Cubis Engineers
Linux

Linux command reference

A compact operational reference for daily server work and first-response troubleshooting.

Cloud & infrastructureReferenceUpdated Aug 13, 2026linuxcommandscheatsheettroubleshooting

Use this page after you understand the commands. Copying an unfamiliar destructive or privileged command into production is not an operating procedure.

System state

Terminal
hostnamectl                       # system identity
uptime                            # uptime and load
free -h                           # memory and swap
df -hT                            # filesystem capacity and type
du -sh * 2>/dev/null | sort -h    # size of entries here
ps aux --sort=-%cpu | head        # top CPU processes
systemctl --failed                # failed units
timedatectl                       # clock, timezone, and time sync
last reboot                      # recent reboot history
dmesg --level=err,warn            # current boot's kernel warnings

Package management by family

Terminal
sudo apt update                   # refresh package information
apt list --upgradable             # list available upgrades
sudo apt upgrade                  # install normal upgrades
sudo apt install PACKAGE          # install a package
apt show PACKAGE                  # inspect package metadata
dpkg -S /path/to/file             # find the package owning a file

Files and text

Terminal
ls -lah                           # detailed listing
find /path -type f -name '*.log'  # find by name and type
less file                         # inspect safely
tail -F file                      # follow a rotating log
grep -Rin 'pattern' /path         # recursive content search
cp -a source destination          # preserve metadata when copying
rsync -a --dry-run src/ dest/     # preview synchronization
namei -l /full/path/to/file       # permissions on every path component
file archive.tar.gz               # detect file type from content
sha256sum file                    # calculate an integrity checksum

Archives and transfers

Terminal
tar -czf backup.tar.gz directory/ # create a gzip-compressed archive
tar -tzf backup.tar.gz            # list archive contents before extraction
tar -xzf backup.tar.gz            # extract the archive here
rsync -aHAX --dry-run src/ dest/  # preview a metadata-preserving local copy
scp file user@host:/tmp/          # copy one file over SSH
sftp user@host                    # interactive transfer over SSH

Inspect an archive before extracting it as root. For full server copies, confirm filesystem, ACL, extended-attribute, and hard-link requirements before choosing rsync flags.

Identities and permissions

Terminal
whoami
id
sudo -l
stat file
chmod 640 file
chown user:group file
getent passwd deploy
getent group www-data
getent hosts example.com
sudo -u deploy command             # run one command as the service user
umask                              # default permissions for new files

Processes and scheduled work

Terminal
pgrep -af nginx                    # find matching PIDs and full commands
ps -o pid,ppid,user,%cpu,%mem,etime,cmd -p PID
sudo lsof -p PID                   # files and sockets opened by a process
nice -n 10 command                 # start with lower CPU scheduling priority
renice 10 -p PID                   # adjust a running process priority
systemctl list-timers --all        # systemd timers and their next runs
crontab -l                         # current user's cron jobs
sudo crontab -u deploy -l          # another user's cron jobs

Services and logs

Terminal
systemctl status SERVICE --no-pager
systemctl restart SERVICE
systemctl reload SERVICE
systemctl enable --now SERVICE
journalctl -u SERVICE -n 100 --no-pager
journalctl -u SERVICE -f
journalctl --since '-30 min' -p warning
systemctl cat SERVICE              # unit file plus drop-in configuration
systemctl show SERVICE -p User -p MainPID -p ExecStart
journalctl -b -u SERVICE           # service logs from the current boot

Network and HTTP

Terminal
ip -brief address
ip route
sudo ss -tulpn
dig +short example.com A
nc -vz example.com 443
curl -fsS http://127.0.0.1:3000/health
curl -vI https://example.com
sudo ufw status numbered
resolvectl status                  # configured DNS resolvers
ip route get 1.1.1.1               # route chosen for a destination
openssl s_client -connect example.com:443 -servername example.com

For RHEL-family firewalls, inspect sudo firewall-cmd --list-all instead of UFW. A successful TCP connection does not prove the application is healthy; follow it with an HTTP or protocol-specific check.

Storage and disk pressure

Terminal
lsblk -f                           # block devices, filesystems, and mount points
findmnt                            # mounted filesystems and options
df -hT                             # capacity by filesystem
df -ih                             # inode usage
du -xhd1 /var | sort -h            # directory sizes on one filesystem
sudo lsof +L1                      # deleted files still held open
journalctl --disk-usage            # journal storage use

When df reports a full disk but du cannot account for the space, look for deleted-open files with lsof +L1 and check container storage.

Containers

Terminal
docker compose ps
docker compose logs -f --tail=100 app
docker compose pull
docker compose up -d --remove-orphans
docker compose exec app sh
docker inspect CONTAINER
docker system df
docker stats --no-stream
docker inspect --format '{{json .State.Health}}' CONTAINER

Security checks

Terminal
sudo ss -lntup                    # listening ports and owning processes
sudo last -a | head               # recent login history
sudo journalctl -u ssh --since today   # Ubuntu / Debian SSH events
sudo journalctl -u sshd --since today  # RHEL-family SSH events
sudo find / -xdev -perm -4000 -type f  # setuid files on the root filesystem
sudo getenforce                   # SELinux mode, when installed
sudo aa-status                    # AppArmor status, when installed

Treat this output as evidence to review, not a pass/fail security scan. Compare it with the server's intended ports, users, and policy.

Where to start

SymptomFirst commands
Site unavailabledig +short, nc -vz HOST 443, curl -vI
Nginx 502ss -ltnp, local curl, Nginx error log, service journal
SSH timeoutprovider status, cloud firewall, route, UFW, SSH listener
Permission deniedid, namei -l PATH, stat, service user
Disk fulldf -hT, du, lsof +L1, journalctl --disk-usage
Process disappearedsystemctl status, journalctl -u, kernel OOM log
Container restart loopdocker compose ps, logs, inspect, health check

Safe configuration change

Terminal
sudo cp -a config config.bak.$(date +%Y%m%d%H%M%S)
sudoedit config
VALIDATOR -t                     # nginx -t, sshd -t, compose config --quiet
sudo systemctl reload SERVICE
systemctl status SERVICE --no-pager

Check before running a risky command

For rm, chmod, chown, firewall rules, database changes, and recursive operations: resolve the target, preview where possible, keep a recovery path, and know how to verify success.

Continue learning

Operations and recovery

Observe server health, investigate failures in a reliable order, control logs, and restore from tested backups.

Networking for Cloud Engineers

Understand how traffic moves from a client to a cloud application and back.

On this page

System statePackage management by familyFiles and textArchives and transfersIdentities and permissionsProcesses and scheduled workServices and logsNetwork and HTTPStorage and disk pressureContainersSecurity checksWhere to startSafe configuration changeContinue learning