Linux and shell commands, with examples

pwd

Prints the full path of the folder you are currently working in.

Your shell always has a current directory, and relative paths such as notes.txt or ../logs are measured from it, so pwd is the quickest way to get your bearings after a few cd commands. If you arrived through a symbolic link, plain pwd usually shows the path through the link, while pwd -P shows where you really are on disk.

pwd

pwd -P

-P

Resolve symbolic links and print the physical path.

ls

Lists the files and folders inside a directory.

With no argument it lists the current folder. Names that start with a dot, such as .env or .gitignore, stay hidden unless you add -a, and flags can be combined, so ls -lah gives a detailed, readable listing that includes them. The tree command, which draws folders as a nested diagram, is not installed by default on most distributions, so you would have to add it with your package manager first.

ls

ls -la

ls -lh project/

ls -lt

-l

Long format: one entry per line with permissions, owner, size, and modification time.

-a

Include hidden entries whose names begin with a dot.

-h

With -l, print sizes in readable units such as 4.0K or 12M.

-t

Sort by modification time, newest first.

cd <directory>

Changes the directory your shell is working in.

Plain cd or cd ~ takes you home, .. means the parent folder, and cd - jumps back to wherever you were before and prints that path, which makes flipping between two places easy. cd has to be built into the shell, because a separate program cannot change the folder of the shell that started it; for the same reason, a script that calls cd leaves your terminal where it was unless you source the script.

cd project

cd ..

cd ~

cd -

mkdir -p <path>

Creates new directories, including any missing parent folders when you add -p.

Without -p, mkdir fails if a parent in the path does not exist yet or if the folder is already there. With -p it builds the whole chain and quietly succeeds when the folder already exists, which is why scripts nearly always use it.

mkdir drafts

mkdir notes drafts archive

mkdir -p project/src/components

-p

Create missing parent folders and do not complain if the target already exists.

-v

Print a line for every folder that gets created.

touch <file>

Creates an empty file if it does not exist, or updates the modification time of one that does.

It never changes what is inside an existing file, so it is safe to run on something you care about. People mostly use it to create placeholder files quickly, or to bump a timestamp so a build tool treats a file as changed.

touch notes.txt

touch index.html style.css app.js

-c

Only update files that already exist; never create new ones.

cp <source> <destination>

Copies files, and whole folders when you add -r.

If the destination is an existing folder the copy goes inside it; otherwise the copy takes the destination name. Because of that rule, running the same cp -r twice nests the folder on the second run, leaving you with project-copy/project.

Careful: When a file already exists at the destination, cp replaces its contents without asking and keeps no copy of the old version. Add -i if you want to be prompted first.

cp notes.txt notes-backup.txt

cp notes.txt todo.txt archive/

cp -r project project-copy

cp -i draft.txt notes.txt

-r

Copy directories and everything inside them.

-i

Prompt before overwriting an existing file.

-p

Keep the original permissions and timestamps on the copy.

-v

Print each file as it is copied.

mv <source> <destination>

Moves files or folders to a new place, which is also how you rename them.

Renaming is simply a move to a new name in the same folder, so there is no separate step for it. A move within the same filesystem is instant even for huge folders, because only the directory entry changes, and folders need no -r flag.

Careful: If something already exists at the destination name, mv replaces it silently and the replaced file cannot be recovered. Use -i to be asked or -n to leave existing files alone.

mv draft.txt notes.txt

mv notes.txt archive/

mv old-name/ new-name/

mv -n report.txt archive/

-i

Ask before overwriting an existing file.

-n

Never overwrite an existing file.

-v

Report each move as it happens.

rm <file>

Deletes files, and with -r deletes folders along with everything inside them.

rm will not delete a folder unless you give -r, and -f silences both prompts and complaints about missing paths, which is why rm -rf is common in scripts. Wildcards are expanded by the shell before rm even runs, so run ls with the same pattern first to see exactly what would go.

Careful: There is no trash on the command line: removed files are gone and ordinary tools cannot bring them back. rm -rf never asks for confirmation, so a small typo does a lot of damage; rm -rf * .log, with a stray space, deletes everything in the folder rather than just the log files.

rm notes-backup.txt

rm -i *.log

rm -r old-project/

rm -rf build/

-r

Remove directories and everything beneath them.

-f

Never prompt, and ignore paths that do not exist.

-i

Confirm every single removal.

-I

Ask once when deleting more than three files or when recursing; less tedious than -i.

ln -s <target> <link-name>

Creates a symbolic link, a small pointer that leads to another file or folder.

Opening the link opens whatever it points at, which is handy for giving a long path a short name or switching versions by repointing one link. A relative target is resolved from the folder where the link lives, not from where you ran ln, and getting that wrong is the usual reason a new link is broken. Without -s, ln makes a hard link instead: a second name for the same data that works only within one filesystem and not for folders.

ln -s ~/projects/website/docs docs

ls -l docs

ln -sfn releases/v2 current

readlink -f docs

-s

Make a symbolic link rather than a hard link.

-f

Replace an existing file or link that has the same name.

-n

Treat an existing link to a folder as a plain file, so -f replaces the link instead of creating a new one inside the folder.

find <where> <tests>

Searches a folder tree for files by name, type, age, and more, and can run a command on each result.

find walks every subfolder of the starting point and prints each match. Quote wildcard patterns such as "*.txt" so the shell hands them to find instead of expanding them itself. With -exec, {} stands for each path found: ending with \; runs the command once per file, while ending with + passes many paths per run and is much faster.

find . -name "*.txt"

find . -type d -name node_modules

find . -type f -mtime -7

find src -name "*.ts" -exec grep -l "TODO" {} +

-name <pattern>

Match the file name against a wildcard pattern, case sensitively.

-type f|d

Keep only regular files (f) or directories (d).

-mtime <days>

Filter by days since the last change: -7 means within a week, +30 means older than 30 days.

-exec <cmd> {} +

Run a command on the results, with {} replaced by the paths.

cat <file>

Prints the whole contents of one or more files to the terminal.

It suits short files; for anything longer than a screen, less is easier because cat pours everything out at once. The name is short for concatenate, and joining several files into one is its other everyday job.

cat notes.txt

cat part1.txt part2.txt > combined.txt

cat -n data.csv

cat -A windows.txt

-n

Number every output line.

-A

Show tabs, line endings, and other invisible characters. This is GNU-only; cat -et is the closest option on macOS.

less <file>

Opens a file in a scrollable viewer so you can page through and search it.

less opens instantly even on very large logs because it only reads what it needs to show. Inside it, Space and b move a page forward and back, /word searches, n jumps to the next match, g and G go to the start and end, and q quits. Tools such as man and git log display their output through less, so the same keys work there too.

less server.log

less -N server.log

less +F server.log

ps aux | less

-N

Display line numbers.

-S

Cut long lines off at the screen edge instead of wrapping them.

-i

Make searches ignore case unless the pattern contains capital letters.

head <file>

Shows the first lines of a file, ten by default.

Use it to peek at a CSV header, the top of a config file, or the first results of a long pipeline. GNU head also accepts a negative count, so -n -5 means everything except the last five lines; the head on macOS does not support that form.

head data.csv

head -n 3 data.csv

head -c 200 notes.txt

ls -t | head -n 5

-n <count>

How many lines to show.

-c <bytes>

Count bytes instead of lines.

tail <file>

Shows the last lines of a file, and with -f keeps printing new lines as they are written.

tail -f is the standard way to watch a log while you reproduce a problem; Ctrl+C stops watching without affecting the program that writes the log. Logs are often rotated, meaning renamed and replaced by a fresh file, and -F copes with that by reopening the file by name, whereas -f keeps following the old renamed copy.

tail notes.txt

tail -n 50 app.log

tail -f app.log

tail -n +2 data.csv

-n <count>

How many lines to show; a leading + means start at that line number.

-f

Keep the file open and print lines as they are appended.

-F

Like -f, but reopen the file if it is replaced, as happens with log rotation.

wc <file>

Counts the lines, words, and bytes in a file or in piped input.

Plain wc prints all three counts followed by the file name, but input that arrives through a pipe or < has no name to print, so wc -l < file gives just the number. wc -l actually counts newline characters, which means a final line with no newline at the end is not counted.

wc -l app.log

wc -l < app.log

grep "ERROR" app.log | wc -l

ls | wc -l

-l

Count lines.

-w

Count words, meaning runs of characters separated by spaces.

-c

Count bytes.

-m

Count characters, which differs from bytes for accented letters, emoji, and other non-ASCII text.

grep <pattern> <file>

Prints the lines that match a pattern, from files or from piped input.

The pattern is a regular expression, so characters like . * [ and ^ have special meanings; add -F when you want to search for that text literally. With -r it searches every file under a folder, the classic way to find where something is used in a codebase. grep exits with status 0 when it finds a match and 1 when it does not, so it also works as a test in if statements and && chains.

grep "ERROR" app.log

grep -rn "TODO" src/

grep -v "^#" config.ini

grep -iE "warn|error" app.log

-i

Ignore the difference between upper and lower case.

-r

Search all files beneath the given folders.

-n

Prefix each matching line with its line number.

-v

Invert the match and print the lines that do not match.

sort <file>

Sorts lines alphabetically, numerically, or by a chosen column.

By default sort compares text, so 100 comes before 9; add -n to compare numbers by value. Redirecting the result back into the same file with > empties that file before sort can read it, so use -o with the same name when you want to sort a file in place.

sort names.txt

sort -n scores.txt

sort -t, -k3 -n data.csv

sort -o names.txt names.txt

-n

Compare values as numbers.

-r

Reverse the order.

-k <field>

Sort by a particular field; -t sets the separator, which is otherwise any whitespace.

-h

Understand sizes such as 200K, 30M, and 1.5G, as printed by du -h.

uniq

Collapses repeated lines into one, and can count or list the duplicates.

uniq only compares each line with the one directly above it, so duplicates that are not next to each other slip through, which is why it almost always follows sort. The chain sort | uniq -c | sort -rn is a quick way to rank the most common lines in any file.

sort visitors.txt | uniq

sort visitors.txt | uniq -c | sort -rn

sort emails.txt | uniq -d

-c

Prefix each line with the number of times it occurred.

-d

Print only lines that were repeated.

-u

Print only lines that were never repeated.

-i

Ignore case when comparing neighbouring lines.

cut -d <delimiter> -f <fields>

Pulls selected columns or character ranges out of each line.

cut works well on simple data where columns are separated by exactly one character, and its default separator is a tab. It does not understand quoted CSV values that contain commas, and several spaces in a row count as several empty columns, so awk is the better fit for space-aligned command output.

cut -d, -f1 data.csv

cut -d, -f1,3 data.csv

cut -d: -f1 /etc/passwd

cut -c1-8 app.log

-d <char>

The single character between fields; a tab if you leave it out.

-f <list>

Which fields to keep, such as 2, 1,3, or 2-4.

-c <range>

Select characters by position instead of fields.

tr <set1> <set2>

Translates, squeezes, or deletes individual characters in a stream of text.

tr reads only standard input, so give it data through a pipe or <; it does not take a file name. It works one character at a time rather than on words, so reach for sed when you need to replace whole strings.

echo "hello world" | tr 'a-z' 'A-Z'

tr -d '\r' < windows.txt > unix.txt

echo "a,b,c" | tr ',' '\n'

echo "too    many   spaces" | tr -s ' '

-d

Delete the listed characters.

-s

Squeeze each run of a repeated character into a single one.

sed 's/old/new/g' <file>

Edits text as a stream, most often to find and replace, and prints the result without touching the file unless you add -i.

In s/old/new/ only the first match on each line changes; the trailing g changes every match, and for text full of slashes, such as URLs, you can pick another separator like s|old|new|. The -i flag edits the file itself, and platforms disagree on its syntax: GNU sed on Linux accepts -i alone, the BSD sed on macOS needs a backup suffix and uses -i '' for none, and -i.bak with the suffix attached works on both.

Careful: sed -i rewrites the file with no undo. If the pattern matches more than you expected, the original text is gone unless you used a backup suffix or the file is under version control, so preview the output without -i first.

sed 's/http:/https:/g' config.txt

sed -i 's/http:/https:/g' config.txt

sed -i.bak 's/http:/https:/g' config.txt

sed -n '5,10p' app.log

-i

Write the changes back into the file instead of printing them.

-n

Print nothing unless a command such as p asks for it.

-E

Use extended regular expressions, so +, ?, | and ( ) need no backslashes.

awk '{print $1}' <file>

Splits each line into fields and lets you print, filter, or total them with a tiny program.

Fields are numbered $1, $2, and so on, $0 is the whole line, and NR is the current line number. By default any run of spaces or tabs separates fields, which makes awk a better fit than cut for aligned output, and -F chooses a different separator. Keep the program in single quotes so the shell does not swap $1 for one of its own variables.

awk '{print $1}' access.log

awk -F, 'NR > 1 {print $1, $3}' data.csv

awk '$2 > 100' sales.txt

awk '{sum += $2} END {print sum}' sales.txt

-F <sep>

Set the field separator, for example -F, for commas or -F: for colons.

-v name=value

Pass a value in from the shell as an awk variable.

xargs <command>

Reads items from standard input and turns them into arguments for another command.

Commands such as mkdir, touch, and rm take names as arguments and ignore piped input, and xargs bridges that gap. It splits input on spaces as well as newlines, so a name like my notes.md becomes two arguments unless you pair find -print0 with xargs -0. GNU xargs still runs the command once when the input is empty; -r prevents that, and the BSD xargs on macOS already skips empty input.

find . -name "*.md" -print0 | xargs -0 grep -l "draft"

xargs mkdir -p < folders.txt

echo "one two three" | xargs -n 1 echo

printf '%s\n' api web worker | xargs -I {} mkdir -p services/{}/logs

-0

Expect items separated by null characters, as produced by find -print0.

-n <count>

Pass at most this many items to each run of the command.

-I {}

Run once per input line, substituting the line wherever {} appears.

-r

GNU only: skip running the command when there is no input.

command1 | command2

Sends the normal output of one command straight into the input of the next.

Pipes let you build up a result step by step without temporary files. Only standard output travels through the pipe, so error messages still reach your screen unless you redirect them too. A pipeline reports the exit status of its last command, so scripts often run set -o pipefail to stop an earlier failure from being hidden.

ls -l | less

grep "ERROR" app.log | wc -l

history | grep ssh

cut -d, -f2 data.csv | sort | uniq -c

command > file

Writes a command's normal output into a file, replacing whatever the file held before.

The shell creates the file if needed and empties it before the command even starts, which is why sort notes.txt > notes.txt leaves you with an empty file. Running set -o noclobber makes > refuse to overwrite existing files for the rest of the session, and >| then overrides that when you really mean it.

Careful: > wipes the current contents of the target without asking, and pointing it at the same file a command is reading destroys that file's data. Check the name, or use >> if you meant to add to the end.

ls > files.txt

echo "draft" > notes.txt

sort names.txt > sorted-names.txt

set -o noclobber

command >> file

Adds a command's output to the end of a file, keeping what is already there.

Like >, it creates the file when it is missing. It is the usual choice for log files and for adding lines to settings files. Running the same >> command twice adds the text twice, so scripts that append settings should check for the line first.

echo "Buy milk" >> todo.txt

date >> run.log

./backup.sh >> backup.log 2>&1

grep -qxF "cache=on" settings.conf || echo "cache=on" >> settings.conf

command 2> file

Sends a command's error messages to a file, apart from its normal output.

Programs write problems to a separate stream, number 2, which is why error text still appears on screen after you redirect output with >. Sending the two streams to different files gives you a tidy record of what went wrong, and 2>> appends errors instead of overwriting them.

ls missing-folder 2> errors.txt

./build.sh > build.log 2> build-errors.log

find / -name "*.conf" 2> /dev/null

command > file 2>&1

Merges error messages into the same destination as normal output.

2>&1 means send stream 2 wherever stream 1 points at that moment, so order matters: > file 2>&1 captures both, while 2>&1 > file leaves errors on the screen because output had not moved to the file yet. Bash also accepts &> file as a shortcut, but a script run by plain sh reads that differently, so the long form is safer there.

./build.sh > build.log 2>&1

./build.sh 2>&1 | grep -i warning

./build.sh &> build.log

command < file

Feeds a file into a command's standard input, as though you had typed its contents.

Most tools accept a file name directly, but a few, such as tr, only read input, and with others the output changes slightly: wc -l < file prints the count without the name. A related form, the here-document written as << followed by a marker word, supplies several lines of input straight from a script.

wc -l < names.txt

tr 'a-z' 'A-Z' < notes.txt

sort < names.txt > sorted-names.txt

command | tee <file>

Shows output on screen and saves a copy to a file at the same time.

Use it to watch a long command while keeping a log. It also fixes a common sudo surprise: in sudo echo text > /etc/file the redirection is done by your own unprivileged shell and fails, whereas echo text | sudo tee /etc/file writes the file with root rights.

./build.sh | tee build.log

./build.sh 2>&1 | tee build.log

echo "line" | tee -a notes.txt

echo "debug=true" | sudo tee -a /etc/myapp.conf > /dev/null

-a

Append to the file rather than overwriting it.

/dev/null

A special file that throws away anything written to it and always reads as empty.

Redirect output there when you only care whether a command worked, not what it printed. Because reading it gives nothing, it also serves as blank input for a command that would otherwise sit waiting for you to type.

find / -name "*.conf" 2>/dev/null

./backup.sh > /dev/null 2>&1

curl -s -o /dev/null -w "%{http_code}\n" https://example.com

ls -l

Shows each file's permission string, such as -rwxr-xr--, alongside its owner and group.

The first character is the type: - for a regular file, d for a directory, l for a symbolic link. The next nine characters are three sets of three, for the owner, the group, and everyone else, each showing r (read), w (write), and x (execute, or enter for a folder), with - wherever a permission is missing. In numbers r is 4, w is 2, and x is 1, so rwx is 7, r-x is 5, and -rwxr-xr-- as a whole is 754.

ls -l deploy.sh

ls -ld project/

stat -c '%a %A %n' deploy.sh

chmod <mode> <file>

Changes who is allowed to read, write, or execute a file or folder.

Symbolic modes adjust what is already set: u, g, o, and a pick the owner, group, others, or all, and +, -, or = add, remove, or set exactly. Numeric modes set all nine bits at once with one digit each for owner, group, and others, so 644 is typical for ordinary files and 755 for scripts and folders. SSH refuses to use a private key that other users can read, which is why key files need 600.

Careful: chmod -R 777 lets every account on the machine modify or replace every file in that tree and marks plain files as executable. It can appear to fix a permission error while opening a security hole, so work out which user actually needs access and grant only that.

chmod +x deploy.sh

chmod 644 notes.txt

chmod u+x,go-w deploy.sh

chmod 600 ~/.ssh/id_ed25519

-R

Apply the change to a folder and everything inside it.

u / g / o / a

Target the owner, the group, other users, or all three.

+ / - / =

Add, remove, or set exactly the permissions that follow.

chown <user>:<group> <file>

Changes which user and group own a file or folder.

Handing a file to another user normally requires root, so chown usually runs under sudo. You can change only the owner (user), both (user:group), or only the group (:group). A frequent use is giving a web app's folder to the account the web server runs as.

Careful: Running chown -R on system folders such as /usr or /etc can break sudo, SSH logins, and installed services, which expect particular owners on particular files. Changing ownership also clears the setuid bit that programs like sudo rely on, so point chown -R only at folders that belong to your own project.

sudo chown deploy notes.txt

sudo chown -R www-data:www-data /var/www/example

sudo chown :developers shared-report.txt

sudo chown -R "$USER":"$USER" project/

-R

Apply the change to a folder and everything below it.

sudo <command>

Runs a single command with administrator (root) privileges.

sudo asks for your own password, not root's, and usually remembers it for a few minutes. Your account has to be allowed to use it, typically through the sudo group on Debian and Ubuntu or the wheel group on Fedora and RHEL. Redirections such as > are carried out by your shell before sudo starts, so to write a protected file, pipe into sudo tee instead.

Careful: A command run with sudo can change or delete any file on the system, including those needed to boot or log in. Do not paste sudo commands you do not understand, and avoid using sudo just to get past a permission error with tools like npm or pip, since that leaves root-owned files in folders you normally write to.

sudo apt update

sudo !!

sudo -u postgres psql

sudo -l

-u <user>

Run the command as this user rather than root.

-i

Open an interactive root shell; type exit to leave it.

-l

Show which commands your account may run.

whoami / id

whoami prints the name of the account you are using, and id adds your numeric user ID and every group you belong to.

Both are quick sanity checks after sudo -i, su, or logging in to a server, when it is easy to lose track of which account you are on. Groups control access to things such as Docker, serial devices, and shared folders, and a group you were just added to only appears in id after you log out and back in.

whoami

sudo whoami

id

id -Gn

-u

With id, print only the user ID.

-G

With id, print every group ID.

-n

With -u or -G, print names instead of numbers.

ps aux

Lists running processes with their owner, PID, CPU and memory use, and full command.

ps takes a one-time snapshot; top gives a live view. The aux form comes from the BSD tradition and is written without a dash, while ps -ef is the System V style that shows much the same information plus each parent's PID. When you search with ps aux | grep, the grep process itself often shows up in the results, and pgrep avoids that.

ps aux

ps aux | grep nginx

pgrep -a node

ps aux --sort=-%mem | head

a

Include processes that belong to other users.

u

Use the user-oriented layout with %CPU, %MEM, and start time columns.

x

Include processes with no terminal, such as background services.

top

Shows a live, refreshing view of the processes using the most CPU and memory.

The header summarises uptime, load, and memory, and the list below updates every few seconds. While it runs, P sorts by CPU, M sorts by memory, k sends a signal to a PID you type, and q quits. htop is a friendlier alternative that usually needs installing, and the top on macOS uses different keys and options, such as top -o cpu.

top

top -u deploy

top -b -n 1 | head -n 20

-u <user>

Limit the list to one user's processes.

-d <seconds>

Change how often the display refreshes.

-b

Batch mode: print plain text instead of the interactive screen.

kill <pid>

Sends a signal to a process, by default asking it to shut down cleanly.

Plain kill sends SIGTERM, which a well-behaved program handles by finishing its work, closing connections, and exiting. If it ignores that, kill -9 sends SIGKILL, which cannot be caught and ends the process on the spot. pkill and killall choose processes by name instead of PID, so check what they will match before running them.

Careful: kill -9 gives the program no chance to clean up: temporary and lock files stay behind, buffered data never reaches disk, and a database may need recovery on its next start. Try plain kill first and give it a few seconds before using -9.

kill 4821

kill -9 4821

pkill -f "node server.js"

kill -l

-TERM (15)

The default, a polite request to shut down.

-KILL (9)

End the process immediately; it cannot refuse or clean up.

-HUP (1)

Many services treat this as a request to reload their configuration; check the program's documentation.

-l

List the available signals.

command &

Starts a command in the background so your prompt comes back straight away.

The shell prints a job number in brackets and the process ID, and $! holds that PID afterwards. A background job still writes to your terminal unless you redirect its output, and it is usually ended when the terminal window closes, so use nohup or a proper service for anything that must keep running.

sleep 300 &

./export-data.sh > export.log 2>&1 &

echo $!

wait

jobs / fg / bg

jobs lists the background and stopped jobs in your shell, fg brings one back to the front, and bg lets a stopped one carry on in the background.

Each job gets a small number such as [1], which you refer to as %1 with fg, bg, or kill. A common move is to press Ctrl+Z to pause a program that has taken over the terminal, then type bg so it keeps running out of the way, or fg to return to it. Without a number both act on the current job, marked + in the jobs list, and jobs only knows about work started from this terminal, so use ps to see everything else.

jobs -l

fg %2

bg

kill %1

-l

With jobs, also show each job's process ID.

Ctrl+C / Ctrl+Z

Ctrl+C interrupts the program running in the foreground, and Ctrl+Z pauses it.

Ctrl+C sends SIGINT, which most programs take as a request to stop now. Ctrl+Z sends SIGTSTP, which suspends the program without ending it, so it keeps its memory and open files until you resume it with fg or bg or end it with kill. Ctrl+D is not a signal at all; it marks the end of input, which is why it closes a shell or an interactive prompt such as python.

sleep 300

jobs

fg

nohup <command> &

Runs a command that keeps going after you log out or close the terminal.

nohup makes the command ignore the hang-up signal sent when a session ends, and if its output would otherwise go to the terminal it is saved in a file called nohup.out. That is fine for one-off jobs, but tmux or screen let you reattach to a session later, and a systemd service is the right home for something that should always be running.

nohup ./backup.sh &

nohup ./backup.sh > backup.log 2>&1 &

disown %1

df -h

Shows how much space is used and available on each mounted filesystem.

It is the first thing to check when commands start failing with No space left on device. Give it a path to see only the filesystem that path lives on. A disk can also run out of inodes, the entries used for each file, while still showing free space, and df -i reveals that.

df -h

df -h .

df -i

df -hT

-h

Print sizes in readable units.

-i

Report inodes rather than bytes.

-T

Show the filesystem type (GNU df).

du -sh <path>

Reports how much disk space files and folders take up.

df tells you a disk is full and du tells you what filled it. Without -s it prints a line for every subfolder, which is usually far too much, so use -s or a depth limit and pipe the result into sort -h to find the biggest items. The -d depth option works on both GNU/Linux and macOS.

du -sh project/

du -sh *

du -h -d 1 | sort -h

du -shc *.log

-s

Print only a total for each argument.

-h

Print sizes in readable units.

-d <depth>

List folders only down to this many levels.

-c

Add a grand total line at the end.

free -h

Shows how much memory and swap is in use on a Linux machine.

Look at the available column rather than free: Linux deliberately fills spare memory with disk cache and hands it back the moment programs need it, so a small free figure is normal. Low available memory combined with heavy swap use is the real sign of a RAM shortage. free comes with Linux's procps tools and does not exist on macOS, where vm_stat or Activity Monitor fill the same role.

free -h

free -m

free -h -s 5

-h

Print sizes in readable units.

-s <seconds>

Repeat the report at this interval.

uname -a

Prints details about the kernel and hardware, such as the kernel version and CPU architecture.

uname describes the kernel rather than the distribution, so to learn whether you are on Ubuntu or Fedora, and which release, read /etc/os-release. The architecture from uname -m matters when downloading prebuilt programs, because x86_64 and aarch64 builds are not interchangeable.

uname -a

uname -r

uname -m

cat /etc/os-release

-a

Print all available information.

-r

Print the kernel release.

-m

Print the machine hardware name.

uptime

Shows how long the system has been running, how many users are logged in, and the load averages.

The three load figures average, over the last 1, 5, and 15 minutes, how many processes were running, waiting for a CPU, or stuck waiting on disk. Compare them with the number of CPU cores, which nproc prints; a load that stays above the core count means work is queuing up.

uptime

uptime -p

nproc

curl <url>

Sends a request to a URL and prints the response, the everyday tool for testing websites and APIs.

By default curl prints the response body and does not follow redirects, so add -L when a URL has moved. It treats HTTP error codes such as 404 as a successful transfer unless you add -f, which matters in scripts that check the exit status. It ships with nearly every Linux distribution and with macOS.

Careful: Install guides often pipe a download straight into a shell, as in curl ... | sh. That runs whatever the server sends, with your permissions or root's if sudo is involved, before you have seen a line of it. Save the script to a file, read it, and only then run it.

curl https://example.com

curl -I https://example.com

curl -L -o page.html https://example.com

curl -fsSL https://example.com/install.sh -o install.sh

-I

Request the headers only.

-L

Follow redirects to the final location.

-o <file>

Save the response to a file instead of printing it.

-f

Exit with an error on HTTP failure codes rather than saving the error page.

curl -X POST <url> -d <data>

Sends data to a server with a POST request, adding headers with -H.

-d places data in the request body and already switches curl to POST, so -X POST is optional but makes the intent clear. Data sent with -d is labelled as form data unless you set a Content-Type header, so add one for JSON, or use --json on curl 7.82 and later, which sets the body and headers together. Wrap JSON in single quotes so the shell leaves the inner double quotes alone.

curl -X POST https://api.example.com/notes -H "Content-Type: application/json" -d '{"title":"Hello"}'

curl -d "name=Ada&topic=linux" https://example.com/signup

curl -H "Authorization: Bearer $API_TOKEN" https://api.example.com/me

curl --json '{"title":"Hello"}' https://api.example.com/notes

-X <method>

Choose the HTTP method, such as POST, PUT, or DELETE.

-d <data>

Send data in the request body; start the value with @ to read it from a file, as in -d @body.json.

-H <header>

Add or replace a request header.

--json <data>

Send JSON with matching Content-Type and Accept headers (curl 7.82+).

wget <url>

Downloads files from the web straight to disk.

Unlike curl, wget saves to a file by default, follows redirects without being asked, and can resume an interrupted download, which suits large files. It is common on Linux servers but is not included with macOS and is missing from some minimal container images, where curl -O does a similar job.

wget https://example.com/files/backup.tar.gz

wget -O latest.tar.gz https://example.com/files/backup.tar.gz

wget -c https://example.com/files/backup.tar.gz

-O <file>

Write the download to this file name.

-c

Resume a partial download.

-q

Quiet mode with no progress output.

ping -c <count> <host>

Checks whether a host answers and how long each round trip takes.

On Linux and macOS ping keeps going until you press Ctrl+C, so -c sends a fixed number of packets; Windows stops after four by default and uses -n instead. No reply does not prove a machine is down, because many servers and firewalls block ping on purpose, so test the real service, for example with curl, before drawing conclusions.

ping -c 4 example.com

ping -c 3 203.0.113.10

-c <count>

Stop after sending this many packets.

ssh <user>@<host>

Opens an encrypted terminal session on a remote machine, or runs one command there.

Key-based login is safer and more convenient than passwords: create a key pair once with ssh-keygen, then copy the public half to the server with ssh-copy-id. An entry in ~/.ssh/config lets you connect to a frequent host by a short name and remembers its user, port, and key. The first connection to a host asks you to confirm its fingerprint, and a later warning that the fingerprint changed deserves investigation before you continue.

ssh deploy@203.0.113.10

ssh -p 2222 deploy@203.0.113.10

ssh-keygen -t ed25519 -C "you@example.com"

ssh deploy@203.0.113.10 "df -h"

-p <port>

Connect to this port instead of 22.

-i <keyfile>

Use a specific private key.

-L <port>:<host>:<port>

Forward a local port through the connection, for example to reach a database that only listens on the server.

-v

Print debugging details, useful when a login fails.

scp <source> <destination>

Copies files between your machine and a remote one over SSH.

Remote paths are written user@host:path, and a path without a leading slash is relative to that user's home folder. scp uses your existing SSH keys and settings, but its port option is a capital -P, unlike ssh. For large or repeated transfers rsync is the better tool, since it only sends what has changed.

scp backup.tar.gz deploy@203.0.113.10:backups/

scp deploy@203.0.113.10:/var/log/app.log .

scp -r project/ deploy@203.0.113.10:~/sites/

scp -P 2222 notes.txt deploy@203.0.113.10:~

-r

Copy folders and their contents.

-P <port>

The SSH port; a capital P here, whereas ssh uses -p.

-i <keyfile>

Use a specific private key.

ss -tulpn

Lists network sockets, most often to see which programs are listening on which ports.

Use it when a server will not start because its port is taken, or to confirm a service is really listening. It replaces netstat, which comes from the older net-tools package and is no longer installed by default on many distributions, although netstat -tulpn gives similar output where it exists. Without sudo the process column stays blank for other users' programs, and on macOS lsof -iTCP -sTCP:LISTEN -n -P gives a comparable list.

ss -tulpn

sudo ss -tulpn

ss -tlnp | grep :3000

ss -tn state established

-t / -u

Show TCP or UDP sockets.

-l

Show only listening sockets.

-p

Show the process that owns each socket.

-n

Print numeric ports and addresses instead of looking up names.

dig <domain>

Looks up DNS records for a domain and shows exactly what the name server returned.

Use it to check whether a DNS change has taken effect or which address a name points to. dig is not always preinstalled: it comes in the dnsutils or bind9-dnsutils package on Debian and Ubuntu and in bind-utils on Fedora and RHEL. nslookup is an older, simpler lookup tool that is also available on Windows.

dig example.com

dig +short example.com

dig MX example.com

nslookup example.com

+short

Print only the answer values.

<type>

Ask for a record type such as A, AAAA, MX, TXT, or CNAME.

@<server>

Query a specific DNS server instead of your default one.

tar -czf <archive.tar.gz> <files>

Packs files and folders into a single compressed .tar.gz archive.

Read the letters as create, gzip, file; -f must come last in the group because the archive name has to follow it directly. The archive stores paths as you typed them, so run tar from the folder just above the one you are packing to keep those paths short. Use -j for .tar.bz2 or -J for .tar.xz, which compress more slowly but smaller.

tar -czf backup.tar.gz project/

tar -czvf backup.tar.gz project/

tar -czf backup.tar.gz --exclude=node_modules project/

tar -czf "backup-$(date +%F).tar.gz" project/

-c

Create a new archive.

-z

Compress it with gzip.

-f <file>

The archive's file name; keep this letter last when grouping.

-v

List files as they are processed.

tar -xzf <archive.tar.gz>

Unpacks a .tar.gz archive, and with -t lists what is inside without extracting.

Files come out into the current folder unless you pass -C with a destination, which must already exist. Listing first with -tzf shows whether the archive holds one top-level folder or will scatter files everywhere. GNU tar and the tar on macOS both detect the compression type when extracting, so tar -xf handles .tar.gz, .tar.bz2, and .tar.xz alike.

Careful: Extraction replaces existing files that have the same paths without asking, so unpacking an old backup over a working folder overwrites newer edits. Extract into an empty folder with -C, or add -k to skip files that already exist.

tar -tzf backup.tar.gz

tar -xzf backup.tar.gz

mkdir restore && tar -xzf backup.tar.gz -C restore/

tar -xzf backup.tar.gz project/readme.txt

-x

Extract files from the archive.

-t

List the archive's contents.

-C <dir>

Switch to this folder before extracting.

-k

Keep existing files instead of overwriting them.

gzip <file>

Compresses a single file into a .gz file, and gunzip turns it back into the original.

gzip replaces the original with the compressed file rather than keeping both, unless you add -k, which gzip 1.6 and later support. It only works on single files, so bundle folders with tar first. zcat, zless, and zgrep read or search a .gz file without unpacking it, which is handy for rotated logs.

gzip app.log

gzip -k app.log

gunzip app.log.gz

zgrep "ERROR" app.log.gz

-k

Keep the original file.

-d

Decompress, the same as gunzip.

-9

Use the strongest and slowest compression.

zip -r <archive.zip> <folder>

Creates .zip archives with zip and extracts them with unzip.

Zip files open natively on Windows and macOS, which makes them the friendliest format for sharing. Without -r, zip adds only the empty folder entry and none of its contents. Neither tool is guaranteed on a fresh server, so install them with sudo apt install zip unzip or sudo dnf install zip unzip.

zip -r project.zip project/

zip -r project.zip project/ -x "project/node_modules/*"

unzip -l project.zip

unzip project.zip -d restore/

-r

With zip, include folders and everything inside them.

-x <pattern>

With zip, skip files that match the pattern.

-l

With unzip, list the archive instead of extracting it.

-d <dir>

With unzip, extract into this folder.

echo <text>

Prints text, or the value of variables, to the terminal.

Inside double quotes the shell swaps variables such as $HOME for their values before echo sees them, while single quotes keep the text exactly as written. Options like -n and -e are not treated the same way by every shell, so scripts that need exact formatting are better served by printf.

echo "Hello, $USER"

echo 'Cost: $5'

echo $?

printf "%s\n" "Done"

-n

Leave out the newline at the end.

-e

In bash, interpret escapes such as \t and \n.

export NAME=value

Sets an environment variable that programs started from this shell can read.

A variable set without export exists only inside the current shell, while an exported one is handed to every command you run afterwards; either way it disappears when the terminal closes, so lasting settings belong in ~/.bashrc. There must be no spaces around the equals sign. To set a variable for just one command, write the assignment directly in front of that command.

export API_URL="https://api.example.com"

NODE_ENV=production node server.js

unset API_URL

env

Lists every environment variable, or runs a command with a modified environment.

Pipe it through grep to find a particular setting, such as a proxy or locale. It is also why many scripts begin with #!/usr/bin/env bash or #!/usr/bin/env python3: env finds the interpreter by searching PATH instead of assuming a fixed location.

env

env | grep -i proxy

env NODE_ENV=production node server.js

printenv HOME

-i

Start the command with an empty environment, PATH included.

-u <name>

Remove one variable for the command.

echo $PATH

Shows the list of folders the shell searches, in order, when you type a command name.

PATH is a colon-separated list, and the first folder that contains a matching program wins, which is how two installed versions of a tool end up competing. The current folder is deliberately left out, so you run a script sitting in it as ./script.sh. To add a folder, set PATH in ~/.bashrc and include the existing $PATH in the new value so you do not lose everything else.

echo "$PATH" | tr ':' '\n'

export PATH="$HOME/.local/bin:$PATH"

./deploy.sh

type -a python3

which <command>

Prints the full path of the program that runs when you type a command name.

It answers questions like which of two installed Python versions you are actually getting. which only searches PATH, so it cannot see aliases, shell functions, or builtins such as cd; the bash builtin type reports all of those, and command -v is the portable choice in scripts.

which python3

which -a node

type ll

command -v git

-a

Print all matches instead of stopping at the first.

alias name='command'

Creates a short name that expands into a longer command.

An alias lasts only for the current shell session, so add the line to ~/.bashrc to keep it. Running alias by itself lists what is already defined, and many distributions preset a few, such as ll. Putting a backslash in front of a name, as in \ls, skips the alias once and runs the real command.

alias ll='ls -lah'

alias gs='git status'

alias

unalias ll

history

Lists the commands you have run recently, each with a number.

Press Ctrl+R and start typing to search back through history, often faster than scrolling. !! repeats the last command and !42 reruns entry 42. Bash writes history to ~/.bash_history, so passwords or tokens typed on the command line end up there; a command that starts with a space is left out when HISTCONTROL includes ignorespace, as it does in Ubuntu's default settings.

history

history 20

history | grep docker

!42

source <file>

Runs the commands in a file inside your current shell, so the variables, aliases, and folder changes it makes stay in effect.

Running a script normally starts a separate child shell, and whatever it sets vanishes when it ends; sourcing avoids that, which is why you run source ~/.bashrc after editing it instead of opening a new terminal. A single dot, as in . ~/.bashrc, does the same and also works in shells that lack the word source. On macOS the default shell is zsh, whose settings live in ~/.zshrc.

source ~/.bashrc

. ~/.bashrc

source venv/bin/activate

set -a; source .env; set +a

cmd1 && cmd2

Combines commands on one line, running the next one only on success, only on failure, or always.

Success means the command exited with status 0. Be careful using a && b || c as a shortcut for if-else, because c also runs when b fails, not only when a does.

mkdir -p build && cd build

npm test && npm run build

grep -q "debug" config.ini || echo "debug not set"

cd project; ls

&&

Run the next command only if the previous one succeeded.

||

Run the next command only if the previous one failed.

;

Run the next command regardless of the result.

sudo apt install <package>

Installs, upgrades, and removes software on Debian, Ubuntu, and related distributions.

Run sudo apt update first: it refreshes the list of available versions but installs nothing, while apt upgrade actually installs newer versions of what you have. apt search and apt show find and describe packages without sudo. apt is designed for people at a terminal, so scripts usually call apt-get, whose output and options stay stable between releases.

sudo apt update

sudo apt install curl git

sudo apt upgrade

sudo apt remove nginx

-y

Answer yes to confirmation prompts automatically.

--no-install-recommends

Skip optional recommended packages to keep the install small.

sudo dnf install <package>

Installs, upgrades, and removes software on Fedora, RHEL, and related distributions.

dnf refreshes its repository information automatically once it is out of date, so there is no separate update step before installing. dnf upgrade brings every package up to date, with dnf update accepted as another name for it, and older RHEL and CentOS releases use yum, which takes much the same commands.

sudo dnf install git

sudo dnf upgrade

dnf search nodejs

sudo dnf remove nginx

-y

Answer yes to all prompts.

systemctl status <service>

Controls systemd services: starts, stops, and restarts them, and decides which launch at boot.

status shows whether a service is running, its main PID, and its latest log lines, so it is the first check when something is down. start and stop act right now, while enable and disable only decide what happens at the next boot, and enable --now does both. After editing a unit file run sudo systemctl daemon-reload so systemd picks up the change; many containers and some WSL setups do not run systemd, so these commands will not work there.

systemctl status nginx

sudo systemctl restart nginx

sudo systemctl enable --now nginx

systemctl list-units --type=service --state=running

--now

With enable or disable, also start or stop the service immediately.

--failed

Show units that failed to start.

--type=service

With list-units, limit the list to services.

journalctl -u <service>

Reads the logs collected by systemd, for the whole system or for one service.

Entries appear oldest first inside a pager, so add -e to jump to the end, -f to follow new lines, or -n for only the latest ones. Reading system services' logs usually needs sudo or membership in the adm or systemd-journal group.

journalctl -u nginx

journalctl -u nginx -f

journalctl -u nginx --since "1 hour ago"

journalctl -b -p err

-u <unit>

Show logs for one service.

-f

Keep printing new entries as they are written.

-n <lines>

Show only the most recent lines.

--since <time>

Start from a point in time, such as "yesterday" or "1 hour ago".