Linux Cheatsheet¶

A quick-lookup reference for on-call — grouped tables instead of prose. For explanations and worked examples, see Linux & Shell.

🔎 System & Hardware¶

Command	What it shows
`hostnamectl`	Hostname, OS, kernel, virtualization
`uname -a`	Kernel version & architecture
`uptime`	Load average & time since boot
`lscpu`	CPU model, core/thread count
`free -h`	Memory & swap usage
`lsblk`	Block devices & mount points

📊 Processes¶

Command	What it does
`ps aux --sort=-%cpu \\| head`	Top CPU consumers
`ps aux --sort=-%mem \\| head`	Top memory consumers
`top` / `htop`	Live process view
`kill -TERM <pid>`	Graceful stop
`kill -9 <pid>`	Force kill
`pkill -f <pattern>`	Kill by process name/args match
`nice -n 10 <cmd>`	Run with lower priority
`renice -n 5 -p <pid>`	Change priority of a running process

🗂 Disk & Filesystem¶

Command	What it does
`df -hT`	Disk usage by filesystem
`du -sh * \\| sort -h`	Directory sizes, largest last
`find / -xdev -size +200M`	Find large files
`lsof +D /path`	What has files open under a path
`mount \\| column -t`	Mounted filesystems, readable

🌐 Networking¶

Command	What it does
`ip a`	Interfaces & IPs
`ip route`	Routing table
`ss -tulpn`	Listening ports & owning process
`dig +short example.com`	DNS A record lookup
`curl -sS -o /dev/null -w '%{http_code} %{time_total}\n' <url>`	HTTP status + latency, no body
`mtr -rwzbc100 <host>`	Combined ping + traceroute
`tcpdump -i eth0 port 443 -w cap.pcap`	Capture traffic to a file

🔧 systemd Services¶

Command	What it does
`systemctl status <svc>`	Current state
`systemctl restart <svc>`	Restart
`systemctl enable --now <svc>`	Enable + start
`journalctl -u <svc> -n 100 -f`	Tail logs for a unit
`journalctl -p err -b`	Errors since last boot
`systemd-analyze blame`	What's slowing down boot

🧾 Logs & Text¶

Command	What it does
`journalctl -xe`	Recent system logs with context
`tail -f -n 200 app.log`	Follow a log file
`grep -RniE "error\\|fail\\|timeout" /var/log`	Search logs recursively
`awk '{print $1}' access.log \\| sort \\| uniq -c \\| sort -nr \\| head`	Top requesters by IP
`jq '.items[] \\| {name, status}' payload.json`	Pull fields from JSON
`sed -n '100,150p' file`	Print a line range

📦 Packages¶

Debian / UbuntuRHEL / CentOS / RockyAlpine

sudo apt update && sudo apt -y upgrade
sudo apt install -y htop curl jq
apt list --installed | grep <pkg>

sudo dnf update -y
sudo dnf install -y htop curl jq
rpm -qa | grep <pkg>

apk update && apk upgrade
apk add htop curl jq
apk info | grep <pkg>

🔐 Users, SSH & Permissions¶

Command	What it does
`useradd -m -s /bin/bash app`	Create a user with a home dir
`passwd -l app`	Lock a password (force key-only login)
`chmod 640 file` / `chown app:app file`	Permissions / ownership
`getfacl file` / `setfacl -m u:alice:r file`	ACL read / grant
`ssh-keygen -t ed25519 -C "note"`	Generate a keypair
`ssh-copy-id user@host`	Install your public key remotely

🗓 Cron¶

Field order	`min hour day month weekday`
Every day at 03:00	`0 3 * * * /usr/local/bin/backup.sh`
Every 15 minutes	`/15 * * * /usr/local/bin/check.sh`
Every Monday at 09:00	`0 9 * * 1 /usr/local/bin/report.sh`

crontab -e      # edit current user's crontab
crontab -l      # list it

🧯 Incident Triage — Run This First¶

date -Is; uptime
journalctl -u app -n 200 --no-pager
ss -tulpn
df -hT
free -h
curl -sS -m 5 -o /dev/null -w '%{http_code} %{time_total}\n' https://service.health/ready

When in doubt, check disk, memory, and the last 200 log lines — in that order, before anything fancier.