kb/commands

Linux commands: a reference for admins and DevOps

Linux commands reference with real use cases: ip, ss, tcpdump, nft, find, grep, journalctl, systemctl, lsof, sysctl, strace, tc, iperf3, vtysh. This is not a copy of the man page. It tells you which flag to reach for in a given situation and what the output means.

28 статей в категории

§ статьи

cmd-awkawk: field-oriented processing of structured textawk splits a line into fields by FS (default is whitespace) and applies pattern { action }. `$1..$NF`, `NR` (a counter), BEGIN/END for a prologue and totals. It covers 80% of "process the columns" tasks without Python.
bash-scriptingbash scripts: basics and idiomsA bash script is a text file with shebang `#!/usr/bin/env bash` and `chmod +x`. Start every script with `set -euo pipefail` and run `shellcheck` to catch errors early.
cmd-cron-crontabcron and crontab: scheduling taskscron is a daemon that reads crontab files and runs jobs on a schedule. Format: `min hour day month weekday command`. anacron handles machines that are powered off. On systemd systems, timers are often used instead.
cmd-curlcurl: HTTP client from the terminal`curl` is a CLI for HTTP, HTTPS, FTP, and more. Send requests, inspect headers, certificates, and timing. The primary tool for REST API debugging.
cmd-digdig: DNS queries with full detaildig queries DNS. Ask for any record type from any server. +short gives compact output. +trace follows resolution from the root. +dnssec shows DNSSEC signatures. It replaces nslookup for debugging.
cmd-findfind: search files by predicates`find` walks a directory tree and applies predicates (name, type, time, size, permissions). Actions: `-print` (default), `-delete`, `-exec`, `| xargs`.
cmd-grepgrep: search lines by pattern`grep` searches stdin or files for lines matching a regex. Key modes: `-E` (ERE), `-P` (PCRE), `-F` (fixed string), `-r` (recursive tree walk).
cmd-htophtop: interactive process monitorhtop is an interactive TUI process monitor. F-keys: F3 search, F4 filter, F5 tree, F6 sort, F9 kill. Color meters at the top, process list below. It replaces top wherever it is available.
cmd-ipip: Swiss army knife for network configuration`ip` is the iproute2 frontend that replaces the old ifconfig, route, and arp tools. Subcommands: `ip addr` (addresses), `ip link` (interfaces), `ip route` (routing table), `ip neigh` (ARP).
cmd-iperf3iperf3: measuring bandwidth`iperf3` measures TCP/UDP throughput between two endpoints. Run a server on one host and a client on the other. Use it for network testing, not in production.
cmd-iptablesiptables: netfilter rules (legacy)iptables is the userland interface for netfilter. Five tables (filter/nat/mangle/raw/security), chains INPUT/OUTPUT/FORWARD/PRE/POSTROUTING, and jump targets ACCEPT/DROP/MASQUERADE. Legacy, but still widely deployed.
cmd-journalctljournalctl: systemd journal`journalctl` reads the binary journal written by systemd-journald. It is the central log for the system: kernel, systemd services, syslog, all through one interface.
cmd-jqjq: JSON queries and transformationjq is a query language for JSON in the shell. Use .field, .array[], select(...), map(...), and in-expression pipes via |. -r strips quotes, -c packs output into a single line. Works well in curl + jq + grep pipelines.
cmd-lsblk-blkidlsblk and blkid: block devices and UUIDslsblk shows the block device tree (disk -> partition -> LVM/crypt -> mountpoint). blkid prints UUID, LABEL, and filesystem type. Use them together to write a [[mount-and-fstab|/etc/fstab]] entry by UUID.
cmd-lsoflsof: who has what open`lsof` (List Open Files) shows every open file across all processes. In Linux everything is a file, so that includes regular files, sockets, and pipes.
cmd-mtrmtr: traceroute + ping in one toolmtr = traceroute + ping. It probes every hop continuously and shows loss% and latency. Use it to find where packets are being dropped or where latency spikes in a matter of seconds.
cmd-nftnft: modern firewall (nftables)`nft` is the single CLI for modern netfilter. Replaces iptables/ip6tables/ arptables/ebtables. Structure: tables, chains, rules.
cmd-psps: process snapshotps prints a snapshot of processes at the moment it runs. Two dialects: BSD (`aux`, no dash) and UNIX (`-ef`, with dash). `-o` specifies columns. For continuous monitoring, use [[cmd-htop|htop]].
cmd-rsyncrsync: incremental file synchronizationrsync copies only the changed blocks of files, locally or over SSH. `-avz` is the baseline combination (archive + verbose + compress). `--delete` mirrors. `--dry-run` is required before the first run.
cmd-sedsed: stream editorsed is a stream editor: it applies commands (`s/a/b/`, `d`, `p`, ...) to each line. `-i` edits a file in place; `-E` enables ERE; the address range `/start/,/end/` filters a block. Hold space is a second buffer.
cmd-ssss: who is listening and who is connected`ss` is the modern replacement for netstat. It shows sockets in LISTEN and ESTABLISHED state, supports filters by address, port, and state, and provides extended TCP info.
cmd-stracestrace: what syscalls a process makes`strace` shows in real time which system calls a process makes and with what arguments. The primary tool when a process goes silent.
cmd-sysctlsysctl: kernel tunables`sysctl` reads and writes kernel parameters through the virtual filesystem `/proc/sys/`. Network, memory, and filesystem tuning all go through these knobs.
cmd-systemctlsystemctl: managing systemd services`systemctl` is the main CLI for managing systemd units: services, timers, mounts, and sockets. It replaces SysV init and `service` on modern distros.
cmd-tctc: traffic control`tc` manages packet queues on network interfaces: bandwidth limits, delay, loss, and classification. Part of iproute2.
cmd-tcpdumptcpdump: packet capturetcpdump captures packets from a network interface using a BPF filter. It supports writing pcap files for later analysis in Wireshark.
cmd-vtyshvtysh: CLI for FRR (BGP/OSPF)vtysh is the Cisco-style CLI for FRRouting. It lets you configure all routing daemons (zebra, bgpd, ospfd) in a single integrated session.
xargs-and-find-execxargs and find -exec: bulk operationsTwo ways to apply a command to a set of files: `find ... -exec cmd {} +` (inside find) and `... | xargs cmd` (via pipe). For safety with spaces and special characters, use `find -print0 | xargs -0`.

← вернуться ко всем категориям базы знаний