Essential Linux Command Cheatsheet: Find, Sed, Nginx, Firewall & More

1. Find and move all *.tar files

Use find . -name "*.tar" -exec mv {} ./backup/ \; to locate every file ending with .tar in the current directory tree and move it to the backup directory.

2. Batch unzip all *.zip files

Iterate over zip files with a for loop:

for i in `find . -name "*.zip" -type f`
do
  unzip -d $i /data/www/img/
 done

3. Common sed one‑liners (example file: test.txt)

Remove the first character of each line: sed -i 's/^\.//g' test.txt Prefix each line with a: sed 's/^/a/g' test.txt Append a at the end of each line: sed 's/$/a/' test.txt After a line containing wuguangke, insert c: sed '/wuguangke/a c' test.txt Before a line containing wuguangke, replace it with c:

sed '/wuguangke/c c' test.txt

4. Check if a directory exists, create if not

Conditional script:

if [ ! -d /data/backup/ ]; then
  mkdir -p /data/backup/
else
  echo "The directory already exists, please exit"
fi

5. Monitor root partition usage and send email when ≥90%

Extract the usage percentage: df -h | awk 'NR==2 {print $5}' | tr -d '%' Continuously check every 5 minutes and alert:

while sleep 5m
do
  for i in $(df -h | awk 'NR==2 {print $5}' | tr -d '%')
  do
    if [ $i -ge 90 ]; then
      echo "Disk usage $i% exceeds 90%" | mail -s "Linux Disk Warning $i%" [email protected]
    fi
  done
done

6. List top 20 IPs from Nginx access log

Command:

cat access.log | awk '{print $1}' | sort | uniq -c | sort -nr | head -20

7. Modify SELinux setting with sed

Replace enforcing with disabled in /etc/selinux/config:

sed -i '/SELINUX/s/enforcing/disabled/' /etc/selinux/config

8. Print maximum and minimum values from a file

Using sort and awk:

cat a.txt | sort -nr | awk 'NR==1{max=$0} END{print max}'
cat a.txt | sort -n | awk 'NR==1{min=$0} END{print min}'

9. Retrieve SNMP v2 data with snmpwalk

Example:

snmpwalk -v2c -c public 192.168.0.241

10. Replace lines ending with jk to yz

sed -e 's/jk$/yz/g' b.txt

11. Capture network packets with tcpdump

Capture traffic to host 192.168.56.7 on port 80: tcpdump -nn host 192.168.56.7 and port 80 Capture all traffic except host 192.168.0.22 on port 80:

tcpdump -nn host 192.168.56.7 or ! host 192.168.0.22 and port 80

12. Configure SNMP community name on H3C

snmp-agent sys-info version v1 v2c
snmp-agent community read public

13. Show the 20 most used commands from Bash history

cat .bash_history | grep -v '^#' | awk '{print $1}' | sort | uniq -c | sort -nr | head -20

14. Delete *.log files older than 3 days

find . -mtime +3 -name "*.log" | xargs rm -rf

15. Move files larger than 100 KB to /tmp

find . -size +100k -exec mv {} /tmp \;

16. Simple firewall script allowing only remote access to port 80

iptables -F
iptables -X
iptables -A INPUT -p tcp --dport 80 -j ACCEPT
iptables -A INPUT -p tcp -j REJECT

17. Nginx log analysis – top 10 IPs

cd /home/logs/nginx/default
sort -m -k 4 -o access.logok access.1 access.2 access.3 ...
cat access.logok | awk '{print $1}' | sort | uniq -c | sort -nr | head -10

18. Replace directory path in a file

sed 's:/user/local:/tmp:g' test.txt
# or in‑place
sed -i 's:/usr/local:/tmp:g' test.txt