Linux Commands Cheat Sheet
The Linux commands a server needs most, searchable by task: disk and memory, processes and ports, services and logs, files and permissions, networking, users and packages.
Free · No sign-up · Your inputs stay in your browser
Reference
Linux commands for servers
| Command | Does | Notes |
|---|---|---|
| df -h | Disk space per filesystem | df -i shows inodes, which run out before bytes on a disk of tiny files. |
| du -sh * | sort -h | Size of each item here, sorted | ncdu is the interactive version. |
| free -h | Memory and swap | Look at available, not free: cache counts as available. |
| uptime | Load averages for 1, 5 and 15 minutes | Compare with the core count from nproc. |
| top / htop | Live processes | In top, press M to sort by memory and P by CPU. |
| ps aux --sort=-%mem | head | Biggest memory users | |
| ss -tulpn | Listening ports and the processes behind them | Replaces netstat -tulpn. |
| lsof -i :8080 | What is using a port | |
| journalctl -u nginx -f | Follow a service's log | -p err for errors only, --since '1 hour ago'. |
| systemctl status nginx | Service state and last log lines | restart, reload, enable --now, disable. |
| systemctl list-units --failed | Units that failed | |
| tail -f /var/log/syslog | Follow a log file | tail -F keeps following across log rotation. |
| grep -rn 'pattern' /etc/nginx | Search files recursively with line numbers | -i ignores case, -l lists file names only. |
| find / -xdev -size +500M -type f | Find large files on this filesystem | |
| chmod 640 file / chown www-data:www-data file | Permissions and ownership | -R for recursive; be careful at /. |
| tar -czf backup.tgz dir/ / tar -xzf backup.tgz | Create and extract a gzip tarball | |
| rsync -avz --progress src/ user@host:/dst/ | Copy efficiently, locally or over SSH | Trailing slash on src copies its contents. |
| scp file user@host:/path/ | Copy a file over SSH | rsync is better for anything large or repeated. |
| ssh -L 5433:localhost:5432 user@host | Forward a remote port locally | Reach a database that only listens on localhost. |
| curl -sSI https://example.com | Response headers only | -v shows the TLS handshake and request. |
| dig +short example.com A | Resolve a name | @1.1.1.1 to ask a specific resolver. |
| ip -br addr / ip route | Addresses and routes | Replace ifconfig and route. |
| mtr example.com | Traceroute and ping combined | Shows where packet loss starts. |
| dmesg -T | tail | Kernel messages with times | Where the OOM killer reports what it killed. |
| last -a | head / who | Recent and current logins | |
| crontab -e / crontab -l | Edit or list your cron jobs | sudo crontab -u www-data -l for another user. |
| usermod -aG docker deploy | Add a user to a group | -a is essential: without it the user leaves every other group. |
| sudo -u www-data php artisan ... | Run a command as another user | |
| watch -n 2 'command' | Re-run a command every 2 seconds | |
| nohup cmd > out.log 2>&1 & | Keep a command running after logout | tmux or a systemd unit is better for anything that matters. |
| openssl s_client -connect host:443 -servername host | Inspect a TLS endpoint | |
| timedatectl / hostnamectl | Clock, time zone and host name | timedatectl set-timezone UTC. |
| apt list --upgradable / dnf check-update | Pending package updates |
The commands a server needs most, as on current Debian, Ubuntu and RHEL-family systems with systemd. Prefix with sudo where the target belongs to root. man command, or tldr command for examples, has the rest.
About this tool
Method, assumptions, practical next steps, and limits.
For systemd distributions
The commands match current Debian, Ubuntu, RHEL, Rocky and Alma Linux, which all use systemd and iproute2; older tools such as netstat and ifconfig are replaced by ss and ip. man and tldr pages cover every command in detail; the Linux man-pages project publishes them online.
The order of investigation
When a server misbehaves: uptime for load, free for memory, df for disk, journalctl and dmesg for errors, ss for what is listening, then top or htop for the process responsible. Most incidents show up in the first three.