20 Essential Linux Command Combos Every Sysadmin Must Master

File and Directory Management

find + xargs rm Command: find /var/log -name "*.log" -mtime +30 -print0 | xargs -0 rm -f Finds log files older than 30 days, safely handles spaces with -print0 , and deletes them via xargs . Use find … -exec echo {} \; first to preview.

ls -la + grep + sort Command: ls -la /etc | grep "^d" | sort -k9 Lists entries in /etc , filters directories, and sorts by the size column (9th field).

du -sh * + sort -hr Command: du -sh /home/* | sort -hr | head -10 Shows the size of each user’s home directory, sorts descending, and displays the top ten consumers.

find + tar -czf Command: find /etc -name "*.conf" -type f | tar -czf config_backup.tar.gz -T - Finds all .conf files and packs them into a gzip archive. Add --exclude=*.bak to skip backup files.

grep -r + wc -l Command: grep -r "error" /var/log/app/ | wc -l Recursively searches for the word “error” and counts matching lines.

Process and Resource Monitoring

ps aux + grep + awk Command: ps aux | grep [n]ginx | awk '{print $2, $3, $11}' | sort -nrk2 | head -5 Lists processes, filters nginx, extracts PID, CPU usage and command, sorts by CPU, and shows the top five.

top -b -n1 + sort Command: top -b -n1 | grep "Cpu(s)" -A 20 | sort -k9 -nr | head -10 Runs top in batch mode, extracts the process list, sorts by memory usage, and displays the ten most memory‑intensive processes.

free -h + awk Command: free -h | awk 'NR==2{printf "Used: %s/%s (%.1f%%)\n", $3,$2,$3*100/$2 }' Shows human‑readable memory statistics and calculates the usage percentage.

lsof + grep Command: lsof -i :80 | grep LISTEN | awk '{print $2, $9}' Lists open files on port 80, filters listening sockets, and prints PID and address.

Network Diagnosis and Configuration

ping + mtr Command: ping -c 10 8.8.8.8 & mtr -r -c 10 8.8.8.8 Ping sends ten ICMP packets to Google DNS; mtr reports hop latency and loss.

netstat -an + grep + wc Command: netstat -an | grep :443 | wc -l Counts active connections on HTTPS port 443.

ifconfig + grep + awk Command: ifconfig eth0 | grep "inet " | awk '{print $2}' Shows the IPv4 address of eth0 . On newer systems ip addr show eth0 is preferred.

tcpdump + grep Command: tcpdump -i eth0 -n port 80 -c 100 | grep "GET /" Captures 100 packets on port 80 and extracts HTTP GET requests.

Log Analysis and Debugging

tail -f + grep Command: tail -f /var/log/syslog | grep --line-buffered ERROR Follows syslog in real time and shows only lines containing “ERROR”.

awk + sort + uniq Command: awk '{print $5}' /var/log/auth.log | sort | uniq -c | sort -nr | head -5 Extracts the fifth field (usually the command), counts occurrences, and lists the top five events.

sed + grep Command: grep "2025-09" /var/log/app.log | sed 's/IP=//g' | grep "blocked" Filters logs by date, removes the IP= prefix, and keeps only blocked entries.

zcat + grep + wc Command: zcat /var/log/oldlogs/*.gz | grep "panic" | wc -l Searches compressed logs for the word “panic” and counts matches without extracting files.

System Maintenance and Security

yum check-update + grep + xargs yum update -y Command: yum check-update | grep security | xargs yum update -y Lists available updates, filters security‑related packages, and installs them automatically.

chmod + find Command: find /var/www -type f -exec chmod 644 {} \; ; find /var/www -type d -exec chmod 755 {} \; Recursively sets files to 644 and directories to 755 , hardening web‑root permissions.

history + grep + awk Command: history | grep rm | awk '{print $1, $2}' | sort -u Extracts recent rm commands from shell history, showing line numbers and commands without duplicates.