When I first touched a Linux terminal, I learned ls, cd, mkdir, and rm. Then I stopped. For about three years I thought that was "knowing Linux."
It wasn't until a senior engineer watched me fight with a log file that I realized the terminal is not a file browser with extra steps — it's a pipeline-oriented toolbelt, and most people only ever use the hammer.
Here are 25 commands I wish I'd learned on day one, grouped by what you're actually trying to do. These are the ones that pay rent.
Stop opening files to search them
1. grep -rn "TODO" .
Recursive (-r), with line numbers (-n). This is how you find every TODO comment in a project in 0.3 seconds instead of opening 40 files.
2. grep -v node_modules
The -v flag inverts the match — it shows everything that doesn't match. Pair it to filter out noise:
grep -rn "api_key" . --include="*.js" | grep -v node_modules
3. rg "pattern"
If ripgrep is installed, use it instead of grep. It respects .gitignore automatically, is dramatically faster, and skips binary files. It's the single biggest quality-of-life upgrade in the terminal.
Read logs without losing your mind
4. tail -f app.log
Follows the file in real time. Combine with grep to watch only errors:
tail -f app.log | grep --line-buffered ERROR
The --line-buffered matters — without it, grep buffers output and you see nothing for seconds at a time.
5. less +F app.log
Like tail -f, but you can scroll up, search with /, and press F again to resume following. Far better for huge logs.
6. journalctl -u nginx -f --since "1 hour ago"
On systemd systems, this is how you read service logs. The --since filter is a lifesaver.
Actually understand what's using space
7. du -sh * | sort -h
Shows the size of every item in the current directory, human-readable (-h), then sorts smallest-to-largest. Instantly reveals which folder ate your disk.
8. ncdu /
Interactive disk usage analyzer. If it's installed, it turns "why is my server full" into a 10-second task.
9. df -h
The classic. Shows free space per filesystem. Run it first, then drill in with du.
Find the process hogging the port
10. lsof -i :3000
Tells you exactly which process is listening on port 3000. No more "port already in use" mystery.
11. kill -9 $(lsof -t -i :3000)
-t prints just the PID. Wrap it in kill to free the port in one move.
12. htop
If top is a spreadsheet, htop is a dashboard. Scroll, sort by column, kill processes with F9. Install it once and never go back.
Move data around like a plumber
13. rsync -avz --progress src/ user@host:/dest/
rsync only transfers the changed parts of a file. For deploying or syncing large directories, it's an order of magnitude faster than scp. The trailing slash on src/ matters: with it, you copy the contents; without it, you copy the folder itself.
14. tar -czf archive.tar.gz folder/
Compress (-c), gzip (-z), file (-f). To extract: tar -xzf archive.tar.gz. You'll type these two commands thousands of times.
15. scp file.txt user@host:/path/
Quick one-off copy over SSH. Fine for single files, but reach for rsync for anything bigger.
Save your wrists with history
16. Ctrl + R
Reverse search. Start typing and it matches against your command history. Hit Ctrl + R again to cycle through older matches. This alone saves hours.
17. !!
"Bang bang" — repeats the last command. The classic move is sudo !! when you forgot to prefix with sudo.
18. history | grep docker
Then !1234 to re-run command number 1234 from history.
Edit text without leaving the terminal
19. sed -i 's/localhost/0.0.0.0/g' config.yaml
In-place find-and-replace across a file. The -i flag edits the file directly (back up first until you trust your regex).
20. awk '{print $2}' access.log
Prints the second column of every line. awk is a mini programming language for columnar data — once you learn $1, $2, $NF (last field), you stop opening CSVs in Excel.
21. cut -d, -f1 data.csv
Simpler than awk when you just need a field by delimiter. -d, = comma delimiter, -f1 = first field.
The ones that feel like superpowers
22. find . -name "*.log" -mtime +7 -delete
Find log files older than 7 days and delete them. Use without -delete first to preview what it'll touch. This is how you write a cleanup cron job in one line.
23. watch -n 2 'curl -s localhost:3000/health'
Re-runs a command every 2 seconds and shows the result full-screen. Perfect for watching a deploy come up or a queue drain.
24. xargs
Takes stdin and turns it into arguments. The combination that clicks for everyone once:
grep -rl "old-domain.com" . | xargs sed -i 's/old-domain.com/new-domain.com/g'
Find every file containing a string, then run a replacement on each. This is the pipeline mindset in one line.
25. jq '.' response.json
Pretty-prints JSON. Once you add jq, you stop squinting at API responses. jq '.data[].name' extracts every name from a list. It's grep for structured data.
The pattern behind all of these
None of these commands is impressive on its own. The power is pipes — connecting small tools so the output of one becomes the input of the next:
cat access.log | grep 404 | awk '{print $7}' | sort | uniq -c | sort -rn | head
That one-liner answers "which URLs are 404ing the most?" It's cat -> filter -> extract -> sort -> count -> sort -> top-10. Each piece is trivial. Strung together, they replace a script.
That's the whole secret. Learn the primitives, then practice chaining them. After a few weeks it stops feeling like memorizing commands and starts feeling like thinking in pipelines.
If you found this useful, I build free developer tools that run in your browser — no signup, no tracking. There's a longer-form Git and Docker command reference in the same series, and a collection of small utilities I keep adding to. Happy to share links in the comments if anyone wants them.
Top comments (0)