Cheatsheet¶

cp -a src dst              # copy preserving mode, owner, timestamps, links
mv old new                 # rename, or move across directories
rm -rf dir                 # remove a directory tree (no confirmation)
mkdir -p a/b/c             # create parents as needed
ln -s target link          # symbolic link; ln without -s makes a hard link
find /path -type f -mtime +7 -size +100M   # files older than 7 days, over 100 MB
find /path -name '*.log' -delete            # delete matches (test without -delete first)
du -sh /path               # total size of a directory

tar czf out.tgz dir/       # create a gzip archive
tar xzf out.tgz            # extract it
tar tzf out.tgz            # list contents without extracting
rsync -a --delete src/ dst/    # mirror src into dst (trailing slash matters)
rsync -avn src/ host:dst/      # dry run first (-n), then drop -n
scp file host:/path        # copy one file over SSH

useradd -m -s /bin/bash alice      # create with home and shell
usermod -aG wheel alice            # add to a group (-a appends; RHEL admin group)
passwd alice                       # set a password
chage -l alice                     # show password aging
chmod 2775 dir                     # setgid directory for a shared team
chown -R alice:devs dir            # recursive owner and group
setfacl -m u:bob:rwx file          # grant one user access beyond the mode
getfacl file                       # show ACLs

ps aux --sort=-%mem | head         # top memory users
ps -eo pid,ppid,stat,comm          # states and parents
pgrep -a nginx                     # find PIDs by name, with command line
kill -TERM PID                     # ask to stop; kill -KILL only if it will not
pkill -f 'pattern'                 # match against the full command line
nice -n 10 cmd; renice 10 -p PID   # lower priority
strace -f -e trace=open,openat -p PID   # watch a running process's syscalls

systemctl status svc               # state, PID, recent log lines
systemctl enable --now svc         # start now and on boot
systemctl edit svc                 # add an override drop-in
systemctl daemon-reload            # after editing unit files
journalctl -u svc -b               # this boot's logs for one unit
journalctl -p err -b               # errors this boot
journalctl -f                      # follow live

lsblk -f                           # tree of disks with filesystems and UUIDs
blkid                              # UUIDs and types
mount -a                          # mount everything in fstab
findmnt --verify                   # check fstab before trusting it
pvs; vgs; lvs                      # LVM summary
lvextend -r -L +2G vg/lv           # grow a volume and its filesystem
df -h; df -i                       # space, then inodes
lsof +L1                          # deleted-but-open files holding space

ip -br addr                        # addresses, one line per interface
ip route                          # routing table and default gateway
ss -tulpn                         # listening TCP and UDP ports with process
dig +short name; getent hosts name # resolve through DNS, then through nsswitch
ping -c3 host; mtr host            # reachability and per-hop loss
curl -v https://host/             # request with headers and TLS detail
tcpdump -ni eth0 port 443         # capture without name resolution

firewall-cmd --add-service=https --permanent && firewall-cmd --reload   # RHEL
ufw allow 443/tcp                  # Ubuntu
getenforce                        # SELinux mode
restorecon -Rv /path              # reset SELinux labels to policy default
semanage port -a -t http_port_t -p tcp 8080   # allow a service to bind a new port
ausearch -m avc -ts recent        # recent SELinux denials

uptime                            # load average against core count (nproc)
top; then press 1                 # per-core CPU, memory
vmstat 1 5                        # run queue, swap, io, cpu split
free -h                           # judge by 'available', not 'free'
iostat -xz 1                      # per-disk %util and await
sar -q; sar -r                    # historical load and memory

dnf install pkg; dnf remove pkg    # RHEL
apt update && apt install pkg      # Ubuntu
rpm -qf /path/to/file              # which package owns a file (RHEL)
dpkg -S /path/to/file              # which package owns a file (Ubuntu)