Home › Guides › Linux Commands Cheat Sheet
Tech Explained · 2026Linux Commands Cheat Sheet for DevOps in 2026: 50 Commands With Worked Examples
A Linux commands cheat sheet is a job-grouped reference to the handful of commands that do most real work on a server: navigating files, fixing permissions, reading logs, checking disk and inspecting sockets. This one covers 50 commands across six jobs, each with the exact syntax and what the output actually means.
- Fifty commands cover the job. Six groups, learned properly, handle most of what a junior cloud or DevOps engineer touches in a week.
-
Permissions are arithmetic, not memory. Once you know r is 4, w is 2 and x is 1, you can read any
ls -lline and write anychmodwithout looking it up. -
ifconfig and netstat are the wrong things to learn. The net-tools package has been unmaintained for years, and iproute2's
ipandssship by default on Debian and Ubuntu. - A full disk is usually logs. systemd's journal defaults to 10% of the filesystem capped at 4 GB, per the journald.conf manual, and that is before your application writes a single line.
-
df and du disagreeing means a deleted file is still open.
lsof +L1finds it in one command, and nothing else will. - You can practise all of this for nothing. AWS still runs a 750 hour per month t4g.small free trial through 31 December 2026, and Ubuntu Pro is free on up to five personal machines.
Your deploy fails at 2am, you SSH into the box, and the prompt just sits there blinking. You know the fix is three commands away. You just cannot remember which three, and the tutorial you read in March listed four hundred of them alphabetically, which is exactly as useful as a dictionary is for writing a letter.
So this cheat sheet is organised the way the work arrives: by the question you are trying to answer. Fifty commands, six jobs. Learn these fifty properly and you will be slower than a greybeard sysadmin but never stuck, which is the whole bar for a cloud or platform role.
Linux Commands Cheat Sheet: Files, Navigation and Text
Roughly half of every terminal session is finding a file and reading part of it, so these belong in muscle memory.
| Command | What it does | Example |
|---|---|---|
pwd |
Prints where you are, which matters more than you think after an ssh plus sudo su
|
pwd |
ls -lah |
Long listing with human sizes and hidden files | ls -lah /etc/nginx |
cd - |
Jumps back to the previous directory | cd - |
find |
Searches by name, age or size | find /var/log -name "*.gz" -mtime +7 |
grep -rn |
Recursive search showing file and line number | grep -rn "proxy_pass" /etc/nginx |
tail -f |
Follows a file as it grows | tail -f /var/log/nginx/error.log |
head -n |
First N lines, for sampling a huge file | head -n 20 access.log |
less |
Pages a file without loading all of it into memory | less /var/log/syslog |
wc -l |
Counts lines, the fastest "how bad is it" signal | wc -l access.log |
awk '{print $1}' |
Pulls one whitespace-separated column out of a file | awk '{print $7}' access.log |
sort and uniq -c
|
Groups identical lines and counts them | sort ips.txt | uniq -c | sort -rn |
cut -d |
Splits on a delimiter instead of whitespace | cut -d: -f1 /etc/passwd |
tar -czf |
Creates a gzipped archive, usually before you delete something | tar -czf logs.tar.gz /var/log/nginx |
rsync -avz |
Copies files and resumes if the link drops | rsync -avz ./build/ deploy@host:/srv/app/ |
The one-liner worth memorising
Four of those commands chained together answer the most common question in any incident, which is who is hammering us. Run this against an nginx access log and you get the top ten client IPs by request count:
awk '{print $1}' /var/log/nginx/access.log | sort | uniq -c | sort -rn | head -10
48213 203.0.113.44
9110 198.51.100.7
2044 203.0.113.9
881 192.0.2.15Swap $1 for $7 and the same pipeline tells you which URL path is being hit hardest, because awk splits each line on whitespace and numbers the fields from 1, and field 7 in the default nginx format is the request path. Learn that much and skip the rest of awk until a job demands it.
Linux File Permissions Explained: chmod, chown and the Three Numbers
Permissions look like hieroglyphs until someone shows you that they are addition. Then they never confuse you again.
How -rw-r--r-- becomes 644
Read the ten characters as a type flag plus three triplets, then add up each triplet.
Bit values are the POSIX mode bits used by chmod on every Linux distribution, checked 17 September 2026.
That arithmetic is the whole model. A directory needs the execute bit to be entered at all, which is why 755 is the normal setting for a folder and 644 for the file inside it. And the moment a private key is more permissive than 600, OpenSSH refuses to use it and prints the error that has cost more engineers an hour than any other:
$ ssh deploy@10.0.4.21
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@ WARNING: UNPROTECTED PRIVATE KEY FILE! @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
Permissions 0644 for '/home/riya/.ssh/id_ed25519' are too open.
$ chmod 600 ~/.ssh/id_ed25519| Command | What it does | Example |
|---|---|---|
chmod |
Sets permissions numerically | chmod 644 /etc/app/config.yml |
chmod +x |
Adds the execute bit so a script can run | chmod +x deploy.sh |
chown |
Changes owner and group together | chown deploy:deploy /srv/app |
umask |
Shows or sets default permissions for new files | umask 022 |
id |
Shows uid, gid and every group a user belongs to | id deploy |
usermod -aG |
Adds a user to a group, the fix for "permission denied" on the Docker socket | usermod -aG docker deploy |
sudo -u |
Runs a single command as another user | sudo -u postgres psql |
stat |
Exact mode, owner and timestamps for one file | stat /srv/app/.env |
Permission handling is also the first thing a cloud exam tests once you get past the shell, because IAM roles and instance profiles sit directly on top of it. Both the AWS Solutions Architect and DevOps program and its Azure AZ-305 and AZ-400 equivalent spend live lab time on exactly this join between Linux users and cloud identity, because it is where most beginner deployments break.
Processes and Services: Finding What Is Eating the CPU
Picture a two-person platform team at a Pune logistics startup. One Ubuntu box, nginx in front, a Django app behind it, a Celery worker doing overnight route optimisation. At 9:40am the app goes slow and nobody has touched it in a week. These are the commands that find the culprit in under a minute.
| Command | What it does | Example |
|---|---|---|
ps aux --sort=-%cpu |
Every process, heaviest CPU first | ps aux --sort=-%cpu | head -6 |
htop |
Live, sortable, kill from inside it | htop |
pgrep -a |
Finds PIDs and full command lines by name | pgrep -a celery |
kill -TERM |
Asks a process to shut down cleanly | kill -TERM 8421 |
pkill -f |
Matches against the whole command line, not just the binary | pkill -f "celery worker" |
systemctl status |
Running or not, plus the last ten log lines explaining why not | systemctl status nginx |
systemctl enable --now |
Starts the service and sets it to start at boot | systemctl enable --now nginx |
uptime |
Load average over 1, 5 and 15 minutes | uptime |
Read uptime against your core count, not against zero. A load average of 3.8 on a four-core instance is a box working hard; the same number on a single-core t4g.small is a box with a queue forming behind it.
Here is the desk warning about kill -9. It is the default reflex and it is usually wrong. -9 gives the process no chance to flush buffers, finish a transaction or remove its PID file, so you trade a thirty second wait for a corrupted state you debug for an hour. Send -TERM, count to fifteen, and only then reach for -9. The one place this matters most is a database, where a forced kill means crash recovery on next start.
Four commands that bite beginners
Each of these looks like a fix in the moment and creates the next incident.
chmod -R 777 on a web root
It makes the "permission denied" go away and hands every user on the box write access to your application code. The real fix is almost always chown to the service user plus 755 on directories.
rm -rf with an unset variable
If $APP_DIR is empty, rm -rf $APP_DIR/ becomes rm -rf /. Quote your variables and run the command as ls first to see what it would match.
Piping a script straight into a shell
Fetching an installer and executing it unread is normal in tutorials and reckless on anything holding customer data. Download it, read it, then run it.
Read before runningDeleting a log file to free space
If a daemon still holds the file open, the space does not come back and your logs now go nowhere. Truncate the file in place instead, which the next section walks through.
Truncate, do not deletePatterns drawn from common production incident write-ups, reviewed 17 September 2026.
How to Check Disk Space in Linux: A Worked 2am Fix
Back to the logistics box. Overnight the app started returning 500s and the Celery worker died. The first command is always the same, and the output tells you where to look next.
$ df -h
Filesystem Size Used Avail Use% Mounted on
/dev/root 29G 29G 0 100% /
tmpfs 2.0G 0 2.0G 0% /dev/shm
$ du -xh --max-depth=1 /var | sort -h
...
1.2G /var/lib
6.8G /var/log
8.4G /varThe -x flag keeps du on one filesystem so it does not wander into mounted volumes and give you a misleading total, and sort -h sorts those human-readable sizes correctly, which plain sort will not. So /var/log is the problem. Next question is how much of it is the systemd journal:
$ journalctl --disk-usage
Archived and active journals take up 3.9G in the file system.
$ sudo journalctl --vacuum-size=200M
Vacuuming done, freed 3.7G of archived journals.That 3.9G is not an accident. The journald.conf manual page documents SystemMaxUse as defaulting to 10% of the filesystem capped at 4 GB, with SystemKeepFree at 15% capped at 4 GB, so on a 29 GB root disk the journal will happily grow to just under its 4 GB ceiling before it rotates anything. On a small instance that is an eighth of your disk gone before your application logs a line. Set SystemMaxUse=500M in /etc/systemd/journald.conf on every box you build and the problem never returns.
Now the part that catches people. You cleared 3.7 GB, yet df -h still reports 100% used and du insists the files are gone. That gap between the two commands has exactly one common cause: a file has been deleted but a running process still holds it open, so the inode and its blocks stay allocated until that process exits.
$ sudo lsof +L1 | sort -k7 -rn | head -3
python3 2841 deploy 3w REG 259,1 9214887936 0 1442 /var/log/app/debug.log (deleted)
$ sudo truncate -s 0 /proc/2841/fd/3lsof +L1 lists open files whose link count has dropped below one, which is the precise definition of deleted-but-still-open. Truncating through /proc/PID/fd/ releases the blocks without restarting the process, so the API stays up. Never do that to a database write-ahead log or anything a process replays on restart; there, restart the service properly instead.
-
Check inodes too.
df -ican show 100% whiledf -hshows plenty of space. Millions of tiny session files will do it, and the error message is the same misleading "No space left on device". -
Do not delete files under /var/log by hand. Use
truncate -s 0on the file, or let logrotate do it, so the daemon keeps writing to a file descriptor that still exists. -
Fix the cause the same night. A debug log that grew to 9 GB means someone left
DEBUGlogging on in production, and vacuuming the journal just buys you a week.
| Command | What it does | Example |
|---|---|---|
df -h |
Free space per mounted filesystem | df -h |
df -i |
Inode usage, the invisible way to fill a disk | df -i |
du -xh --max-depth=1 |
Size per directory, staying on one filesystem | du -xh --max-depth=1 /var | sort -h |
ncdu |
Interactive disk browser, faster than repeated du calls | ncdu /var |
lsof +L1 |
Deleted files still held open by a process | lsof +L1 |
truncate -s 0 |
Empties a file in place, keeping the descriptor valid | truncate -s 0 /var/log/app/debug.log |
free -h |
Memory and swap in human units | free -h |
Also read: Docker Tutorial for Beginners 2026: Containerise a Python API in 7 Steps, which is where most of these commands go next once your app stops living directly on the host.
Linux Networking Commands in 2026: Use ip and ss, Not ifconfig and netstat
This is the section where the internet will actively teach you the wrong thing. Most Linux networking tutorials still open with ifconfig and netstat, both from the net-tools package, which Debian marked deprecated in favour of iproute2 back in 2009 and which several distributions no longer install at all. Meanwhile ip and ss ship by default on Debian and Ubuntu. If you type ifconfig in an interview and get "command not found" on their machine, that is the tell.
| Command | What it does | Replaces |
|---|---|---|
ip a |
Addresses on every interface | ifconfig |
ip r |
Routing table, including the default gateway | route -n |
ss -tulpn |
Listening TCP and UDP ports with the owning process | netstat -tulpn |
ss -tn state established |
Connections open right now | netstat -tn |
curl -I |
Headers only, to test a service without downloading the body | Browser guesswork |
dig +short |
Resolves a name with no surrounding noise | nslookup |
nc -zv |
Tests whether a port is reachable from this host | telnet host port |
ss -tulpn is the single most useful of these. When a container will not start because the port is busy, or when you need to prove the app is actually listening on 0.0.0.0 and not 127.0.0.1, that one command settles it. The -p flag needs root to show process names, so run it with sudo or you will wonder why the last column is empty.
Logs and journalctl: The Six Commands You Will Use Weekly
On any modern distribution using systemd, application and system logs land in the journal, and tail -f /var/log/syslog is no longer where the answer lives.
| Command | What it does | Example |
|---|---|---|
journalctl -u |
Logs for one service only | journalctl -u nginx |
journalctl -f |
Follows the journal live | journalctl -u celery -f |
journalctl --since |
Restricts to a time window in plain English | journalctl --since "10 min ago" |
journalctl -p err -b |
Errors and worse since the last boot | journalctl -p err -b |
journalctl --disk-usage |
How much space the journal is holding | journalctl --disk-usage |
journalctl --vacuum-size |
Deletes archived journals down to a size | journalctl --vacuum-size=200M |
Combine two of them and you have the standard opening move for any "it broke around 3am" ticket: journalctl -u myapp -p err --since "2026-09-17 02:30" gives you errors from one service in one window, with no scrolling. That habit, filtering before reading, is most of what separates someone who finds the cause in five minutes from someone who greps for an hour.
Log discipline is also the unglamorous half of running models in production, which is why an MLOps engineering program covering AI-300 spends as much time on observability as on training, and why teams shipping RAG systems and AI agents end up reading journal output at least as often as model metrics.
Go from these 50 commands to running cloud infrastructure for a living
A 12 week live weekend program that prepares you for both AWS Solutions Architect Associate (SAA-C03) and AWS DevOps Engineer Professional (DOP-C02). Includes hands on projects, mentor support and placement guidance, with the next batch starting 27 Sept 2026.
Explore the course
How to Practise This Linux Commands Cheat Sheet for Free
Reading a cheat sheet builds nothing. You need a machine you are allowed to break, and in 2026 there are three sensible free options depending on what you already own.
Free ways to get a Linux box in 2026
Each figure below is a documented limit, not an estimate.
AWS free trial terms and Ubuntu release cycle pages, checked 17 September 2026.
The AWS T4g free trial deducts up to 750 hours a month of t4g.small usage through 31 December 2026, which is one small always-on Arm instance. Note that accounts opened after 15 July 2025 no longer get the old twelve month free tier; new accounts run on a credit model instead, so watch the console billing page rather than assuming anything is free. If you would rather not touch a card at all, install Ubuntu 26.04 LTS in a VM, or use WSL on Windows, which gives you a real Linux userspace with the same commands and none of the cloud bill.
Whichever you pick, practise by breaking things on purpose. Fill a disk with fallocate -l 5G /tmp/big and clear it. Set a config file to 000 and watch the service refuse to start. Stop nginx and read what systemctl status tells you. Twenty deliberate failures teach more than two hundred copied commands, and they are also where interview answers come from, because "I have seen this error" is a different sentence from "I have read about this error".
The honest caveat
Memorising commands is the cheapest part of this job, and a cheat sheet will not make you employable on its own. Nobody is paid to type ls. What gets paid is knowing which command to reach for when the evidence is thin, and being able to read the output rather than just produce it. If your work lives entirely inside managed services, say Fabric notebooks or Lambda functions, you may genuinely only need about ten of these fifty, and that is a reasonable place to stop. The other forty start mattering the day you own a server, a container host or a CI runner.
Also read: What Is CI/CD? How the Pipeline Works, CI vs CD, and Your First Workflow in 2026 and What Is Kubernetes? Plain-English Definition, How It Works and Where You Will Use It in 2026.
Where this sits in a certification path
No exam has a "Linux commands" domain, which is why people skip it and then struggle in the labs. Every cloud and data credential assumes shell fluency: building a CI runner, sizing a Spark cluster in a Microsoft Fabric data engineering program covering DP-700, or debugging a container that exits on startup. If you are choosing what to aim at next, the full certifications overview lists the options, and a free webinar tests whether cloud work suits you more cheaply than an exam fee does.
Related guides
- How to Run an LLM Locally in 2026: Ollama Commands, Hardware and What It Really Costs puts this shell fluency to work on your own machine.
- SAA-C03 vs DOP-C02: Which AWS Certification Should You Take First in 2026? answers the obvious next question once the terminal stops scaring you.
- IT Support to Cloud Engineer in India 2026: The Real Timeline, Skills Gap and What It Pays is the switch plan if you are already on a service desk.
- DevOps Engineer Salary in India 2026: Pay by Experience, Company Type and Certification sets expectations for what these skills are worth.
- Cloud Engineer Jobs in Chennai 2026: Salary Bands, Skills and Which GCCs Are Hiring shows who is hiring for them right now.
Frequently asked questions
What is a Linux commands cheat sheet and how should I use one?
A Linux commands cheat sheet is a short reference to the commands that do most of the work, grouped by the task you are trying to complete rather than listed alphabetically. Use it as a lookup while you work on a real machine, not as something to memorise in advance. The commands stick after you have used them in an actual incident.
How many Linux commands do I need to know for a DevOps job?
Around fifty, used confidently, is enough for a junior cloud or DevOps role. Interviewers rarely test obscure flags; they test whether you can find a busy port, read a service log, fix a permission and diagnose a full disk without guessing. Depth on the common commands beats breadth across rare ones.
What is the difference between chmod 644 and chmod 755?
Both give the owner read and write. 755 adds the execute bit for everyone, which a directory needs before anyone can enter it and a script needs before it can run. Use 644 for configuration files and documents, 755 for directories and executable scripts, and 600 for private keys and files holding secrets.
How do I check disk space in Linux when the server is full?
Start with df -h to find which filesystem is full, then du -xh --max-depth=1 /var | sort -h to walk down to the directory responsible. If the numbers from the two commands disagree, run lsof +L1 to find a deleted file a process is still holding open. Also check df -i, since running out of inodes produces the same error message.
Is ifconfig still used in 2026?
It works where the net-tools package is installed, but it has been deprecated in favour of iproute2 for years and some distributions no longer ship it. Learn ip a and ip r instead, and use ss rather than netstat. They are faster, they reflect what the kernel actually does, and they are present by default on Debian and Ubuntu.
How do I see the logs for a single service in Linux?
Use journalctl -u servicename on any systemd distribution, adding -f to follow it live, -p err to show only errors and --since "10 min ago" to narrow the window. Filtering before reading is the habit worth building, because scrolling an unfiltered journal is how an hour disappears.
Which Linux distribution should a beginner learn on?
Ubuntu LTS, because the current release is supported into 2031 and most cloud documentation, container base images and tutorials assume it. Once you are comfortable, try a Red Hat family distribution such as Rocky Linux, since large Indian enterprises and banks often standardise on RHEL and the package manager differs.
Can I practise Linux commands on Windows without dual booting?
Yes. WSL gives you a real Ubuntu userspace inside Windows, and every command in this guide behaves the same there, with the exception of a few hardware and boot related ones. A virtual machine or a small cloud instance is the other route if you want to practise services, networking and reboots properly.
About this guide. 360 Digital Transformation is an Authorized Training Partner of Anthropic and Microsoft. Other certification bodies, vendors and employers named here are not affiliated with us. Tools and versions change quickly; commands and figures cited were checked on 17 September 2026.
If you are starting today, do this: get one small Linux box, work through the six tables above by breaking something in each category, and write down the errors you cause. Do that for two weekends and you will be past the point where a terminal feels hostile, which is the point at which cloud certifications start making sense instead of feeling like vocabulary tests. When you want the structured version with a live instructor and real projects, the AWS Solutions Architect and DevOps course is where these commands turn into an actual job, and a free demo class costs you nothing but an evening.
Amazon Web Services
