30 Linux Commands Every SysAdmin Should Know

Every Linux system administrator and SRE builds up a core set of commands they reach for daily. This is that set — 30 commands grouped by what they do, with a quick example for each and a link to a deeper reference where we have one. Bookmark it; it’s the page to send to anyone learning the ropes.

Files and directories

1. ls — list directory contents

ls -lah        # long format, all files, human-readable sizes

The -l gives the long listing (permissions, owner, size, date), -a shows hidden dotfiles, and -h makes sizes readable (K/M/G instead of bytes).

2. cd — change directory

cd /var/log    # go to a path
cd -           # jump back to the previous directory

3. cp — copy files and directories

cp -a source/ dest/    # archive mode: preserves permissions, timestamps, links

4. mv — move or rename

mv old.conf new.conf   # rename
mv file.txt /tmp/      # move

5. rm — remove files and directories

rm -i file.txt    # prompt before each delete (safer)
rm -rf dir/       # recursive, forced — powerful and unforgiving

To force-remove a directory and understand the flags safely, see rmdir force in Linux.

6. find — search the filesystem

find /var/log -name "*.log" -mtime +7    # logs older than 7 days

find is one of the most powerful commands on the system. For 14 practical patterns, see find command: top ways to find files.

7. chmod — change permissions

chmod 750 script.sh     # rwx for owner, r-x for group, nothing for others

Viewing and editing files

8. cat — print a file

cat /etc/os-release     # show the whole file

9. less — page through a file

less /var/log/syslog    # scroll with arrows, /search, q to quit

10. grep — search text

grep -ri "error" /var/log/    # recursive, case-insensitive search

11. awk — field processing

awk '{print $1, $4}' access.log    # print columns 1 and 4

awk is a whole language for text processing. See awk commands and examples for the field model and real recipes.

12. sed — stream editing

sed -i 's/old/new/g' config.txt    # find-and-replace in place

13. vi / vim — the editor that’s always installed

vi /etc/hosts

If vi feels cryptic, the vi editor quick reference covers the modes and the commands worth memorizing.

Processes and monitoring

14. ps — snapshot of processes

ps aux --sort=-%cpu | head    # top processes by CPU

15. top — live process view

top              # press P for CPU, M for memory, q to quit

For the difference between top and htop and how to read the fields, see top vs htop.

16. kill — signal a process

kill -15 1234    # graceful stop (SIGTERM)
kill -9 1234     # force kill (SIGKILL) — last resort

17. free — memory usage

free -h          # read the 'available' column, not 'free'

Why “free” looks low on a healthy system is explained in how to check memory usage.

18. df — disk space

df -h            # usage per filesystem

19. du — what’s using the space

du -sh /var/* | sort -h    # biggest items, sorted

Both are covered in depth in how to check disk space. For a full tour of monitoring commands, see Linux monitoring commands.

Services and scheduling

20. systemctl — control services

sudo systemctl restart nginx
systemctl status nginx

The full command set is in the systemctl reference, and when a service won’t start, systemd service failed to start walks the fix.

21. journalctl — read system logs

journalctl -u nginx -f     # follow a service's logs live

See journalctl: view and filter logs for time and priority filtering.

22. crontab — schedule jobs

crontab -e       # edit your scheduled jobs

The crontab quick reference and 75+ crontab examples cover the syntax and recipes.

Networking

23. ss — socket statistics (the modern netstat)

sudo ss -tlnp    # listening TCP ports with the owning process

24. netstat — network connections

netstat -tuln    # still useful; see our 10 common usages

See netstat: 10 common usages and iostat, vmstat, netstat for performance angles.

25. ssh — secure shell

ssh user@host

For passwordless key-based login, see SSH without a password, and for more options, ssh examples and usage.

26. curl — transfer data / test endpoints

curl -I https://example.com    # just the response headers

27. dig — DNS lookups

dig +short example.com    # just the answer

When DNS misbehaves, DNS troubleshooting is the checklist.

Archives and transfer

28. tar — archive files

tar -czf backup.tar.gz /etc/    # create a gzipped archive
tar -xzf backup.tar.gz          # extract it

29. rsync — efficient sync and backup

rsync -avz src/ user@host:/dest/    # archive, verbose, compressed

30. scp — copy over SSH

scp file.txt user@host:/tmp/

Keep this within reach

These 30 cover the daily core, but each is a doorway to more. The reference pages linked above go deeper on the commands that reward it — cron, find, awk, systemctl, and the monitoring tools. For everything by topic, browse the full topic index.

FAQ

What’s the single most important command to learn first? man — the manual. man find, man systemctl, and so on give you the authoritative options for any command on your system. Pair it with grep to search within a man page.

Why ss instead of netstat? netstat is deprecated on modern distros (part of the older net-tools package). ss is faster and the current standard, though netstat still works where it’s installed.

Are these the same across distributions? The core commands here are identical across Ubuntu, Debian, RHEL, and Rocky. Service names differ (e.g. httpd vs apache2), but systemctl, journalctl, and the file/process commands work the same everywhere.