Linux Commands Every IT Professional Should Know Cold

Not a beginner list. These are the commands that come up in real incidents, slow system diagnosis and network troubleshooting.

Networking

ss -tulpn

Shows all listening TCP/UDP sockets with the process name and PID. Faster than netstat, same output. Run this first when you're looking for what's actually bound to a port.

ip route show

Prints the routing table. Add ip route get 8.8.8.8 to see which interface and gateway handle a specific destination.

tcpdump -i eth0 port 443 -n

Capture HTTPS traffic on eth0. Add -w /tmp/capture.pcap to write to a file for Wireshark analysis. Replace eth0 with any to capture across all interfaces.

Process and Resource Management

ps aux --sort=-%cpu | head -10

Top 10 processes by CPU usage, with full command lines. More useful than top for scripting.

lsof -p PID

Lists every file, socket and device a specific process has open. Useful for finding what a runaway process is doing.

systemd-cgls

Shows the full cgroup tree — which systemd units are running and what processes they contain.

Disk and Filesystem

du -sh /var/log/* | sort -rh | head -20

Top 20 largest items in /var/log by human-readable size. Swap the path to find what's eating space anywhere.

df -hT

Disk usage with filesystem type. The -T flag catches when something is mounted as tmpfs that shouldn't be.

lsblk -o NAME,SIZE,TYPE,MOUNTPOINT,FSTYPE

Block device tree with size, type and where each partition is mounted. Cleaner than fdisk -l for a quick overview.

Log Analysis

journalctl -u nginx.service --since "1 hour ago" -f

Follow logs for a specific systemd service. Replace nginx with any unit name. Add --no-pager to pipe into grep.

grep -i "error\|fail\|crit" /var/log/syslog | tail -50

Pull the last 50 lines containing error-level keywords. Add | sort | uniq -c | sort -rn to count and rank recurring errors.

One-Liners Worth Memorising

# Find files modified in the last 24 hours
find /etc -mtime -1 -type f

# Check which process is using a port
fuser 8080/tcp

# Watch a command output refresh every 2 seconds
watch -n2 'ss -tulpn | grep LISTEN'

# Count open file descriptors per process
lsof | awk '{print $1}' | sort | uniq -c | sort -rn | head -10

The Terminal Setup That Makes All This Faster

A good terminal emulator and shell config saves more time than memorising commands. I use tmux for persistent sessions, zsh with Oh My Zsh, and fzf for history search. If you're still pressing the up arrow to find commands, fzf will change your workflow.

As an Amazon Associate, IT Lad earns from qualifying purchases made through links on this page. Read the full affiliate disclosure.