Cheat sheet

Linux Commands for DevOps

The commands you actually reach for during deploys and incidents — files, processes, networking, logs, and transfer.

Files & navigation

# Find files by name (case-insensitive)
find /var/log -iname "*.log" -mtime -1

# Find large files (>500MB)
find / -type f -size +500M -exec ls -lh {} \; 2>/dev/null

# Disk usage of a directory, sorted
du -h --max-depth=1 /var | sort -rh | head

# Follow symlinks to the real path
readlink -f /etc/nginx/sites-enabled/app

# Fast directory tree overview
ls -lahtr   # newest last — great for log dirs

Text processing

# Grep with context and line numbers
grep -rn -C3 "connection refused" /var/log/app/

# Only show the match (e.g. extract IPs)
grep -oE "[0-9]{1,3}(\.[0-9]{1,3}){3}" access.log | sort | uniq -c | sort -rn

# In-place replace across files
sed -i 's/old-registry.io/new-registry.io/g' k8s/*.yaml

# Print specific columns
awk '{print $1, $9}' access.log | sort | uniq -c

# JSON logs: pretty-print one line
tail -1 app.log | jq .

Processes & services

# What is eating CPU/memory right now
ps aux --sort=-%cpu | head
ps aux --sort=-%mem | head

# Process tree for a service
pstree -ap $(pgrep -f myapp | head -1)

# Which process holds a file or port
lsof /var/log/app.log
lsof -i :8080

# Service status and recent logs
systemctl status nginx
journalctl -u nginx --since "10 min ago" -f

System resources

# Memory: focus on "available", not "free"
free -h

# Disk space + inodes (full inodes also break writes!)
df -h
df -i

# Load, CPU steal, IO wait at a glance
top -bn1 | head -15
vmstat 1 5

# IO per disk / per process
iostat -xz 1 3
iotop -oPa   # needs root

Networking

# Listening sockets and owning processes
ss -tulpn

# Test TCP connectivity (no telnet needed)
timeout 3 bash -c "</dev/tcp/db.internal/5432" && echo open

# HTTP check with timing breakdown
curl -sS -o /dev/null -w "dns=%{time_namelookup} connect=%{time_connect} ttfb=%{time_starttransfer} total=%{time_total}\n" https://api.example.com/health

# DNS resolution path
dig +short api.example.com
resolvectl status   # which DNS server is actually used

# Capture traffic on a port
tcpdump -i any port 5432 -nn -c 50

Logs & journald

# Boot-time errors
journalctl -p err -b

# Logs for a unit, since a timestamp
journalctl -u kubelet --since "2026-06-11 09:00"

# Kernel messages (OOM kills live here)
dmesg -T | grep -i "killed process"

# Watch multiple logs at once
tail -F /var/log/nginx/{access,error}.log

# Vacuum old journals
journalctl --vacuum-size=500M

Permissions & users

# Effective permissions on a path (each segment matters)
namei -l /var/www/app/shared/uploads

# Change owner recursively
chown -R app:app /opt/app

# Mode bits: rwx = 421
chmod 640 secrets.env     # rw- r-- ---
chmod u+x deploy.sh

# Who am I, and what groups
id
sudo -l    # what can I sudo

# Last logins / current sessions
last -n 10
w

Archives & transfer

# Tarball create / extract (c=create, x=extract)
tar czf logs-$(date +%F).tar.gz /var/log/app/
tar xzf release.tar.gz -C /opt/app

# Rsync: archive mode, show progress, delete extraneous
rsync -avh --delete ./dist/ deploy@web1:/var/www/app/

# Copy through a bastion
scp -o ProxyJump=bastion app.conf web1:/etc/app/

# Download with resume
curl -L -C - -O https://example.com/big.iso

# Checksum verification
sha256sum -c release.tar.gz.sha256

Want the full walkthrough?

These commands are covered in depth in the three-part Linux tutorial series: Beginner, Intermediate, and Advanced.

Networking-specific commands have their own Linux Networking cheat sheet.

About the Linux Commands Cheat Sheet (DevOps)

The commands worth knowing well are not the obscure ones — they are the handful you will use every day for the rest of your career, used properly. Navigating a filesystem, finding a file, following a log, seeing what is consuming resources and what is listening on a port covers the large majority of real work.

The most valuable habit is knowing which tool answers which question. Disk full is a different question from directory large, which is different again from a deleted file still held open by a process — and that last one explains the classic case where usage reports a full disk while the files appear to have been removed.

Permissions are where newcomers lose the most time. The three-triple model of owner, group and other is simple once seen clearly, and the common failure is not permissions on the file itself but on a directory in its path, because traversing a directory requires execute permission on it.

Frequently asked questions

My disk is full but I deleted the files. Why is the space not back?

A process still has the deleted file open, so the kernel keeps the data until that file descriptor closes. List open files and filter for deleted entries to find the culprit — usually a log file removed without restarting the service writing to it. Restarting that process releases the space; truncating the file rather than deleting it avoids the situation.

How do I find what is using a port?

Use the socket statistics tool with the options for listening sockets and process information. This shows which process holds the port, which is what you need when a service will not start because the address is already in use. The older netstat may not be installed on modern minimal images.

What is the difference between the load average and CPU usage?

Load average counts processes that are runnable or in uninterruptible sleep, which includes those waiting on disk. A machine with high load and low CPU is usually blocked on I/O rather than compute. Interpret load relative to core count — a load of 4 on four cores is fully utilised, and on sixteen cores it is quiet.

How do I search inside many files efficiently?

Use grep recursively with the options to exclude directories you do not care about, or a faster modern alternative if available. When looking for files by name or attribute rather than content, use find and let it filter before you process, since piping everything into a filter is far slower on a large tree.

Why does chmod not fix my permission denied error?

The permissions on the file may be fine while a parent directory blocks traversal — reaching a file requires execute permission on every directory in its path. Check the whole path rather than the leaf. On systems with SELinux or AppArmor, the context can also deny access independently of the traditional permission bits.