Master Linux Ops: Essential High-Frequency Commands for Daily Production Use

Overview

This article organizes high-frequency Linux operations commands by scenario, providing for each command: purpose, common parameters, a production-ready example, and risk notes. It targets junior ops engineers, mid-level engineers systematizing their command knowledge, and DevOps engineers needing cross-discipline troubleshooting skills.

Command Quick-Reference Index

A table maps 16 categories to core commands:

System Info: uname, hostname, uptime, date, cal, who, w, last Process: ps, top, htop, pidof, pgrep, pkill, kill, pstree, nice, renice, systemctl CPU: top, mpstat, sar -u, vmstat, lscpu, turbostat, perf top Memory: free, vmstat, sar -r, slabtop, smem, pmap, numastat Network: ip, ss, netstat, curl, wget, tcpdump, iftop, nethogs, mtr, traceroute, nc, ethtool, sar -n Disk: df, du, lsblk, blkid, mount, fdisk, parted, iostat, iotop, fuser, lsof File: find, locate, stat, file, tree, ls, chmod, chown, ln, rsync, scp, tar, zip Log: tail, head, less, grep, awk, sed, journalctl, dmesg, logrotate User: useradd, usermod, userdel, passwd, chage, groupadd, id, su, sudo Service: systemctl, journalctl, systemd-analyze Package: yum, dnf, apt, rpm, dpkg Scheduling: crontab, at, flock Performance Analysis: strace, ltrace, perf, bcc, bpftrace Text Processing: grep, awk, sed, xargs, sort, uniq, cut, tr, column Tools: tmux, screen, glances, dstat, nmon,

sysstat

Detailed Command Sections

System Information Commands

Examples include uname -a for kernel/arch, hostnamectl set-hostname for persistent hostname change, uptime load average interpretation (load/CPU cores > 1 = busy), date for timestamp conversion and arithmetic, and w / who / last for login auditing.

Process Commands

Covers ps aux (BSD) vs ps -ef (SysV), sorting by CPU/memory ( ps aux --sort=-%cpu | head), thread view ( ps -eLf), top interactive keys (P/M/T/1/c/V/k/r), htop mouse-driven UI, pidof / pgrep / pkill with warnings on fuzzy matching, kill signals (1=SIGHUP reload, 15=SIGTERM graceful, 9=SIGKILL forced), nice / renice priority ranges (-20 to 19), and systemctl service lifecycle (start/stop/restart/reload/enable/disable/mask/unmask/daemon-reload) with mask warning (creates /dev/null symlink, blocks even manual start).

CPU Commands

lscpu

shows topology (sockets, cores, threads, NUMA nodes). mpstat -P ALL 1 per-CPU breakdown with %usr/%sys/%iowait/%idle/%steal. sar -u 1 5 and historical sar -u -f /var/log/sa/sa13. turbostat --interval 5 reveals actual vs nominal frequency (Avg_MHz vs TSC_MHz). perf top -g and perf record -a -g sleep 10; perf report for profiling; warning: perf record -a heavy on production storage.

Memory Commands

free -h

explains total/used/free/shared/buff/cache/available. /proc/meminfo fields: Dirty, Writeback, AnonPages, Mapped. slabtop for kernel slab allocator leaks. smem -tk uses PSS (proportional set size) for accurate shared-memory accounting. pmap -x <pid> shows process memory mappings; last line gives total. numastat -m diagnoses cross-NUMA access (Numa_Miss, Other_Node).

Network Commands

ip a

, ip link, ip r, ip route get, address/route add/del, link up/down. ss -tunap replaces netstat; filters for listeners ( ss -tlnp), connection counts ( ss -s), state counts ( ss -tan state time-wait | wc -l). curl examples: verbose, POST JSON, headers, rate limiting, proxy, timing with -w and percentile calculation via bash loop. wget for resume, mirror, page save. tcpdump filters (port, host, src/dst, write/read pcap, HTTP/DNS/TCP flags) with sensitive-data warning. iftop -i eth0 real-time bandwidth; nethogs eth0 per-process bandwidth. mtr -r 8.8.8.8 and mtr --tcp for path latency/loss. traceroute -T/-I. nc -zv port test, listener, file transfer, scan. ethtool for driver, ring buffer, statistics, speed/duplex (caution). sar -n DEV/TCP,ETCP 1 and historical.

Disk Commands

df -h/-i/-T/--total

. du -sh /*, du -h --max-depth=1, sorting, exclude, find large files. lsblk -f (fs/UUID), lsblk -d -o NAME,SIZE,MODEL,ROTA,TRAN (physical disk type). mount, remount, NFS mount, umount -f, fuser -m to find holders. iostat -xz 1 extended device stats (r/s, w/s, await, %util). iotop -ao cumulative per-process I/O. fuser -km kills holders (risk). lsof -p <pid>, lsof /path, lsof +D /dir, lsof -i :80.

File Commands

find

with name, type, size, time (mtime/atime/ctime), user, perm, -exec ... {} + vs \;, depth, boolean, prune, printf. locate requires updatedb (heavy IO). stat timestamps. file -i MIME. tree -L 2 -h -I. chmod numeric/symbolic, recursive warning ( chmod -R 777 / disaster). chown user:group, recursive. ln -s (symlink) vs hard link, readlink. rsync -av trailing slash semantics, remote, exclude, -P (partial+progress), --delete (dry-run first), --bwlimit, SSH key. scp -r -l 1000 -i key. tar create/extract/list, gzip/bzip2/xz, -C, exclude. zip -r -x, unzip -l -d.

Log Commands

tail -f

vs tail -F (retry on rotation). less +F for follow. grep with -i, -A/-B/-C context, -v invert, -c count, -n line numbers, -E regex, --include/--exclude-dir, recursive. awk field printing, custom FS (-F), conditions, arithmetic, BEGIN/END, associative arrays, nginx access log IP top. sed s/old/new/g, -i in-place (backup with -i.bak), delete lines, print range, multiple -e, anchor inserts, range extraction.

journalctl -u nginx -f --since "1 hour ago" -p err -k -b --disk-usage --vacuum-time=7d

. dmesg -T -w --level=err,crit | grep -i "out of memory". logrotate -f -d debug.

User & Permission Commands

useradd -m -s /bin/bash

, usermod -aG sudo (append critical), usermod -L lock, userdel -r. passwd, chage -M 90 -d 0 -l. groupadd, gpasswd -a/-d, id / groups. su - loads env, sudo -u user cmd, sudo -l. visudo syntax check; example username ALL=(ALL) NOPASSWD: ALL warning (equivalent to root).

Service Management

Systemd unit template ( Type=simple, Restart=always, RestartSec=5), daemon-reload, enable --now. systemd-analyze, blame, critical-chain, plot > boot.svg.

Package Management

RHEL/CentOS:

yum install/remove/update/search/list/info/provides/clean/makecache/repolist/config-manager --enable epel/versionlock

. Ubuntu/Debian:

apt-get install/remove/purge/update/upgrade/dist-upgrade/cache search/list --installed/file search/mark hold/unhold

. Low-level: rpm -ivh/-e/-Uvh/-qa/-qi/-ql/-qf, dpkg -i/-r/-P/-l/-L/-S.

Scheduled Tasks

crontab -e/-l/-r

(danger: -r deletes entire table), format (min hour day month dow cmd), examples. System directories /etc/cron.*. flock -n /tmp/mytask.lock -c "cmd" prevents concurrent runs. at one-off: echo "cmd" | at 14:30, atq, atrm. systemd-timer unit example with OnCalendar=daily, Persistent=true, systemctl enable --now backup.timer, list-timers.

Performance Analysis

strace -p <pid> -e trace=network -c -t -o file

(production caution: slows process, log explosion). ltrace -p <pid> -l "libssl*". perf (see CPU section). bcc-tools: biolatency, tcpconnect, opensnoop, execsnoop, capable. bpftrace one-liners for openat/execve tracing. Warning: bcc/bpftrace may cause performance jitter.

Text Processing (Three Musketeers +)

xargs -n1 -I{} -P4

for parallel execution. sort -n -rn -k2 -u -h. uniq -c -d -u (requires sorted input). cut -d: -f1, cut -c1-10. tr 'a-z' 'A-Z', tr -d '0-9', tr -s ' '. column -t -s:. paste -d'|'. diff -u, comm -23/-13.

Practical Tools

tmux

session/window/pane keys (Ctrl+b). screen -S/-ls/-r. glances all-in-one, -w web, CSV export. dstat -cdngym 1, --top-cpu --top-io --top-mem. nmon interactive (c/m/d/n/t/h), recording nmon -f -s 5 -c 60 for analyser. sysstat suite: iostat, mpstat, pidstat, sar, sadc, sa1/sa2; enable cron collector */5 * * * * root /usr/lib64/sa/sa1 1 1, systemctl enable sysstat, historical sar -u -f /var/log/sa/sa13.

SSH & Remote

ssh -p 2222 user@host "cmd"

, scp, ssh-keygen -t rsa -b 4096, ssh-copy-id, jump host -J, port forwarding -L/-R/-D (SOCKS). ~/.ssh/config Host alias. ssh-agent, ssh-add -l/-x/-X.

Network Debugging

ping -c5 -w10

, ping6. host, dig +short @8.8.8.8 -x MX +trace, nslookup. telnet cleartext warning; prefer nc -zv.

Ops Troubleshooting Workflows

Slow request: top -c → PID →

ps -p <pid> -o pid,ppid,user,stat,pcpu,pmem,vsz,rss,etime,cmd

→ pidstat -d -p <pid> 1 → lsof -p <pid> → strace -p <pid> -c → pmap -x <pid> → ss -tnp | grep <pid> → tail -F /var/log/app.log.

Port occupancy: ss -tlnp | grep 80 → lsof -i :80 → ps -p 1234 -o cmd → ls -l /proc/1234/cwd.

Large files: df -h → du -sh /* | sort -h | tail → drill down →

find / -type f -size +1G -exec du -h {} \; | sort -h | tail -20

.

CPU spike: top -c → ps aux --sort=-%cpu | head → pidstat -u 1 → top -H -p <pid> → thread hex printf "%x\n" <tid> → jstack <pid> | grep -A 30 "hex" (Java) or perf top -p <pid> -g (C/Go) → strace -p <pid> -c.

Connection counts: ss -s, state breakdown, per-IP, top client IPs, top ports, established count.

Network jitter: ping -c 100, mtr -r -c 100, sar -n TCP,ETCP 1 (retrans/s), ifconfig eth0 dropped, ethtool -g/-S eth0 | grep -i drop.

Memory leak: free -h → ps aux --sort=-%mem | head → loop ps -p <pid> -o rss,vsz → pmap -x <pid> | sort -k2 -nr | head → Java jmap -heap, jstat -gc <pid> 1s → valgrind (dev).

Slow boot: systemd-analyze, blame, critical-chain, journalctl -b.

Dangerous Commands Checklist

Real incident anecdotes and safe alternatives: rm -rf / / rm -rf $VAR/* (unset var) → use trash-cli, ls $VAR/ before delete, restrict path. dd if=/dev/zero of=/dev/sda (whole disk vs partition) → lsblk, fdisk -l, target partition sdb1, count= limit. chmod -R 777 / → limit scope, separate file/dir perms via find -type f -exec chmod 644, find -type d -exec chmod 755. kill -9 mysqld → kill <pid> (SIGTERM), wait 30s, mysql -e "SHUTDOWN", kill -0 test. > /etc/passwd (truncate) → >> append, cp backup, vim edit. history -c erases audit trail → retain history, ship to central log. mkfs.ext4 /dev/sda (whole disk) → lsblk, fdisk -l, target partition. fdisk /dev/sdb write error → backup partition table sfdisk -d /dev/sda > /tmp/sda-part.bak, umount first.

Command History & Audit

history

, !1234, history | grep "rm -rf", export HISTTIMEFORMAT="%Y-%m-%d %H:%M:%S ", central HISTFILE=/var/log/bash_history/$(whoami)_$(date +%Y%m).log. auditd: auditctl -w /etc/passwd -p wa -k passwd_changes, ausearch -k passwd_changes, persistent rules in /etc/audit/rules.d/audit.rules. sudo logs: /var/log/secure (RHEL) or /var/log/auth.log (Debian), grep sudo.

Efficiency Boosters

Bash shortcuts (Ctrl+A/E/U/K/W/R/L/C/D/Z, ↑/↓, Tab, !!, !$, !*, !123). Aliases in ~/.bashrc: ll, la, rm -i (caution in scripts), psg, ports, myip, reload, server shortcuts, dangerous command guards. Functions: bigfiles() (size/count args), kp() interactive kill, sshhost() no-strict-host-key. Prompt PS1 with color and git branch.

Command Combinations

Find empty files find / -type f -empty, delete find /tmp -type f -empty -delete. Batch rename for f in *.txt; do mv "$f" "${f%.txt}.md"; done or rename 's/\.txt$/.md/' *.txt. Git changed files size

git status --porcelain | awk '{print $2}' | xargs -I {} ls -lh {}

. Remote multi-host loop, pssh -h hosts.txt -i "uptime", ansible all -i hosts -m shell -a "uptime". Batch chmod via find, batch tar, batch scp. System info one-liners: cat /etc/os-release, lsb_release -a, uname -a, lscpu | head, free -h, df -h, ip a, uptime, hostnamectl.

Time & Scheduling

time ls

(real/user/sys), /usr/bin/time -v detailed. timeout 10 ping 8.8.8.8, timeout --signal=9 600 long_cmd.

File Transfer & Sync

rsync

deep dive: SSH port -e "ssh -p 2222", multiple --exclude, --exclude-from, --bwlimit=10m, -P, --delete (dry-run -avn), -z compress, -H hard links. scp -r -l 1000 -i key -p.

Disk Management

fdisk -l

, interactive (m/p/n/d/t/w/q). parted /dev/sda print, mklabel gpt, mkpart primary xfs 0% 100%, rm 1, resizepart 1 200GiB. mkfs.ext4/xfs/btrfs with -L label -m 1 -f. mount /dev/sda1 /data, blkid for UUID,

echo "UUID=xxx /data xfs defaults,noatime 0 0" >> /etc/fstab

, mount -a, mount -o remount,rw.

LVM Commands

PV: pvcreate, pvs, pvdisplay. VG: vgcreate, vgextend, vgs, vgdisplay. LV: lvcreate -L 100G -n data-lv data-vg, lvextend -l +100%FREE, lvreduce -L 100G (high risk), lvs, lvdisplay. FS grow: xfs_growfs /data, resize2fs /dev/data-vg/data-lv.

Text Statistics

wc -l/-w/-c/-m

. head/tail -n 10, tail -F. split -l 1000 -b 100m -d -a 3. nl -ba.

Other Utilities

date +%F +%T +"%F %T"

, cal 6 2026. echo -e, printf "%s\n". yes | cmd, yes "no" | cmd. seq 1 10, seq 1 2 10, seq 1 10 | xargs -I {} echo "task {}". bc calculator echo "scale=2; 10/3" | bc. watch -n 1 -d "free -h". man ls, man -k network, man 5 passwd sections.

Final Cheatsheet & Onboarding Checklist

Condensed one-liner per category. 18-item checklist: aliases, HISTTIMEFORMAT, central history, editing keys, dangerous command guards, auditd, sudo logs, SSH config/keys, tmux/screen, editor fluency, monitoring commands memorized, runbook ready, local cheatsheet, tool versions recorded, package mirrors set, aliases synced, output formats memorized, deep understanding of each command.