Linux Commands: A Server Admin's Reading List

The whole catalog, in the order you'll actually need them — connect, look around, find out what's wrong, fix it.

How to Read This Index

We've ordered the commands the way you'll actually meet them on a real server: connect first, look around, learn the daily diagnostic loop, then the specialized tools and the corners. Start at the top if you're new to Linux. Skip the first two sections if ls and pwd are already in your fingers. Every command links to its own full tutorial — examples, gotchas, history. The curated sections below are the order we recommend reading; the full alphabetical list at the bottom is for jumping straight to a known target.

1. Connecting — The First Thing You Do

You can't admin a server without a way in, and you can't get anything done if your shell dies the moment your laptop sleeps.

  • ssh — connect to a remote host over the Secure Shell protocol
  • scp — copy files between hosts over ssh
  • sftp — interactive file transfer over ssh
  • rsync — fast, incremental file sync that survives interruptions
  • tmux — keep work alive after you disconnect; split the terminal
  • screen — the older sibling of tmux

2. Getting Around — Skip If You Already Know These

The first 30 minutes on any Linux box. If cd, ls, cat and man are reflexes, jump to the next section.

  • pwd — where am I?
  • cd — go somewhere
  • ls — what's in this directory?
  • cat — dump a file to stdout
  • less — page through a file (much better than more)
  • more — the older pager
  • head / tail — first or last N lines of a file
  • file — what kind of file is this?
  • find — find files by name, time, size, or contents
  • locate — find files by name from a pre-built index
  • which / whereis — which binary will run when I type X?
  • man — the built-in manual
  • cp / mv / rm — copy, move, delete
  • mkdir / rmdir — make / remove a directory
  • ln — symbolic and hard links
  • echo — print text (more nuanced than it looks)
  • printf — formatted output, the predictable sibling of echo
  • env — show or modify the environment for a command
  • set — configure shell options and positional parameters
  • sudo — run a command as root
  • whoami — who am I logged in as?
  • who / w — who else is on this box?

3. Is the Server Alive and Well — The Daily Diagnostic

When something feels wrong, you reach for these in this order. Master the loop and "the server is slow" stops being scary.

  • uptime — load average plus how long since reboot
  • top — live process table, CPU + memory at a glance, the foundation
  • htop — the friendlier, colorful, interactive cousin of top
  • ps — process snapshot, scriptable, the tool you pipe against
  • free — memory state with the "Linux ate my RAM" reveal

4. Disk Space — When Storage Fills Up

The single most common production outage, and the four tools that always solve it.

  • df — which mount is full, and the surprising inode trap
  • du — which directory is eating the space
  • ncdu — interactive, visual du — install it first, then thank me
  • lsof — what files are open, and the "deleted but still held open" mystery
  • mount / umount — what's mounted where
  • lsblk — list block devices and how they're stacked
  • smartctl — SMART health data; is this disk dying?

5. I/O Performance — When the Disk Is Slow

When top shows high wa (I/O wait), this is where you go.

  • iostat — per-device queue, latency, throughput
  • iotop — top, but for disk I/O per process
  • vmstat — six subsystems on one line, the highest-level dashboard
  • sar — historical performance archive across days
  • mpstat — per-CPU breakdown
  • pidstat — per-process CPU, memory, I/O from sysstat
  • dstat — versatile real-time resource stats, all subsystems at once

6. Processes and Signals — Making Things Behave

Find it, talk to it, stop it, restart it — with the safety habit built in.

  • kill — send a signal by PID (and signals are way more than "kill")
  • pkill — send a signal by name; the daemon-administrator's hammer
  • pgrep — find PIDs by name; the safety wrapper for pkill
  • killall — older sibling of pkill, more dangerous
  • nice / renice — adjust a process's priority
  • bg / fg / jobs — shell job control

7. Network — What's Listening, Who's Talking

The first command on a new server: ss -ltnp. From there, this whole section.

  • ss — modern socket inspector; what's listening, what's connected
  • netstat — the museum-piece predecessor still in every tutorial
  • ip — modern interface/route/address config (iproute2)
  • ifconfig — the legacy version, still useful for read-only views
  • ping — is it reachable?
  • traceroute — where does the path break?
  • curl / wget — HTTP from the shell
  • dig / host / nslookup — DNS queries
  • tcpdump — packet capture, the wire-level truth
  • nmap — port scanning, the external view of your box
  • iptables — firewall rules (legacy syntax, still everywhere)
  • nft — nftables, the modern replacement for iptables

8. Logs and Debugging — What Just Happened

When something broke, this is the chain.

  • journalctl — every log line from every systemd service, queryable
  • dmesg — the kernel's ring buffer; first place to look for hardware trouble or OOM kills
  • tail — follow a log file in real time (tail -f)
  • grep — find lines in a log
  • strace — see every syscall a program makes; the universal debugger when there are no logs
  • ltrace — like strace, but for library calls
  • logrotate — rotate, compress, and prune log files before they eat the disk
  • gdb — the GNU debugger, for when you need to step inside a crash

9. Service Management — Systemd and Friends

  • systemctl — the front door to systemd; start, stop, supervise services
  • service — the legacy wrapper, still in scripts everywhere
  • crontab — schedule recurring jobs (or use systemd timers via systemctl)
  • timedatectl — check and set the system clock, timezone, NTP sync
  • hostnamectl — show or set the hostname and machine metadata

10. Text Processing — The Shell's Superpower

Once you can fluently slice and reshape text, the whole shell starts feeling like a programming language.

  • grep / egrep / fgrep — search for patterns
  • awk — column-oriented text processing and a tiny scripting language
  • sed — stream editor for line-by-line transformations
  • cut — pick out columns
  • sort — sort lines
  • uniq — collapse adjacent duplicates
  • wc — count lines, words, characters
  • tr — translate or delete characters
  • xargs — build command lines from input
  • jq — query and reshape JSON
  • tee — split a stream so you can save and pipe

11. Packages — Installing Software

Each distro family has its own; the verbs are the same.

12. Storage Administration — Filesystems and RAID

When you're past "the disk is full" into "let me build the disk."

13. Users and Permissions

14. Files and Archives

  • tar — pack and unpack archives, the universal Unix bundle format
  • gzip / gunzip — compress / decompress
  • xz — modern, slow, high-ratio compression
  • zip / unzip — the Windows-compatible archive
  • zstd — fast modern compression
  • cmp / diff — compare files

15. Editors

Pick one and learn it well. You'll spend more time in this tool than any other.

  • nano — the friendliest for newcomers
  • vi / vim — universal; ships on every Unix
  • emacs — the other one
  • mc — Midnight Commander, two-pane file manager with built-in editor

16. The Shell Itself

  • bash — the default shell on most Linux distros
  • zsh — popular alternative with better completion
  • sh — the POSIX shell, scripts use this
  • alias — create command shortcuts
  • exec — replace the shell with another program
  • exit — leave the shell
  • history — recall previous commands
  • time — measure how long a command took
  • watch — run a command repeatedly and watch the output change

Full Alphabetical List

Everything in the knowledge base, A to Z. If you know what you're looking for, jump straight to it.

  • ab: a tool for benchmarking web servers
  • alias: create a shortcut for a command
  • apt: install, remove, and manage software packages
  • apt-cache: search for and display information about software packages
  • apt-get: install, remove, and manage software packages
  • aptitude: a high-level interface for managing packages in Debian-based systems
  • aria2c: download files using different protocols
  • at: execute a command at a specified time
  • atop: show performance metrics
  • awk: perform text processing and data manipulation tasks
  • bash: widely used Unix shell
  • bg: resume a stopped job in the background
  • btrfs: manage btrfs filesystems
  • cat: concatenate and display files
  • cd: change the current directory
  • chgrp: change file group ownership
  • chmod: change file permissions
  • chown: change file ownership
  • cmp: compare two files byte by byte
  • cp: copy files and directories
  • crontab: schedule commands to run at specific times
  • curl: transfer data from or to a server
  • cut: remove sections from each line of a file
  • date: display or set the date and time
  • dd: convert and copy a file
  • df: display information about free disk space
  • dhclient: manage DHCP leases
  • diff: compare two files line by line
  • dig: query DNS servers
  • dmesg: print the kernel ring buffer
  • dnf: install, remove, and manage software packages on Fedora
  • docker: manage Docker containers
  • dpkg: manage Debian software packages
  • dstat: versatile real-time resource statistics
  • du: display the size of a file or directory
  • echo: display a message or the value of a variable
  • egrep: search files using extended regular expressions
  • emacs: edit text files with the Emacs editor
  • env: show or modify the environment for a command
  • exec: replace the shell with another program
  • exit: leave the shell
  • fdupes: find and remove duplicate files
  • fdisk: partition a disk
  • fg: bring a backgrounded job to the foreground
  • fgrep: search files for fixed strings
  • file: determine file type
  • find: search for files in a directory hierarchy
  • free: display the amount of free and used memory
  • fsck: check and repair a filesystem
  • gdb: the GNU debugger
  • grep: search files for patterns
  • groupadd: create a new group
  • groups: show which groups a user belongs to
  • gunzip: decompress gzip-compressed files
  • gzip: compress files using gzip
  • hdparm: get or set hard disk parameters
  • head: display the first few lines of a file
  • history: show recently typed commands
  • host: perform DNS lookups
  • hostnamectl: show or set the hostname and machine metadata
  • htop: an interactive process viewer
  • id: display user and group IDs
  • ifconfig: configure a network interface (legacy)
  • iostat: report CPU and I/O statistics
  • iotop: display I/O usage per process
  • ip: show and manipulate routing, devices, and tunnels
  • iptables: configure firewall rules
  • jobs: list active shell jobs
  • journalctl: query and display systemd journal logs
  • jq: process and query JSON data
  • kill: send a signal to a process
  • kubectl: manage Kubernetes clusters and workloads
  • killall: kill processes by name
  • less: view the contents of a file one page at a time
  • ln: create symbolic or hard links
  • locate: find files by name from an index
  • logrotate: rotate, compress, and prune log files
  • ls: list the contents of a directory
  • lsblk: list block devices
  • lsof: list open files
  • ltrace: trace library calls
  • lvcreate: create a logical volume in LVM
  • make: build software from source using Makefiles
  • man: display the manual page for a command
  • mc: start the Midnight Commander
  • mdadm: manage Linux software RAID arrays
  • mkdir: create a new directory
  • mkfs: create a filesystem on a device
  • mkfs.btrfs: create a btrfs filesystem
  • mkfs.ext4: create an ext4 filesystem
  • mkfs.ntfs: create an NTFS filesystem
  • mkfs.vfat: create a FAT filesystem
  • mkfs.xfs: create an XFS filesystem
  • modprobe: add or remove kernel modules
  • more: the older pager
  • mount: mount a filesystem
  • mpstat: report per-CPU statistics
  • mv: move or rename files and directories
  • nano: a friendly text editor
  • ncdu: interactive disk usage analyzer
  • netstat: display network connections (legacy)
  • newgrp: switch the active group for the current session
  • nft: manage nftables firewall rules
  • nice: run a command with adjusted priority
  • nmap: scan networks
  • nproc: print the number of processing units
  • nslookup: query DNS records
  • pacman: install, remove, and manage software packages on Arch
  • parted: interactive partition editor for GPT and MBR
  • passwd: change a user's password
  • pgrep: find processes by name
  • pidstat: per-process CPU, memory, and I/O statistics
  • ping: send an ICMP echo request
  • pkill: signal processes by name
  • printf: formatted output to stdout
  • ps: display information about running processes
  • ptrace: trace and control another process
  • pvcreate: create an LVM physical volume
  • pwd: print the current working directory
  • python: launch the Python interpreter
  • renice: change the priority of a running process
  • rm: delete files and directories
  • rmdir: remove an empty directory
  • route: show or manipulate the IP routing table (legacy)
  • rsync: fast incremental file sync
  • sar: collect and report historical system performance
  • scp: copy files over ssh
  • screen: run multiple shells in one terminal
  • sed: stream editor for transforming text
  • service: start, stop, or query a service (legacy)
  • set: configure shell options and positional parameters
  • sgdisk: scriptable GPT partition tool
  • showmount: list NFS exports from a server
  • sftp: interactive file transfer over ssh
  • sh: the POSIX shell
  • shutdown: shut down or reboot the system
  • sleep: pause for a number of seconds
  • smartctl: query disk SMART data
  • snmpwalk: query SNMP data from network devices
  • sort: sort lines of text
  • ss: modern socket inspector
  • ssh: connect to a remote host
  • ssh-add: add an ssh key to the agent
  • ssh-agent: hold decrypted ssh keys in memory
  • ssh-copy-id: install a public key on a remote host
  • ssh-keygen: generate ssh keys
  • strace: trace system calls
  • su: switch to another user
  • sudo: execute a command as root
  • swapoff: disable swap
  • swapon: enable swap
  • sysctl: read and write kernel parameters
  • systemctl: control the systemd system and service manager
  • tail: display the last few lines of a file
  • tar: archive files
  • tcpdump: capture network packets
  • tee: split a stream into a file and stdout
  • timedatectl: check and set system clock, timezone, NTP sync
  • time: measure how long a command takes
  • tmux: terminal multiplexer
  • top: display running processes
  • tr: translate or delete characters
  • traceroute: trace the route packets take to a host
  • tune2fs: adjust ext filesystem parameters
  • umount: unmount a filesystem
  • uname: print system information
  • uniq: collapse adjacent duplicate lines
  • unzip: extract a zip archive
  • uptime: display the current uptime of the system
  • useradd: add a user
  • userdel: delete a user
  • usermod: modify a user
  • valgrind: detect memory errors and leaks
  • vgcreate: create an LVM volume group
  • vi: the classic Unix editor
  • vim: the modernized vi
  • visudo: safely edit the sudoers file
  • vmstat: report virtual memory statistics
  • w: show who is logged in and what they're doing
  • watch: run a command periodically
  • wc: count lines, words, and characters
  • wget: download files from the web
  • whereis: locate the binary, source, and manual page for a command
  • which: display the path of a command
  • who: show who is logged in
  • whoami: print the current user
  • xargs: build command lines from input
  • xfs_repair: check and repair an XFS filesystem
  • xz: compress or decompress files
  • yast: configure a SUSE-based system
  • yum: install, remove, and manage software packages on Red Hat
  • zcat: view compressed files without extracting
  • zip: create a zip archive
  • zsh: the Z shell
  • zstd: fast modern compression
  • zypper: manage packages on openSUSE

Not sure which of these your own server actually needs right now?

CleverUptime watches the symptoms — load creeping, disk filling, services flapping, OOMs in the kernel — and tells you in plain language what's wrong, so you reach for the right command instead of trying twelve.

Want to see your own server's health right now? One command, no signup, no install.

Check your server →