CentOS Administration Command Reference

A comprehensive cheat‑sheet of the most useful commands you’ll encounter on CentOS (versions 6‑8). Each entry includes a brief description, common options, and practical examples. Use this as a study guide for a practical server‑administration test.

1. File & Directory Management

Command	Description	Full Options	5 Examples
`ls`	List directory contents	-a, --all — do not ignore entries starting with . -A, --almost-all — like -a but exclude . and .. --author — print author of each file -b, --escape — print C-style escapes for nongraphic chars --block-size=SIZE — scale sizes by SIZE -B, --ignore-backups — ignore entries ending with ~ -c — sort/show ctime -C — list entries by columns --color[=WHEN] — colorize output -d, --directory — list directories themselves, not contents -D, --dired — generate output for Emacs dired mode -f — list all entries, disable sorting -F, --classify — append indicator (/=>@\|) to entries --file-type — likewise, except do not append --format=WORD — across/commas/horizontal/long/single-column/verbose/vertical --full-time — like -l with full ISO time -g — like -l but no owner --group-directories-first -G, --no-group — no group in long listing -h, --human-readable — sizes like 1K 234M 2G --si — human-readable using powers of 1000 -H, --dereference-command-line — follow symlinks on cmd line --dereference-command-line-symlink-to-dir --hide=PATTERN — hide entries matching pattern --indicator-style=WORD — none/slash/file-type/classify -i, --inode — print index number of each file -I, --ignore=PATTERN — do not list implied entries matching pattern -k, --kibibytes — use 1024-byte blocks -l — use long listing format -L, --dereference — show info for linked-to file -m — fill width with comma-separated list -n, --numeric-uid-gid — like -l but list UID/GID numbers -N, --literal — print raw entry names -o — like -l but no group info -p, --indicator-style=slash — append / to directories -q, --hide-control-chars — print ? for nongraphic chars --show-control-chars — show as-is -Q, --quote-name — enclose entry names in quotes --quoting-style=WORD -r, --reverse — reverse sort order -R, --recursive — list subdirectories recursively -s, --size — print allocated size of each file -S — sort by file size --sort=WORD — none/size/time/version/extension --time=WORD — access/status/use/birth/creation --time-style=STYLE -t — sort by modification time, newest first -T, --tabsize=COLS -u — sort/show access time -U — do not sort; list in directory order -v — natural sort of version numbers -w, --width=COLS -x — list entries by lines instead of columns -X — sort alphabetically by extension -Z, --context — print security context -1 — list one file per line --help --version	`ls -lha /etc` `ls -lt /var/log \| head -20` `ls -R /etc/sysconfig` `ls --color=auto -F /usr/bin` `ls -la --time-style=full-iso /home`
`cd`	Change directory	cd (bash builtin) — no traditional flags -L — force symbolic-link resolution to follow logical path (default) -P — use physical directory structure, resolve symlinks -e — with -P, exit non-zero if current dir cannot be determined -@ — on supported systems, present extended attributes as directory (macOS-style, rare on CentOS) cd - — go to previous directory ($OLDPWD) cd (no args) — go to $HOME	`cd /var/log` `cd ..` `cd -` `cd ~jdoe` `cd -P /var/www/html`
`pwd`	Print working directory	-L, --logical — print $PWD if it names current directory (default) -P, --physical — print physical directory without symlinks --help --version	`pwd` `pwd -P` `pwd -L` `builtin cd /tmp; pwd` `(cd /var/log && pwd)`
`cp`	Copy files/directories	-a, --archive — same as -dR --preserve=all --attributes-only — do not copy file data, only attributes -b, --backup — make backup of destination --copy-contents — copy contents of special files when recursive -d — same as --no-dereference --preserve=links -f, --force — remove destination and retry if it cannot be opened -i, --interactive — prompt before overwrite -H — follow command-line symlinks -l, --link — hard link instead of copy -L, --dereference — always follow symlinks -n, --no-clobber — never overwrite existing file -P, --no-dereference — never follow symlinks -p — preserve mode, ownership, timestamps --preserve[=ATTR_LIST] --no-preserve=ATTR_LIST --parents — use full source path under destination -r, -R, --recursive — copy directories recursively --reflink[=WHEN] — copy-on-write clone if supported --remove-destination — remove destination before creating --sparse=WHEN — control sparse-file handling --strip-trailing-slashes -s, --symbolic-link — make symlinks instead of copying -S, --suffix=SUFFIX — override backup suffix -t, --target-directory=DIR -T, --no-target-directory — treat DEST as normal file -u, --update — copy only when source is newer -v, --verbose — explain what is being done -x, --one-file-system — stay on this filesystem -Z, --context — set SELinux context to default type --help --version	`cp -r /home/user/docs /backup/` `cp -av /etc/httpd /root/httpd.bak` `cp -u src/*.conf /etc/` `cp --parents etc/hosts /backup/` `cp -p important.conf important.conf.orig`
`mv`	Move/rename files or directories	-b, --backup[=CONTROL] — make backup of each existing destination -f, --force — overwrite without prompting -i, --interactive — prompt before overwrite -n, --no-clobber — do not overwrite existing file --strip-trailing-slashes -S, --suffix=SUFFIX -t, --target-directory=DIR -T, --no-target-directory -u, --update — move only when source newer -v, --verbose -Z, --context --help --version	`mv oldname.txt newname.txt` `mv -v /tmp/*.log /var/log/archive/` `mv -n report.docx ~/Documents/` `mv -i config.yml config.yml.bak` `mv -t /backup/ file1 file2 file3`
`rm`	Remove files/directories	-f, --force — ignore nonexistent files, never prompt -i — prompt before every removal -I — prompt once before removing more than 3 files or recursively --interactive[=WHEN] --one-file-system — stay on this filesystem when removing recursively --no-preserve-root --preserve-root[=all] -r, -R, --recursive — remove directories recursively -d, --dir — remove empty directories -v, --verbose --help --version	`rm -rf /tmp/old` `rm -i important.conf` `rm -rv /var/cache/yum/` `rm --preserve-root -rf /` `rm -f /tmp/lockfile`
`mkdir`	Make directories	-m, --mode=MODE — set file mode (as chmod) -p, --parents — create parent dirs as needed, no error if existing -v, --verbose — print message for each created dir -Z — set SELinux context --context[=CTX] --help --version	`mkdir -p /srv/www/html` `mkdir -m 700 ~/.ssh` `mkdir -v /opt/app/{bin,logs,conf}` `mkdir -p /backup/2026/{jan,feb,mar}` `mkdir newproject`
`touch`	Create empty file or update timestamp	-a — change access time only -c, --no-create — do not create any file -d, --date=STRING — parse STRING and use instead of current time -f — ignored (compat) -h, --no-dereference — affect symlink instead of referenced file -m — change modification time only -r, --reference=FILE — use this file's times instead of current -t STAMP — use [[CC]YY]MMDDhhmm[.ss] --time=WORD — access/atime/use, modify/mtime --help --version	`touch /var/log/myapp.log` `touch -t 202601010000 /tmp/marker` `touch -r file1 file2` `touch -a onlyatime.txt` `touch -c maybe-exists.txt`
`cat`	Concatenate and display files	-A, --show-all — equivalent to -vET -b, --number-nonblank — number nonempty output lines -e — equivalent to -vE -E, --show-ends — display $ at end of each line -n, --number — number all output lines -s, --squeeze-blank — suppress repeated empty lines -t — equivalent to -vT -T, --show-tabs — display TAB as ^I -u — ignored (compat) -v, --show-nonprinting — use ^ and M- notation, except LFD/TAB --help --version	`cat /etc/passwd` `cat -n /etc/fstab` `cat file1 file2 > combined.txt` `cat -A script.sh` `cat << EOF > note.txt`
`less`	Page-wise file viewer (forward/back)	-N — show line numbers -M — verbose prompt with position percentage -S — chop long lines instead of wrapping -X — do not clear screen on exit -F — quit if entire file fits on one screen -i — case-insensitive search unless pattern has uppercase -R — output raw ANSI color escapes +F — like tail -f, follow file growth -p PATTERN — start at first match of pattern --help --version	`less /var/log/messages` `less -N /etc/httpd/conf/httpd.conf` `less +F /var/log/messages` `less -S wide_report.csv` `less -i /var/log/secure`
`more`	Simple page-wise viewer	-d — display helpful prompts -f — count logical lines rather than screen lines -l — do not pause after form-feed -p — do not scroll, clear and display -s — squeeze multiple blank lines -u — suppress underlining -NUM — set screen size to NUM lines +NUM — start at line NUM +/PATTERN — start at first match --help --version	`more /etc/hosts` `more +50 /var/log/dmesg` `more -s /var/log/cron` `more +/error /var/log/messages` `more -d /etc/services`
`head`	Show first N lines of a file	-c, --bytes=NUM — print first NUM bytes -n, --lines=NUM — print first NUM lines (default 10) -q, --quiet, --silent — never print filename headers -v, --verbose — always print filename headers -z, --zero-terminated — line delimiter is NUL --help --version	`head -20 /var/log/secure` `head -c 500 bigfile.bin` `head -q -n 5 *.log` `head -v file1 file2` `head -n -5 file.txt (all but last 5)`
`tail`	Show last N lines of a file; follow live output	-c, --bytes=NUM -f, --follow[=name\|descriptor] — output appended data as file grows -F — like -f but also retry if file becomes inaccessible/renamed -n, --lines=NUM (default 10) --pid=PID — with -f, terminate after process PID dies -q, --quiet, --silent --retry — keep trying to open file if inaccessible -s, --sleep-interval=N — seconds between iterations with -f -v, --verbose -z, --zero-terminated --help --version	`tail -f /var/log/httpd/access_log` `tail -n 50 /var/log/messages` `tail -F -n0 /var/log/app.log` `tail -f --pid=1234 /var/log/proc.log` `tail -c 1K bigfile.bin`
`grep`	Search text using patterns	-E, --extended-regexp -F, --fixed-strings -G, --basic-regexp (default) -P, --perl-regexp -e PATTERN, --regexp=PATTERN -f FILE, --file=FILE — patterns from file -i, --ignore-case --no-ignore-case -v, --invert-match -w, --word-regexp -x, --line-regexp -z, --null-data -c, --count --color[=WHEN] -L, --files-without-match -l, --files-with-matches -m NUM, --max-count=NUM -o, --only-matching -q, --quiet, --silent -s, --no-messages -b, --byte-offset -H, --with-filename -h, --no-filename --label=LABEL -n, --line-number -T, --initial-tab -u, --unix-byte-offsets -Z, --null -A NUM, --after-context=NUM -B NUM, --before-context=NUM -C NUM, --context=NUM -a, --text --binary-files=TYPE -I — ignore binary files -d ACTION, --directories=ACTION -D ACTION, --devices=ACTION -r, -R, --recursive --include=GLOB --exclude=GLOB --exclude-from=FILE --exclude-dir=DIR -U, --binary -Z, --decompress (zgrep) --help --version	`grep -i "error" /var/log/*` `grep -rn "TODO" /opt/app/src` `grep -v "^#" /etc/fstab` `grep -E "fail\|error" /var/log/secure` `grep -c "GET" access.log`
`find`	Locate files/directories	-name PATTERN — match filename (case sensitive) -iname PATTERN — case-insensitive name match -type f/d/l/b/c/p/s — file type -size N[ckMG] — file size -mtime N — modified N*24h ago -mmin N — modified N minutes ago -atime N / -amin N — access time -ctime N / -cmin N — change time -newer FILE — modified more recently than FILE -user NAME / -group NAME — owner/group -perm MODE — permission match -empty — empty files/dirs -maxdepth N / -mindepth N -exec CMD {} \; / -exec CMD {} + -delete — delete matched files -print / -print0 -prune — do not descend into directory -not / ! — negate -a / -and, -o / -or — logical combinators -inum N — match inode number -links N — match hard-link count -path PATTERN / -ipath -regex PATTERN / -iregex -samefile FILE -xdev — do not cross filesystem boundaries --help --version	`find /var -type f -name ".log" -mtime +7` `find / -perm -4000 -type f 2>/dev/null` `find /tmp -empty -delete` `find /home -user jdoe -size +100M` `find . -name ".tmp" -exec rm {} \;`
`which`	Show full path of executable	-a — print all matching executables in PATH, not just first --skip-alias — ignore alias definitions --skip-functions — ignore shell function definitions --skip-dot — skip PATH dirs starting with . --skip-tilde — skip PATH dirs starting with ~ --show-dot — print dot in place of PATH dir --show-tilde — output ~ instead of $HOME --tty-only — stop processing after first non-tty option --version — print version --help	`which ssh` `which -a python3` `which sshd sshd_config` `which -a vim` `which nonexistentcmd; echo $?`
`whereis`	Locate binary, source, and manual page files	-b — search binaries only -m — search manuals only -s — search sources only -u — search for unusual entries (missing one category) -l — list directories whereis searches -B DIRS — limit binary search to DIRS -M DIRS — limit manual search to DIRS -S DIRS — limit source search to DIRS -f — terminate options list before filenames	`whereis bash` `whereis -b python3` `whereis -m gzip` `whereis -u *` `whereis -l`
`man`	Display manual page	-k, --apropos — search short descriptions (like apropos) -f, --whatis — display short description (like whatis) -a — display all matching manual pages -w — print location of manual page file(s) -M PATH — set search path for manual pages -S LIST, --sections=LIST — restrict sections searched -s SECTION — like -S -P PAGER — specify pager to use -L LOCALE — specify locale -C FILE — use FILE as configuration file --help --version	`man iptables` `man 5 passwd` `man -k network` `man -f ls` `man -w bash`
`info`	Display GNU info documentation	-f, --file=FILE — specify Info file to visit -n, --node=NODENAME — specify starting node -o, --output=FILE — output selected nodes to FILE --subnodes — recursively output subnode content -w, --where, --location — print physical location of node --apropos=STRING — look up STRING in indices -d, --directory=DIR — add DIR to Info search path --usage — show usage message --vi-keys — use vi-like key bindings --help --version	`info coreutils` `info -k printf` `info bash` `info -f coreutils -n "ls invocation"` `info --usage tar`
`echo`	Print text to standard output	-n do not output trailing newline -e enable interpretation of backslash escapes (\n, \t) -E disable backslash escapes (default)	`echo "Hello World"` `echo -n "no newline"` `echo -e "line1\nline2"` `echo "$HOME"` `echo "Status: $?"`
`printf`	Formatted output	%s string %d decimal integer %f floating point %x hexadecimal %q shell-quoted string \n / \t escape sequences in format string	`printf "%s\n" "hello"` `printf "%d items\n" 5` `printf "%-10s%5d\n" "name" 42` `printf "%x\n" 255` `printf "%.2f\n" 3.14159`
`dirname / basename`	Extract path components	dirname: -z, --zero — end each output line with NUL basename: -a, --multiple — support multiple arguments basename: -s, --suffix=SUFFIX — remove trailing SUFFIX basename: -z, --zero — end each output line with NUL --help / --version (both commands)	`basename /etc/passwd` `dirname /var/log/httpd/access_log` `basename -s .txt notes.txt` `basename -a *.conf` `dirname "$0"`

2. System Information & Monitoring

Command	Description	Full Options	5 Examples
`uname`	Kernel & system info	-a all information -s kernel name -n hostname -r kernel release -v kernel version -m machine hardware -p processor type -i hardware platform -o operating system	`uname -r` `uname -a` `uname -m` `uname -s` `uname -o`
`hostname`	Show/set system hostname	status show current settings set-hostname NAME set-icon-name NAME set-chassis TYPE set-deployment ENV set-location LOC --static / --transient / --pretty scope	`hostnamectl status` `hostnamectl set-hostname web01` `hostnamectl set-hostname web01 --pretty` `hostnamectl set-chassis server` `hostnamectl set-deployment production`
`hostnamectl`	Control hostname (systemd)	status show current settings set-hostname NAME set-icon-name NAME set-chassis TYPE set-deployment ENV set-location LOC --static / --transient / --pretty scope	`hostnamectl status` `hostnamectl set-hostname web01` `hostnamectl set-hostname web01 --pretty` `hostnamectl set-chassis server` `hostnamectl set-deployment production`
`uptime`	How long system has been running	-p pretty format -s since (boot time) -V version	`uptime` `uptime -p` `uptime -s` `watch uptime` `uptime \| awk -F"," "{print \$1}"`
`who`	Who is logged in	-a all information -b time of last boot -r current runlevel -q count of users -H print column headers -u show idle time	`who` `who -a` `who -b` `who -q` `who -u`
`w`	Who + what they are doing	-h no header -s short format -f show/hide from field -u ignore idle time	`w` `w -h` `w jdoe` `w -s` `w -u`
`last`	Show last logins	-n NUM limit lines -f FILE alternate wtmp file -a display hostname last -x show shutdown/runlevel -t YYYYMMDDHHMMSS show state at time	`last -n 10` `last reboot` `last -a` `last jdoe` `last -x`
`lastlog`	Last login of all users	-u USER show one user -t DAYS show logins within DAYS -b DAYS show logins before DAYS -C clear entry (with -u)	`lastlog` `lastlog -u jdoe` `lastlog -t 30` `lastlog -b 90` `lastlog -u root`
`df`	Disk space usage	-h human-readable -T show fs type -i inode usage -a all filesystems --total grand total -x TYPE exclude fs type -t TYPE limit to fs type	`df -hT` `df -i` `df --total` `df -x tmpfs` `df -h /var`
`du`	Estimate file space usage	-h human-readable -s summary only -c grand total -a all files not just dirs --max-depth=N limit depth -x stay on one filesystem	`du -sh /var/` `du -c --max-depth=1 /home` `du -a /etc \| sort -rh \| head` `du -sh --exclude=".log" /opt` `du -x -sh /`
`free`	Memory usage	-h human-readable -m megabytes -g gigabytes -s SECONDS continuous update -t show totals line -w wide (separate buffers/cache)	`free -h` `free -m` `free -s 2` `free -t` `free -h -w`
`top`	Dynamic process viewer	-d SECONDS refresh delay -n NUM number of iterations -b batch mode -u USER filter by user -p PID monitor specific PIDs -o FIELD sort by field	`top` `top -d 5` `top -b -n 1 > /tmp/top.log` `top -u nginx` `top -p 1234,5678`
`htop`	Interactive process viewer (if installed)	-d DELAY update delay (tenths of sec) -u USER filter by user -p PID monitor specific PIDs -s SORTCOL sort column -C no-color mode	`htop` `htop -u nginx` `htop -d 10` `htop -p 1234` `htop -C`
`ps`	Snapshot of processes	-e all processes -f full format -u USER by user -aux BSD style all/user/extended -eo FORMAT custom columns --forest tree view -C NAME by command name	`ps -ef` `ps aux \| grep httpd` `ps -eo pid,ppid,cmd,%mem,%cpu --sort=-%cpu` `ps -u nginx` `ps --forest -ef`
`pstree`	Tree view of processes	-p show PIDs -u show uid transitions -a show command-line args -h highlight current process ancestry	`pstree -p` `pstree -up jdoe` `pstree -a` `pstree -h` `pstree systemd`
`pgrep / pkill`	Find/kill processes by name	-l list name with PID -u USER match effective user -f match full cmdline -x exact match -n newest matching -o oldest matching	`pgrep -l sshd` `pgrep -u nginx` `pgrep -f "java -jar app"` `pgrep -n httpd` `pgrep -x cron`
`kill / killall`	Send signal to PID/name	-SIGNAL or -s SIGNAL name/number -l list signal names -9 SIGKILL -15 SIGTERM (default) -1 SIGHUP	`kill -15 $(pgrep httpd)` `kill -9 1234` `kill -HUP $(cat /var/run/nginx.pid)` `kill -l` `kill %1`
`nice / renice`	Set/adjust process priority	-n ADJUSTMENT set niceness (-20 highest to 19 lowest priority) --help --version	`nice -n 10 command` `nice -n -5 sudo make` `nice --adjustment=15 backup.sh` `nice tar czf a.tgz /data` `nice -19 find / -name "*.tmp"`
`ionice`	Set I/O scheduling class/priority	-c CLASS 1=realtime 2=best-effort 3=idle -n LEVEL priority 0-7 (with class 1/2) -p PID apply to existing process -t ignore failure to set priority	`ionice -c2 -n7 dd if=/dev/zero of=/tmp/test bs=1M count=100` `ionice -c3 rsync -a /src /dst` `ionice -p 4321 -c1 -n0` `ionice -c2 -n0 backup.sh` `ionice -t -c3 updatedb`
`vmstat`	Virtual memory statistics	delay [count] -a active/inactive memory -s table of event counters -d disk statistics -D disk table summary -w wide output -t timestamp	`vmstat 1 5` `vmstat -a 2` `vmstat -s` `vmstat -d` `vmstat -t 1 3`
`iostat`	CPU & I/O statistics	-x extended statistics -m display in MB/s -k display in KB/s (default) -c CPU only -d device only -N LVM info -p [DEVICE] per-partition stats interval [count]	`iostat -xz 1 3` `iostat -m 2 5` `iostat -d /dev/sda 1` `iostat -c` `iostat -p sda 1`
`mpstat`	Per-CPU utilization	-P ALL all CPUs / N specific CPU interval [count] -u CPU utilization (default) -I info about interrupts	`mpstat -P ALL 1` `mpstat 2 5` `mpstat -P 0 1` `mpstat -u` `mpstat -I SUM 1 2`
`pidstat`	Per-process statistics	-r memory -d I/O -u CPU (default) -p PID specific process -w context switches interval [count]	`pidstat -d 1` `pidstat -r -p 1234` `pidstat -u 2 5` `pidstat -w` `pidstat -p ALL 1`
`sar`	Collect/report system activity	-u CPU -r memory -n DEV network -b I/O and transfer rate -d block devices -q load average -A all data -f FILE read from file	`sar -u 1 3` `sar -r 2 5` `sar -n DEV 1` `sar -f /var/log/sa/sa15` `sar -q`
`dmesg`	Kernel ring buffer	-T human-readable timestamps -n LEVEL set console log level -c clear buffer after printing -l LEVEL filter by level -w follow new messages	`dmesg -T \| tail -50` `dmesg -c` `dmesg -l err,warn` `dmesg -w` `dmesg -T \| grep -i eth0`
`journalctl`	Query systemd journal	-b boot (current or -b -1 previous) -u UNIT filter by systemd unit -f follow -n NUM last N lines -p PRIORITY filter level --since / --until time range -k kernel messages only -r reverse order -o FORMAT output format (json, cat, short) --disk-usage --vacuum-time=TIME / --vacuum-size=SIZE	`journalctl -u nginx -f` `journalctl -b -1` `journalctl --since "1 hour ago"` `journalctl -p err -b` `journalctl --vacuum-time=2weeks`
`lsblk`	List block devices	-f show filesystem info -a show empty devices too -p full device paths -o COLUMNS custom columns -d no partitions, only devices	`lsblk -f` `lsblk -o NAME,SIZE,FSTYPE,MOUNTPOINT` `lsblk -a` `lsblk -p` `lsblk -d`
`blkid`	Show block device attributes (UUID, label, fstype)	-o FORMAT output format (value, device, list) -s TAG show only given tag -U UUID / -L LABEL find device by uuid/label	`blkid` `blkid /dev/sda1` `blkid -s UUID /dev/sda1` `blkid -U` `blkid -o list`
`fdisk`	Partition table manipulator (MBR)	-l list partition tables -u unit display (cylinders/sectors) -c compatible mode off device to enter interactive editor	`fdisk -l` `fdisk /dev/sdb` `fdisk -l /dev/sda` `fdisk -u /dev/sdb` `echo -e "n\np\n\n\n\nw" \| fdisk /dev/sdb`
`parted`	Partition editor (MBR/GPT)	-l list all disks -s script mode (non-interactive) print / mklabel / mkpart / rm subcommands align-check resizepart	`parted -l` `parted /dev/sdb print` `parted -s /dev/sdb mklabel gpt` `parted -s /dev/sdb mkpart primary ext4 0% 100%` `parted /dev/sdb resizepart 1 100%`
`mkfs`	Create a filesystem	-t TYPE filesystem type mkfs.ext4 / mkfs.xfs / mkfs.vfat variants -L LABEL volume label -n dry run (some variants) -F force even if not a block device	`mkfs -t ext4 /dev/sdb1` `mkfs.xfs -f /dev/sdb1` `mkfs.ext4 -L data /dev/sdc1` `mkfs.vfat /dev/sdd1` `mkfs -t ext4 -F /dev/loop0`
`fsck`	Check/repair filesystem	-A check all in fstab -t TYPE filesystem type -y assume yes to all prompts -f force check even if clean -n assume no, read-only check	`fsck /dev/sdb1` `fsck -y /dev/sdb1` `fsck -A` `fsck -f /dev/sda1` `fsck -n /dev/sdc1`
`mount`	Mount a filesystem	-a mount all in fstab -t TYPE filesystem type -o OPTIONS mount options (ro,rw,noexec...) -r read-only -w read-write -B bind mount -L LABEL / -U UUID mount by label/uuid --make-shared/private/slave/unbindable propagation	`mount -a` `mount -t nfs server:/export /mnt/nfs` `mount -o remount,rw /` `mount -U /mnt/data` `mount --bind /data /var/www/data`
`umount`	Unmount a filesystem	-a unmount all -f force unmount -l lazy unmount -r remount read-only if busy -t TYPE limit to fs type	`umount /mnt/usb` `umount -l /mnt/nfs` `umount -f /mnt/stuck` `umount -a -t nfs` `umount /dev/sdb1`
`findmnt`	Find/list mounted filesystems	-l list format -D disk usage -t TYPE filter by fs type -S SOURCE find by device -T TARGET find by mountpoint --json	`findmnt /` `findmnt -t ext4` `findmnt -S /dev/sda1` `findmnt --json /home` `findmnt -D`
`df`	Disk free (see above)	-h human-readable -T show fs type -i inode usage -a all filesystems --total grand total -x TYPE exclude fs type -t TYPE limit to fs type	`df -hT` `df -i` `df --total` `df -x tmpfs` `df -h /var`
`hdparm`	Get/set SATA/PATA disk parameters	-I detailed device info -i identify device -t timing buffered reads -T timing cached reads -W set write-caching (0/1)	`hdparm -I /dev/sda` `hdparm -t /dev/sda` `hdparm -T /dev/sda` `hdparm -W1 /dev/sda` `hdparm -i /dev/sdb`
`smartctl`	SMART disk health monitoring	-a all SMART info -H health status -t TYPE run self-test (short/long) -i identify info --scan list devices	`smartctl -a /dev/sda` `smartctl -H /dev/sda` `smartctl -t short /dev/sda` `smartctl --scan` `smartctl -i /dev/sdb`
`lspci`	List PCI devices	-v verbose -vv very verbose -k show kernel driver in use -nn show numeric IDs and names -t tree view	`lspci` `lspci -k` `lspci -nn` `lspci -vv -s 00:1f.2` `lspci -t`
`lsusb`	List USB devices	-v verbose -t tree view -d VID:PID filter by device ID -s BUS:DEV filter by bus/device	`lsusb` `lsusb -v` `lsusb -t` `lsusb -d 046d:c52b` `lsusb -s 001:004`
`lshw`	List detailed hardware configuration	-short summary format -C CLASS filter by class (network, disk, memory) -html output as html -json output as json -sanitize hide serials	`lshw -short` `lshw -C network` `lshw -html > hw.html` `lshw -json` `sudo lshw -C disk`
`dmidecode`	Dump DMI/SMBIOS hardware table	-t TYPE filter by type (e.g. memory, bios, system) -s KEYWORD show single value -q quiet, less verbose --type list valid type names	`dmidecode -t memory` `dmidecode -s system-product-name` `dmidecode -t bios` `dmidecode -q` `dmidecode -t processor`
`hostnamectl`	Control hostname (see above)	status show current settings set-hostname NAME set-icon-name NAME set-chassis TYPE set-deployment ENV set-location LOC --static / --transient / --pretty scope	`hostnamectl status` `hostnamectl set-hostname web01` `hostnamectl set-hostname web01 --pretty` `hostnamectl set-chassis server` `hostnamectl set-deployment production`
`timedatectl`	Control system time/date/timezone	status show current settings set-time TIME set-timezone ZONE list-timezones set-ntp true/false show all properties	`timedatectl status` `timedatectl set-timezone Asia/Singapore` `timedatectl set-ntp true` `timedatectl list-timezones` `timedatectl set-time "2026-07-27 09:00:00"`
`clock`	Query/set hardware clock (see hwclock)	-r read hardware clock -w write system time to hardware clock -s set system time from hw clock -u treat hw clock as UTC	`clock -r` `clock -w` `sudo hwclock --systohc` `hwclock -s` `hwclock -u -w`
`date`	Print/set system date	-d STRING display arbitrary date -s STRING set system date/time -u UTC/GMT time +FORMAT custom output format -R RFC-2822 format -I[=TIMESPEC] ISO 8601 format -r FILE last modification of FILE	`date` `date +"%Y-%m-%d %H:%M:%S"` `date -d "next friday"` `sudo date -s "2026-07-27 10:00:00"` `date -u`

3. User & Group Management

Command	Description	Full Options	5 Examples
`useradd`	Create new user	-m create home directory -d DIR home directory path -s SHELL login shell -g GROUP primary group -G GROUPS secondary groups -c COMMENT gecos field -e DATE account expiry -u UID specify uid -r create system account	`useradd -m -s /bin/bash jdoe` `useradd -m -G wheel,devs -s /bin/bash admin1` `useradd -r -s /sbin/nologin svcacct` `useradd -e 2026-12-31 tempuser` `useradd -u 5001 -d /opt/app appuser`
`usermod`	Modify existing user	-l NEWNAME rename login -d DIR -m move home directory -s SHELL change shell -G GROUPS set supplementary groups -aG GROUP append to group (use with -G) -L lock account -U unlock account -e DATE set expiry -c COMMENT change gecos	`usermod -aG wheel jdoe` `usermod -s /bin/zsh jdoe` `usermod -L jdoe` `usermod -d /home/newloc -m jdoe` `usermod -e 2026-12-31 jdoe`
`userdel`	Delete user	-r remove home directory and mail spool too -f force removal even if user logged in / owns files -Z remove SELinux user mapping	`userdel jdoe` `userdel -r jdoe` `userdel -rf tempuser` `userdel -Z jdoe` `userdel svcacct`
`groupadd`	Create new group	-g GID specify GID -r create system group -f exit success if group exists	`groupadd devs` `groupadd -g 2001 developers` `groupadd -r svcgroup` `groupadd -f existinggroup` `groupadd -g 3000 finance`
`groupmod`	Modify group	-n NEWNAME rename group -g GID change GID	`groupmod -n devteam devs` `groupmod -g 3001 finance` `groupmod -n staff employees` `groupmod -g 5000 admins` `groupmod -n sysops ops`
`groupdel`	Delete group	-f force removal even if primary group of a user	`groupdel oldgroup` `groupdel -f devs` `groupdel testgroup` `groupdel finance` `groupdel legacy`
`id`	Show UID/GID/groups	-u print effective UID -g print effective GID -G print all group IDs -n print name instead of number -nu / -ng / -nG combine name+category -Z print SELinux context	`id jdoe` `id -u` `id -Gn jdoe` `id -Z` `id -un`
`whoami`	Show current effective user	(no options besides --help/--version)	`whoami` `echo "Current user: $(whoami)"` `whoami --version` `sudo whoami` `ssh host whoami`
`passwd`	Change password	-l lock account -u unlock account -d delete password (no password) -e expire immediately, force change -S show status -n MINDAYS minimum age -x MAXDAYS maximum age -w WARNDAYS warning period	`passwd jdoe` `passwd -l jdoe` `passwd -e jdoe` `passwd -S jdoe` `passwd -x 90 -w 7 jdoe`
`chage`	Change password expiry info	-l list expiry info -m MIN minimum days between changes -M MAX maximum password age -W WARN warning days before expiry -I INACTIVE days after expiry to disable -E EXPIRE account expire date -d LASTDAY set last change date	`chage -l jdoe` `chage -M 90 jdoe` `chage -W 7 -I 14 jdoe` `chage -E 2026-12-31 jdoe` `chage -d 0 jdoe (force change at next login)`
`gpasswd`	Administer /etc/group	-a USER add to group -d USER delete from group -A USER set administrators -M USER set members list -r remove group password	`gpasswd -a jdoe wheel` `gpasswd -d jdoe wheel` `gpasswd -A admin1,admin2 devteam` `gpasswd -M user1,user2 devteam` `gpasswd -r devteam`
`su`	Switch user	- (dash) start login shell -c COMMAND run single command -s SHELL specify shell -l same as - -p preserve environment	`su - root` `su -c "systemctl restart nginx" root` `su -s /bin/bash jdoe` `su -l postgres` `su -p www-data`
`sudo`	Execute command as another user	-u USER run as USER -l, -ll list allowed/denied commands -i simulate login shell -s run shell -k invalidate cached credentials -v refresh cached credentials -e edit file as target user	`sudo -u nginx systemctl restart nginx` `sudo -l` `sudo -i` `sudo -k` `sudo -e /etc/hosts`
`visudo`	Safely edit sudoers file	-c check sudoers syntax without editing -f FILE edit alternate file -s strict syntax checking	`visudo` `visudo -c` `visudo -f /etc/sudoers.d/custom` `visudo -s` `sudo visudo -c`
`chsh`	Change login shell	-s SHELL set shell -l list available shells	`chsh -s /bin/zsh jdoe` `chsh -l` `chsh -s /bin/bash` `chsh jdoe (interactive)` `chsh -s $(which fish)`
`chfn`	Change finger information	-f NAME full name -o OFFICE office -p PHONE office phone -h PHONE home phone	`chfn jdoe` `chfn -f "John Doe" jdoe` `chfn -o "Room 101" jdoe` `chfn -p 5551234 jdoe` `chfn -h 5555678 jdoe`
`groups`	List group membership	(no options; optional USER argument)	`groups jdoe` `groups` `groups root` `groups $(whoami)` `groups www-data`
`newgrp`	Log in to a new group (changes primary GID)	GROUP switch primary group for session - (dash) start login shell with new group	`newgrp developers` `newgrp -` `newgrp wheel` `newgrp finance` `newgrp - devs`
`logout`	Exit login shell	(shell builtin; no options — exits login shell)	`logout` `exit (equivalent in non-login shell)` `logout (from ssh session)` `logout (from tty console)` `CTRL-D (EOF equivalent)`

4. Permissions & Ownership

Command	Description	Full Options	5 Examples
`chmod`	Change file mode bits	u/g/o/a +/-/= rwx symbolic mode numeric mode e.g. 750 -R recursive --reference=FILE copy mode from file -v verbose -c report changes only -f suppress errors	`chmod 750 /var/www/html` `chmod -R g+rwX /shared` `chmod u+x deploy.sh` `chmod --reference=orig.conf new.conf` `chmod -c 644 *.txt`
`chown`	Change file owner/group	-R recursive --reference=FILE copy owner from file -v verbose -c report changes only -f suppress error messages -h affect symlinks not target --from=OWNER:GROUP only change matching files	`chown -R nginx:nginx /var/log/nginx` `chown jdoe:devs file.txt` `chown --reference=orig.txt new.txt` `chown -Rv www-data:www-data /var/www` `chown -h jdoe symlink`
`chgrp`	Change group only	-R recursive --reference=FILE copy group from file -v verbose -c report changes only -h affect symlinks not target	`chgrp -R adm /var/log` `chgrp devs project/` `chgrp --reference=orig.txt new.txt` `chgrp -Rv www-data /var/www` `chgrp -h staff symlink`
`umask`	Show/set default creation mask	-S symbolic output -p output in a form that can be reused as input octal mode argument e.g. 022	`umask 022` `umask -S` `umask 077` `umask -p` `umask 002`
`getfacl`	Get POSIX ACLs	-a print only file access ACL -d print only default ACL -R recursive -p do not skip leading slash in absolute paths -c omit header comments	`getfacl /shared` `getfacl -R /projects` `getfacl -d /shared` `getfacl -c file.txt` `getfacl -p /var/www`
`setfacl`	Set POSIX ACLs	-m modify ACL entry -x remove ACL entry -b remove all ACL entries -R recursive -d default ACL for directory --set replace entire ACL	`setfacl -m u:jdoe:rwx /shared` `setfacl -x u:jdoe /shared` `setfacl -Rm g:devs:rx /projects` `setfacl -b /shared` `setfacl -d -m u:jdoe:rwx /shared`
`ls -l`	Show mode & ownership (see File & Directory Management)	-a all -A almost-all -l long format -h human-readable sizes -R recursive -t sort by mtime -S sort by size -r reverse order -F classify entries --color[=WHEN] colorize -i inode numbers -d directory itself -1 one per line	`ls -lha /etc` `ls -lt /var/log \| head -20` `ls -R /etc/sysconfig` `ls --color=auto -F /usr/bin` `ls -la --time-style=full-iso /home`
`stat`	Detailed file/info	-c FORMAT custom output format -f filesystem status instead of file status -L follow symlinks -t terse output format	`stat /etc/passwd` `stat -c "%a %U %G" file.txt` `stat -f /var` `stat -L symlink` `stat -t /etc/hosts`

5. Package Management (YUM/DNF)

CentOS 6/7 → yum; CentOS 8 → dnf (yum is a symlink to dnf).
Commands are largely interchangeable.

Command	Description	Full Options	5 Examples
`yum check-update`	List available updates	(no unique options beyond global yum options: -y, -q, --disablerepo, --enablerepo)	`yum check-update` `yum check-update httpd` `yum --disablerepo=* --enablerepo=base check-update` `yum -q check-update` `yum check-update > /tmp/updates.txt`
`yum update`	Update all packages	-y assume yes --security only security updates PACKAGE update specific package --exclude=PKG exclude package -q quiet	`yum -y update` `yum update httpd` `yum update --security` `yum update --exclude=kernel*` `yum -y update -q`
`yum install`	Install package(s)	-y assume yes --enablerepo=REPO / --disablerepo=REPO --nogpgcheck skip GPG check (not recommended) --downloadonly download only, no install	`yum install httpd php` `yum -y install git` `yum install --enablerepo=epel htop` `yum install --downloadonly httpd` `yum -y install httpd-2.4.6`
`yum remove`	Erase package(s)	-y assume yes --noautoremove do not remove unused dependencies	`yum remove httpd` `yum -y remove php*` `yum remove --noautoremove git` `yum remove httpd php mariadb` `yum -y remove old-package`
`yum list`	List packages	installed — list installed packages available — list available packages all — list all packages updates — list packages with updates extras — packages not in any repo	`yum list installed` `yum list available httpd*` `yum list updates` `yum list extras` `yum list all \| grep nginx`
`yum info`	Show package details	PACKAGE show package details installed / available restrict scope	`yum info httpd` `yum info installed kernel` `yum info available nginx` `yum info mariadb-server` `yum info httpd php`
`yum search`	Search package names/descriptions	all — search names and descriptions QUERY search term	`yum search httpd` `yum search all "web server"` `yum search php-mysql` `yum search nginx` `yum search all editor`
`yum provides`	Find package providing a file	PATTERN — find package providing file/feature (alias: whatprovides)	`yum provides "/ifconfig"` `yum provides httpd` `yum whatprovides /usr/bin/python3` `yum provides "bin/ssh"` `yum provides "*/systemctl"`
`yum clean all`	Clean cached metadata/packages	all — clean everything (headers, packages, metadata, dbcache) packages — clean cached packages only metadata — clean cached metadata only expire-cache — mark cache as expired	`yum clean all` `yum clean packages` `yum clean metadata` `yum clean expire-cache` `yum clean all && yum makecache`
`yum history`	View/undo/redo transactions	list — list transactions info ID — details of transaction undo ID — undo a transaction redo ID — redo a transaction rollback ID — rollback to transaction	`yum history` `yum history info 25` `yum history undo 25` `yum history rollback 20` `yum history redo 26`
`yum deplist`	List package dependencies	PACKAGE — show dependency list for package	`yum deplist httpd` `yum deplist nginx` `yum deplist mariadb-server` `yum deplist php-fpm` `yum deplist git`
`yum reinstall`	Reinstall a package	PACKAGE — reinstall the same package version	`yum reinstall httpd` `yum reinstall -y kernel` `yum reinstall glibc` `yum reinstall php-common` `yum reinstall bash`
`yum downgrade`	Downgrade a package	PACKAGE — downgrade to previous version available in cache/repo	`yum downgrade httpd` `yum downgrade kernel-3.10.0-1160` `yum downgrade -y openssl` `yum downgrade php` `yum downgrade mariadb-server`
`rpm`	Low-level RPM package tool	-i install -U upgrade (or install) -e erase/remove -q query -qa query all installed -qi query package info -ql list files in package -qf query which package owns a file -V verify -Va verify all packages --nodeps ignore dependencies --force force install -vh verbose with hash progress	`rpm -ivh package.rpm` `rpm -qa \| grep httpd` `rpm -qf /etc/passwd` `rpm -ql httpd` `rpm -e --nodeps oldpkg`
`rpm -Va`	Verify all installed packages	(no additional flags beyond base rpm verify options: -V/--verify, -a/--all)	`rpm -Va` `rpm -Va \| grep "^..5"` `rpm -Va httpd` `rpm -Va > /tmp/verify.txt` `rpm -Va \| grep -v "^\."`
`createrepo`	Create YUM/DNF repo metadata	-v verbose -u BASEURL set base URL -o OUTPUTDIR output directory --update update existing repo metadata	`createrepo /repo/centos8` `createrepo --update /repo/centos8` `createrepo -v /var/www/html/repo` `createrepo -o /tmp/repo /packages` `createrepo -u http://mirror/repo /repo`
`repoquery`	Query repository package info	-l list files in package --requires show dependencies --whatprovides find providing package -i package info --installed limit to installed	`repoquery -l httpd` `repoquery --requires nginx` `repoquery --whatprovides /usr/bin/git` `repoquery -i mariadb-server` `repoquery --installed`
`yum-config-manager`	Manage yum repo configuration	--enable REPO enable repository --disable REPO disable repository --add-repo URL add new repo --save persist changes	`yum-config-manager --enable epel` `yum-config-manager --disable epel` `yum-config-manager --add-repo http://repo.example.com/repo.repo` `yum-config-manager --list` `yum-config-manager --save --setopt=epel.enabled=1`
`dnf`	Next-gen package manager (CentOS 8+)	(same subcommands as yum: install, remove, update, search, list, info, history, clean, etc.) -y assume yes --best try to install best available version --allowerasing allow removing conflicting packages	`dnf install httpd` `dnf -y update` `dnf remove nginx` `dnf search editor` `dnf history undo last`
`dnf module`	Manage modular content streams	list — list available modules install NAME:STREAM — install module stream enable NAME:STREAM disable NAME reset NAME	`dnf module list php` `dnf module install php:7.4` `dnf module enable nodejs:14` `dnf module reset php` `dnf module disable postgresql`
`alternatives`	Manage symlink alternatives for commands	--install --config NAME choose active alternative --display NAME show current config --remove NAME PATH remove an alternative --auto NAME restore automatic mode	`alternatives --config python` `alternatives --install /usr/bin/java java /usr/lib/jvm/java-11/bin/java 1` `alternatives --display java` `alternatives --auto java` `alternatives --remove python /usr/bin/python2`

6. Services & Systemd (CentOS 7+)

Command	Description	Full Options	5 Examples
`systemctl`	Control systemd units (services, sockets, targets)	start/stop/restart/reload UNIT status UNIT enable/disable UNIT is-active/is-enabled UNIT list-units list-unit-files daemon-reload mask/unmask UNIT --now combine enable+start	`systemctl restart nginx` `systemctl enable --now firewalld` `systemctl status sshd` `systemctl list-units --type=service` `systemctl daemon-reload`
`service`	Legacy SysV service control wrapper	SERVICE start/stop/restart/status/reload — SysV-style wrapper around systemctl --status-all list status of all services (legacy)	`service httpd status` `service network restart` `service sshd stop` `service --status-all` `service crond start`
`chkconfig`	Legacy runlevel service management	--list list all services and runlevels --add SERVICE register new service --del SERVICE remove service --level LEVELS SERVICE on/off set runlevels SERVICE on/off enable/disable at default runlevels	`chkconfig --list` `chkconfig httpd on` `chkconfig --level 35 httpd on` `chkconfig sshd off` `chkconfig --add myservice`
`init`	Change runlevel / init system	0 halt 1 single-user mode 3 multi-user with networking 5 graphical mode 6 reboot q re-examine inittab	`init 6` `init 0` `telinit 3` `init q` `init 1`
`runlevel`	Show previous and current runlevel	(no options; shows previous and current runlevel)	`runlevel` `runlevel > /tmp/rl.txt` `who -r (alternative)` `runlevel 2>&1` `echo "Current: $(runlevel \| awk '{print $2}')"`
`shutdown`	Shut down or reboot the system	-h halt after shutdown -r reboot after shutdown -c cancel scheduled shutdown now shutdown immediately +MINUTES delay shutdown by minutes TIME schedule at HH:MM -k warn only, do not actually shut down	`shutdown -h now` `shutdown -r +10` `shutdown -c` `shutdown -h 23:00` `shutdown -k now "Maintenance in 5 min"`
`reboot`	Reboot the system	-f force reboot without systemd -p power off instead of reboot --reboot standard reboot (default action)	`reboot` `reboot -f` `sudo reboot` `systemctl reboot` `reboot -p`
`halt`	Halt the system	-f force -p power off after halting -w write wtmp record only, no actual halt	`halt` `halt -p` `sudo halt -f` `halt -w` `systemctl halt`
`poweroff`	Power off the system	-f force power off -w write wtmp record only, no actual poweroff	`poweroff` `poweroff -f` `sudo poweroff` `systemctl poweroff` `poweroff -w`
`systemd-analyze`	Analyze system boot performance	blame — show unit startup time ranking critical-chain — show critical path time — total boot time plot — generate SVG boot chart verify UNIT — check unit file for errors	`systemd-analyze` `systemd-analyze blame` `systemd-analyze critical-chain` `systemd-analyze plot > boot.svg` `systemd-analyze verify httpd.service`
`systemd-run`	Run a command as a transient systemd unit	--unit=NAME name the transient unit --scope run as scope instead of service --on-calendar=TIME schedule like a timer --uid=USER / --gid=GROUP run as user/group -p PROPERTY=VALUE set unit property	`systemd-run --unit=backup /usr/local/bin/backup.sh` `systemd-run --scope htop` `systemd-run --on-calendar="daily" /usr/bin/cleanup.sh` `systemd-run --uid=nginx sleep 60` `systemd-run -p CPUQuota=20% stress --cpu 1`
`loginctl`	Control the systemd login manager	list-sessions list-users session-status ID user-status USER terminate-session ID terminate-user USER lock-session / unlock-session ID	`loginctl list-sessions` `loginctl session-status 3` `loginctl terminate-user jdoe` `loginctl list-users` `loginctl lock-session 5`
`hostnamectl`	Control system hostname (see System Info)	status show current settings set-hostname NAME set-icon-name NAME set-chassis TYPE set-deployment ENV set-location LOC --static / --transient / --pretty scope	`hostnamectl status` `hostnamectl set-hostname web01` `hostnamectl set-hostname web01 --pretty` `hostnamectl set-chassis server` `hostnamectl set-deployment production`
`timedatectl`	Control system time/date (see System Info)	status show current settings set-time TIME set-timezone ZONE list-timezones set-ntp true/false show all properties	`timedatectl status` `timedatectl set-timezone Asia/Singapore` `timedatectl set-ntp true` `timedatectl list-timezones` `timedatectl set-time "2026-07-27 09:00:00"`
`localectl`	Control system locale and keyboard layout	status show current locale settings set-locale LOCALE set system locale list-locales set-keymap MAP set console keymap list-keymaps	`localectl status` `localectl set-locale LANG=en_US.UTF-8` `localectl list-locales` `localectl set-keymap us` `localectl list-keymaps`

7. Networking

Command	Description	Full Options	5 Examples
`ip`	Show/manipulate network interfaces, routing, addresses	addr / a — show/manipulate addresses link / l — show/manipulate interfaces route / r — show/manipulate routing table neigh / n — ARP/neighbor table add / del / show subcommands -4 / -6 restrict to IPv4/IPv6 -s statistics detail	`ip addr show` `ip link set eth0 up` `ip route add default via 192.168.1.1` `ip -4 addr add 10.0.0.5/24 dev eth1` `ip neigh show`
`ifconfig`	Legacy interface configuration tool	IFACE up/down — enable/disable interface IFACE ADDR — assign address netmask MASK mtu SIZE -a show all interfaces including down	`ifconfig` `ifconfig eth0 up` `ifconfig eth0 192.168.1.10 netmask 255.255.255.0` `ifconfig -a` `ifconfig eth0 mtu 9000`
`nmcli`	NetworkManager command-line control	device status — list devices connection show — list connections connection up/down NAME device connect IFACE general status radio wifi on/off	`nmcli device status` `nmcli connection show` `nmcli connection up eth0` `nmcli device disconnect eth1` `nmcli general status`
`nmtui`	NetworkManager text user interface	(text-based interactive UI; no CLI flags — arrow keys/menus navigate: edit connections, activate, set hostname)	`nmtui` `nmtui edit` `nmtui connect` `nmtui hostname` `sudo nmtui`
`ethtool`	Query/control Ethernet device settings	IFACE — show settings -i IFACE driver info -S IFACE statistics -s IFACE speed SPEED duplex full autoneg off — set speed -p IFACE identify (blink)	`ethtool eth0` `ethtool -i eth0` `ethtool -S eth0` `ethtool -s eth0 speed 1000 duplex full autoneg off` `ethtool -p eth0 5`
`mii-tool`	View/manipulate MII status of NIC (legacy)	-v verbose -w watch for link changes -r restart autonegotiation IFACE specify interface	`mii-tool` `mii-tool eth0` `mii-tool -v eth0` `mii-tool -r eth0` `mii-tool -w eth0`
`ping`	Send ICMP echo requests	-c COUNT number of packets -i INTERVAL seconds between packets -s SIZE packet size -W TIMEOUT seconds to wait for reply -q quiet, summary only -4 / -6 force IPv4/IPv6	`ping -c 4 google.com` `ping -i 0.2 -c 10 10.0.0.1` `ping -s 1000 host.example.com` `ping -W 2 -c 3 8.8.8.8` `ping -q -c 5 localhost`
`traceroute`	Trace route packets take to a host	-n numeric only, no DNS -m MAXHOPS max hop count -w WAIT timeout per hop -I use ICMP echo -p PORT destination port	`traceroute google.com` `traceroute -n 8.8.8.8` `traceroute -m 15 example.com` `traceroute -I host.example.com` `traceroute -p 443 example.com`
`netstat`	Network connections, routing, statistics (legacy)	-t TCP -u UDP -l listening only -n numeric -p show PID/program -a all sockets -r routing table	`netstat -tulnp` `netstat -an \| grep ESTABLISHED` `netstat -r` `netstat -tlnp \| grep :80` `netstat -s (statistics)`
`ss`	Socket statistics (modern netstat replacement)	-t TCP -u UDP -l listening -n numeric -p show process -a all -s summary statistics	`ss -tulnp` `ss -s` `ss -tan state established` `ss -lntp` `ss -o state time-wait`
`nc`	Netcat — read/write raw TCP/UDP connections	-l listen mode -p PORT local port -v verbose -z zero-I/O (port scan) -u UDP mode -w TIMEOUT connection timeout	`nc -zv host.example.com 80` `nc -l 8080` `nc -u host 53` `echo test \| nc host 9000` `nc -w 3 host 22`
`telnet`	Legacy plaintext remote terminal/protocol tester	HOST PORT — connect -l USER — login as user (some implementations) -e CHAR escape character	`telnet host.example.com 80` `telnet 192.168.1.1 23` `telnet mail.example.com 25` `telnet localhost 3306` `telnet host 443`
`ssh`	Secure remote shell	-p PORT remote port -i IDENTITY_FILE private key -L LOCAL:HOST:REMOTE local port forward -R REMOTE:HOST:LOCAL remote port forward -D PORT SOCKS proxy dynamic forward -v verbose (repeat for more) -N no remote command (with -L/-R) -o OPTION additional ssh_config option	`ssh jdoe@host.example.com` `ssh -p 2222 root@host` `ssh -i ~/.ssh/id_rsa jdoe@host` `ssh -L 8080:localhost:80 jdoe@host` `ssh -D 1080 jdoe@host`
`scp`	Secure copy over SSH	-r recursive -P PORT remote port -i IDENTITY_FILE private key -p preserve times/modes -C compress during transfer	`scp file.txt jdoe@host:/tmp/` `scp -r ./project jdoe@host:/opt/` `scp -P 2222 backup.tgz jdoe@host:~/` `scp -i key.pem file.txt user@host:/tmp/` `scp jdoe@host:/etc/hosts ./hosts.bak`
`sftp`	Secure FTP over SSH	-P PORT remote port -i IDENTITY_FILE private key -b BATCHFILE batch mode script -r (with put/get) recursive	`sftp jdoe@host.example.com` `sftp -P 2222 jdoe@host` `sftp -i key.pem jdoe@host` `sftp -b script.txt jdoe@host` `sftp> get -r /remote/dir`
`rsync`	Efficient file sync/copy tool	-a archive mode (recursive+preserve) -v verbose -z compress -r recursive --delete remove extraneous files at destination -e SSH_CMD specify remote shell --dry-run show what would happen -P show progress + partial transfer	`rsync -avz /src/ user@host:/dst/` `rsync -a --delete /data/ /backup/` `rsync -avzP file.tgz host:/tmp/` `rsync -e "ssh -p 2222" -a /src/ host:/dst/` `rsync -a --dry-run /src/ /dst/`
`wget`	Non-interactive file downloader	-O FILE output filename -c continue partial download -r recursive download -b background -q quiet --limit-rate=RATE throttle bandwidth	`wget https://example.com/file.tar.gz` `wget -O out.html https://example.com` `wget -c https://example.com/bigfile.iso` `wget -r -np https://example.com/docs/` `wget --limit-rate=200k https://example.com/file`
`curl`	Transfer data with URLs, many protocols	-O save with remote filename -o FILE save as filename -I headers only -L follow redirects -X METHOD HTTP method -d DATA POST data -H HEADER custom header -u USER:PASS basic auth -k insecure (skip TLS verify) -s silent	`curl -I https://example.com` `curl -O https://example.com/file.zip` `curl -X POST -d "a=1" https://api.example.com` `curl -H "Authorization: Bearer TOKEN" https://api.example.com` `curl -Lk https://self-signed.example.com`
`host`	Simple DNS lookup utility	-t TYPE record type (A, MX, TXT...) -a all records (equivalent to -v -t ANY) -v verbose	`host example.com` `host -t MX example.com` `host -a example.com` `host -t TXT example.com` `host 8.8.8.8 (reverse lookup)`
`dig`	Detailed DNS lookup utility	@SERVER query specific DNS server -t TYPE record type +short concise output +trace trace delegation path -x reverse lookup (PTR)	`dig example.com` `dig @8.8.8.8 example.com MX` `dig +short example.com` `dig +trace example.com` `dig -x 8.8.8.8`
`nslookup`	Interactive/legacy DNS lookup tool	-type=TYPE record type SERVER specify DNS server -query=TYPE alternate syntax	`nslookup example.com` `nslookup -type=MX example.com` `nslookup example.com 8.8.8.8` `nslookup -type=TXT example.com` `nslookup 8.8.8.8`
`arp`	Show/manipulate the ARP cache	-a display ARP table -d IP delete entry -s IP MAC add static entry -n numeric (no hostname resolution)	`arp -a` `arp -n` `arp -d 192.168.1.5` `arp -s 192.168.1.5 aa:bb:cc:dd:ee:ff` `arp -a eth0`
`iptables`	Legacy Netfilter firewall rule management	-A append rule -D delete rule -I insert rule -L list rules -F flush all rules -P set default policy -p PROTOCOL --dport PORT / --sport PORT -j TARGET (ACCEPT/DROP/REJECT) -s / -d source/destination	`iptables -L -n -v` `iptables -A INPUT -p tcp --dport 22 -j ACCEPT` `iptables -P INPUT DROP` `iptables -F` `iptables -A INPUT -s 10.0.0.0/24 -j DROP`
`iptables-save`	Dump iptables rules for persistence	-c include packet/byte counters -t TABLE save only specified table	`iptables-save > /etc/sysconfig/iptables` `iptables-save -c > rules.v4` `iptables-save -t nat` `iptables-save \| grep DROP` `iptables-save -t filter`
`firewall-cmd`	firewalld command-line client	--state --list-all --add-service=SERVICE --add-port=PORT/PROTO --remove-service=SERVICE --permanent make persistent --reload apply permanent changes --zone=ZONE specify zone	`firewall-cmd --state` `firewall-cmd --add-service=http --permanent` `firewall-cmd --reload` `firewall-cmd --list-all` `firewall-cmd --add-port=8080/tcp --permanent`
`firewall-offline-cmd`	Configure firewalld zones while daemon is stopped	--add-port=PORT/PROTO --add-service=SERVICE --zone=ZONE --list-all (works when firewalld is not running)	`firewall-offline-cmd --add-service=ssh` `firewall-offline-cmd --add-port=443/tcp` `firewall-offline-cmd --zone=public --add-service=http` `firewall-offline-cmd --list-all` `firewall-offline-cmd --remove-service=telnet`
`semanage port`	Manage SELinux port type mappings	-l list all port mappings -a add new port mapping -m modify existing mapping -d delete mapping -t TYPE SELinux type	`semanage port -l \| grep http` `semanage port -a -t http_port_t -p tcp 8080` `semanage port -m -t ssh_port_t -p tcp 2222` `semanage port -d -t http_port_t -p tcp 8080` `semanage port -l`
`getenforce`	Show current SELinux enforcement mode	(no options; prints Enforcing, Permissive, or Disabled)	`getenforce` `echo "SELinux mode: $(getenforce)"` `getenforce \| grep Enforcing` `getenforce > /tmp/selinux_status` `if [ "$(getenforce)" = "Enforcing" ]; then echo on; fi`
`sestatus`	Show detailed SELinux status	-v verbose (show file context info) -b show SELinux booleans	`sestatus` `sestatus -v` `sestatus -b` `sestatus \| grep policy` `sestatus -b \| grep httpd`
`semodule`	Manage SELinux policy modules	-l list installed modules -i install module -r remove module -e enable module -d disable module	`semodule -l` `semodule -i mymodule.pp` `semodule -r mymodule` `semodule -d unwanted_module` `semodule -e mymodule`
`auditctl`	Control the kernel audit system	-l list current rules -w PATH watch a file/dir -a ACTION,FILTER add rule -D delete all rules -e 0/1 enable/disable auditing -s show status	`auditctl -l` `auditctl -w /etc/passwd -p wa -k passwd_watch` `auditctl -D` `auditctl -s` `auditctl -a always,exit -F arch=b64 -S execve`
`ausearch`	Search audit daemon logs	-k KEY search by rule key -m TYPE search by message type -ts TIME start time -ua USER search by user -i interpret uid/gid to names	`ausearch -k passwd_watch` `ausearch -m USER_LOGIN -ts today` `ausearch -ua jdoe` `ausearch -i -m AVC` `ausearch -ts recent -k rootcmd`
`aureport`	Generate summary reports from audit logs	-au authentication report -f file access report -l login report -x executable report --summary summary only	`aureport -au` `aureport -f` `aureport -l --summary` `aureport -x` `aureport --summary`
`setsebool`	Set SELinux boolean values	-P persistent across reboot BOOLEAN on/off set value	`setsebool -P httpd_can_network_connect on` `setsebool -P httpd_enable_cgi on` `setsebool ftpd_full_access off` `setsebool -P samba_enable_home_dirs on` `setsebool -P nis_enabled 1`
`toggle SELinux boolean`	Enable/disable an SELinux boolean (see setsebool)	-P persistent across reboot BOOLEAN on/off set value	`setsebool -P httpd_can_network_connect on` `setsebool -P httpd_enable_cgi on` `setsebool ftpd_full_access off` `setsebool -P samba_enable_home_dirs on` `setsebool -P nis_enabled 1`

8. Storage – LVM, RAID & Disk Management

LVM (Logical Volume Manager)

Command	Description	Full Options	5 Examples
`pvcreate`	Initialize a disk/partition as an LVM physical volume	-f force -u UUID specify UUID -y assume yes --metadatasize SIZE DEVICE(s) — physical volumes to initialize	`pvcreate /dev/sdb1` `pvcreate /dev/sdb1 /dev/sdc1` `pvcreate -f /dev/sdd` `pvcreate -u --restorefile backup /dev/sde1` `pvcreate --metadatasize 1M /dev/sdf1`
`vgcreate`	Create a volume group from physical volumes	-s SIZE physical extent size VGNAME PV... — create volume group from PVs	`vgcreate vg_data /dev/sdb1` `vgcreate -s 8M vg_fast /dev/sdc1 /dev/sdd1` `vgcreate vg_app /dev/sde1` `vgcreate vg_backup /dev/sdf1 /dev/sdg1` `vgcreate -s 4M vg_db /dev/sdh1`
`lvcreate`	Create a logical volume	-L SIZE absolute size (e.g. 10G) -l EXTENTS or %FREE/%VG relative size -n NAME logical volume name -s snapshot of existing LV -i STRIPES / -I STRIPESIZE striping options -m MIRRORS mirrored LV	`lvcreate -L 10G -n lv_data vg_data` `lvcreate -l 100%FREE -n lv_home vg_data` `lvcreate -s -L 5G -n snap_data vg_data/lv_data` `lvcreate -i 2 -I 64 -L 20G -n lv_striped vg_fast` `lvcreate -m 1 -L 10G -n lv_mirror vg_data`
`lvextend`	Grow a logical volume	-L SIZE new absolute size or +SIZE to add -l EXTENTS or +%FREE -r / --resizefs resize filesystem too	`lvextend -L +5G /dev/vg_data/lv_data` `lvextend -l +100%FREE /dev/vg_data/lv_home` `lvextend -r -L 50G /dev/vg_data/lv_data` `lvextend -L +10G -r /dev/vg_app/lv_app` `lvextend -l +50%FREE /dev/vg_data/lv_data`
`lvreduce`	Shrink a logical volume	-L SIZE new absolute size or -SIZE to shrink -r / --resizefs resize filesystem first (ext only) -f force, skip confirmation	`lvreduce -L 5G /dev/vg_data/lv_data` `lvreduce -L -2G /dev/vg_data/lv_data` `lvreduce -r -L 8G /dev/vg_data/lv_home` `lvreduce -f -L 10G /dev/vg_app/lv_app` `lvreduce -L -1G /dev/vg_data/lv_logs`
`lvremove`	Remove a logical volume	-f force, skip confirmation LV — logical volume(s) to remove	`lvremove /dev/vg_data/lv_old` `lvremove -f vg_data/lv_temp` `lvremove vg_data/snap_data` `lvremove -f /dev/vg_test/lv1 /dev/vg_test/lv2` `lvremove vg_app/lv_scratch`
`pvs`	Report physical volume info (short)	-o FIELDS custom output columns -v verbose --units h human-readable	`pvs` `pvs -o pv_name,vg_name,pv_size` `pvs -v` `pvs --units g` `pvs /dev/sdb1`
`pvdisplay`	Report physical volume info (detailed)	-v verbose (maps to segments) -C columnar report --maps show mapping of PEs to devices	`pvdisplay` `pvdisplay /dev/sdb1` `pvdisplay -v` `pvdisplay -C` `pvdisplay --maps /dev/sdc1`
`vgchange`	Activate/deactivate a volume group	-a y/n activate/deactivate volume group -s NEWNAME rename (older syntax)	`vgchange -a y vg_data` `vgchange -a n vg_data` `vgchange -a y vg_backup` `vgchange -a n vg_test` `vgchange -ay`
`vgremove`	Remove a volume group	-f force removal VGNAME — volume group to remove	`vgremove vg_old` `vgremove -f vg_test` `vgremove vg_backup` `vgremove vg_scratch` `vgremove -f vg_temp`
`vgextend`	Add a physical volume to a volume group	VGNAME DEVICE — add physical volume(s) to group	`vgextend vg_data /dev/sdd1` `vgextend vg_app /dev/sde1 /dev/sdf1` `vgextend vg_backup /dev/sdg1` `vgextend vg_data /dev/sdh1` `vgextend vg_fast /dev/sdi1`
`pvmove`	Move extents between physical volumes	SRC_PV — move all extents off a PV SRC_PV DEST_PV — move extents to specific destination	`pvmove /dev/sdb1` `pvmove /dev/sdb1 /dev/sdc1` `pvmove -n lv_data /dev/sdb1 /dev/sdd1` `pvmove /dev/sde1` `pvmove /dev/sdb1 /dev/sdf1`
`lvdisplay`	Report logical volume info (detailed)	-v verbose (segment info) -C columnar report -m show segments/mapping	`lvdisplay` `lvdisplay /dev/vg_data/lv_data` `lvdisplay -v` `lvdisplay -C` `lvdisplay -m vg_data/lv_data`
`lvscan`	Scan for all logical volumes	-v verbose -b blocks display --all include inactive LVs	`lvscan` `lvscan -v` `lvscan --all` `lvscan -b` `lvscan \| grep active`
`vgcfgrestore`	Restore volume group metadata from backup	-f FILE restore from specific backup file -l list available archived backups VGNAME — volume group to restore	`vgcfgrestore vg_data` `vgcfgrestore -l vg_data` `vgcfgrestore -f /etc/lvm/backup/vg_data vg_data` `vgcfgrestore vg_backup` `vgcfgrestore -l vg_app`

Software RAID (mdadm)

Command	Description	Full Options	5 Examples
`mdadm --create`	Create a new software RAID array	--level=LEVEL RAID level (0,1,5,6,10) --raid-devices=N number of active devices --spare-devices=N spare devices --chunk=SIZE stripe chunk size --metadata=VER metadata version	`mdadm --create /dev/md0 --level=1 --raid-devices=2 /dev/sdb1 /dev/sdc1` `mdadm --create /dev/md1 --level=5 --raid-devices=3 /dev/sd[bcd]1` `mdadm --create /dev/md0 --level=0 --raid-devices=2 --chunk=64 /dev/sdb1 /dev/sdc1` `mdadm --create /dev/md2 --level=10 --raid-devices=4 /dev/sd[b-e]1` `mdadm --create /dev/md0 --level=1 --raid-devices=2 --spare-devices=1 /dev/sd[bcd]1`
`mdadm --detail`	Show details of a RAID array	/dev/mdX — show details of an array --scan generate summary for all arrays	`mdadm --detail /dev/md0` `mdadm --detail --scan` `mdadm --detail /dev/md1 \| grep State` `mdadm --detail /dev/md0 > /tmp/raid_status.txt` `mdadm --detail /dev/md0 \| grep -A5 Devices`
`mdadm --manage`	Add/remove/fail disks in an array	--add DEVICE add spare/replacement disk --remove DEVICE remove failed disk --fail DEVICE mark disk as failed --re-add DEVICE re-add previously removed disk	`mdadm --manage /dev/md0 --add /dev/sdd1` `mdadm --manage /dev/md0 --fail /dev/sdb1` `mdadm --manage /dev/md0 --remove /dev/sdb1` `mdadm /dev/md0 --add /dev/sde1` `mdadm --manage /dev/md0 --re-add /dev/sdb1`
`mdadm --grow`	Resize or reshape a RAID array	--raid-devices=N grow number of active devices --size=SIZE resize array --level=LEVEL change RAID level (migration)	`mdadm --grow /dev/md0 --raid-devices=4` `mdadm --grow /dev/md0 --size=max` `mdadm --grow /dev/md0 --level=5 --raid-devices=3` `mdadm --grow /dev/md1 --size=100G` `mdadm --grow /dev/md0 --raid-devices=3`
`mdadm --stop`	Stop/deactivate a RAID array	/dev/mdX — deactivate array	`mdadm --stop /dev/md0` `mdadm --stop /dev/md1` `mdadm --stop --scan` `mdadm --stop /dev/md2` `mdadm --stop /dev/md0 && mdadm --remove /dev/md0`
`mdadm --assemble`	Assemble an existing RAID array	--scan assemble all arrays from mdadm.conf /dev/mdX DEVICE... — assemble specific array --uuid=UUID assemble by UUID --run force run even if degraded	`mdadm --assemble --scan` `mdadm --assemble /dev/md0 /dev/sdb1 /dev/sdc1` `mdadm --assemble --uuid= /dev/md0` `mdadm --assemble --run /dev/md0 /dev/sdb1` `mdadm -As`
`mdadm --monitor`	Monitor RAID arrays for events	--scan monitor all arrays --daemonise run as background daemon --mail=ADDRESS email alert address --delay=SECONDS polling interval	`mdadm --monitor --scan --daemonise` `mdadm --monitor /dev/md0 --mail=root@localhost` `mdadm --monitor --scan --delay=300` `mdadm --monitor /dev/md0 --program=/usr/local/bin/alert.sh` `mdadm --monitor --scan -f`
`mdadm --examine`	Examine RAID superblock on a device	DEVICE — examine RAID superblock on a device --scan generate config output for all found	`mdadm --examine /dev/sdb1` `mdadm --examine /dev/sdc1` `mdadm --examine --scan` `mdadm -E /dev/sdd1` `mdadm --examine /dev/sd[bc]1`

Miscellaneous Disk Tools

Command	Description	Full Options	5 Examples
`fdisk`	Partition table manipulator (MBR, some GPT)	-l list partition tables -u unit display (cylinders/sectors) -c compatible mode off device to enter interactive editor	`fdisk -l` `fdisk /dev/sdb` `fdisk -l /dev/sda` `fdisk -u /dev/sdb` `echo -e "n\np\n\n\n\nw" \| fdisk /dev/sdb`
`parted`	Partition editor (MBR/GPT)	-l list all disks -s script mode (non-interactive) print / mklabel / mkpart / rm subcommands align-check resizepart	`parted -l` `parted /dev/sdb print` `parted -s /dev/sdb mklabel gpt` `parted -s /dev/sdb mkpart primary ext4 0% 100%` `parted /dev/sdb resizepart 1 100%`
`lsblk`	List block devices in tree form	-f show filesystem info -a show empty devices too -p full device paths -o COLUMNS custom columns -d no partitions, only devices	`lsblk -f` `lsblk -o NAME,SIZE,FSTYPE,MOUNTPOINT` `lsblk -a` `lsblk -p` `lsblk -d`
`blkid`	Show block device UUID/label/fstype	-o FORMAT output format (value, device, list) -s TAG show only given tag -U UUID / -L LABEL find device by uuid/label	`blkid` `blkid /dev/sda1` `blkid -s UUID /dev/sda1` `blkid -U` `blkid -o list`
`mkfs`	Create a filesystem	-t TYPE filesystem type mkfs.ext4 / mkfs.xfs / mkfs.vfat variants -L LABEL volume label -n dry run (some variants) -F force even if not a block device	`mkfs -t ext4 /dev/sdb1` `mkfs.xfs -f /dev/sdb1` `mkfs.ext4 -L data /dev/sdc1` `mkfs.vfat /dev/sdd1` `mkfs -t ext4 -F /dev/loop0`
`fsck`	Check/repair a filesystem	-A check all in fstab -t TYPE filesystem type -y assume yes to all prompts -f force check even if clean -n assume no, read-only check	`fsck /dev/sdb1` `fsck -y /dev/sdb1` `fsck -A` `fsck -f /dev/sda1` `fsck -n /dev/sdc1`
`mount`	Mount a filesystem	-a mount all in fstab -t TYPE filesystem type -o OPTIONS mount options (ro,rw,noexec...) -r read-only -w read-write -B bind mount -L LABEL / -U UUID mount by label/uuid --make-shared/private/slave/unbindable propagation	`mount -a` `mount -t nfs server:/export /mnt/nfs` `mount -o remount,rw /` `mount -U /mnt/data` `mount --bind /data /var/www/data`
`findmnt`	Find/list mounted filesystems	-l list format -D disk usage -t TYPE filter by fs type -S SOURCE find by device -T TARGET find by mountpoint --json	`findmnt /` `findmnt -t ext4` `findmnt -S /dev/sda1` `findmnt --json /home` `findmnt -D`
`df`	Disk space usage	-h human-readable -T show fs type -i inode usage -a all filesystems --total grand total -x TYPE exclude fs type -t TYPE limit to fs type	`df -hT` `df -i` `df --total` `df -x tmpfs` `df -h /var`
`hdparm`	Get/set SATA/PATA disk parameters	-I detailed device info -i identify device -t timing buffered reads -T timing cached reads -W set write-caching (0/1)	`hdparm -I /dev/sda` `hdparm -t /dev/sda` `hdparm -T /dev/sda` `hdparm -W1 /dev/sda` `hdparm -i /dev/sdb`
`smartctl`	SMART disk health monitoring	-a all SMART info -H health status -t TYPE run self-test (short/long) -i identify info --scan list devices	`smartctl -a /dev/sda` `smartctl -H /dev/sda` `smartctl -t short /dev/sda` `smartctl --scan` `smartctl -i /dev/sdb`
`blockdev`	Call block device ioctls from userspace	--getsize64 size in bytes --getbsz block size --setro / --setrw set read-only/read-write --flushbufs flush buffers --report summary of all devices	`blockdev --getsize64 /dev/sda` `blockdev --setro /dev/sdb1` `blockdev --report` `blockdev --getbsz /dev/sda1` `blockdev --flushbufs /dev/sdb`
`cryptsetup`	Manage LUKS encrypted block devices	luksFormat DEVICE — initialize LUKS volume luksOpen DEVICE NAME — unlock and map luksClose NAME — close mapped device luksDump DEVICE — show LUKS header info luksAddKey DEVICE — add new passphrase status NAME — show mapping status	`cryptsetup luksFormat /dev/sdb1` `cryptsetup luksOpen /dev/sdb1 secure_vol` `cryptsetup luksClose secure_vol` `cryptsetup luksDump /dev/sdb1` `cryptsetup luksAddKey /dev/sdb1`

9. Logging & Log Management

Command	Description	Full Options	5 Examples
`journalctl`	Query the systemd journal	-b boot (current or -b -1 previous) -u UNIT filter by systemd unit -f follow -n NUM last N lines -p PRIORITY filter level --since / --until time range -k kernel messages only -r reverse order -o FORMAT output format (json, cat, short) --disk-usage --vacuum-time=TIME / --vacuum-size=SIZE	`journalctl -u nginx -f` `journalctl -b -1` `journalctl --since "1 hour ago"` `journalctl -p err -b` `journalctl --vacuum-time=2weeks`
`rsyslogd`	Enhanced syslog daemon	-n run in foreground (no daemonize) -f CONFIGFILE specify config file -N LEVEL check config syntax level -v show version info	`rsyslogd -N1` `systemctl restart rsyslog` `rsyslogd -f /etc/rsyslog.conf -n` `rsyslogd -v` `rsyslogd -N1 -f /etc/rsyslog.conf`
`logrotate`	Rotate, compress, and manage log files	-f force rotation now -d debug mode (dry run, verbose) -v verbose -s STATEFILE use alternate state file CONFIGFILE — path to config	`logrotate -f /etc/logrotate.d/httpd` `logrotate -d /etc/logrotate.conf` `logrotate -v /etc/logrotate.conf` `logrotate -s /tmp/logrotate.state /etc/logrotate.conf` `logrotate /etc/logrotate.conf`
`last`	Show last logins from wtmp	-n NUM limit lines -f FILE alternate wtmp file -a display hostname last -x show shutdown/runlevel -t YYYYMMDDHHMMSS show state at time	`last -n 10` `last reboot` `last -a` `last jdoe` `last -x`
`lastb`	Show failed login attempts from btmp	-n NUM limit lines -f FILE alternate btmp file -a display hostname last	`lastb` `lastb -n 20` `lastb -a` `lastb root` `lastb -f /var/log/btmp.1`
`dmesg`	Print kernel ring buffer messages	-T human-readable timestamps -n LEVEL set console log level -c clear buffer after printing -l LEVEL filter by level -w follow new messages	`dmesg -T \| tail -50` `dmesg -c` `dmesg -l err,warn` `dmesg -w` `dmesg -T \| grep -i eth0`
`tail -f`	Follow a log file live (see File & Directory Management)	-f follow (output appended data as file grows) -F like -f but retries if file renamed/rotated -n NUM show last N lines (default 10) -c NUM show last N bytes --pid=PID terminate after PID dies (with -f) -s SECONDS sleep interval between checks (-f) -q quiet, no filename headers -v verbose, always show headers	`tail -f /var/log/httpd/access_log` `tail -n 50 /var/log/messages` `tail -F -n0 /var/log/app.log` `tail -f --pid=1234 /var/log/proc.log` `tail -c 1K bigfile.bin`
`zgrep`	Search inside compressed (.gz) log files	(same options as grep, operates on .gz files) -i ignore case -r recursive -v invert match -c count matches	`zgrep "error" /var/log/messages-20260101.gz` `zgrep -i "fail" /var/log/*.gz` `zgrep -c "GET" access.log.gz` `zgrep -r "OOM" /var/log/archive/` `zgrep -v "^#" config.gz`
`savelog`	Save and age-rotate a log file	-c NUM number of cycles to keep -n do not compress old files (no-op default varies) -m MODE set file mode -u USER / -g GROUP set ownership	`savelog /var/log/myapp.log` `savelog -c 7 /var/log/myapp.log` `savelog -m 640 /var/log/app.log` `savelog -u root -g adm /var/log/custom.log` `savelog -c 5 -m 644 /var/log/service.log`
`logger`	Add entries to the system log from shell/scripts	-p FACILITY.LEVEL priority -t TAG tag messages -i include PID -s also log to stderr -f FILE log contents of file	`logger "Backup completed"` `logger -p local0.notice "Custom event"` `logger -t myapp -i "Service started"` `logger -s "Deploy finished"` `logger -f /tmp/output.log`
`watch`	Repeatedly run a command, showing live output	-n SECONDS interval between runs (default 2) -d highlight differences between updates -g exit when output changes -t no title/header	`watch -n 1 df -h` `watch -d "netstat -tn"` `watch -g "ls /tmp/lockfile"` `watch -t uptime` `watch -n 5 "tail -5 /var/log/messages"`

10. Performance & Tuning Tools

Command	Description	Full Options	5 Examples
`sysctl`	Read/write kernel runtime parameters	-a show all parameters -w NAME=VALUE set at runtime -p [FILE] load from sysctl.conf -n show value only, no name --system load all system config files	`sysctl -a \| grep ip_forward` `sysctl -w net.ipv4.ip_forward=1` `sysctl -p /etc/sysctl.d/99-custom.conf` `sysctl net.ipv4.tcp_syncookies` `sysctl --system`
`/proc/sys/`	Kernel tunables filesystem interface	(not a command; a filesystem path) — read: cat /proc/sys/PATH write: echo VALUE > /proc/sys/PATH tree mirrors sysctl names, e.g. net/ipv4/ip_forward	`cat /proc/sys/net/ipv4/ip_forward` `echo 1 > /proc/sys/net/ipv4/ip_forward` `cat /proc/sys/vm/swappiness` `echo 10 > /proc/sys/vm/swappiness` `ls /proc/sys/kernel/`
`iostat`	CPU & I/O statistics	-x extended statistics -m display in MB/s -k display in KB/s (default) -c CPU only -d device only -N LVM info -p [DEVICE] per-partition stats interval [count]	`iostat -xz 1 3` `iostat -m 2 5` `iostat -d /dev/sda 1` `iostat -c` `iostat -p sda 1`
`vmstat`	Virtual memory statistics	delay [count] -a active/inactive memory -s table of event counters -d disk statistics -D disk table summary -w wide output -t timestamp	`vmstat 1 5` `vmstat -a 2` `vmstat -s` `vmstat -d` `vmstat -t 1 3`
`mpstat`	Per-CPU utilization	-P ALL all CPUs / N specific CPU interval [count] -u CPU utilization (default) -I info about interrupts	`mpstat -P ALL 1` `mpstat 2 5` `mpstat -P 0 1` `mpstat -u` `mpstat -I SUM 1 2`
`pidstat`	Per-process statistics	-r memory -d I/O -u CPU (default) -p PID specific process -w context switches interval [count]	`pidstat -d 1` `pidstat -r -p 1234` `pidstat -u 2 5` `pidstat -w` `pidstat -p ALL 1`
`sar`	Collect/report system activity	-u CPU -r memory -n DEV network -b I/O and transfer rate -d block devices -q load average -A all data -f FILE read from file	`sar -u 1 3` `sar -r 2 5` `sar -n DEV 1` `sar -f /var/log/sa/sa15` `sar -q`
`perf`	Linux performance analysis/profiling toolkit	stat — collect event counts for a command record — record profiling data report — analyze recorded data top — live system profiling -e EVENT specify perf event -p PID attach to running process	`perf stat ls` `perf record -g ./myapp` `perf report` `perf top` `perf stat -p 1234`
`tcpdump`	Capture and analyze network packets	-i IFACE interface to capture on -n no DNS resolution -w FILE write to pcap file -r FILE read from pcap file -c COUNT stop after N packets -v/-vv/-vvv verbosity levels port PORT / host HOST filter expressions	`tcpdump -i eth0 -n` `tcpdump -i eth0 port 80 -w capture.pcap` `tcpdump -r capture.pcap` `tcpdump -c 100 host 10.0.0.5` `tcpdump -i any -nn icmp`
`iftop`	Real-time bandwidth usage per connection	-i IFACE interface to monitor -n no DNS resolution -P show ports -B show bytes instead of bits	`iftop` `iftop -i eth0` `iftop -n` `iftop -P` `iftop -B`
`nethogs`	Real-time bandwidth usage per process	IFACE — monitor specific interface -d SECONDS refresh delay -t tracemode (plain text)	`nethogs` `nethogs eth0` `nethogs -d 2` `nethogs -t` `nethogs eth0 wlan0`
`iotop`	Real-time disk I/O usage per process	-o only show processes doing I/O -b batch mode (non-interactive) -n NUM number of iterations -d SECONDS delay between updates -a accumulated I/O instead of bandwidth	`iotop` `iotop -o` `iotop -b -n 3` `iotop -a` `iotop -d 5`
`stress`	Generate synthetic CPU/memory/IO/disk load	--cpu N spawn N CPU workers --io N spawn N I/O workers --vm N spawn N memory workers --vm-bytes SIZE memory per worker -t SECONDS timeout duration	`stress --cpu 4 --timeout 60s` `stress --io 2 --timeout 30s` `stress --vm 2 --vm-bytes 1G --timeout 60s` `stress -c 8 -t 120` `stress --hdd 1 --timeout 30s`
`hdparm`	Get/set SATA/PATA disk parameters	-I detailed device info -i identify device -t timing buffered reads -T timing cached reads -W set write-caching (0/1)	`hdparm -I /dev/sda` `hdparm -t /dev/sda` `hdparm -T /dev/sda` `hdparm -W1 /dev/sda` `hdparm -i /dev/sdb`
`fio`	Flexible I/O tester and disk benchmarking tool	--name=NAME job name --rw=MODE read/write pattern (read,write,randread,randwrite) --bs=SIZE block size --size=SIZE test file size --numjobs=N parallel jobs --runtime=SECONDS limit test duration	`fio --name=test --rw=randwrite --bs=4k --size=1G` `fio --name=readtest --rw=read --bs=1M --size=2G` `fio --name=t --rw=randrw --rwmixread=70 --size=500M` `fio --name=t --numjobs=4 --rw=write --bs=64k --size=1G` `fio --name=t --runtime=60 --rw=randread --size=1G`

11. Kernel Modules & Boot Loader

Command	Description	Full Options	5 Examples
`lsmod`	List currently loaded kernel modules	(no options; lists loaded kernel modules)	`lsmod` `lsmod \| grep nf_conntrack` `lsmod \| wc -l` `lsmod \| grep -i raid` `lsmod > /tmp/modules.txt`
`modinfo`	Show information about a kernel module	-d description -p list module parameters -n show module file path -F FIELD show single field -k KERNEL query for specific kernel version	`modinfo e1000e` `modinfo -p bonding` `modinfo -n nf_conntrack` `modinfo -d dummy` `modinfo -F version e1000e`
`modprobe`	Load/unload a kernel module and its dependencies	-r remove module -v verbose -n dry run -f force load -l list matching modules (deprecated)	`modprobe -v e1000e` `modprobe -r nf_conntrack` `modprobe -n bonding` `modprobe -f dummy` `modprobe bonding mode=1`
`insmod`	Insert a single kernel module (no dependency resolution)	(no standard options besides module path and params) MODULE.ko param=value pairs after module path	`insmod /lib/modules/$(uname -r)/kernel/drivers/net/dummy.ko` `insmod ./mymodule.ko debug=1` `insmod bonding.ko mode=1 miimon=100` `insmod ./test.ko` `insmod /path/to/module.ko param=value`
`depmod`	Generate module dependency list	-a process all modules (default) -n dry run, print to stdout -v verbose	`depmod -a` `depmod -v` `depmod -n` `depmod $(uname -r)` `sudo depmod -a`
`grub2-mkconfig`	Generate a new GRUB2 configuration file	-o FILE output file (typically /boot/grub2/grub.cfg)	`grub2-mkconfig -o /boot/grub2/grub.cfg` `grub2-mkconfig -o /boot/efi/EFI/centos/grub.cfg` `grub2-mkconfig > /tmp/grub.cfg.test` `sudo grub2-mkconfig -o /boot/grub2/grub.cfg` `grub2-mkconfig -o /boot/grub2/grub.cfg 2>&1 \| tee /tmp/grub.log`
`grub2-install`	Install the GRUB2 boot loader to a device	--target=PLATFORM (i386-pc, x86_64-efi) --boot-directory=DIR --efi-directory=DIR (UEFI systems) --recheck rescan devices DEVICE — target disk (e.g. /dev/sda)	`grub2-install /dev/sda` `grub2-install --target=x86_64-efi --efi-directory=/boot/efi` `grub2-install --recheck /dev/sda` `grub2-install --boot-directory=/boot /dev/sdb` `grub2-install --target=i386-pc /dev/sda`
`grub2-set-default`	Set the default GRUB2 boot entry	NUMBER or TITLE — set default boot entry index/title	`grub2-set-default 0` `grub2-set-default "CentOS Linux (older kernel)"` `grub2-set-default 2` `grub2-editenv list (verify)` `grub2-set-default $(grep -c menuentry /boot/grub2/grub.cfg)`
`grub2-editenv`	View/edit the GRUB2 environment block	list — show current environment block set VAR=VALUE — set a variable unset VAR — remove a variable FILE — specify env block file (default grubenv)	`grub2-editenv list` `grub2-editenv - set saved_entry=0` `grub2-editenv /boot/grub2/grubenv list` `grub2-editenv - unset saved_entry` `grub2-editenv - set menu_show_once=1`
`kernel-install`	Install/remove kernel images and boot entries	add VERSION IMAGE — install a new kernel remove VERSION — remove kernel entry list — list installed kernels	`kernel-install add 5.14.0-1 /boot/vmlinuz-5.14.0-1` `kernel-install remove 5.14.0-1` `kernel-install list` `kernel-install add $(uname -r) /boot/vmlinuz-$(uname -r)` `kernel-install add-all`
`dracut`	Build an initramfs image	-f force overwrite existing initramfs --kver VERSION target kernel version -v verbose --add MODULE add dracut module -o MODULE omit dracut module	`dracut -f` `dracut -f /boot/initramfs-$(uname -r).img $(uname -r)` `dracut --add multipath -f` `dracut -v -f` `dracut -o plymouth -f`
`kexec`	Load and boot into a new kernel without a full reboot	-l KERNEL load kernel for later exec -e execute previously loaded kernel --initrd=FILE specify initrd --command-line=CMDLINE specify kernel cmdline -u unload currently loaded kernel	`kexec -l /boot/vmlinuz --initrd=/boot/initramfs.img --command-line="root=/dev/sda1"` `kexec -e` `kexec -u` `kexec -l /boot/vmlinuz-5.14 --initrd=/boot/initramfs-5.14.img --reuse-cmdline` `kexec --load /boot/vmlinuz --append="console=ttyS0"`
`sysctl`	Runtime kernel parameter management (see Performance)	-a show all parameters -w NAME=VALUE set at runtime -p [FILE] load from sysctl.conf -n show value only, no name --system load all system config files	`sysctl -a \| grep ip_forward` `sysctl -w net.ipv4.ip_forward=1` `sysctl -p /etc/sysctl.d/99-custom.conf` `sysctl net.ipv4.tcp_syncookies` `sysctl --system`
`systemctl`	Query/manage systemd units	start/stop/restart/reload UNIT status UNIT enable/disable UNIT is-active/is-enabled UNIT list-units list-unit-files daemon-reload mask/unmask UNIT --now combine enable+start	`systemctl restart nginx` `systemctl enable --now firewalld` `systemctl status sshd` `systemctl list-units --type=service` `systemctl daemon-reload`

12. Security & Hardening Utilities

Command	Description	Full Options	5 Examples
`passwd`	Change/manage user password	-l lock account -u unlock account -d delete password (no password) -e expire immediately, force change -S show status -n MINDAYS minimum age -x MAXDAYS maximum age -w WARNDAYS warning period	`passwd jdoe` `passwd -l jdoe` `passwd -e jdoe` `passwd -S jdoe` `passwd -x 90 -w 7 jdoe`
`chage`	Manage password aging policy	-l list expiry info -m MIN minimum days between changes -M MAX maximum password age -W WARN warning days before expiry -I INACTIVE days after expiry to disable -E EXPIRE account expire date -d LASTDAY set last change date	`chage -l jdoe` `chage -M 90 jdoe` `chage -W 7 -I 14 jdoe` `chage -E 2026-12-31 jdoe` `chage -d 0 jdoe (force change at next login)`
`faillock`	View/reset failed login attempt counters (PAM)	--user USER show/reset a specific user --reset clear failed attempt records --dir DIR use alternate tally directory	`faillock --user jdoe` `faillock --user jdoe --reset` `faillock` `faillock --reset` `faillock --dir /var/run/faillock --user jdoe`
`pam_tally2`	Legacy failed login attempt counter (PAM)	--user USER show/reset specific user --reset reset counter --deny=N max failed attempts allowed (config) --unlock-time=SECONDS lockout duration (config)	`pam_tally2 --user jdoe` `pam_tally2 --user jdoe --reset` `pam_tally2` `pam_tally2 -u jdoe -r` `pam_tally2 --deny=5 --unlock-time=600`
`auditctl`	Control the kernel audit subsystem	-l list current rules -w PATH watch a file/dir -a ACTION,FILTER add rule -D delete all rules -e 0/1 enable/disable auditing -s show status	`auditctl -l` `auditctl -w /etc/passwd -p wa -k passwd_watch` `auditctl -D` `auditctl -s` `auditctl -a always,exit -F arch=b64 -S execve`
`ausearch`	Search audit logs for events	-k KEY search by rule key -m TYPE search by message type -ts TIME start time -ua USER search by user -i interpret uid/gid to names	`ausearch -k passwd_watch` `ausearch -m USER_LOGIN -ts today` `ausearch -ua jdoe` `ausearch -i -m AVC` `ausearch -ts recent -k rootcmd`
`aureport`	Summarize audit log data	-au authentication report -f file access report -l login report -x executable report --summary summary only	`aureport -au` `aureport -f` `aureport -l --summary` `aureport -x` `aureport --summary`
`setsebool`	Set an SELinux boolean value	-P persistent across reboot BOOLEAN on/off set value	`setsebool -P httpd_can_network_connect on` `setsebool -P httpd_enable_cgi on` `setsebool ftpd_full_access off` `setsebool -P samba_enable_home_dirs on` `setsebool -P nis_enabled 1`
`semanage`	Manage SELinux policy configuration	port — manage port type mappings fcontext — manage file context mappings login — manage user login mappings boolean — manage SELinux booleans user — manage SELinux users	`semanage fcontext -a -t httpd_sys_content_t "/web(/.*)?"` `semanage port -a -t http_port_t -p tcp 8080` `semanage login -a -s staff_u jdoe` `semanage boolean -l \| grep httpd` `semanage user -l`
`restorecon`	Restore default SELinux security contexts	-R recursive -v verbose, show changes -F force reset context even if type matches -n dry run, do not change anything	`restorecon -Rv /var/www/html` `restorecon -v /etc/httpd/conf/httpd.conf` `restorecon -R -n /srv/data` `restorecon -F /var/www/html/index.html` `restorecon -Rv /`
`chcon`	Change SELinux security context of a file	-t TYPE set SELinux type -u USER set SELinux user -R recursive --reference=FILE copy context from file	`chcon -t httpd_sys_content_t /var/www/html/index.html` `chcon -R -t httpd_sys_rw_content_t /var/www/uploads` `chcon --reference=orig.html new.html` `chcon -u system_u /var/www/html/file` `chcon -Rt admin_home_t /home/admin`
`getenforce`	Show current SELinux mode	(no options; prints Enforcing, Permissive, or Disabled)	`getenforce` `echo "SELinux mode: $(getenforce)"` `getenforce \| grep Enforcing` `getenforce > /tmp/selinux_status` `if [ "$(getenforce)" = "Enforcing" ]; then echo on; fi`
`semodule`	Manage SELinux policy modules	-l list installed modules -i install module -r remove module -e enable module -d disable module	`semodule -l` `semodule -i mymodule.pp` `semodule -r mymodule` `semodule -d unwanted_module` `semodule -e mymodule`
`iptables`	Legacy firewall rule management	-A append rule -D delete rule -I insert rule -L list rules -F flush all rules -P set default policy -p PROTOCOL --dport PORT / --sport PORT -j TARGET (ACCEPT/DROP/REJECT) -s / -d source/destination	`iptables -L -n -v` `iptables -A INPUT -p tcp --dport 22 -j ACCEPT` `iptables -P INPUT DROP` `iptables -F` `iptables -A INPUT -s 10.0.0.0/24 -j DROP`
`fail2ban-client`	Control the fail2ban intrusion-prevention daemon	status show overall status status JAIL show specific jail status set JAIL banip IP manually ban an IP set JAIL unbanip IP unban an IP reload reload configuration	`fail2ban-client status` `fail2ban-client status sshd` `fail2ban-client set sshd banip 203.0.113.5` `fail2ban-client set sshd unbanip 203.0.113.5` `fail2ban-client reload`
`lynis`	Security auditing and hardening scanner	audit system — run a full system audit --quick run without user interaction pauses show version update info — check for updates	`lynis audit system` `lynis audit system --quick` `lynis show version` `lynis update info` `lynis audit system --pentest`
`openssl`	TLS/SSL toolkit — keys, certs, ciphers, digests	genrsa — generate RSA key req — create/process certificate requests x509 — display/sign certificates s_client — test TLS connection enc — encrypt/decrypt with a cipher dgst — compute message digest	`openssl genrsa -out key.pem 2048` `openssl req -new -key key.pem -out cert.csr` `openssl x509 -in cert.pem -text -noout` `openssl s_client -connect example.com:443` `openssl dgst -sha256 file.txt`
`ssh-keygen`	Generate/manage SSH key pairs	-t TYPE key type (rsa, ed25519, ecdsa) -b BITS key length -f FILE output filename -C COMMENT key comment -p change passphrase of existing key -l show fingerprint of key	`ssh-keygen -t ed25519 -C "jdoe@host"` `ssh-keygen -t rsa -b 4096 -f ~/.ssh/id_rsa_backup` `ssh-keygen -p -f ~/.ssh/id_rsa` `ssh-keygen -l -f ~/.ssh/id_rsa.pub` `ssh-keygen -t rsa -b 2048 -N ""`
`ssh-copy-id`	Install a public key on a remote host	-i IDENTITY_FILE specify public key file -p PORT remote SSH port -o OPTION pass ssh option	`ssh-copy-id jdoe@host` `ssh-copy-id -i ~/.ssh/id_ed25519.pub jdoe@host` `ssh-copy-id -p 2222 jdoe@host` `ssh-copy-id -o StrictHostKeyChecking=no jdoe@host` `ssh-copy-id -i ~/.ssh/id_rsa.pub root@backup-server`
`gpg`	GNU Privacy Guard — encryption and signing	--gen-key generate a new key pair --encrypt / -e encrypt a file --decrypt / -d decrypt a file --sign / -s sign a file --armor / -a ASCII-armored output --list-keys show keys --import import a key	`gpg --gen-key` `gpg -e -r jdoe@example.com file.txt` `gpg -d file.txt.gpg` `gpg --list-keys` `gpg --import public.key`
`htpasswd`	Manage HTTP basic-auth password files	-c create new password file -b batch mode (password on command line) -n display result without writing file -D delete a user from file -B use bcrypt hashing	`htpasswd -c /etc/httpd/.htpasswd jdoe` `htpasswd -b /etc/httpd/.htpasswd jdoe MyPassword` `htpasswd -D /etc/httpd/.htpasswd jdoe` `htpasswd -B -c /etc/httpd/.htpasswd admin` `htpasswd -n jdoe`
`sudoers`	Sudo privilege configuration file (edit via visudo)	(file, edited via visudo) — syntax: USER HOST=(RUNAS) COMMANDS %GROUP ALL=(ALL) ALL — allow group full sudo NOPASSWD: COMMAND — skip password prompt Defaults — global option directives Cmnd_Alias / User_Alias / Host_Alias — reusable groupings	`%wheel ALL=(ALL) ALL` `jdoe ALL=(ALL) NOPASSWD: /usr/bin/systemctl restart httpd` `Defaults requiretty` `User_Alias ADMINS = jdoe, asmith` `Cmnd_Alias SERVICES = /usr/bin/systemctl restart httpd, /usr/bin/systemctl restart nginx`

13. Miscellaneous Useful Commands

Command	Description	Full Options	5 Examples
`script`	Record a terminal session to a file	-a append to file instead of overwriting -f flush output after each write -q quiet, no start/done messages -t FILE output timing data to file -c COMMAND run a single command instead of shell	`script session.log` `script -a session.log` `script -q /tmp/output.txt` `script -t 2> timing.log session.log` `script -c "yum update" update.log`
`history`	Show command history	-c clear history -d OFFSET delete entry -a append session history to file -r read history file into current session -w write history to file -n read new lines not yet read N show last N lines	`history 20` `history -c` `history -d 45` `!123 (re-run command 123)` `history \| grep yum`
`!!`	Repeat the last command (bash history expansion)	(bash history expansion, not a command) — !! repeats last command !N repeats command number N !STRING repeats last command starting with STRING ^OLD^NEW^ quick substitution in last command	`sudo !!` `!!` `!42` `!yum` `^error^warning^`
`alias`	Create a shorthand for a command	NAME=VALUE define an alias -p print all defined aliases (no args also works)	`alias ll="ls -la"` `alias grep="grep --color=auto"` `alias -p` `alias rm="rm -i"` `alias ..="cd .."`
`unalias`	Remove a defined alias	-a remove all aliases NAME remove specific alias	`unalias ll` `unalias -a` `unalias grep` `unalias ..` `unalias rm`
`env`	Run a command in a modified environment / show environment	-i start with empty environment VAR=VALUE set variable for the invoked command -u NAME remove a variable -0 output NUL-terminated	`env` `env VAR=1 command` `env -i bash` `env -u PATH env` `env -0`
`printenv`	Print environment variables	VARNAME show single variable -0 output NUL-terminated (no trailing newline separators)	`printenv` `printenv PATH` `printenv HOME` `printenv -0` `printenv \| sort`
`export`	Mark a variable for export to child processes	-p list all exported variables -n unexport a variable NAME=VALUE set and export	`export PATH=$PATH:/opt/bin` `export -p` `export -n MYVAR` `export JAVA_HOME=/usr/lib/jvm/java-11` `export EDITOR=vim`
`unset`	Remove a variable or function	-v unset a variable (default) -f unset a function	`unset MYVAR` `unset -f myfunction` `unset HISTFILE` `unset -v PATH_BACKUP` `unset TMPDIR`
`source`	Execute commands from a file in the current shell	FILE [args] — read and execute commands from file in current shell (alias: .)	`source ~/.bashrc` `source /etc/profile` `source venv/bin/activate` `source script.sh arg1` `. ./config.sh`
`bash -c`	Run bash with a command string	-c STRING — execute commands from STRING -x trace execution (xtrace) -i interactive shell --norc do not read startup files	`bash -c "echo hello"` `bash -x script.sh` `bash -c "ls \| wc -l"` `bash --norc -c "env"` `bash -c "for i in 1 2 3; do echo \$i; done"`
`which`	Show full path of executable	-a print all matching executables in PATH --skip-alias ignore alias definitions --skip-functions ignore shell functions --skip-dot skip PATH dirs starting with . --skip-tilde skip PATH dirs starting with ~ --show-dot / --show-tilde formatting of dir output --tty-only stop after first non-tty option	`which ssh` `which -a python3` `which sshd sshd_config` `which -a vim` `which nonexistentcmd; echo $?`
`timeout`	Run a command with a time limit	-s SIGNAL signal to send on timeout (default TERM) -k DURATION also send SIGKILL after DURATION --preserve-status exit with command's status --foreground allow job control	`timeout 10 ping host` `timeout -s KILL 5 sleep 100` `timeout -k 5 30 long_running_cmd` `timeout --preserve-status 5 cmd` `timeout 1m backup.sh`
`flock`	Manage file locks from shell scripts	-x exclusive lock (default) -s shared lock -n non-blocking (fail if locked) -w SECONDS timeout waiting for lock -u unlock	`flock /tmp/lockfile -c "backup.sh"` `flock -n /tmp/lock.lockfile echo ok \|\| echo busy` `flock -x /var/lock/mylock.lock -c "critical_section.sh"` `flock -w 10 /tmp/lock cmd` `flock -s /tmp/sharedlock cat file`
`nice`	Run a command with modified scheduling priority	-n ADJUSTMENT set niceness (-20 highest to 19 lowest priority) --help --version	`nice -n 10 command` `nice -n -5 sudo make` `nice --adjustment=15 backup.sh` `nice tar czf a.tgz /data` `nice -19 find / -name "*.tmp"`
`ionice`	Set/get I/O scheduling class and priority	-c CLASS 1=realtime 2=best-effort 3=idle -n LEVEL priority 0-7 (with class 1/2) -p PID apply to existing process -t ignore failure to set priority	`ionice -c2 -n7 dd if=/dev/zero of=/tmp/test bs=1M count=100` `ionice -c3 rsync -a /src /dst` `ionice -p 4321 -c1 -n0` `ionice -c2 -n0 backup.sh` `ionice -t -c3 updatedb`
`watch`	Repeatedly run a command, showing live output	-n SECONDS interval between runs (default 2) -d highlight differences between updates -g exit when output changes -t no title/header	`watch -n 1 df -h` `watch -d "netstat -tn"` `watch -g "ls /tmp/lockfile"` `watch -t uptime` `watch -n 5 "tail -5 /var/log/messages"`
`parallel`	Run commands in parallel	-j N number of jobs to run simultaneously --dry-run show commands without running -a FILE read arguments from file --eta show estimated time to completion ::: supply argument list inline	`parallel -j4 gzip ::: .log` `ls .txt \| parallel gzip` `parallel --dry-run echo ::: 1 2 3` `parallel -a hosts.txt ping -c1` `parallel --eta -j8 process.sh ::: input*.csv`
`xargs`	Build and execute commands from standard input	-n NUM max arguments per command line -I REPL replace string for each item -P N run N processes in parallel -0 input items NUL-terminated -t print command before executing (verbose) -r do not run if input empty	`find . -name ".tmp" \| xargs rm` `echo "a b c" \| xargs -n1 echo` `find . -print0 \| xargs -0 -I{} mv {} /backup/` `ls .jpg \| xargs -P4 -I{} convert {} {}.png` `xargs -a args.txt echo`
`exec`	Replace shell / redirect descriptors	COMMAND — replace shell process with COMMAND -a NAME set argv[0] name N<&M / N>&M — redirect file descriptors (no new process)	`exec bash` `exec 3< file.txt` `exec > output.log 2>&1` `exec -a myproc ./binary` `exec ssh host`
`disown`	Remove a job from the shell job table	-h keep job in job list but not sent SIGHUP -a apply to all jobs -r apply to running jobs only %N specify job by number	`disown %1` `disown -h %2` `disown -a` `disown -r` `command & disown`
`bg`	Resume a job in the background	%N resume specific stopped job in background (no other options)	`bg` `bg %1` `bg %2` `CTRL-Z then bg` `bg %vim`
`jobs`	List active jobs	-l list PIDs too -p list only PIDs -r running jobs only -s stopped jobs only	`jobs` `jobs -l` `jobs -p` `jobs -r` `jobs -s`
`screen`	Terminal multiplexer / session manager	-S NAME name the session -r reattach to a session -ls list sessions -d detach a session -X CMD send command to a session	`screen -S build` `screen -r build` `screen -ls` `screen -d -r build` `screen -X -S build quit`
`tmux`	Terminal multiplexer / session manager	new -s NAME create named session attach -t NAME attach to session ls list sessions kill-session -t NAME detach (from inside session, prefix+d)	`tmux new -s work` `tmux attach -t work` `tmux ls` `tmux kill-session -t work` `tmux new -s deploy -d`
`scriptreplay`	Replay a terminal session recorded with script	-t TIMINGFILE timing file from script -t -s TYPESCRIPT the recorded output file -d SPEED speed multiplier	`scriptreplay -t timing.log session.log` `scriptreplay --timing timing.log session.log` `scriptreplay -t timing.log -s session.log -d 2` `scriptreplay timing.log typescript` `scriptreplay -t timing.log session.log -d 0.5`
`strace`	Trace system calls made by a process	-p PID attach to running process -f follow forked children -e TRACE=SET filter syscalls (e.g. trace=network) -o FILE write output to file -c summarize counts/times instead of full trace -T show time spent in each syscall	`strace -f -e trace=network curl example.com` `strace -p 1234` `strace -c ls` `strace -o trace.log myprog` `strace -T -f make`
`ltrace`	Trace library calls made by a process	-p PID attach to running process -e FUNC filter to specific library calls -c summary of call counts/times -o FILE write output to file -S also show syscalls	`ltrace ./myprog` `ltrace -p 1234` `ltrace -c ls` `ltrace -o trace.log myprog` `ltrace -S -e malloc ./myprog`
`lsof`	List open files and the processes using them	-i list network files/sockets -p PID files opened by PID -u USER files opened by user -c NAME files opened by command name +D DIR files open under directory	`lsof -i :80` `lsof -p 1234` `lsof -u nginx` `lsof -c sshd` `lsof +D /var/log`
`fuser`	Identify processes using files or sockets	-k kill processes using resource -m show processes using a mounted filesystem -v verbose output -u show user owning process	`fuser -v /var/log/messages` `fuser -k /mnt/usb` `fuser -m /mnt/data` `fuser -u 8080/tcp` `fuser -k 8080/tcp`
`nl`	Number lines of a file	-b STYLE numbering style (a=all, t=non-empty, n=none) -n FORMAT number format (ln, rn, rz) -w WIDTH number field width -s SEP separator after number -i INCREMENT numbering increment	`nl file.txt` `nl -b a file.txt` `nl -w 5 -s ": " file.txt` `nl -i 2 file.txt` `nl -n rz file.txt`
`paste`	Merge lines of files side by side	-d DELIM use DELIM instead of tab -s serial mode, paste one file at a time	`paste file1.txt file2.txt` `paste -d, file1.txt file2.txt` `paste -s file.txt` `paste -d: names.txt ids.txt` `paste -s -d, list.txt`
`join`	Join lines of two files on a common field	-1 FIELD join field of file1 -2 FIELD join field of file2 -t CHAR field separator -a FILENUM output unpairable lines from file -o FORMAT specify output format	`join file1.txt file2.txt` `join -1 2 -2 1 a.txt b.txt` `join -t: /etc/passwd ids.txt` `join -a1 file1.txt file2.txt` `join -o 1.1,2.2 a.txt b.txt`
`split`	Split a file into pieces	-b SIZE split by byte size -l LINES split by number of lines -d use numeric suffixes -a LENGTH suffix length --additional-suffix=SUFFIX	`split -b 100M bigfile.tar part_` `split -l 1000 data.csv chunk_` `split -d -a 3 file.log part` `split -b 10M --additional-suffix=.bin firmware.bin fw_` `split -n 4 archive.tar section_`
`wc`	Count lines, words, and bytes	-l count lines -w count words -c count bytes -m count characters -L length of longest line	`wc -l file.txt` `wc -w document.txt` `wc -c file.bin` `find . -name "*.py" \| xargs wc -l` `wc -L file.txt`
`sort`	Sort lines of text	-n numeric sort -r reverse order -k FIELD sort by field -u unique (remove duplicate lines) -t CHAR field delimiter -h human-numeric sort (K,M,G suffixes) -f case-insensitive	`sort file.txt` `sort -n numbers.txt` `sort -k2 -t: /etc/passwd` `sort -ru names.txt` `sort -h sizes.txt`
`uniq`	Report or omit repeated lines	-c prefix lines with count -d only show duplicated lines -u only show unique lines -i case-insensitive comparison -f N skip first N fields	`sort file.txt \| uniq` `uniq -c access.log \| sort -rn` `uniq -d names.txt` `uniq -u names.txt` `sort ids.txt \| uniq -i`
`tr`	Translate or delete characters	-d delete characters -s squeeze repeated characters -c complement the SET1 SET1 SET2 translate characters	`tr "a-z" "A-Z" < file.txt` `tr -d "\n" < file.txt` `tr -s " " < file.txt` `echo "hello" \| tr -c "a-z" "_"` `cat file.txt \| tr -d "\r"`
`cut`	Extract sections from each line	-d DELIM field delimiter -f FIELDS select fields -c CHARS select character positions --complement invert selection -s suppress lines without delimiter	`cut -d: -f1 /etc/passwd` `cut -c1-10 file.txt` `cut -d, -f2,4 data.csv` `cut -f1 --complement data.tsv` `cut -d: -f1,3 -s /etc/passwd`
`awk`	Pattern scanning and text-processing language	-F SEP field separator -v VAR=VALUE set variable -f SCRIPTFILE read program from file '{ pattern { action } }' inline program syntax	`awk -F: '{print $1}' /etc/passwd` `awk '{sum+=$1} END{print sum}' numbers.txt` `awk -v x=5 '{print $1*x}' file.txt` `awk -f script.awk data.txt` `awk '/error/{print NR, $0}' log.txt`
`sed`	Stream editor for filtering/transforming text	-i edit files in place -e SCRIPT add script to commands to run -n suppress automatic printing -r / -E extended regex s/OLD/NEW/g substitute globally	`sed -i "s/foo/bar/g" file.txt` `sed -n "2,5p" file.txt` `sed -e "s/^#//" config.conf` `sed -r "s/[0-9]+/N/g" file.txt` `sed "/^$/d" file.txt (remove blank lines)`
`grep`	Search text using patterns	-i ignore case -v invert match -r/-R recursive -n line numbers -c count matches -l files with matches -w whole word -E extended regex -A/-B/-C NUM context lines --include=GLOB / --exclude=GLOB	`grep -i "error" /var/log/*` `grep -rn "TODO" /opt/app/src` `grep -v "^#" /etc/fstab` `grep -E "fail\|error" /var/log/secure` `grep -c "GET" access.log`
`diff`	Compare files line by line	-u unified format -c context format -r recursive (compare directories) -q report only whether files differ -y side-by-side format -i ignore case	`diff -u old.txt new.txt` `diff -r dir1/ dir2/` `diff -q file1 file2` `diff -y a.txt b.txt` `diff -i a.txt b.txt`
`patch`	Apply a diff file to an original	-p NUM strip NUM leading path components -i FILE read patch from file -R reverse a previously applied patch --dry-run test without modifying files -b make backup of original files	`patch -p1 < changes.patch` `patch -i fix.patch file.c` `patch -R -p1 < changes.patch` `patch --dry-run -p1 < changes.patch` `patch -b file.c < fix.patch`
`cmp`	Compare two files byte by byte	-s silent, only exit status -l list all differing byte positions -b print differing bytes -n LIMIT compare only first N bytes	`cmp file1 file2` `cmp -s file1 file2 && echo same` `cmp -l file1 file2` `cmp -b a.bin b.bin` `cmp -n 100 a.bin b.bin`
`base64`	Encode/decode base64 data	-d decode instead of encode -w COLS wrap lines at COLS (0 = no wrap) -i ignore garbage in decode input	`base64 file.txt > file.b64` `base64 -d file.b64 > file.txt` `base64 -w0 file.bin` `echo "hello" \| base64` `base64 -d -i input.b64`
`md5sum`	Compute/check MD5 checksums	-c check sums against a list file --quiet only show failures with -c -b binary mode read	`md5sum file.iso` `md5sum -c checksums.md5` `md5sum *.txt > sums.md5` `md5sum -c sums.md5 --quiet` `md5sum file.bin`
`gzip`	Compress/decompress files (.gz)	-d decompress (same as gunzip) -k keep original file -r recursive -N level (1 fastest .. 9 best compression) -c write to stdout -l list compressed file info	`gzip file.txt` `gzip -d file.txt.gz` `gzip -9 -k bigfile.log` `gzip -c file.txt > file.txt.gz` `gzip -l archive.gz`
`bzip2`	Compress/decompress files (.bz2)	-d decompress -k keep original file -N level (1-9) -c write to stdout -t test integrity	`bzip2 file.txt` `bzip2 -d file.txt.bz2` `bzip2 -9 -k data.log` `bzip2 -c file.txt > file.txt.bz2` `bzip2 -t archive.bz2`
`xz`	Compress/decompress files (.xz)	-d decompress -k keep original file -N level (0-9) -c write to stdout -T N number of threads -t test integrity	`xz file.tar` `xz -d file.tar.xz` `xz -9 -k bigfile.log` `xz -T4 largefile.tar` `xz -t archive.tar.xz`
`tar`	Archive files (tape archive)	-c create archive -x extract archive -t list contents -z gzip compression -j bzip2 compression -J xz compression -v verbose -f FILE archive filename -C DIR change to directory before operation --exclude=PATTERN	`tar czf backup.tar.gz /etc` `tar xzf backup.tar.gz -C /restore` `tar tvf archive.tar` `tar cjf backup.tar.bz2 /data` `tar --exclude="*.log" -czf app.tar.gz /opt/app`
`zip`	Create/update zip archives	-r recursive (zip a directory) -e encrypt with password prompt -x exclude files matching pattern -9 best compression -u update existing zip -d delete entries from zip	`zip -r backup.zip /var/www` `zip -e secure.zip secrets.txt` `zip -r site.zip . -x ".git"` `zip -u archive.zip newfile.txt` `zip -d archive.zip oldfile.txt`
`rsync`	Efficient file sync/copy tool	-a archive mode (recursive+preserve) -v verbose -z compress -r recursive --delete remove extraneous files at destination -e SSH_CMD specify remote shell --dry-run show what would happen -P show progress + partial transfer	`rsync -avz /src/ user@host:/dst/` `rsync -a --delete /data/ /backup/` `rsync -avzP file.tgz host:/tmp/` `rsync -e "ssh -p 2222" -a /src/ host:/dst/` `rsync -a --dry-run /src/ /dst/`
`scp`	Secure copy over SSH	-r recursive -P PORT remote port -i IDENTITY_FILE private key -p preserve times/modes -C compress during transfer	`scp file.txt jdoe@host:/tmp/` `scp -r ./project jdoe@host:/opt/` `scp -P 2222 backup.tgz jdoe@host:~/` `scp -i key.pem file.txt user@host:/tmp/` `scp jdoe@host:/etc/hosts ./hosts.bak`
`sftp`	Secure FTP over SSH	-P PORT remote port -i IDENTITY_FILE private key -b BATCHFILE batch mode script -r (with put/get) recursive	`sftp jdoe@host.example.com` `sftp -P 2222 jdoe@host` `sftp -i key.pem jdoe@host` `sftp -b script.txt jdoe@host` `sftp> get -r /remote/dir`
`ftp`	Legacy plaintext file transfer client	-p passive mode (default in most clients) -n disable auto-login -i turn off interactive prompting -v verbose	`ftp ftp.example.com` `ftp -n ftp.example.com` `ftp -i ftp.example.com` `ftp -v ftp.example.com` `ftp> get filename.txt`
`lftp`	Advanced file transfer client (FTP/SFTP/HTTP)	-u USER,PASS specify credentials -e COMMAND execute command then continue -p PORT specify port -f FILE run script from file	`lftp ftp://ftp.example.com` `lftp -u jdoe,secret ftp.example.com` `lftp -e "mirror /remote /local; quit" ftp.example.com` `lftp -p 2121 sftp://host` `lftp -f script.lftp`
`wget`	Non-interactive file downloader	-O FILE output filename -c continue partial download -r recursive download -b background -q quiet --limit-rate=RATE throttle bandwidth	`wget https://example.com/file.tar.gz` `wget -O out.html https://example.com` `wget -c https://example.com/bigfile.iso` `wget -r -np https://example.com/docs/` `wget --limit-rate=200k https://example.com/file`
`curl`	Transfer data with URLs, many protocols	-O save with remote filename -o FILE save as filename -I headers only -L follow redirects -X METHOD HTTP method -d DATA POST data -H HEADER custom header -u USER:PASS basic auth -k insecure (skip TLS verify) -s silent	`curl -I https://example.com` `curl -O https://example.com/file.zip` `curl -X POST -d "a=1" https://api.example.com` `curl -H "Authorization: Bearer TOKEN" https://api.example.com` `curl -Lk https://self-signed.example.com`
`lynx`	Text-mode web browser	-dump dump rendered page to stdout -source dump raw HTML source -accept_all_cookies -nolist omit link list in dump	`lynx https://example.com` `lynx -dump https://example.com` `lynx -source https://example.com > page.html` `lynx -accept_all_cookies https://example.com` `lynx -dump -nolist https://example.com`
`mailx`	Send/read mail from the command line	-s SUBJECT set subject line -a FILE attach a file -c ADDR CC address -r ADDR from address	`echo "body" \| mailx -s "Subject" user@example.com` `mailx -s "Report" -a report.pdf user@example.com` `echo hi \| mailx -s test -c cc@example.com to@example.com` `mailx -s "Alert" -r noreply@example.com admin@example.com` `mailx -s "Test" user@example.com < message.txt`
`mutt`	Text-based email client	-s SUBJECT set subject -a FILE attach a file -F FILE alternate config file -f MAILBOX open specific mailbox	`echo "body" \| mutt -s "Subject" user@example.com` `mutt -s "Report" -a report.pdf -- user@example.com < body.txt` `mutt -f /var/mail/jdoe` `mutt -F ~/.muttrc-work` `mutt -s "test" user@example.com < /dev/null`
`ssh-agent`	Cache SSH private keys for a session	-s output Bourne-shell commands -c output C-shell commands -k kill currently running agent -t LIFETIME set default key lifetime	`eval $(ssh-agent -s)` `ssh-agent bash` `ssh-agent -k` `ssh-add -l (list loaded keys)` `ssh-agent -t 3600 -s`
`autossh`	Automatically restart SSH tunnels	-M PORT monitor port for connection health -f run in background -t force pseudo-tty allocation (other args passed through to ssh)	`autossh -M 20000 -f jdoe@host` `autossh -M 0 -o "ServerAliveInterval 30" jdoe@host` `autossh -M 20000 -L 8080:localhost:80 jdoe@host` `autossh -f -M 20001 -N jdoe@host` `autossh -M 20000 -t jdoe@host "tmux attach"`
`ncdu`	NCurses disk usage analyzer	-x stay on one filesystem -e export scan to file (some versions) -r read-only mode (no delete) -o FILE export scan output	`ncdu /var` `ncdu -x /` `ncdu -o scan.json /home` `ncdu -r /etc` `ncdu -e /var/log`
`btop`	Resource monitor (modern TUI)	(mostly interactive TUI; few CLI flags) --utf-force force UTF8 --low-color 256-color mode -p PRESET load a preset config	`btop` `btop --utf-force` `btop --low-color` `btop -p 1` `btop --help`
`glances`	Cross-platform system monitoring tool	-t SECONDS refresh interval -1 percpu mode -w start web server mode -s start as a server for remote clients -4/-6 restrict to IPv4/IPv6 in web mode	`glances` `glances -t 2` `glances -w` `glances -s` `glances -1`
`htop`	Interactive process viewer	-d DELAY update delay (tenths of sec) -u USER filter by user -p PID monitor specific PIDs -s SORTCOL sort column -C no-color mode	`htop` `htop -u nginx` `htop -d 10` `htop -p 1234` `htop -C`
`iotop`	Real-time disk I/O usage per process	-o only show processes doing I/O -b batch mode (non-interactive) -n NUM number of iterations -d SECONDS delay between updates -a accumulated I/O instead of bandwidth	`iotop` `iotop -o` `iotop -b -n 3` `iotop -a` `iotop -d 5`
`vnstat`	Network traffic monitor/statistics	-i IFACE specify interface -d daily statistics -m monthly statistics -h hourly statistics -l live traffic view --create create new database for interface	`vnstat -i eth0` `vnstat -d` `vnstat -m` `vnstat -l` `vnstat --create -i eth1`
`speedtest-cli`	Test internet bandwidth from the command line	--simple simple output format --list list nearby servers --server ID use specific server --bytes show results in bytes not bits --json output as JSON	`speedtest-cli` `speedtest-cli --simple` `speedtest-cli --list` `speedtest-cli --server 1234` `speedtest-cli --json`
`iperf3`	Network throughput benchmarking tool	-s run as server -c HOST run as client, connect to server -p PORT port number -t SECONDS test duration -P N parallel streams -u UDP mode instead of TCP	`iperf3 -s` `iperf3 -c 10.0.0.5` `iperf3 -c 10.0.0.5 -t 30 -P 4` `iperf3 -c 10.0.0.5 -u -b 100M` `iperf3 -s -p 5202`
`ethtool`	Query/control Ethernet device settings	IFACE — show settings -i IFACE driver info -S IFACE statistics -s IFACE speed SPEED duplex full autoneg off — set speed -p IFACE identify (blink)	`ethtool eth0` `ethtool -i eth0` `ethtool -S eth0` `ethtool -s eth0 speed 1000 duplex full autoneg off` `ethtool -p eth0 5`
`mii-tool`	View/manipulate MII status of NIC (legacy)	-v verbose -w watch for link changes -r restart autonegotiation IFACE specify interface	`mii-tool` `mii-tool eth0` `mii-tool -v eth0` `mii-tool -r eth0` `mii-tool -w eth0`
`arp-scan`	ARP-based network host discovery	-l scan local network (--localnet) -I IFACE specify interface --interface=IFACE -x quiet, minimal output -g generate host list for later use	`arp-scan -l` `arp-scan -I eth0 -l` `arp-scan --interface=eth1 192.168.1.0/24` `arp-scan -x 192.168.1.0/24` `arp-scan -l -g`
`nmap`	Network exploration and port scanner	-sS TCP SYN scan -sU UDP scan -p PORTS specify ports -A aggressive scan (OS/version/scripts) -O OS detection -sV service version detection -Pn skip host discovery	`nmap 192.168.1.0/24` `nmap -p 1-1000 host.example.com` `nmap -sV -sS host` `nmap -A host.example.com` `nmap -Pn -p80,443 host`
`netcat`	Read/write raw TCP/UDP connections	-l listen mode -p PORT local port -v verbose -z zero-I/O (port scan) -u UDP mode	`netcat -zv host.example.com 80` `netcat -l 8080` `nc -u host 53` `echo test \| netcat host 9000` `netcat -w 3 host 22`
`socat`	Bidirectional data relay between two channels	TCP-LISTEN:PORT listen on TCP port TCP:HOST:PORT connect to TCP endpoint -d / -dd increase verbosity/debug level fork handle multiple connections	`socat TCP-LISTEN:8080,fork TCP:backend:80` `socat - TCP:host.example.com:80` `socat -d -d TCP-LISTEN:9000,reuseaddr,fork EXEC:/bin/bash` `socat UNIX-LISTEN:/tmp/sock,fork TCP:localhost:80` `socat STDIO TCP:host:22`
`stunnel`	Wrap plaintext connections in TLS	-fd FD use existing file descriptor -p PIDFILE write pid file -c foreground/client mode (config-driven mostly) CONFIGFILE — path to stunnel config	`stunnel /etc/stunnel/stunnel.conf` `stunnel -fd 3` `stunnel -p /var/run/stunnel.pid /etc/stunnel/stunnel.conf` `stunnel -c /etc/stunnel/client.conf` `stunnel -help (list options)`
`openssl s_client`	Test/inspect a TLS server connection	-connect HOST:PORT connect to TLS endpoint -servername NAME SNI hostname -showcerts show full cert chain -cipher LIST restrict cipher list -tls1_2 force protocol version	`openssl s_client -connect example.com:443` `openssl s_client -connect example.com:443 -servername example.com` `openssl s_client -connect host:443 -showcerts` `openssl s_client -connect host:443 -tls1_2` `echo \| openssl s_client -connect host:443 2>/dev/null \| openssl x509 -noout -dates`
`certbot`	Obtain/renew Let's Encrypt TLS certificates	certonly obtain cert without installing --nginx / --apache plugin for automatic config -d DOMAIN specify domain --dry-run test without real request renew renew all due certificates	`certbot certonly --nginx -d example.com` `certbot --apache -d example.com -d www.example.com` `certbot renew` `certbot renew --dry-run` `certbot certificates (list existing)`
`fail2ban-client`	Control the fail2ban intrusion-prevention daemon	status show overall status status JAIL show specific jail status set JAIL banip IP manually ban an IP set JAIL unbanip IP unban an IP reload reload configuration	`fail2ban-client status` `fail2ban-client status sshd` `fail2ban-client set sshd banip 203.0.113.5` `fail2ban-client set sshd unbanip 203.0.113.5` `fail2ban-client reload`
`auditd`	Linux audit daemon service control	(service; controlled via systemctl) status/start/stop/restart config file: /etc/audit/auditd.conf	`systemctl status auditd` `systemctl restart auditd` `systemctl enable auditd` `cat /etc/audit/auditd.conf` `service auditd status`
`ausearch`	Search audit daemon logs	-k KEY search by rule key -m TYPE search by message type -ts TIME start time -ua USER search by user -i interpret uid/gid to names	`ausearch -k passwd_watch` `ausearch -m USER_LOGIN -ts today` `ausearch -ua jdoe` `ausearch -i -m AVC` `ausearch -ts recent -k rootcmd`
`setfacl`	Set POSIX ACLs	-m modify ACL entry -x remove ACL entry -b remove all ACL entries -R recursive -d default ACL for directory --set replace entire ACL	`setfacl -m u:jdoe:rwx /shared` `setfacl -x u:jdoe /shared` `setfacl -Rm g:devs:rx /projects` `setfacl -b /shared` `setfacl -d -m u:jdoe:rwx /shared`
`chmod`	Change file mode bits	u/g/o/a +/-/= rwx symbolic mode numeric mode e.g. 750 -R recursive --reference=FILE copy mode from file -v verbose -c report changes only -f suppress errors	`chmod 750 /var/www/html` `chmod -R g+rwX /shared` `chmod u+x deploy.sh` `chmod --reference=orig.conf new.conf` `chmod -c 644 *.txt`
`useradd`	Create new user	-m create home directory -d DIR home directory path -s SHELL login shell -g GROUP primary group -G GROUPS secondary groups -c COMMENT gecos field -e DATE account expiry -u UID specify uid -r create system account	`useradd -m -s /bin/bash jdoe` `useradd -m -G wheel,devs -s /bin/bash admin1` `useradd -r -s /sbin/nologin svcacct` `useradd -e 2026-12-31 tempuser` `useradd -u 5001 -d /opt/app appuser`
`groupadd`	Create new group	-g GID specify GID -r create system group -f exit success if group exists	`groupadd devs` `groupadd -g 2001 developers` `groupadd -r svcgroup` `groupadd -f existinggroup` `groupadd -g 3000 finance`
`su`	Switch user	- (dash) start login shell -c COMMAND run single command -s SHELL specify shell -l same as - -p preserve environment	`su - root` `su -c "systemctl restart nginx" root` `su -s /bin/bash jdoe` `su -l postgres` `su -p www-data`
`visudo`	Safely edit sudoers file	-c check sudoers syntax without editing -f FILE edit alternate file -s strict syntax checking	`visudo` `visudo -c` `visudo -f /etc/sudoers.d/custom` `visudo -s` `sudo visudo -c`
`chsh`	Change login shell	-s SHELL set shell -l list available shells	`chsh -s /bin/zsh jdoe` `chsh -l` `chsh -s /bin/bash` `chsh jdoe (interactive)` `chsh -s $(which fish)`
`passwd`	Change/manage user password	-l lock account -u unlock account -d delete password (no password) -e expire immediately, force change -S show status -n MINDAYS minimum age -x MAXDAYS maximum age -w WARNDAYS warning period	`passwd jdoe` `passwd -l jdoe` `passwd -e jdoe` `passwd -S jdoe` `passwd -x 90 -w 7 jdoe`
`chage`	Manage password aging policy	-l list expiry info -m MIN minimum days between changes -M MAX maximum password age -W WARN warning days before expiry -I INACTIVE days after expiry to disable -E EXPIRE account expire date -d LASTDAY set last change date	`chage -l jdoe` `chage -M 90 jdoe` `chage -W 7 -I 14 jdoe` `chage -E 2026-12-31 jdoe` `chage -d 0 jdoe (force change at next login)`
`gpasswd`	Administer /etc/group	-a USER add to group -d USER delete from group -A USER set administrators -M USER set members list -r remove group password	`gpasswd -a jdoe wheel` `gpasswd -d jdoe wheel` `gpasswd -A admin1,admin2 devteam` `gpasswd -M user1,user2 devteam` `gpasswd -r devteam`
`newgrp`	Log in to a new group (changes primary GID)	GROUP switch primary group for session - (dash) start login shell with new group	`newgrp developers` `newgrp -` `newgrp wheel` `newgrp finance` `newgrp - devs`
`id`	Show UID/GID/groups	-u print effective UID -g print effective GID -G print all group IDs -n print name instead of number -nu / -ng / -nG combine name+category -Z print SELinux context	`id jdoe` `id -u` `id -Gn jdoe` `id -Z` `id -un`
`whoami`	Show current effective user	(no options besides --help/--version)	`whoami` `echo "Current user: $(whoami)"` `whoami --version` `sudo whoami` `ssh host whoami`
`groups`	List group membership	(no options; optional USER argument)	`groups jdoe` `groups` `groups root` `groups $(whoami)` `groups www-data`
`last`	Show last logins	-n NUM limit lines -f FILE alternate wtmp file -a display hostname last -x show shutdown/runlevel -t YYYYMMDDHHMMSS show state at time	`last -n 10` `last reboot` `last -a` `last jdoe` `last -x`
`w`	Who is logged in and what they are doing	-h no header -s short format -f show/hide from field -u ignore idle time	`w` `w -h` `w jdoe` `w -s` `w -u`
`uptime`	How long the system has been running	-p pretty format -s since (boot time) -V version	`uptime` `uptime -p` `uptime -s` `watch uptime` `uptime \| awk -F"," "{print \$1}"`
`hostname`	Show/set system hostname	status show current settings set-hostname NAME set-icon-name NAME set-chassis TYPE set-deployment ENV set-location LOC --static / --transient / --pretty scope	`hostnamectl status` `hostnamectl set-hostname web01` `hostnamectl set-hostname web01 --pretty` `hostnamectl set-chassis server` `hostnamectl set-deployment production`
`timedatectl`	Control system time/date/timezone	status show current settings set-time TIME set-timezone ZONE list-timezones set-ntp true/false show all properties	`timedatectl status` `timedatectl set-timezone Asia/Singapore` `timedatectl set-ntp true` `timedatectl list-timezones` `timedatectl set-time "2026-07-27 09:00:00"`
`clock`	Query/set hardware clock	-r read hardware clock -w write system time to hardware clock -s set system time from hw clock -u treat hw clock as UTC	`clock -r` `clock -w` `sudo hwclock --systohc` `hwclock -s` `hwclock -u -w`
`date`	Print/set system date	-d STRING display arbitrary date -s STRING set system date/time -u UTC/GMT time +FORMAT custom output format -R RFC-2822 format -I[=TIMESPEC] ISO 8601 format -r FILE last modification of FILE	`date` `date +"%Y-%m-%d %H:%M:%S"` `date -d "next friday"` `sudo date -s "2026-07-27 10:00:00"` `date -u`
`cal`	Display a calendar	-y show whole year -3 show previous/current/next month -m MONTH specify month -j julian day numbers	`cal` `cal -y` `cal -3` `cal 7 2026` `cal -j`
`bc`	Arbitrary-precision calculator language	-l load math library (adds sin, cos, sqrt etc.) -q quiet, no welcome banner scale=N set decimal precision (inside bc)	`echo "5+3" \| bc` `echo "scale=2; 10/3" \| bc` `bc -l <<< "sqrt(2)"` `echo "2^10" \| bc` `bc -q`
`units`	Convert between measurement units	FROM TO convert between two units -t terse output (just the number) -v verbose	`units "5 miles" "km"` `units -t "1 gallon" "liters"` `units "100 fahrenheit" "celsius"` `units` `units -v "1 TB" "GB"`
`xxd`	Make a hex dump of a file	-r reverse (hex to binary) -l LEN limit number of bytes shown -c COLS bytes per line -p plain hex dump (no addresses/ASCII)	`xxd file.bin \| head` `xxd -r hexdump.txt > file.bin` `xxd -l 64 file.bin` `xxd -c 8 file.bin` `xxd -p file.bin`
`od`	Dump files in octal/hex/other formats	-c character display -x hex display (2-byte) -A RADIX address radix (d,o,x,n) -N BYTES limit bytes read -t TYPE specify output format	`od -c file.bin` `od -x file.bin \| head` `od -A x -t x1z file.bin` `od -N 32 file.bin` `od -t d4 file.bin`
`strings`	Print printable character sequences in a file	-n MIN minimum string length to show -a scan entire file (not just data sections) -t FORMAT show offset (o,d,x) -e ENCODING character encoding	`strings /bin/ls` `strings -n 8 binaryfile` `strings -a -t x binaryfile` `strings -e l file.exe` `strings /usr/bin/python3 \| grep -i version`
`file`	Determine file type	-b brief, omit filename -i show MIME type -z look inside compressed files -L follow symlinks	`file /etc/passwd` `file -i document.pdf` `file -z archive.tar.gz` `file -L symlink` `file *.bin`
`stat`	Show detailed file/filesystem status	-c FORMAT custom output format -f filesystem status instead of file status -L follow symlinks -t terse output format	`stat /etc/passwd` `stat -c "%a %U %G" file.txt` `stat -f /var` `stat -L symlink` `stat -t /etc/hosts`
`readlink`	Print resolved symbolic links	-f canonicalize, resolve all symlinks fully -e like -f but requires final path to exist -m like -f but does not require any path to exist	`readlink /etc/alternatives/java` `readlink -f ./relative/../path` `readlink -e /etc/hosts` `readlink -m /nonexistent/path` `readlink symlink.txt`
`realpath`	Print resolved absolute file path	-e require path to exist -m no requirement, allow missing components --relative-to=DIR output relative to DIR -s do not expand symlinks	`realpath file.txt` `realpath -e /etc/hosts` `realpath --relative-to=/home .` `realpath -m /does/not/exist` `realpath -s ./symlink`
`mktemp`	Create a temporary file or directory	-d create a directory instead of a file -p DIR use DIR instead of $TMPDIR -u dry run, print name without creating --suffix=SUFFIX append suffix to generated name	`mktemp` `mktemp -d` `mktemp /tmp/myapp.XXXXXX` `mktemp -d -p /var/tmp` `mktemp --suffix=.log`
`tempfile`	Create a temporary file (legacy Debian-style)	-d DIR directory to create in -p PREFIX filename prefix -s SUFFIX filename suffix -m MODE file permissions	`tempfile` `tempfile -p myapp_` `tempfile -d /tmp -s .log` `tempfile -m 600` `FILE=$(tempfile); echo "$FILE"`
`dirname`	Strip last component from a file path	-z, --zero — end each output line with NUL --help --version	`dirname /var/log/httpd/access_log` `dirname "$0"` `dirname /etc/passwd` `dirname ./relative/path/file.txt` `dirname -z /a/b/c`
`pwd`	Print working directory	-L logical (default) -P physical, resolve symlinks	`pwd` `pwd -P` `pwd -L` `cd /tmp; pwd` `(cd /var/log && pwd)`
`cd`	Change directory	-L logical path (default) -P physical path, resolve symlinks -e exit non-zero if -P dir not found cd - previous dir cd (no args) $HOME	`cd /var/log` `cd ..` `cd -` `cd ~jdoe` `cd -P /var/www/html`
`pushd`	Push a directory onto the directory stack	DIR — push DIR and cd into it +N rotate to Nth directory in stack -n suppress directory change, only manipulate stack	`pushd /var/log` `pushd +1` `pushd -n /tmp` `pushd ~/projects` `pushd ..`
`dirs`	Display the directory stack	-c clear the directory stack -v verbose, one per line with index -p print one per line (no index) +N/-N show single entry by index	`dirs` `dirs -v` `dirs -c` `dirs -p` `dirs +1`
`alias`	Create a shorthand for a command (duplicate — see above)	NAME=VALUE define an alias -p print all defined aliases (no args also works)	`alias ll="ls -la"` `alias grep="grep --color=auto"` `alias -p` `alias rm="rm -i"` `alias ..="cd .."`
`unalias`	Remove an alias (duplicate — see above)	-a remove all aliases NAME remove specific alias	`unalias ll` `unalias -a` `unalias grep` `unalias ..` `unalias rm`
`history`	Show command history (duplicate — see above)	-c clear history -d OFFSET delete entry -a append session history to file -r read history file into current session -w write history to file -n read new lines not yet read N show last N lines	`history 20` `history -c` `history -d 45` `!123 (re-run command 123)` `history \| grep yum`
`fc`	Fix/re-execute a command from history	-l list recent commands -e EDITOR choose editor for command -s re-execute a command (like history substitution)	`fc -l` `fc -l -10` `fc -s ls (re-run last ls)` `fc -e vim 15` `fc -l 10 20`
`bind`	Display or set readline key bindings	-p list all key bindings and functions -P list bindings in readable form -x KEYSEQ:CMD bind a key to a shell command -f FILE read bindings from file	`bind -p \| less` `bind -x '"\C-l":clear'` `bind -P` `bind -f ~/.inputrc` `bind '"\e[A": history-search-backward'`
`shopt`	Set/unset bash shell options	-s OPTION enable a shell option -u OPTION disable a shell option -p print all options and their state -q quiet, test option state via exit code	`shopt -s nullglob` `shopt -u dotglob` `shopt -p` `shopt -s histappend` `shopt -q extglob`
`set`	Set shell options and positional parameters	-e exit immediately on error -x print commands before executing (xtrace) -u treat unset variables as error -o pipefail fail pipeline if any command fails -- separate options from positional args	`set -e` `set -x` `set -euo pipefail` `set -- arg1 arg2` `set +x (disable tracing)`
`unset`	Remove a variable (duplicate — see above)	-v unset a variable (default) -f unset a function	`unset MYVAR` `unset -f myfunction` `unset HISTFILE` `unset -v PATH_BACKUP` `unset TMPDIR`
`export`	Export a variable (duplicate — see above)	-p list all exported variables -n unexport a variable NAME=VALUE set and export	`export PATH=$PATH:/opt/bin` `export -p` `export -n MYVAR` `export JAVA_HOME=/usr/lib/jvm/java-11` `export EDITOR=vim`
`source`	Execute a script in current shell (duplicate — see above)	FILE [args] — read and execute commands from file in current shell (alias: .)	`source ~/.bashrc` `source /etc/profile` `source venv/bin/activate` `source script.sh arg1` `. ./config.sh`
`.`	Execute commands from a file (POSIX alias for source)	FILE [args] — read and execute commands from file in current shell (same as source)	`. ~/.bashrc` `. ./env.sh` `. /etc/profile` `. venv/bin/activate` `. script.sh arg1`
`exec`	Replace shell / redirect descriptors (duplicate — see above)	COMMAND — replace shell process with COMMAND -a NAME set argv[0] name N<&M / N>&M — redirect file descriptors (no new process)	`exec bash` `exec 3< file.txt` `exec > output.log 2>&1` `exec -a myproc ./binary` `exec ssh host`
`eval`	Construct and execute a command from arguments	STRING — construct and execute a command from arguments	`eval "ls -l $DIR"` `eval $(ssh-agent -s)` `eval "echo \$$VARNAME"` `CMD="ls -l"; eval $CMD` `eval "$(cat command.txt)"`
`wait`	Wait for background jobs to complete	%N wait for specific job PID wait for specific process ID -n wait for next job to finish (any)	`wait %1` `wait 1234` `wait -n` `wait (wait for all background jobs)` `job1 & job2 & wait`
`jobs`	List active jobs (duplicate — see above)	-l list PIDs too -p list only PIDs -r running jobs only -s stopped jobs only	`jobs` `jobs -l` `jobs -p` `jobs -r` `jobs -s`
`bg`	Resume a job in the background (duplicate — see above)	%N resume specific stopped job in background (no other options)	`bg` `bg %1` `bg %2` `CTRL-Z then bg` `bg %vim`
`disown`	Remove a job from the shell job table (duplicate — see above)	-h keep job in job list but not sent SIGHUP -a apply to all jobs -r apply to running jobs only %N specify job by number	`disown %1` `disown -h %2` `disown -a` `disown -r` `command & disown`
`kill`	Send a signal to a process by PID	-SIGNAL or -s SIGNAL name/number -l list signal names -9 SIGKILL -15 SIGTERM (default) -1 SIGHUP	`kill -15 $(pgrep httpd)` `kill -9 1234` `kill -HUP $(cat /var/run/nginx.pid)` `kill -l` `kill %1`
`killall`	Send a signal to processes by name	-SIGNAL name/number -i interactive confirm -u USER match only user processes -w wait for processes to die -v report if signal sent	`killall httpd` `killall -9 java` `killall -u jdoe -i firefox` `killall -w sshd` `killall -v nginx`
`pkill`	Kill processes matching a pattern	-SIGNAL specify signal -u USER -f full cmdline match -x exact match -o oldest match	`pkill -9 -f myscript.py` `pkill -u jdoe` `pkill httpd` `pkill -x bash` `pkill -o -f server.js`
`pgrep`	Find processes matching a pattern	-l list name with PID -u USER match effective user -f match full cmdline -x exact match -n newest matching -o oldest matching	`pgrep -l sshd` `pgrep -u nginx` `pgrep -f "java -jar app"` `pgrep -n httpd` `pgrep -x cron`
`nice`	Set process priority (duplicate — see above)	-n ADJUSTMENT set niceness (-20 highest to 19 lowest priority) --help --version	`nice -n 10 command` `nice -n -5 sudo make` `nice --adjustment=15 backup.sh` `nice tar czf a.tgz /data` `nice -19 find / -name "*.tmp"`
`ionice`	Set I/O scheduling priority (duplicate — see above)	-c CLASS 1=realtime 2=best-effort 3=idle -n LEVEL priority 0-7 (with class 1/2) -p PID apply to existing process -t ignore failure to set priority	`ionice -c2 -n7 dd if=/dev/zero of=/tmp/test bs=1M count=100` `ionice -c3 rsync -a /src /dst` `ionice -p 4321 -c1 -n0` `ionice -c2 -n0 backup.sh` `ionice -t -c3 updatedb`
`schedtool`	Query/set scheduler policy and CPU affinity	-F FIFO scheduling policy -B batch scheduling policy -N normal scheduling policy -p PRIORITY set priority -e run command with settings applied	`schedtool -F -p 10 -e myprog` `schedtool -B -e backup.sh` `schedtool -N -p 0 -e normaltask` `schedtool -r -a 0,1 -e myprog` `schedtool -F -p 99 -e realtime_task`
`taskset`	Set/get a process's CPU affinity	-c LIST specify CPU list (e.g. 0-3) -p PID apply to existing process -a apply to all threads of process	`taskset -c 0-3 myprog` `taskset -p 1234` `taskset -pc 2 1234` `taskset -c 0,2,4 myprog` `taskset -a -c 0-1 -p 5678`
`numactl`	Control NUMA policy for processes/memory	--cpunodebind=NODE bind CPU execution to NUMA node --membind=NODE bind memory allocation to NUMA node --hardware show NUMA hardware layout --show show current NUMA policy	`numactl --cpunodebind=0 --membind=0 myprog` `numactl --hardware` `numactl --show` `numactl --interleave=all myprog` `numactl --physcpubind=0-3 myprog`
`ulimit`	Show/set per-user resource limits	-a show all limits -n max open file descriptors -u max user processes -f max file size -v max virtual memory -S soft limit -H hard limit	`ulimit -n 4096` `ulimit -a` `ulimit -u 2048` `ulimit -Hn` `ulimit -Sf unlimited`
`prlimit`	Get/set process resource limits	--pid=PID target process --nofile=SOFT:HARD set file descriptor limit --nproc=SOFT:HARD set process limit --output=FIELDS custom columns	`prlimit --pid 1234 --nofile=4096` `prlimit --pid 1 --nproc` `prlimit --pid 1234 --nofile=2048:4096` `prlimit -p 5678 --memlock` `prlimit --output=RESOURCE,SOFT,HARD --pid 1`
`sysctl`	Read/write kernel runtime parameters	-a show all parameters -w NAME=VALUE set at runtime -p [FILE] load from sysctl.conf -n show value only, no name --system load all system config files	`sysctl -a \| grep ip_forward` `sysctl -w net.ipv4.ip_forward=1` `sysctl -p /etc/sysctl.d/99-custom.conf` `sysctl net.ipv4.tcp_syncookies` `sysctl --system`
`/proc/sys/`	Kernel tunables filesystem interface	(not a command; a filesystem path) — read: cat /proc/sys/PATH write: echo VALUE > /proc/sys/PATH tree mirrors sysctl names, e.g. net/ipv4/ip_forward	`cat /proc/sys/net/ipv4/ip_forward` `echo 1 > /proc/sys/net/ipv4/ip_forward` `cat /proc/sys/vm/swappiness` `echo 10 > /proc/sys/vm/swappiness` `ls /proc/sys/kernel/`
`modprobe`	Load/unload a kernel module and dependencies	-r remove module -v verbose -n dry run -f force load -l list matching modules (deprecated)	`modprobe -v e1000e` `modprobe -r nf_conntrack` `modprobe -n bonding` `modprobe -f dummy` `modprobe bonding mode=1`
`lsmod`	List currently loaded kernel modules	(no options; lists loaded kernel modules)	`lsmod` `lsmod \| grep nf_conntrack` `lsmod \| wc -l` `lsmod \| grep -i raid` `lsmod > /tmp/modules.txt`
`rmmod`	Remove a kernel module	-f force removal -v verbose -s log to syslog MODULE — module name to remove	`rmmod dummy` `rmmod -f nf_conntrack` `rmmod -v bonding` `rmmod loop` `rmmod -s e1000e`
`insmod`	Insert a single kernel module	(no standard options besides module path and params) MODULE.ko param=value pairs after module path	`insmod /lib/modules/$(uname -r)/kernel/drivers/net/dummy.ko` `insmod ./mymodule.ko debug=1` `insmod bonding.ko mode=1 miimon=100` `insmod ./test.ko` `insmod /path/to/module.ko param=value`
`depmod`	Generate module dependency list	-a process all modules (default) -n dry run, print to stdout -v verbose	`depmod -a` `depmod -v` `depmod -n` `depmod $(uname -r)` `sudo depmod -a`
`kmod`	Low-level tool for managing kernel modules	list — list loaded modules (like lsmod) insert MODULE — load a module remove MODULE — unload a module static-nodes — generate static device nodes	`kmod list` `kmod insert /path/to/module.ko` `kmod remove bonding` `kmod static-nodes` `kmod list \| grep nf_`
`lsmod`	List loaded kernel modules (duplicate — see above)	(no options; lists loaded kernel modules)	`lsmod` `lsmod \| grep nf_conntrack` `lsmod \| wc -l` `lsmod \| grep -i raid` `lsmod > /tmp/modules.txt`
`lsmod`	List loaded kernel modules (duplicate — see above)	(no options; lists loaded kernel modules)	`lsmod` `lsmod \| grep nf_conntrack` `lsmod \| wc -l` `lsmod \| grep -i raid` `lsmod > /tmp/modules.txt`
`lsmod`	List loaded kernel modules (duplicate — see above)	(no options; lists loaded kernel modules)	`lsmod` `lsmod \| grep nf_conntrack` `lsmod \| wc -l` `lsmod \| grep -i raid` `lsmod > /tmp/modules.txt`

14. How to Use This Guide for Your Practical Test

Focus on the “why” – understand what each option does, not just memorize syntax.
Combine commands – real tasks often pipe outputs (e.g., journalctl -u nginx | grep error | tail -20).
Check man pages – man <command> is the ultimate reference; use it when uncertain.
Remember the hierarchy
- File → User/Group → Permissions → Packages → Services → Networking → Storage → Logging → Performance → Security.
Stay calm – if you forget a command, you can always fall back to command --help or man.