Essential Linux System Administration Commands and Tips

1. How to view the number of physical CPUs and cores on a Linux system?

Answer: cat /proc/cpuinfo | grep -c 'physical id' returns 4, and cat /proc/cpuinfo | grep -c 'processor' also returns 4.

2. Which two commands are commonly used to view system load, and what do the three numbers mean?

Answer: Use w or uptime. The three numbers after "load average" represent the average number of runnable tasks over the past 1, 5, and 15 minutes.

3. What do the vmstat columns r, b, si, so, bi, bo represent?

Answer: vmstat output includes:

r : running tasks

b : blocked tasks

si : data swapped in from disk

so : data swapped out to disk

bi : data read from disk into memory

bo : data written from memory to disk

All values are in KB.

4. How do buffer and cache differ in Linux?

Answer: Both are memory areas. When the CPU writes data to disk, it first stores it in a buffer, which is later flushed to disk. When reading, data is pre‑loaded into cache for faster access.

5. In the top output, which column shows memory usage?

Answer: The RES column shows physical memory usage; VIRT shows virtual memory; SHR shows shared memory; %MEM shows the percentage of memory used.

6. How to view real‑time and historical network interface traffic?

Install the sysstat package and use sar: sar -n DEV – real‑time (updates every 10 seconds) sar -n DEV 1 10 – 1‑second interval, 10 samples sar -n DEV -f /var/log/sa/sa22 – view logs for a specific day

7. How to list all processes on the system?

Use ps -aux or ps -elf.

8. How to check the status of a process in the STAT column?

S = sleeping, s = session leader, Z = zombie.

9. How to view open ports?

Run netstat -lnp to list listening services.

10. How to view all network connections?

Run netstat -an.

11. How to change the IP address and restart the network interface?

Edit /etc/sysconfig/network-scripts/ifcfg-eth0 (or the appropriate interface file) and then execute ifdown eth0 && ifup eth0 or service network restart.

12. Can a single NIC have multiple IP addresses? How?

Yes. Copy the existing config file to ifcfg-eth0:1, modify DEVICE to eth0:1 and set a new IPADDR, then restart the network service.

13. How to check if a NIC is connected to a switch?

Use mii-tool eth0 or mii-tool eth1.

14. How to view and permanently change the hostname?

View with hostname. Change temporarily with hostname newname. For persistence, edit /etc/sysconfig/network and set HOSTNAME=newname.

15. Which file configures DNS?

Primary file: /etc/resolv.conf. It can also be set in the NIC config file.

16. iptables rule to reject traffic from 192.168.1.101 to local port 80?

iptables -I INPUT -s 192.168.1.101 -p tcp --dport 80 -j REJECT

17. How to save and restore iptables rules?

Save: iptables-save > 1.ipt. Restore:

iptables-restore < 1.ipt

18. How to back up a user's cron jobs?

Copy the user's file from /var/spool/cron/username to a backup directory.

19. What do the first five fields in a crontab entry represent?

Minute, hour, day of month, month, day of week.

20. How to disable unnecessary services?

Use the visual tool ntsysv or the command chkconfig servicename off.

21. How to enable a service (e.g., nginx) only in runlevels 3 and 5?

First disable all levels: chkconfig nginx off. Then enable levels 3 and 5: chkconfig --level 35 nginx on.

22. Difference between rsync -av /dira/ ip:/dirb/ and rsync -av /dira/ ip::dirb ?

The first uses SSH for transport; the second uses the rsync daemon.

23. How to sync symbolic links' target files with rsync?

Add the -L option.

24. Which logs record user login activity?

Authentication attempts: /var/log/secure. Successful logins: /var/log/wtmp.

25. Which command shows hardware or disk errors?

Use dmesg.

26. Change permissions of all .txt files to 777 using xargs and -exec ?

Using xargs: find ./ -type f -name "*.txt" | xargs chmod 777. Using -exec:

find ./ -type f -name "*.txt" -exec chmod 777 {} \;

27. How to keep a long‑running script alive and monitor its output?

Run it inside a screen session.

28. Capture 1000 HTTP packets to 192.168.0.111 and save to 1.cap?

tcpdump -nn -s0 host 192.168.0.111 and port 80 -c 1000 -w 1.cap

29. Exclude all .txt files from rsync?

Use --exclude="*.txt".

30. Skip files that are newer on the destination?

Use the -u or --update option.

31. How to access a website whose domain is not yet resolved?

Add an entry mapping the domain to its IP in /etc/hosts or use curl -x with a proxy.

32. Can one IP map to multiple domains and vice‑versa in /etc/hosts ?

Yes, one IP can have multiple domain names; a single domain cannot map to multiple IPs in this file.

33. Which command shows historical system load (e.g., two days ago)?

sar -q -f /var/log/sa/sa22

(replace the date as needed).

34. How to specify a DNS server for a lookup?

Use dig @DNS_IP domain.com, e.g., dig @8.8.8.8 www.baidu.com.

35. rsync over SSH with a non‑standard port (e.g., 10022)?

rsync -e "ssh -p 10022" ...

or

rsync "--rsh=ssh -p 10022" ...

36. Delete files on the destination that no longer exist on the source?

Add the --delete option.

37. In free output, which value shows truly available memory?

The second line (Mem:) value represents available memory.

38. Troubleshooting a suddenly slow website?

First check system load with w or uptime, then examine CPU and memory usage via top. If normal, analyze network traffic with sar to detect possible attacks, and take appropriate actions such as killing processes or blocking traffic.

39. Required permission for an rsync password file?

Set the file mode to 600 or 400.

Source: Rachy1989, http://rachy.blog.51cto.com