/error.log

# 4. Is PHP-FPM actually listening on the socket or port nginx expects?
ss -tlnp | grep php
ls -la /run/php/

# 5. Is the disk full? (full disk causes log write failures which crash PHP-FPM)
df -h
du -sh /var/log/* | sort -rh | head -10
                            

# 1. What is the load average?
uptime
# Rule of thumb: load average should be below the number of CPU cores
nproc    # How many CPU cores does this server have?

# 2. Which specific process is consuming the most CPU?
ps aux --sort=-%cpu | head -10

# 3. Is it I/O wait? Look for 'wa' percentage in iostat
iostat -xz 1 5
iotop -o

# 4. Is it memory exhaustion causing swap thrashing?
free -h
vmstat 1 5
# Look at 'si' (swap in) and 'so' (swap out) columns — high values are bad