DEV Community

Cover image for 10 Linux One-Liners That Feel Like Cheating
Asep Sayyad
Asep Sayyad

Posted on Originally published at asepsayyad007.in

10 Linux One-Liners That Feel Like Cheating

#devops #linux #ubuntu #tutorial

Ten simple, high-impact shell commands that save hours of manual work, speed up server debugging, and make complex terminal tasks effortless.

Every Linux user reaches a point where repetitive terminal tasks start to feel slow and painful.

You want to share a folder with a teammate on the local network, so you install an FTP server or set up Nginx. You want to kill a runaway process locking port 8080, so you run three different commands to find the process ID before typing kill -9. You want to find which IP address is hammering your web server, so you spend fifteen minutes writing a custom Python script to parse access logs.

You do not need heavy scripts or complex external tools for these common jobs.

The Linux shell comes with small, focused utilities that combine into short one-liners. When you put them together the right way, they solve tricky problems in seconds. They feel almost like cheating because of how much time and effort they save.

Here are 10 practical Linux one-liners that will instantly speed up your day-to-day workflow.

1. Instantly Share Any Directory Over HTTP

Need to send a quick build artifact, a log archive, or a folder of images to another computer on your local Wi-Fi?

Setting up a full web server or copying files to a USB drive takes too much time. If you have Python installed, you can turn any folder into an active HTTP file server with a single command:

python3 -m http.server 8000
Enter fullscreen mode Exit fullscreen mode

Once you run this inside a directory, Python binds to port 8000 and serves all files in that folder.

Anyone on your local network can open their browser and visit:

http://<your-ip-address>:8000
Enter fullscreen mode Exit fullscreen mode

They will see a clean directory listing where they can view or download any file.

If you only want to serve files to your local machine and prevent anyone else on the network from accessing them, bind the server directly to localhost:

python3 -m http.server 8000 --bind 127.0.0.1
Enter fullscreen mode Exit fullscreen mode

If you are working on a minimal server or embedded system without Python, BusyBox has a built-in lightweight web server that does the exact same job:

busybox httpd -f -p 8000
Enter fullscreen mode Exit fullscreen mode

When you are done sharing, just press Ctrl+C in your terminal to shut the server down.

2. Kill the Exact Process Locking a Port

There is nothing more annoying than trying to start an application, a Docker container, or a local dev server, only to see this error:

Error: listen EADDRINUSE: address already in use :::8080
Enter fullscreen mode Exit fullscreen mode

The usual workaround is tedious: run lsof -i :8080 or ss -tulpn, copy the process ID number from the output, and run kill -9 <PID>.

You can do the whole thing in a single command using fuser:

sudo fuser -k 8080/tcp
Enter fullscreen mode Exit fullscreen mode

Here is how it works:

  • 8080/tcp: Targets the specific TCP port you want to free up.
  • -k: Sends SIGKILL directly to every process holding that port open.

If you want to see what process is running before killing it, run fuser with the -v (verbose) flag:

sudo fuser -v 8080/tcp
Enter fullscreen mode Exit fullscreen mode

You will see the user, process ID, and command name immediately.

If your system does not have fuser installed, you can achieve the exact same one-liner result using lsof combined with command substitution:

sudo kill -9 $(lsof -t -i:8080)
Enter fullscreen mode Exit fullscreen mode

The -t flag tells lsof to output only the raw process IDs, which are passed directly to kill -9. The port is instantly clear, and you can start your service right away.

3. Re-run Your Last Command with Root Privileges

We have all typed a long, complex command only to get blocked by a permission error:

apt install nginx
# E: Could not open lock file /var/lib/dpkg/lock-frontend - open (13: Permission denied)
Enter fullscreen mode Exit fullscreen mode

Instead of pressing the Up Arrow, jumping all the way to the start of the line with Ctrl+A, typing sudo, and pressing Enter, use Bash history expansion:

sudo !!
Enter fullscreen mode Exit fullscreen mode

In Bash and Zsh, !! (called "bang bang") automatically substitutes the entire previous command.

The shell expands sudo !! into sudo apt install nginx and runs it right away.

You can also use history substitutions to fix typos in long commands. If you typed:

grep -rnI "database_password" /etc/ngnx/
Enter fullscreen mode Exit fullscreen mode

And realized you misspelled nginx, you do not need to retype the command. Use the caret (^) quick-substitution syntax:

^ngnx^nginx^
Enter fullscreen mode Exit fullscreen mode

The shell replaces the first occurrence of ngnx with nginx and runs the corrected command instantly.

4. Watch Any Command Output Live with Highlighted Changes

When you are waiting for a disk to fill, monitoring memory usage during a heavy build, or watching a file download finish, running the same command over and over again is exhausting.

The watch utility runs any command at a set interval and displays the output in full screen:

watch -n 1 -d "df -h"
Enter fullscreen mode Exit fullscreen mode

Here is what the flags do:

  • -n 1: Runs the command every 1 second (the default is 2 seconds).
  • -d: Highlights whatever changed on the screen between runs in reverse video.

You can pass multiple chained commands inside quotes:

watch -n 2 -d "free -m && echo '---' && uptime"
Enter fullscreen mode Exit fullscreen mode

Another great use case is watching network socket states during load tests:

watch -n 1 -d "ss -s"
Enter fullscreen mode Exit fullscreen mode

Every time a metric changes, watch highlights the exact number on your screen, making it easy to spot traffic spikes, memory leaks, and disk growth in real time.

5. Make an Instant Backup of Any File Before Editing

Before modifying a critical configuration file like /etc/ssh/sshd_config or /etc/fstab, making a backup copy is standard best practice.

Typing out long file paths twice gets old fast:

sudo cp /etc/nginx/sites-available/production.conf /etc/nginx/sites-available/production.conf.bak
Enter fullscreen mode Exit fullscreen mode

You can cut that entire command in half using Bash brace expansion:

sudo cp /etc/nginx/sites-available/production.conf{,.bak}
Enter fullscreen mode Exit fullscreen mode

When Bash sees {,.bak}, it expands the string into two separate arguments: the original path and the path with .bak added to the end.

If you want to include a date and timestamp in your backup name so you always know when the copy was made, you can nest command substitution inside the braces:

sudo cp config.yaml{,.bak-$(date +%Y%m%d_%H%M%S)}
Enter fullscreen mode Exit fullscreen mode

This creates a backup named config.yaml.bak-20260828_234500 in a split second.

6. Find the Top 10 Memory and CPU Eating Processes

When a server becomes sluggish and you cannot open an interactive tool like htop or top, you need a quick way to list the worst offending processes directly in your terminal output.

To see the top 10 processes consuming the most RAM:

ps aux --sort=-%mem | head -n 11 | awk '{printf "%-8s %-6s %-6s %-6s %s\n", $1, $2, $3, $4, $11}'
Enter fullscreen mode Exit fullscreen mode

Here is how this pipeline works:

  • ps aux --sort=-%mem: Lists all running processes sorted in descending order by memory usage (the minus sign - sorts highest to lowest).
  • head -n 11: Grabs the table header plus the top 10 rows.
  • awk ...: Prints only the User, PID, %CPU, %MEM, and the Command name in clean, formatted columns.

If CPU usage is your main bottleneck instead of memory, change the sort key to -%cpu:

ps aux --sort=-%cpu | head -n 11 | awk '{printf "%-8s %-6s %-6s %-6s %s\n", $1, $2, $3, $4, $11}'
Enter fullscreen mode Exit fullscreen mode

This gives you a clear snapshot of system resource hogs without taking over your terminal screen.

7. Process Files in Parallel Across Multiple CPU Cores

Most simple shell scripts process files sequentially, one by one. If you have 50 large log files to compress, running a standard loop uses only a single CPU core while the rest of your processor sits idle.

You can use xargs with the -P (max processes) flag to run tasks in parallel across all available CPU cores:

find . -type f -name "*.log" -print0 | xargs -0 -P $(nproc) -I {} gzip {}
Enter fullscreen mode Exit fullscreen mode

Here is a breakdown of each part:

  • find . -type f -name "*.log" -print0: Finds all .log files and outputs them separated by a null byte (\0). This ensures file names with spaces or special characters do not break.
  • -0: Tells xargs to expect null-delimited input from find.
  • -P $(nproc): Tells xargs how many worker processes to spawn at once. $(nproc) automatically returns the number of CPU cores on your machine.
  • -I {}: Replaces {} with the current file name in the target command (gzip {}).

If compressing 10 gigabytes of log files normally takes 4 minutes on a single core, running it on an 8-core CPU finishes the entire batch in about 30 seconds.

You can use this same pattern for converting images, downloading URLs, resizing videos, or running automated test suites.

8. Extract Top 10 Client IP Addresses from Access Logs

When your web server is experiencing high traffic, identifying the top IP addresses sending requests helps you spot web scrapers, bots, or potential denial-of-service attempts.

You can parse millions of log lines in a few seconds using a classic Unix stream pipeline:

awk '{print $1}' /var/log/nginx/access.log | sort | uniq -c | sort -nr | head -n 10
Enter fullscreen mode Exit fullscreen mode

Here is step-by-step how the data moves through the pipe:

  • awk '{print $1}': Grabs the first column of every log line, which is the client IP address in standard Nginx and Apache log formats.
  • sort: Groups identical IP addresses next to each other so uniq can count them.
  • uniq -c: Collapses consecutive identical lines and prefixes each line with its total occurrence count.
  • sort -nr: Sorts the counted list numerically (-n) in reverse order (-r), putting the highest counts at the very top.
  • head -n 10: Prints only the top 10 results.

The output looks like this:

  14820 198.51.100.42
   9210 203.0.113.19
   3411 192.0.2.88
    850 198.51.100.120
Enter fullscreen mode Exit fullscreen mode

You can immediately see that IP 198.51.100.42 sent nearly 15,000 requests.

If you want to filter out requests for static assets (like .png, .css, or .js) and only count hits to API endpoints, add a simple grep filter before awk:

grep -v "\.(css|js|png|jpg|ico)" /var/log/nginx/access.log | awk '{print $1}' | sort | uniq -c | sort -nr | head -n 10
Enter fullscreen mode Exit fullscreen mode

9. Live Filter and Colorize Errors in Streaming Logs

When you are tailing a live log file on a busy production server, hundreds of normal lines scroll past your screen every second. Trying to catch error messages with your naked eyes is impossible.

You can stream the log while filtering and colorizing specific error patterns in real time:

tail -f /var/log/nginx/error.log | grep --line-buffered --color=auto -E "error|crit|alert|emerg"
Enter fullscreen mode Exit fullscreen mode

Here is why this one-liner works so well:

  • tail -f: Follows new lines as they are appended to the log file.
  • --line-buffered: Forces grep to flush output immediately line by line rather than buffering data in memory. Without this flag, output might stall when piped into other tools.
  • --color=auto: Automatically highlights the matched search terms in bright red.
  • -E: Enables extended regular expressions, allowing you to match multiple keywords separated by the pipe character (|).

If you want to monitor HTTP status codes in an access log and only see 4xx client errors and 5xx server errors, adjust the regex:

tail -f /var/log/nginx/access.log | grep --line-buffered --color=auto -E ' "(4[0-9]{2}|5[0-9]{2}) '
Enter fullscreen mode Exit fullscreen mode

Only requests returning status codes like 404, 403, 500, or 502 will appear in your terminal, with the status code brightly highlighted.

10. Truncate a Huge Log File Without Breaking Running Services

When a runaway service produces a 50 GB log file that fills up your server's disk to 100%, your first instinct might be to run:

sudo rm /var/log/myapp/huge.log
Enter fullscreen mode Exit fullscreen mode

Do not do this on an active log file.

In Linux, when a running process has an open file descriptor pointing to a file, deleting the file with rm only removes the directory entry (the name link).

The actual disk space remains occupied and is not freed until the process closes the file or stops running. Even worse, the application may fail to write new logs because the original file path no longer exists.

The correct way to free disk space instantly without restarting the service is to truncate the file to zero bytes:

: > /var/log/myapp/huge.log
Enter fullscreen mode Exit fullscreen mode

Here is why this works:

  • : (the colon): A shell built-in command that does nothing and returns an exit code of 0 (true).
  • >: The standard redirection operator. When used without any input, it immediately opens the file, truncates its size to 0 bytes, and closes it.

The file inode remains unchanged. The running process keeps its open file handle and continues writing new log lines without interruption, while all disk space is returned to the system immediately.

If you need root permissions to truncate a file protected by system privileges, use truncate or tee:

sudo truncate -s 0 /var/log/myapp/huge.log
Enter fullscreen mode Exit fullscreen mode

Or using tee:

true | sudo tee /var/log/myapp/huge.log > /dev/null
Enter fullscreen mode Exit fullscreen mode

Both options zero out the file cleanly and safely in less than a millisecond.

An Interesting Fact in Linux History

Why are Linux command line one-liners so versatile compared to other operating systems?

In 1986, computer scientist Donald Knuth (author of The Art of Computer Programming) was asked to write a program to solve a text processing problem: read a text file, count the frequency of each word, and print the top N most frequent words in sorted order.

Knuth wrote a 10-page Pascal program using a custom trie data structure that was brilliant, elegant, and took several hours to design.

Doug McIlroy, the inventor of Unix pipes, wrote a review of Knuth's solution. In his review, McIlroy included a 6-command Unix shell one-liner that solved the exact same problem:

tr -cs A-Za-z '\n' | tr A-Z a-z | sort | uniq -c | sort -rn | sed 10q
Enter fullscreen mode Exit fullscreen mode

McIlroy's one-liner took less than two minutes to write and achieved the exact same result using standard Unix tools piped together.

This famous comparison demonstrated the enduring power of the Unix philosophy: small, single-purpose tools that communicate through plain text streams can outlast and outperform custom monolithic code.

Quick Reference Summary

Here is a quick cheat sheet of all 10 one-liners with command placeholders to keep in your notes:

# 1. Share any directory over HTTP
python3 -m http.server <port>

# 2. Kill the exact process locking a port
sudo fuser -k <port>/tcp
sudo kill -9 $(lsof -t -i:<port>)

# 3. Re-run last command as root
sudo !!

# 4. Fix a typo in the previous command
^<typo>^<replacement>^

# 5. Watch command output live with diff highlighting
watch -n <seconds> -d "<command>"

# 6. Create an instant timestamped backup
cp <file>{,.bak-$(date +%Y%m%d_%H%M%S)}

# 7. Find top resource-consuming processes (Memory or CPU)
ps aux --sort=-%mem | head -n <count>
ps aux --sort=-%cpu | head -n <count>

# 8. Run tasks in parallel across all CPU cores
find <dir> -type f -name "<pattern>" -print0 | xargs -0 -P $(nproc) -I {} <command> {}

# 9. Extract and count top client IP addresses from logs
awk '{print $1}' <access.log> | sort | uniq -c | sort -nr | head -n <count>

# 10. Live filter and colorize streaming logs
tail -f <logfile> | grep --line-buffered --color=auto -E "<error_pattern>"

# 11. Zero out a massive log file without breaking open handles
: > <logfile>
sudo truncate -s 0 <logfile>
Enter fullscreen mode Exit fullscreen mode

Which One-Liner Is Your Favorite?

Command line shortcuts save you from writing throwaway scripts and keep your terminal workflow fast and uninterrupted.

Which of these 10 one-liners do you use most often in your day-to-day work? Do you have a favorite shell trick that saves you time every week? Let me know in the comments below!

About the Author

Asep Sayyad is a Linux and DevOps engineer passionate about Linux administration, automation, cloud technologies, containers, and open-source software. He enjoys solving real-world infrastructure challenges and sharing practical knowledge through in-depth technical articles, tutorials, and hands-on guides.

His goal is to help aspiring and experienced engineers build stronger Linux and DevOps skills with content focused on real production scenarios rather than theory alone.

Connect with Me

Enjoyed this article?

If you found this guide helpful, consider:

  • Starring my open-source projects on GitHub.
  • Sharing this article with fellow Linux and DevOps engineers.

You can also follow me for more practical content on Linux, DevOps, Cloud, Containers, Automation, and Open Source. Thanks for reading, and enjoy your learning!

© 2026 Asep Sayyad

Top comments (0)