Linux

The terminal always works inside one folder, called the current directory. pwd (print working directory) tells you which one.

ls lists what is inside the current folder.

Files starting with a dot (like .bashrc) are hidden. -l shows details (permissions, owner, size) and -a shows hidden files.

cd (change directory) moves you into another folder.

Two dots (..) mean the parent folder - one level up.

mkdir (make directory) creates a new folder. Add -p to create nested folders in one go.

touch creates an empty file, or updates the timestamp if it already exists.

cat prints a whole file to the screen. Great for short files.

cp SOURCE DESTINATION copies a file. Use cp -r to copy a whole folder.

mv moves a file. Moving to a new name in the same folder is how you rename.

rm removes a file for good - there is no recycle bin. rm -r removes a folder and everything in it, so double-check first!

grep prints only the lines that match a word. It's the #1 tool for reading logs.

head shows the start of a file (10 lines by default). -n sets how many.

tail shows the end of a file. tail -f keeps it open and prints new lines as they arrive.

find searches folders for files. find PATH -name PATTERN looks by name.

The pipe | sends the output of one command into the next. wc -l counts lines.

Linux files have read (r), write (w) and execute (x) permissions. chmod +x lets you run a script.

./ means 'in this folder'. You need it to run a script that isn't on your PATH.

ps aux lists every running process with its PID (process ID), CPU and memory use.

kill sends a signal to a process by its PID. Plain kill asks it to stop nicely; kill -9 forces it.

df -h shows free space on each disk in human-readable units (G, M).

sudo runs one command as the administrator (root). apt is the package manager on Ubuntu/Debian.

ssh opens a secure terminal on a remote server. The format is user@address.

curl talks to URLs from the terminal. -I fetches only the response headers, so you quickly see the status code.

ss shows network sockets. -tulpn = TCP + UDP, listening only, with process names and port numbers.

systemd runs background services. systemctl status shows if a service is running and its latest logs.

systemctl restart stops and starts a service. Changing services needs sudo.

journalctl reads systemd logs. -u picks one service (unit) and -f follows new lines live.

cut picks columns from each line. -d sets the separator and -f the field number. /etc/passwd uses : between fields, and field 1 is the username.

sort puts the same lines next to each other, and uniq -c counts them. Together they answer questions like 'which IP called us most?'.

awk splits each line into fields by spaces. $1 is the first field. In a web access log, the first field is the client IP.

sed edits text. s/old/new/ replaces text, and -i saves the change into the file itself. Very common in scripts to change a port or a version.

tar bundles files into one archive. -c creates, -z compresses with gzip, -f names the file. Backups and deployments use this all the time.

-x extracts. Use the same z and f flags. Add -C folder to extract somewhere else.

Apps and CI jobs should run as their own user, not root. useradd -m also creates a home folder.

Groups give permissions. Members of the docker group can run Docker without sudo. -aG appends a group without removing the others.

dig asks DNS which IP a name points to. When a site 'does not work', DNS is one of the first things to check.

ping sends small test packets. -c 3 stops after three, so it does not run forever.

scp copies files over SSH. The format is scp file user@host:/path.

cron runs commands on a schedule, like a nightly backup. crontab -l lists your jobs, crontab -e edits them. 0 2 * * * means every day at 02:00.

uptime shows how long the server has run and the load average for the last 1, 5 and 15 minutes. Load higher than the number of CPUs means work is queuing up.

free -h shows used, free and available memory in a readable way. If available is close to 0 and swap is used, the server is out of memory.

du -sh shows the size of each item. Logs in /var/log are the most common reason a disk fills up.

lsof -i :PORT shows which process has the port open. Use it when an app fails with 'address already in use'.

journalctl -p err shows only error messages. -b limits it to the current boot. A fast way to see what broke.

top shows processes live, sorted by CPU. Press M to sort by memory and q to quit. htop is a friendlier version.