The Linux command cheat sheet

Quick reference

Files

$ls -lah
$cd /var/log
$cp -a src/ dst/
$mv old.txt new.txt
$find / -name '*.log' 2>/dev/null

Processes

$ps aux | grep nginx
$top -o %CPU
$kill -TERM <pid>
$systemctl status nginx
$journalctl -u nginx -f

Disk

$df -h
$du -sh /var/log/*
$lsblk -f
$free -h
$mount | column -t

Network

$ss -tlnp
$ip -br addr
$curl -I https://example.com
$dig example.com +short
$tcpdump -i any port 443

Explained

Files. ls -lah gives you the listing you actually want: hidden files, human sizes, permissions. cp -a preserves the things you forget: timestamps, symlinks, ownership. find with -name is still the fastest way to answer "where is that log".

Processes. ps aux | grep is crude and works. top -o %CPU answers "what is eating the box" without a dashboard. systemctl status and journalctl -u are the pair you use on any systemd host, and kill -TERM asks politely before -9 ends the argument.

Disk. df -h shows the filesystem, du -sh shows the folder, and the gap between them is usually a deleted-but-open file. lsblk -f shows what is actually mounted where. free -h is the first thing to check when a process disappears at night.

Network. ss -tlnp shows what is listening, ip -br addr is the short address view, curl -I proves the service answers, dig answers DNS, and tcpdump is the last resort that settles arguments.

In one line

A first look

$uptime; df -h; free -h