DEV Community: Cameroon Reeves

find Command Cheat Sheet — All Flags & Usage Examples

Cameroon Reeves — Wed, 06 May 2026 12:55:53 +0000

Originally published at commandinline.com.

The find command searches a directory tree by name, type, time, size, permissions, or any combination — and runs an action on every match. It is the most powerful filesystem tool on Linux, and the one that rewards memorizing a few core flags. This sheet maps the flags to real tasks and pairs with locate for fast database queries and find -exec deep dive.

Quick Reference

find takes a path, a series of expressions (filters), and optionally an action. The default action is -print. Expressions combine with implicit AND; use -o for OR and ! or -not for negation.

Syntax & Common Options

Form: find [PATH...] [EXPRESSION].

find . -name '*.log'                   # by name
find /etc -type f                      # files only
find / -type d -name nginx             # directories named nginx
find . -mtime -1                       # modified in the last 24h
find . -size +100M                     # bigger than 100 MB
find . -perm /u+w                      # any user-write set
find . -name '*.tmp' -delete           # deletion action
find . -type f -exec wc -l {} +        # batched exec
find . -name node_modules -prune       # do not descend into node_modules

Syntax

Path first, then expressions. Expressions before -name are options (e.g., -maxdepth); after are tests and actions.

find . -maxdepth 2 -type f -name '*.py'
find . \( -name '*.log' -o -name '*.tmp' \) -delete

Quick Reference Table

The most-used tests and actions.

Tests:
-name PATTERN        glob match (case sensitive)
-iname               case-insensitive
-type f|d|l|c|b|p|s  file type
-size +N|-N c|k|M|G  size (c=bytes, M=MiB)
-mtime ±N            modified N*24h ago (- newer, + older)
-mmin ±N             minutes
-newer FILE          modified more recently than FILE
-perm /MODE          any of these mode bits set
-perm -MODE          all of these mode bits set
-user NAME           by owner
-group NAME          by group
-empty               empty file or dir
-path PATTERN        match full path

Actions:
-print               default; print path
-print0              NUL-separated for xargs -0
-delete              remove matched files
-exec cmd {} \;      one cmd per match (slow)
-exec cmd {} +       batched (fast)
-prune               do not descend into matched directory

Common Flags

Two patterns dominate: filter by name+type, then act with -exec ... + or -delete.

# Delete logs older than 14 days
find /var/log -type f -name '*.log' -mtime +14 -delete

# Run a command on each match (batched is much faster)
find . -name '*.py' -exec wc -l {} +

Practical Examples

Real-world hunts.

# Files modified in the last hour
find /var/log -mmin -60

# All world-writable files (security audit)
find / -xdev -type f -perm -o+w 2>/dev/null

# Empty directories
find . -type d -empty

# Find and grep (NUL-safe)
find . -type f -name '*.conf' -print0 | xargs -0 grep -l TLS

# Skip noisy directories
find . \( -name node_modules -o -name .git \) -prune -o -type f -name '*.js' -print

# Files larger than 1 GB
find / -xdev -type f -size +1G 2>/dev/null

# Files newer than another (rebuild trigger)
find src -newer build/.last -type f

Tips and Tricks

Patterns from production scripts.

# Stay on one filesystem (do not cross mount points)
find / -xdev ...

# NUL-safe pipeline
find . -type f -print0 | xargs -0 sha256sum

# Group expressions with escaped parens
find . \( -name '*.bak' -o -name '*.tmp' \) -delete

# Time precision: use -newermt for human dates
find . -newermt '2024-01-01' ! -newermt '2024-02-01'

Common Pitfalls

find: paths must precede expression — you placed an option after a test. Move -maxdepth, -mindepth, etc. before any -name/-type tests.
find: missing argument to -exec — you forgot the terminator. -exec ends with \; (one cmd per match) or + (batched).

Pro Tips

Always prefer -exec ... + over -exec ... \; for batched commands — orders of magnitude faster on big trees.
Use -prune instead of post-grep filtering to skip node_modules, .git, etc. — find never descends, saving I/O.
For regex on full paths, use -regex with -regextype posix-extended; -name only matches the basename.
Pair -print0 with xargs -0 when filenames may contain spaces or newlines.

Related Commands

Try the -prune trick on a project with node_modules — find finishes in seconds where it used to crawl, and the syntax sticks immediately.

Get-Process Cmdlet — PowerShell Cheat Sheet & Examples

Cameroon Reeves — Wed, 06 May 2026 12:54:26 +0000

Originally published at commandinline.com.

Get-Process is the daily-driver cmdlet for listing and inspecting running processes on Windows and (in PowerShell 7+) Linux and macOS. It returns System.Diagnostics.Process objects you can filter, sort, and pipe into Stop-Process or Wait-Process. This cheat sheet covers the parameters, pipeline patterns, and pitfalls you will hit in everyday automation.

Quick Reference

TL;DR: Get-Process emits live Process objects (not text). It is fully pipeline-friendly — chain it into Where-Object, Sort-Object, or Stop-Process. The default formatter shows handles, NPM, PM, WS, CPU, Id, SI, ProcessName, but every property on System.Diagnostics.Process is available downstream.

Syntax & Common Parameters

Three parameter sets cover almost everything: by name, by Id, and by InputObject. The -Name parameter accepts wildcards and an array; -Id takes an integer or array of integers; -IncludeUserName requires elevation but adds the owning account.

# Core syntax
Get-Process [[-Name] ] [-ComputerName ]
            [-Module] [-FileVersionInfo] [-IncludeUserName]

Get-Process -Id  [-ComputerName ]
Get-Process -InputObject 

# Examples
Get-Process                       # all processes
Get-Process -Name notepad         # exact name (no .exe)
Get-Process chrome*               # wildcard
Get-Process -Id 1234, 5678        # by PID

Common Use Cases

Most workflows fall into “list everything,” “find one,” or “inspect details.” Use -FileVersionInfo to grab vendor and product strings, and -Module to enumerate loaded DLLs.

# Snapshot of every process
Get-Process | Format-Table -AutoSize

# Single process by name
Get-Process -Name explorer

# Get version info on the running pwsh.exe
Get-Process pwsh -FileVersionInfo

# Loaded modules for a single process
Get-Process -Id $PID -Module |
    Select-Object ModuleName, FileName

Filtering & Output Formatting

Filter on the rich object surface: WorkingSet64, CPU, StartTime, Path, Responding. Format-cmdlets are display-only — never pipe them into a real cmdlet.

# Top 10 by working-set memory (bytes)
Get-Process | Sort-Object WorkingSet64 -Descending |
    Select-Object -First 10 Name, Id,
        @{N='WS_MB'; E={ [math]::Round($_.WorkingSet64/1MB, 1) }}

# Hung processes (Responding flag false; Windows GUI apps only)
Get-Process | Where-Object { -not $_.Responding }

# Processes started in the last hour
Get-Process | Where-Object { $_.StartTime -gt (Get-Date).AddHours(-1) }

Pipeline Patterns

Get-Process shines as a producer. Pipe its output to other process cmdlets — they accept Process objects via -InputObject or ValueFromPipeline.

# Stop every Notepad instance
Get-Process notepad -ErrorAction SilentlyContinue | Stop-Process

# Wait for a build to exit, then continue
Get-Process msbuild -ErrorAction SilentlyContinue | Wait-Process

# Group by process name and count
Get-Process | Group-Object Name |
    Sort-Object Count -Descending |
    Select-Object -First 5 Count, Name

Error Handling

If a name does not match, Get-Process emits a non-terminating error: Cannot find a process with the name "X". Use -ErrorAction SilentlyContinue to suppress, or wrap in try/catch with -ErrorAction Stop for strict pipelines.

# Suppress missing-process noise
$p = Get-Process notepad -ErrorAction SilentlyContinue
if ($p) { 'Notepad is running' } else { 'Not running' }

# Promote to terminating error
try {
    Get-Process bogus -ErrorAction Stop
} catch {
    Write-Warning "Lookup failed: $($_.Exception.Message)"
}

Real-World Examples

Aggregate views, ownership lookups, and remote inspections cover most production needs. -IncludeUserName requires an elevated session.

# Memory grouped by process name
Get-Process | Group-Object Name |
    ForEach-Object {
        [pscustomobject]@{
            Name     = $_.Name
            Count    = $_.Count
            TotalMB  = [math]::Round( ($_.Group |
                Measure-Object WorkingSet64 -Sum).Sum / 1MB, 1)
        }
    } | Sort-Object TotalMB -Descending | Select-Object -First 10

# Owner per process (admin shell required)
Get-Process -IncludeUserName |
    Select-Object Name, Id, UserName -First 20

# Remote host (PS 5.1; deprecated in 7+)
Get-Process -ComputerName SERVER01 -Name w3wp

Common Pitfalls

Name lookup fails with .exe — pass notepad, not notepad.exe.
Access denied on other users' processes — run elevated when using -IncludeUserName or reading paths.
CPU column is total CPU-seconds since start, not current load. Sample twice and diff for percentage.
-ComputerName is removed in PowerShell 7 — use Invoke-Command or CIM cmdlets for remote process queries.
Wildcard with -Name is case-insensitive on Windows but case-sensitive on Linux file systems for path matching.

Pro Tips

gps and ps are built-in aliases — gps chrome | % Id.
Need PID of the current shell? $PID is a built-in variable; Get-Process -Id $PID.
(Get-Process -Name code).Path | Select-Object -Unique reveals install location.
Combine with Where-Object using simple syntax: Get-Process | ? WorkingSet64 -gt 500MB.

Related Cmdlets

Bookmark this page for the next time a runaway process eats your RAM — Get-Process plus Sort-Object WorkingSet64 gets you to the culprit in two keystrokes.

grep Command Cheat Sheet — All Flags & Usage Examples

Cameroon Reeves — Wed, 06 May 2026 12:47:05 +0000

Originally published at commandinline.com.

The grep command searches files for lines matching a pattern and is the single most-used text tool in any Unix admin's daily workflow. This cheat sheet covers basic and extended regex, recursion, context lines, file-type filtering, and the speed tricks that make multi-gigabyte log spelunking practical. Pair it with awk for column extraction or sed when you need to transform matches in place.

Quick Reference

grep PATTERN FILE finds matching lines. Add -i for case-insensitive, -v to invert, -r to recurse, -n for line numbers, -l for filenames only, -c for counts, -A/-B/-C N for context lines, -E for extended regex, and -F for fixed strings. --include='*.py' filters file types during recursion.

Syntax & Common Options

The general form is grep [OPTIONS] PATTERN [FILE...]. When no file is given, grep reads stdin.

grep [OPTIONS] PATTERN [FILE...]
  -i        # case-insensitive
  -v        # invert match (lines NOT matching)
  -r / -R   # recursive (R follows symlinks)
  -n        # show line numbers
  -l        # only print filenames with matches
  -L        # only print filenames WITHOUT matches
  -c        # count of matching lines per file
  -o        # print only the matching part
  -w        # match whole words
  -x        # match whole lines
  -E        # extended regex (egrep)
  -F        # fixed string, no regex (fgrep)
  -P        # Perl-compatible regex (PCRE)
  -A N      # N lines after match
  -B N      # N lines before match
  -C N      # N lines of context (before AND after)
  --include='GLOB'   # only search matching files
  --exclude-dir=DIR  # skip directories

Syntax

Quote your pattern to keep the shell from expanding it. Single quotes are safest for regex characters like $, *, and parentheses.

# Basic search
grep 'ERROR' /var/log/syslog

# Multiple files
grep 'timeout' /var/log/nginx/*.log

# Read from stdin
journalctl -u sshd | grep 'Failed password'

# Search recursively under a directory
grep -r 'TODO' src/

# Use -e to combine multiple patterns
grep -e 'ERROR' -e 'WARN' -e 'CRITICAL' app.log

Quick Reference Table

The patterns and flags that solve 90% of real searches.

# Find IP addresses (basic POSIX regex with -E)
grep -E '([0-9]{1,3}\.){3}[0-9]{1,3}' access.log

# Lines starting with ERROR
grep '^ERROR' app.log

# Lines ending in a digit
grep '[0-9]$' data.txt

# Empty lines
grep '^$' file.txt

# Non-empty lines (invert empty)
grep -v '^$' file.txt

# Comments and blanks (typical for cleaning configs)
grep -Ev '^(#|$)' /etc/ssh/sshd_config

Common Flags

Day-to-day combinations that show up in incident response and code search.

# Case-insensitive recursive search with line numbers
grep -rin 'connection refused' /var/log/

# Count occurrences per file
grep -c 'ERROR' /var/log/*.log

# Only print filenames that contain a match
grep -rl 'API_KEY' .

# Exclude vendor and node_modules from a code search
grep -r 'TODO' . --exclude-dir={node_modules,vendor,.git}

# Search only Python files
grep -rn --include='*.py' 'import requests' .

# Show 3 lines of context around each match
grep -C 3 'segfault' /var/log/kern.log

Practical Examples

Real diagnostic and admin patterns.

# Find failed SSH logins with usernames
grep 'Failed password' /var/log/auth.log | awk '{print $9, $11}'

# Pull all 5xx responses from an Nginx access log
grep -E ' 5[0-9]{2} ' /var/log/nginx/access.log

# Locate a process listening on a specific port
ss -tnlp | grep ':443'

# Find all files containing a deprecated API call
grep -rln --include='*.go' 'ioutil.ReadAll' .

# Extract just the matching email addresses
grep -oE '[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+' contacts.txt

# Show 10 lines after every "panic" entry
grep -A 10 'panic:' /var/log/syslog

Tips and Tricks

Performance and ergonomics tricks that pay off on big trees.

# Combine -F with a file of fixed strings (huge speedup)
grep -Ff blocked_ips.txt access.log

# Set GREP_COLORS for custom highlight (or use --color=always)
export GREP_COLOR='1;31'   # bright red matches
export GREP_OPTIONS=''     # avoid (deprecated, breaks scripts)

# Use --color=auto in interactive shells, never in scripts
alias grep='grep --color=auto'

# When grep is too slow, switch to ripgrep (rg) — same flags
rg -i 'pattern' .

# Use -P for lookarounds and \d shortcuts (PCRE)
grep -P '(?<=user=)\w+' /var/log/auth.log

Common Pitfalls

"grep: invalid option" — your pattern starts with -. Use -- or -e: grep -e '-foo' file.
"Binary file matches" — pass -a to treat as text, or -I to skip binaries entirely.
No matches when you expect them — check case (-i), check whether you need -E for +/?, and confirm the file actually contains the pattern with cat -A.
Recursive search hangs — you crossed into /proc or a network mount. Add --exclude-dir or use -r instead of -R.

Pro Tips

Pipe through grep --color=always | less -R to keep highlights when paging.
Use grep -B 1 -A 1 'KEY:' to show YAML/INI keys with surrounding context.
zgrep, bzgrep, and xzgrep search compressed logs without decompressing first.
Replace grep | wc -l with grep -c — saves a process and works on big files.

Related Commands

Master a dozen of these patterns and you will replace half your "open the file in an editor" reflex with a one-line grep.

ls Command Cheat Sheet — All Flags & Usage Examples

Cameroon Reeves — Wed, 06 May 2026 12:45:33 +0000

Originally published at commandinline.com.

The ls command is the first thing every Linux user types and the last one they ever stop tuning. It lists directory contents, but its real value is in the dozens of flags that turn a plain listing into a permissions audit, a size report, or a sort by modification time. Pair it with advanced find searches for filtered hunts and stat for deep file metadata when ls output is not enough.

Quick Reference

ls prints the names of files and directories. Reach for it any time you need to see what is in a path, when a file last changed, who owns it, or how much disk it occupies. With the right flags it replaces a half-dozen ad hoc commands at once.

Syntax & Common Options

The general form is ls [OPTION]... [FILE].... With no path, ls lists the current directory. Combine flags freely — order does not matter.

ls -lah --color=auto /var/log
# -l   long listing: perms, links, owner, group, size, mtime
# -a   include dotfiles
# -h   human-readable sizes (1K, 234M, 2G)
# --color=auto  colorize when stdout is a TTY

Syntax

The minimal invocation is just ls. Pass one or more paths to list specific targets, and stack short flags together (-lah) for compact commands.

ls                  # current directory
ls /etc /var        # multiple paths
ls -d */            # list directories themselves, not their contents

Quick Reference Table

The flags you will reach for daily, mapped to what they actually do.

-l    long format
-a    show hidden (dotfiles)
-A    like -a but skip . and ..
-h    human-readable sizes (use with -l or -s)
-S    sort by file size, largest first
-t    sort by modification time, newest first
-r    reverse the sort
-R    recursive into subdirectories
-1    one entry per line (script-friendly)
-i    show inode numbers

Common Flags

For day-to-day use, -lh is the workhorse. Add -t when you want freshly modified files first, or -S when hunting disk hogs.

ls -lhSr        # sort by size ascending, human-readable
ls -lt | head   # 10 most recently modified entries
ls -ld /etc     # show directory's own metadata, not its contents

Practical Examples

Real workflows: find the biggest files, audit permissions, list only directories, or feed a clean filename list into a pipeline.

# Top 5 largest files in current dir
ls -lhS | head -n 6

# All files modified in the last few minutes (combine with stat for precision)
ls -lt | head

# Only directories, with trailing slash
ls -d */

# Machine-readable: one filename per line, no decoration
ls -1 --color=never

Tips and Tricks

A few flag combinations every sysadmin keeps in muscle memory.

# Show hidden + sort by size + human readable
ls -lAhS

# Recursive listing piped to grep for a quick search
ls -R /etc | grep -i ssh

# Quote names with spaces or special chars
ls -lQ

# Long format including SELinux/ACL indicators
ls -lZ          # SELinux context
ls -l           # trailing '+' marks ACLs present

Common Pitfalls

ls: cannot access: No such file or directory — the path argument does not exist or is misspelled. Tab-complete to verify, or quote globs that may have failed to expand.
Permission denied listing /root — the directory has mode 700 and you are not its owner. Re-run with sudo ls /root or check ownership with ls -ld /root.

Pro Tips

Alias ll='ls -lah' in ~/.bashrc — it is on every veteran's shell.
Use ls --group-directories-first on GNU coreutils to keep folders at the top.
Pipe ls -1 (digit one) into xargs only for filenames without spaces; otherwise prefer find -print0 | xargs -0.
Replace ls with eza or exa for git-aware listings and tree mode.

Related Commands

Bookmark this sheet and try the flag combos on a test box right now — your future self will thank you when a 500-file directory needs sorting at 2 a.m.