Linux Command Line: The 25 Commands I Use Every Day (2026)
Stop memorizing random commands. Learn the ones that actually matter.
File Operations
# Find files (my #1 most used command)
find . -name "*.js" # By name
find . -name "*.js" -mtime -7 # Modified in last 7 days
find . -size +100M # Larger than 100MB
find . -type d -name "node_modules" # Directories only
# Search file CONTENTS (faster than find + grep)
grep -r "TODO" src/ # Recursive search
grep -r "TODO" src/ --include="*.js" # In specific files
grep -rn "function" src/ # With line numbers (-n)
grep -ri "error" logs/ # Case insensitive (-i)
rg "TODO" src/ # ripgrep (faster, use this instead!)
# Quick file preview
head -20 app.log # First 20 lines
tail -f app.log # Follow live log (essential!)
tail -100 app.log # Last 100 lines
wc -l *.js # Line count of files
cat config.json | python3 -m json.tool # Pretty-print JSON
# File management
cp important.txt important.txt.bak # ALWAYS backup before editing
mv old-name new-name # Rename/move
rm -rf node_modules # Remove directory (use carefully!)
touch new-file.js # Create empty file
ln -s /path/to/target symlink # Symbolic link
Process Management
# What's running?
ps aux | grep node # Find Node processes
top # Interactive process viewer
htop # Better top (install it!)
# Kill processes
kill 12345 # Graceful shutdown (SIGTERM)
kill -9 12345 # Force kill (SIGKILL) — when stuck
pkill -f "node server.js" # Kill by name pattern
killall node # Kill all processes named 'node'
# Background & foreground
npm start & # Run in background
jobs # List background jobs
fg %1 # Bring job 1 to foreground
Ctrl+z # Suspend current process
bg %1 # Resume suspended in background
# Resource usage
free -h # Memory usage
df -h # Disk usage
du -sh * # Directory sizes (finds space hogs!)
du -sh node_modules/ # How big is this thing?
du -h --max-depth=1 | sort -hr # Sorted by size, best for cleanup!
lsof -i :3000 # What's using port 3000?
ss -tlnp # All listening ports
Networking
# Connection testing
curl -I https://example.com # Headers only (quick check)
curl -v https://api.example.com/users # Verbose (debug API calls)
curl -X POST -H "Content-Type: application/json" \
-d '{"name":"test"}' https://api.example.com/users
wget https://example.com/file.zip # Download file
# DNS & network info
dig example.com # DNS lookup
nslookup example.com # Alternative DNS lookup
ping google.com # Basic connectivity
curl ifconfig.me # Your public IP
ip addr show # Network interfaces
# Port scanning (is a service running?)
nc -zv localhost 3000 # Test if port 3000 is open
ssh user@host "nc -zv localhost 22" # Remote port test
Text Processing (The Unix Way)
# sed — stream editor (find & replace in files)
sed -i 's/old/new/g' file.txt # Replace all occurrences
sed -i 's/old/new/g' *.js # Replace in all JS files
sed -n '10,20p' file.txt # Print lines 10-20
sed '/^$/d' file.txt # Remove empty lines
# awk — text processing language
awk '{print $1}' access.log # Print first column
awk '{sum+=$NF} END {print sum}' data.txt # Sum last column
awk -F',' '{print $1, $3}' csv.csv # CSV parsing (comma delimiter)
# sort — organize lines
sort names.txt # Alphabetical
sort -r names.txt # Reverse
sort -n numbers.txt # Numerical
sort -k2 -n data.txt # Sort by 2nd column numerically
sort -u names.txt # Unique only (remove duplicates)
# uniq — deduplicate (must be sorted first)
sort file.txt | uniq # Remove adjacent duplicates
sort file.txt | uniq -c # Count occurrences
sort file.txt | uniq -c | sort -rn # Most common first
# The classic pipeline: count requests by IP in access log
awk '{print $1}' access.log | sort | uniq -c | sort -rn | head -10
# xargs — build commands from input
find . -name "*.log" | xargs rm # Delete all found files
find . -name "*.js" | xargs wc -l # Line count all JS files
echo "file1 file2 file3" | xargs -n 1 cp backup/ # Copy each to backup/
# tee — split output (to file AND screen)
cat largefile.json | tee output.log | jq '.data'
npm run build 2>&1 | tee build.log # Save and see build output
System Monitoring
# Real-time monitoring
watch -n 5 'free -h' # Refresh every 5 seconds
tail -f /var/log/syslog # Live log follow
journalctl -u nginx -f # Follow systemd service logs
# Disk space cleanup
du -h --max-depth=2 / | sort -rh | head -20 # Top 20 disk consumers
ncdu / # Interactive disk usage (amazing tool!)
# Memory analysis
free -h # Overview
cat /proc/meminfo # Detailed
ps aux --sort=-%mem | head -10 # Top memory consumers
# CPU analysis
uptime # Load average (1min, 5min, 15min)
mpstat -P ALL # Per-CPU stats
ps aux --sort=-%cpu | head -10 # Top CPU consumers
# Service management
systemctl status nginx # Check service status
systemctl restart nginx # Restart
systemctl enable myapp # Start on boot
journalctl -u myapp -n 50 # Last 50 lines of service logs
SSH & Remote
# Connect
ssh user@hostname
ssh user@hostname -p 2222 # Custom port
ssh -i ~/.ssh/key.pem user@host # Specific key
# Copy files (SCP)
scp file.txt user@host:/path/to/
scp -r folder/ user@host:/path/to/ # Directory copy
scp user@host:/path/to/file ./ # Download
# Better alternative: rsync (resumable, shows progress)
rsync -avz source/ user@host:dest/
rsync -avz --progress big-file user@host:~/
rsync -avz --delete source/ dest/ # Mirror (deletes extra files in dest)
# SSH tunneling (forward local port to remote)
ssh -L 8080:localhost:3000 user@host # Access host's :3000 via your :8080
# Config shortcuts (~/.ssh/config)
Host myserver
HostName 192.168.1.100
User deployer
IdentityFile ~/.ssh/id_rsa
Port 2222
# Now just: ssh myserver
Git Commands I Actually Use
git status # Always first
git diff # What changed?
git add -A && git commit -m "message" # Stage + commit
git push origin main # Push
git pull --rebase origin main # Pull cleanly
git log --oneline -10 # Recent history
git stash && git stash pop # Temporarily save work
git checkout -b feature/name # New branch
My Top 25 List
| Rank | Command | Use Case |
|---|---|---|
| 1 |
cd + ls + pwd
|
Navigation |
| 2 |
grep / rg
|
Search content |
| 3 | find |
Find files |
| 4 |
cat / less
|
Read files |
| 5 | tail -f |
Follow logs |
| 6 |
ps / htop
|
Check processes |
| 7 |
kill / pkill
|
Stop processes |
| 8 | curl |
Test APIs |
| 9 |
chmod / chown
|
Permissions |
| 10 | chown |
Ownership |
| 11 | sudo |
Run as root |
| 12 |
apt / npm
|
Install packages |
| 13 | ssh |
Remote connect |
| 14 |
scp / rsync
|
Transfer files |
| 15 |
tar / zip
|
Archive/extract |
| 16 | wget |
Download |
| 17 |
df / du
|
Disk usage |
| 18 |
free / top
|
Resources |
| 19 | systemctl |
Services |
| 20 | crontab -e |
Scheduled tasks |
| 21 | env |
Environment vars |
| 22 | `history \ | grep` |
| 23 | man |
Documentation |
| 24 |
which / type
|
Find executables |
| 25 | alias |
Custom shortcuts |
Essential Aliases
# Add these to ~/.bashrc or ~/.zshrc
alias ll='ls -lah' # Detailed listing
alias gs='git status' # Quick git status
alias gp='git pull --rebase origin main'
alias ..='cd ..' # Go up one level
alias ...='cd ../..' # Go up two levels
alias ports='ss -tlnp' # Show listening ports
alias myip='curl ifconfig.me' # Public IP
alias cls='clear' # Clear terminal
alias serve='python3 -m http.server 8000' # Quick HTTP server
alias json='python3 -m json.tool' # Pretty JSON
alias grep='grep --color=auto' # Colored grep
alias df='df -h' # Human-readable disk
alias du='du -sh' # Human-readable size
alias mkdir='mkdir -pv' # Create parent dirs, verbose
# Useful functions
mkcd() { mkdir -p "$1" && cd "$1"; } # Create + enter directory
extract() { # Extract any archive
if [ -f "$1" ]; then
case "$1" in
*.tar.bz2) tar xjf "$1" ;;
*.tar.gz) tar xzf "$1" ;;
*.bz2) bunzip2 "$1" ;;
*.rar) unrar x "$1" ;;
*.gz) gunzip "$1" ;;
*.tar) tar xf "$1" ;;
*.tbz2) tar xjf "$1" ;;
*.tgz) tar xzf "$1" ;;
*.zip) unzip "$1" ;;
*.Z) uncompress "$1" ;;
*) echo "'$1' cannot be extracted" ;;
esac
fi
}
What's your most-used terminal command?
Follow @armorbreak for more practical developer guides.
Top comments (0)