Essential Linux commands cheat sheet
Everything on this sheet ships with a base install of any mainstream distro — no extra packages, no root for the read-only rows. Commands are grouped by the job they do rather than alphabetically, because that is how you reach for them.
Two conventions hold throughout. First, anything that changes the system is prefixed sudo; inventory commands run as your normal user. Second, where Debian/Ubuntu and Fedora/RHEL genuinely differ — package management, mainly — the row labels the family instead of pretending one command fits both.
Files and navigation
| Task | Command | Notes |
|---|---|---|
| Where am I | pwd | prints the absolute working directory |
| Detailed listing incl. hidden files | ls -lah | -l long form, -a dotfiles included, -h human-readable sizes |
| Newest entries last | ls -ltr | long form sorted by modification time, reversed — the log-triage idiom |
| Jump to previous directory | cd - | toggles between the two most recent directories |
| Create nested directories | mkdir -p /srv/app/conf | -p builds missing parents without erroring on existing ones |
| Copy preserving everything | cp -a /opt/app/ /backup/app/ | archive mode: recursive plus permissions, ownership and timestamps |
| Move or rename | mv draft-v1.txt final.txt | same tool does both; overwrites silently — no trash can, no undo |
| Delete, asking per file | rm -ri ./build/ | -r recursive, -i interactive prompt; the polite form of a dangerous command |
| Symlink a binary onto PATH | ln -s /opt/app/bin/app /usr/local/bin/app | argument order: target first, link name second |
| Find files by name | find /etc -name '*.conf' | quote the glob so the shell cannot expand it; -iname ignores case |
| Identify true file type | file export.dat | reads magic bytes, not the filename extension |
Reading files and logs
| Task | Command | Notes |
|---|---|---|
| Dump a whole file | cat setup.env | fine for short files; pipe through it only when concatenating |
| Page through a long file | less /var/log/syslog | space = page down, /pattern = search, F = follow like tail -f, q = quit |
| First lines of a file | head -n 20 app.log | -n sets the count; default is 10 |
| Last lines of a file | tail -n 50 app.log | the end is usually the interesting part of a log |
| Follow a growing log live | tail -f /var/log/syslog | Ctrl+C stops; add -n 0 to start from the very end |
| Compare two versions | diff -u old.conf new.conf | -u unified format — three context lines, patch-compatible output |
Search and reshape text
| Task | Command | Notes |
|---|---|---|
| Find lines containing text | grep "error" app.log | plain substring match, one matching line per hit |
| Case-insensitive with context | grep -inC 2 "timeout" app.log | -i ignore case, -n line numbers, -C 2 two lines either side |
| Search a whole tree | grep -rn "TODO" ./src | -r recursive, -n line numbers; prefix with sudo for system paths |
| Hide comment lines | grep -v '^#' /etc/ssh/sshd_config | -v inverts the match — see only active settings |
| Count matching lines | grep -c "Failed password" /var/log/auth.log | outputs one number, not the lines |
| Extract a delimited field | cut -d: -f1 /etc/passwd | -d sets the delimiter, -f picks the field — usernames here |
| Print chosen columns | awk '{print $1, $NF}' report.txt | $1 first whitespace-separated field, $NF the last |
| Sort numerically, descending | sort -rn sizes.txt | -n numeric, -r reverse; plain sort goes lexicographic |
| Deduplicate after sorting | sort emails.txt | uniq | uniq only collapses adjacent duplicates — sort first, always |
| Top repeated lines | sort access.log | uniq -c | sort -rn | head -n 10 | count occurrences, rank highest-first, take ten |
| Line and word counts | wc -l app.log | -l lines; -w words, -c bytes |
| Replace text in place | sed -i 's|http://example.com|https://example.com|g' index.html | | delimiter sidesteps slashes in URLs; drop -i to preview on stdout |
Archives
| Task | Command | Notes |
|---|---|---|
| Create a .tar.gz | tar czf backup.tar.gz project/ | c create, z gzip, f file; relative paths keep restores portable |
| Extract a .tar.gz | tar xzf backup.tar.gz | extracts into the current directory — check where you are first |
| Extract into a target directory | tar xzf backup.tar.gz -C /tmp/restore | -C changes directory before extracting; target must exist |
| List contents without extracting | tar tzf backup.tar.gz | t list — worth doing before any extract |
| Zip for cross-platform exchange | zip -r site.zip site/ | unzip site.zip -d dest/ on the far end; zip preserves Unix permissions |
Processes
| Task | Command | Notes |
|---|---|---|
| Snapshot all processes | ps aux | a all users, u detailed columns, x daemons without a terminal |
| Find one process | ps aux | grep nginx | grep itself appears in the list — pgrep avoids that noise |
| PIDs plus full command line | pgrep -a sshd | -a lists the complete command, not bare PIDs |
| Terminate politely | kill 4821 | default signal TERM lets the process shut down cleanly |
| Force-kill a stuck PID | kill -9 4821 | SIGKILL cannot be caught — last resort, data loss possible |
| Kill by name or pattern | pkill -f worker.py | -f matches the full command line; check pgrep -f first so you know the blast radius |
| Live process view | top | sorted by CPU by default; M re-sorts by memory, q quits; htop is the friendlier installable cousin |
| Run past logout | nohup ./worker.sh > worker.log 2>&1 & | & backgrounds it, nohup survives the session ending; jobs -l lists, fg %1 brings back |
Packages: apt vs dnf
| Task | Command | Family |
|---|---|---|
| Install a package | sudo apt update && sudo apt install ripgrep | Debian, Ubuntu, Mint |
| Install a package | sudo dnf install ripgrep | Fedora, RHEL 9, Rocky, Alma |
| Check a command exists | command -v docker | both — resolves aliases and PATH order, exit code 1 when absent |
apt separates metadata refresh (apt update) from installation, hence the two-step; dnf refreshes automatically before installing. On Fedora 41+ the same commands route through dnf5 with identical syntax. Search before installing with apt search or dnf search.FAQ
What are the most essential Linux commands?
For daily work: pwd, ls -lah, cd and find to move around; cat, less, head and tail to read; grep, cut, sort, uniq, awk, sed and wc to search and reshape text; tar to compress and extract; ps aux, pgrep, kill and top for processes; apt or dnf to install software. That is the working core this sheet documents — every row runs on any mainstream distro without extra installs.
How do I watch a log file update in real time?
tail -f /var/log/syslog streams new lines as they are appended; Ctrl+C stops. Two refinements: tail -F (capital) keeps following through log rotation, and inside less, pressing Shift+F enables the same live-follow mode while keeping search available.
What is the difference between kill and kill -9?
kill PID sends SIGTERM (signal 15), a polite request the process may handle — flushing buffers, closing connections, removing lock files. kill -9 PID sends SIGKILL, which the kernel enforces without telling the process, so cleanup never happens. Standard practice: send TERM first, wait a few seconds, and only escalate to -9 when the process ignores it.
Should I use tar or zip on Linux?
tar for Linux-native backups and transfers: it preserves permissions, ownership and symlinks, and pairs with compression as .tar.gz (tar czf to create, tar xzf to extract — modern GNU tar even auto-detects compression, so tar xf works for anything). zip remains the right choice when the archive is headed to Windows, since unzip is universal there, though it models Unix permissions less faithfully.
Related tools
- IPv4 subnet calculator — break any CIDR block into network, range, broadcast and usable hosts.
- IP range to CIDR — turn an arbitrary address range into its minimal covering CIDR blocks.
- VLSM calculator — split a block into right-sized subnets by host requirements.