DEV Community

Yashvi Kothari
Yashvi Kothari

Posted on

Linux Server Administration: The Skills That Actually Make You Dangerous in Production

#devops #security #cloud #linux

Linux Server Administration: The Skills That Actually Make You Dangerous in Production

Most people learning DevOps start with Kubernetes.

That’s backwards.

Before containers, pipelines, cloud architecture, or Kubernetes, there is a machine.

And that machine is usually running Linux.

If you cannot confidently answer:

  • What is using port 80?
  • Why did Nginx fail?
  • Where did the disk space go?
  • Which process is consuming CPU?
  • Who owns this file?
  • Why can't this user SSH?
  • Why didn't the cron job run?
  • Why did the service stop after reboot?

then Kubernetes won't save you.

Linux server administration is the foundation underneath modern infrastructure.

1. Learn to Think Like a Server Administrator

A junior administrator often asks:

"What command should I run?"

A strong administrator asks:

"What evidence do I need?"

That's the difference.

If a website is down, don't randomly restart services.

Build a chain of evidence:

systemctl status nginx
Enter fullscreen mode Exit fullscreen mode

Is the service running?

Then:

sudo ss -tlnp
Enter fullscreen mode Exit fullscreen mode

Is something actually listening on the expected port?

Then:

sudo journalctl -u nginx
Enter fullscreen mode Exit fullscreen mode

What does the service log say?

Then:

df -h
Enter fullscreen mode Exit fullscreen mode

Is the server out of disk space?

Then inspect the application and web-server logs.

The goal isn't to memorize 500 commands.

The goal is to know which command answers which question.

2. Master the Linux Filesystem

You should be able to navigate a server without thinking.

pwd
ls -lah
cd /var/www/html
cd ..
cd ~
Enter fullscreen mode Exit fullscreen mode

Then learn the basic file operations:

cp file.txt /backup/
mv old.txt new.txt
rm file.txt
mkdir -p /var/www/site/logs
touch newfile.txt
Enter fullscreen mode Exit fullscreen mode

And become comfortable reading logs:

less /var/log/syslog
tail -f /var/log/apache2/error.log
Enter fullscreen mode Exit fullscreen mode

That last command is especially important.

Production troubleshooting often means watching a log while reproducing a problem.

3. Learn How to Find Problems

Linux gives you powerful tools for searching.

For example:

grep "error" /var/log/syslog
Enter fullscreen mode Exit fullscreen mode

Search recursively:

grep -r "db_password" /var/www/
Enter fullscreen mode Exit fullscreen mode

Find files:

find / -name "php.ini"
Enter fullscreen mode Exit fullscreen mode

Find old logs:

find /var/www -name "*.log" -mtime +30
Enter fullscreen mode Exit fullscreen mode

And when disk space disappears:

df -h
Enter fullscreen mode Exit fullscreen mode

Then:

du -sh /var/www/*
Enter fullscreen mode Exit fullscreen mode

The pattern is simple:

Detect → Locate → Investigate → Fix → Verify

That's server administration.

4. Permissions Are Not Optional

Linux permissions are one of the first things interviewers test.

Understand:

-rwxrwxrwx
Enter fullscreen mode Exit fullscreen mode

It represents:

Owner | Group | Others
Enter fullscreen mode Exit fullscreen mode

And:

r = 4
w = 2
x = 1
Enter fullscreen mode Exit fullscreen mode

So:

chmod 755 directory
Enter fullscreen mode Exit fullscreen mode

means:

Owner  = rwx
Group  = r-x
Others = r-x
Enter fullscreen mode Exit fullscreen mode

While:

chmod 644 file
Enter fullscreen mode Exit fullscreen mode

means:

Owner  = rw-
Group  = r--
Others = r--
Enter fullscreen mode Exit fullscreen mode

For sensitive files:

chmod 600 .env
Enter fullscreen mode Exit fullscreen mode

And don't forget ownership:

chown www-data:www-data /var/www/html -R
Enter fullscreen mode Exit fullscreen mode

A web application can be perfectly configured and still fail because the process cannot read or write the required files.

5. SSH Is Your Remote Hands

If you're managing Linux servers, SSH becomes one of your most important tools.

Basic connection:

ssh user@server
Enter fullscreen mode Exit fullscreen mode

Custom port:

ssh -p 2222 user@server
Enter fullscreen mode Exit fullscreen mode

Using an AWS private key:

ssh -i ~/.ssh/mykey.pem ubuntu@aws-ip
Enter fullscreen mode Exit fullscreen mode

Better yet, use SSH keys.

ssh-keygen -t ed25519
Enter fullscreen mode Exit fullscreen mode

Then configure hosts:

Host production
    HostName 192.168.1.100
    User deploy
    Port 2222
    IdentityFile ~/.ssh/production_key
Enter fullscreen mode Exit fullscreen mode

Now:

ssh production
Enter fullscreen mode Exit fullscreen mode

Simple.

Repeatable.

Less typing.

6. SSH Hardening Is More Than Changing the Port

Changing port 22 is not a security strategy by itself.

A stronger configuration includes:

PermitRootLogin no
PasswordAuthentication no
PubkeyAuthentication yes
MaxAuthTries 3
AllowUsers john deploy
Enter fullscreen mode Exit fullscreen mode

And after changing SSH configuration:

sudo sshd -t
Enter fullscreen mode Exit fullscreen mode

Only after validating the configuration should you apply the change.

And keep your current SSH session open while testing a new connection.

That tiny habit can save you from locking yourself out of a server.

7. Cron Turns Scripts Into Automation

A script becomes much more useful when it can run automatically.

Cron format:

* * * * * command
│ │ │ │ │
│ │ │ │ └── day of week
│ │ │ └──── month
│ │ └────── day of month
│ └──────── hour
└────────── minute
Enter fullscreen mode Exit fullscreen mode

For example:

0 2 * * * /usr/local/bin/backup_db.sh
Enter fullscreen mode Exit fullscreen mode

means:

Run the database backup every day at 2 AM.

Every five minutes:

*/5 * * * *
Enter fullscreen mode Exit fullscreen mode

And one of the most important troubleshooting concepts:

>> /var/log/backup.log 2>&1
Enter fullscreen mode Exit fullscreen mode

The command's output gets captured so you can investigate failures later.

Automation without observability is just scheduled confusion.

8. Systemd Controls Your Services

Modern Linux servers rely heavily on systemd.

Know these commands:

systemctl start nginx
systemctl stop nginx
systemctl restart nginx
systemctl reload nginx
systemctl status nginx
systemctl enable nginx
Enter fullscreen mode Exit fullscreen mode

But don't stop at status.

When something fails:

sudo journalctl -u nginx
Enter fullscreen mode Exit fullscreen mode

For live logs:

sudo journalctl -u nginx -f
Enter fullscreen mode Exit fullscreen mode

One of the most useful interview questions is:

What's the difference between restart and reload?

Restart:

Stop the service and start it again.

Reload:

Reload configuration without fully stopping the service.

For services that support it, reload can avoid unnecessary downtime.

9. Processes Tell You What the Machine Is Actually Doing

When the server becomes slow, start looking at processes.

top
Enter fullscreen mode Exit fullscreen mode

or:

htop
Enter fullscreen mode Exit fullscreen mode

For a snapshot:

ps aux
Enter fullscreen mode Exit fullscreen mode

Find a process:

pgrep -a nginx
Enter fullscreen mode Exit fullscreen mode

And when necessary:

kill PID
Enter fullscreen mode Exit fullscreen mode

A graceful termination should normally be preferred over:

kill -9 PID
Enter fullscreen mode Exit fullscreen mode

SIGKILL is the hammer.

Don't use a hammer when a normal shutdown will work.

10. Ports Are One of Your Best Troubleshooting Clues

A service can be "running" and still be unreachable.

Check listening ports:

sudo ss -tlnp
Enter fullscreen mode Exit fullscreen mode

Or:

sudo lsof -i :80
Enter fullscreen mode Exit fullscreen mode

This answers an extremely important question:

"What process is actually listening on this port?"

If your application should listen on port 8080 but nothing is listening there, investigating DNS is probably not your first move.

Follow the evidence.

11. The Real DevOps Skill: Connecting the Dots

Imagine this production incident:

"The website is down."

Don't panic.

Ask:

Is the service running? 

systemctl status nginx
Enter fullscreen mode Exit fullscreen mode

Is the port listening? 

sudo ss -tlnp
Enter fullscreen mode Exit fullscreen mode

Are there errors? 

sudo journalctl -u nginx
Enter fullscreen mode Exit fullscreen mode

Is the disk full? 

df -h
Enter fullscreen mode Exit fullscreen mode

Is a process consuming resources? 

top
Enter fullscreen mode Exit fullscreen mode

What do the application logs say? 

tail -f /var/log/...
Enter fullscreen mode Exit fullscreen mode

Now you're troubleshooting.

Not guessing.

12. The Interview Questions You Should Be Able to Answer

If you're preparing for a Linux/DevOps/SysAdmin interview, know questions such as:

How do you find which process is using a port?

sudo lsof -i :80
Enter fullscreen mode Exit fullscreen mode

or:

sudo ss -tlnp | grep :80
Enter fullscreen mode Exit fullscreen mode

How do you find large files?

du -sh /* | sort -rh | head -20
Enter fullscreen mode Exit fullscreen mode

How do you check whether a service is running?

systemctl status nginx
Enter fullscreen mode Exit fullscreen mode

What does chmod 755 mean?

Owner has rwx; group and others have r-x.

How do you check the OS version?

cat /etc/os-release
Enter fullscreen mode Exit fullscreen mode

How do you troubleshoot a failed service?

systemctl status service
journalctl -u service
Enter fullscreen mode Exit fullscreen mode

What does 2>&1 mean?

It redirects stderr to stdout, allowing both streams to be captured together.

These aren't trivia questions.

They represent real operational tasks.

The Bigger Lesson

DevOps isn't primarily about knowing more tools.

It's about understanding systems.

Linux teaches you:

  • processes
  • networking
  • permissions
  • services
  • logs
  • storage
  • automation
  • security
  • troubleshooting

Once those fundamentals become second nature, tools like Docker, Kubernetes, Jenkins, Terraform, and AWS become much easier to understand.

Because you're no longer memorizing commands.

You're understanding what the infrastructure is doing.

Don't learn Linux to pass an interview.

Learn Linux so that when production breaks at 2 AM, you know where to look.

That's the skill that compounds.

Part 1: Linux Server Administration Fundamentals

[!TIP]
Practice every command on a free VPS (DigitalOcean $4/mo, AWS Free Tier, or a local VM using VirtualBox + Ubuntu Server).

1.1 Essential Linux Commands (Must Know Cold)

File & Directory Operations 

# Navigation
pwd                          # Print current directory
ls -la                       # List all files with permissions, sizes
ls -lah                      # Human-readable sizes
cd /var/www/html             # Change directory
cd ..                        # Go up one level
cd ~                         # Go to home directory

# File operations
cp file.txt /backup/         # Copy file
cp -r /source/ /dest/        # Copy directory recursively
mv old.txt new.txt           # Rename/move
rm file.txt                  # Delete file
rm -rf /path/to/dir/         # Delete directory recursively (DANGEROUS)
mkdir -p /var/www/site/logs  # Create nested directories
touch newfile.txt            # Create empty file

# Viewing files
cat /etc/hosts               # View entire file
less /var/log/syslog         # Paginated view (q to quit)
head -n 50 error.log         # First 50 lines
tail -n 100 error.log        # Last 100 lines
tail -f /var/log/apache2/error.log  # Live follow (VERY common in troubleshooting)

# Searching
grep "error" /var/log/syslog          # Search for text in file
grep -r "db_password" /var/www/       # Recursive search
grep -i "warning" error.log           # Case-insensitive
grep -c "404" access.log              # Count matches
find / -name "php.ini"                # Find file by name
find /var/www -name "*.log" -mtime +30 -delete  # Delete logs older than 30 days
locate php.ini                        # Fast search (uses database, run updatedb first)

# Disk & Space
df -h                        # Disk space usage
du -sh /var/www/*             # Directory sizes
du -sh /var/log/*  | sort -rh | head -20  # Top 20 largest dirs in /var/log
ncdu /                       # Interactive disk usage (install: apt install ncdu)

# Text manipulation
sed -i 's/old/new/g' file.txt         # Find and replace in file
awk '{print $1}' access.log           # Print first column
wc -l access.log                      # Count lines
sort access.log | uniq -c | sort -rn  # Count unique lines, sorted
Enter fullscreen mode Exit fullscreen mode

Interview Q&A: Linux Commands

Question Answer
How do you find which process is using the most CPU? top or htop, press P to sort by CPU
How do you find which process is using a specific port? sudo lsof -i :80 or `sudo netstat -tlnp \
How do you find large files consuming disk space? {% raw %}`du -sh /* \
How do you check if a service is running? {% raw %}systemctl status nginx or `ps aux \
How to check system uptime? {% raw %}uptime command
What does chmod 755 mean? Owner: rwx (7), Group: r-x (5), Others: r-x (5)
What does chmod 644 mean? Owner: rw- (6), Group: r-- (4), Others: r-- (4)
Difference between > and >>? > overwrites file, >> appends to file
What is a symlink? How to create? Shortcut/pointer to another file. ln -s /target /link_name
How to check OS version? cat /etc/os-release or lsb_release -a

1.2 Users, Groups & Permissions

User Management 

# Create users
sudo adduser john                     # Interactive user creation (preferred on Ubuntu)
sudo useradd -m -s /bin/bash john     # Non-interactive, creates home dir, sets shell

# Set/change password
sudo passwd john

# Delete user
sudo userdel john                     # Delete user only
sudo userdel -r john                  # Delete user + home directory

# Modify user
sudo usermod -aG sudo john           # Add john to sudo group
sudo usermod -aG www-data john       # Add john to www-data group (for web files)
sudo usermod -s /usr/sbin/nologin john  # Disable shell login (for service accounts)

# View user info
id john                               # Show UID, GID, groups
whoami                                # Current user
groups john                           # List groups for user
cat /etc/passwd                       # All users
cat /etc/group                        # All groups

# Switch user
su - john                             # Switch to john (with john's environment)
sudo -u www-data command              # Run command as www-data user
Enter fullscreen mode Exit fullscreen mode

File Permissions 

# Permission format: -rwxrwxrwx (owner/group/others)
# r=4, w=2, x=1

# Common permissions for web servers
chmod 755 /var/www/html               # Directories: rwxr-xr-x
chmod 644 /var/www/html/index.html    # Files: rw-r--r--
chmod 600 /var/www/html/.env          # Sensitive files: rw-------
chmod 700 /home/john/.ssh             # SSH directory
chmod 600 /home/john/.ssh/authorized_keys  # SSH keys

# Ownership
chown www-data:www-data /var/www/html -R   # Change owner+group recursively
chown john:john file.txt                    # Change owner and group

# Special permissions
chmod +s /usr/bin/program              # SetUID - runs as file owner
chmod g+s /var/www/shared/             # SetGID - new files inherit group
chmod +t /tmp                          # Sticky bit - only owner can delete
Enter fullscreen mode Exit fullscreen mode

Interview Q&A: Users & Permissions

Question Answer
What permissions should web files have? Directories: 755, Files: 644, Sensitive (.env, config): 600
What user should own web files? www-data:www-data (for Apache/Nginx on Ubuntu)
What's the difference between adduser and useradd? adduser is interactive, creates home dir, sets password. useradd is low-level, non-interactive
How to give a user sudo access? sudo usermod -aG sudo username
What is /etc/passwd vs /etc/shadow? passwd has user info (public), shadow has encrypted passwords (root only)
How do you prevent a user from logging in via SSH? Set shell to /usr/sbin/nologin or /bin/false, or use DenyUsers in sshd_config
What is umask? Default permission mask. umask 022 = new files get 644, dirs get 755

1.3 SSH (Secure Shell)

SSH Configuration & Usage 

# Connect to server
ssh root@192.168.1.100                # Basic connection
ssh -p 2222 john@server.com           # Custom port
ssh -i ~/.ssh/mykey.pem ubuntu@aws-ip # Using private key (AWS)

# SSH Key Generation (on your local machine)
ssh-keygen -t ed25519 -C "john@company.com"   # Modern, preferred
ssh-keygen -t rsa -b 4096 -C "john@company.com"  # RSA alternative

# Copy public key to server
ssh-copy-id john@192.168.1.100
# OR manually:
cat ~/.ssh/id_ed25519.pub >> ~/.ssh/authorized_keys  # On server

# SSH Config file (~/.ssh/config) - saves time
# Create/edit: nano ~/.ssh/config
Host production
    HostName 192.168.1.100
    User john
    Port 2222
    IdentityFile ~/.ssh/production_key

Host staging
    HostName 192.168.1.101
    User deploy
    Port 22
    IdentityFile ~/.ssh/staging_key

# Now you can just type:
ssh production
ssh staging
Enter fullscreen mode Exit fullscreen mode

SSH Hardening (Server-side: /etc/ssh/sshd_config) 

# Edit SSH config
sudo nano /etc/ssh/sshd_config

# IMPORTANT changes:
Port 2222                         # Change default port (not 22)
PermitRootLogin no                # Disable root SSH login
PasswordAuthentication no         # Force key-based auth only
PubkeyAuthentication yes          # Enable key authentication
MaxAuthTries 3                    # Limit login attempts
AllowUsers john deploy            # Whitelist specific users
ClientAliveInterval 300           # Timeout after 5 min idle
ClientAliveCountMax 2             # Disconnect after 2 missed keepalives
Protocol 2                        # Use SSH protocol 2 only

# After changes, ALWAYS test before disconnecting:
sudo sshd -t                      # Test config for syntax errors
sudo systemctl restart sshd       # Apply changes

# IMPORTANT: Keep current session open, test new connection in another terminal!
Enter fullscreen mode Exit fullscreen mode

Interview Q&A: SSH

Question Answer
How do you harden SSH? Change port, disable root login, disable password auth, use key-based auth, whitelist users, use fail2ban
What's the difference between SSH and SFTP? SSH = remote shell access. SFTP = secure file transfer over SSH (port 22)
How do you transfer files via SSH? scp file.txt user@server:/path/ or use SFTP client (FileZilla, WinSCP)
What port does SSH use? Default: 22 (should be changed in production)
What do you do if you're locked out of SSH? Access via hosting provider's console/VNC, check sshd_config, check firewall rules, check fail2ban
Difference between SSH key types? ed25519 (modern, fast, secure), RSA (legacy, use 4096-bit minimum)

1.4 SFTP & FTP 

# SFTP (Secure - uses SSH, port 22) - PREFERRED
sftp john@server.com
sftp -P 2222 john@server.com          # Custom SSH port

# Inside SFTP session:
put localfile.txt /remote/path/        # Upload
get /remote/file.txt ./local/          # Download
ls                                      # List remote files
lls                                     # List local files
cd /var/www/html                        # Change remote directory
lcd ~/Desktop                           # Change local directory

# FTP (Insecure - port 21) - AVOID if possible
# If needed, use vsftpd:
sudo apt install vsftpd
sudo nano /etc/vsftpd.conf
# Key settings:
# anonymous_enable=NO
# local_enable=YES
# write_enable=YES
# chroot_local_user=YES     # Jail users to home directory
# ssl_enable=YES             # Enable FTPS (FTP over SSL)

sudo systemctl restart vsftpd

# SCP (Secure Copy)
scp file.txt john@server:/var/www/html/           # Upload file
scp -r /local/dir/ john@server:/remote/dir/       # Upload directory
scp john@server:/var/log/error.log ./              # Download file
scp -P 2222 file.txt john@server:/path/           # Custom port
Enter fullscreen mode Exit fullscreen mode

Interview Q&A: File Transfer

Question Answer
SFTP vs FTP vs SCP? SFTP: secure, over SSH. FTP: insecure, legacy. SCP: secure copy, simpler but no resume
Why prefer SFTP over FTP? SFTP encrypts data in transit, uses SSH port (no extra ports), supports key auth
What port does FTP use? 21 (control), 20 (data in active mode), random high ports (passive mode)

1.5 Cron Jobs

Setting Up Cron Jobs 

# Edit crontab for current user
crontab -e

# Edit crontab for specific user (as root)
sudo crontab -u www-data -e

# View crontab
crontab -l
sudo crontab -u www-data -l

# Cron format:
# ┌───────── minute (0-59)
# │ ┌─────── hour (0-23)
# │ │ ┌───── day of month (1-31)
# │ │ │ ┌─── month (1-12)
# │ │ │ │ ┌─ day of week (0-7, 0 and 7 = Sunday)
# │ │ │ │ │
# * * * * * command_to_run

# PRACTICAL EXAMPLES:

# Database backup every day at 2 AM
0 2 * * * /usr/local/bin/backup_db.sh >> /var/log/backup.log 2>&1

# Website backup every Sunday at 3 AM
0 3 * * 0 /usr/local/bin/backup_website.sh >> /var/log/backup.log 2>&1

# Clear tmp files every hour
0 * * * * find /tmp -type f -mtime +1 -delete

# Check disk space every 30 minutes
*/30 * * * * /usr/local/bin/check_disk.sh

# SSL certificate auto-renew (Let's Encrypt) - twice daily
0 0,12 * * * certbot renew --quiet

# Restart PHP-FPM every night at 4 AM (performance)
0 4 * * * systemctl restart php8.2-fpm

# Run Laravel scheduler every minute
* * * * * cd /var/www/html && php artisan schedule:run >> /dev/null 2>&1

# Rotate logs weekly
0 0 * * 0 logrotate /etc/logrotate.conf
Enter fullscreen mode Exit fullscreen mode

Sample Backup Script (/usr/local/bin/backup_db.sh) 

#!/bin/bash
# Database backup script
DATE=$(date +%Y-%m-%d_%H-%M)
BACKUP_DIR="/backups/mysql"
DB_NAME="production_db"
DB_USER="backup_user"
DB_PASS="secure_password"

# Create backup directory
mkdir -p $BACKUP_DIR

# Dump database
mysqldump -u $DB_USER -p$DB_PASS $DB_NAME | gzip > $BACKUP_DIR/${DB_NAME}_${DATE}.sql.gz

# Delete backups older than 30 days
find $BACKUP_DIR -name "*.sql.gz" -mtime +30 -delete

# Log the backup
echo "[$DATE] Backup completed: ${DB_NAME}_${DATE}.sql.gz" >> /var/log/backup.log
Enter fullscreen mode Exit fullscreen mode 
# Make script executable
chmod +x /usr/local/bin/backup_db.sh
Enter fullscreen mode Exit fullscreen mode

Interview Q&A: Cron Jobs

Question Answer
What does */5 * * * * mean? Every 5 minutes
What does 0 2 * * * mean? Every day at 2:00 AM
What does 0 0 * * 0 mean? Every Sunday at midnight
What does 2>&1 mean? Redirects stderr to stdout (captures all output)
Where are system cron jobs stored? /etc/crontab, /etc/cron.d/, /etc/cron.daily/, /etc/cron.hourly/
How to debug a cron job not running? Check `/var/log/syslog \
What's the difference between {% raw %}crontab -e and /etc/crontab? crontab -e is per-user, /etc/crontab is system-wide and includes username field

1.6 Systemd & Service Management 

# Service management
sudo systemctl start nginx              # Start service
sudo systemctl stop nginx               # Stop service
sudo systemctl restart nginx             # Restart service
sudo systemctl reload nginx              # Reload config without downtime
sudo systemctl status nginx              # Check status
sudo systemctl enable nginx              # Start on boot
sudo systemctl disable nginx             # Don't start on boot
sudo systemctl is-active nginx           # Check if running
sudo systemctl is-enabled nginx          # Check if enabled on boot

# List all services
systemctl list-units --type=service
systemctl list-units --type=service --state=running

# View service logs
sudo journalctl -u nginx                # All logs for nginx
sudo journalctl -u nginx -f             # Follow logs live
sudo journalctl -u nginx --since "1 hour ago"
sudo journalctl -u nginx --since "2024-01-01" --until "2024-01-02"

# Custom service file example (/etc/systemd/system/myapp.service)
[Unit]
Description=My Python Application
After=network.target

[Service]
User=www-data
Group=www-data
WorkingDirectory=/var/www/myapp
ExecStart=/var/www/myapp/venv/bin/python app.py
Restart=always
RestartSec=5

[Install]
WantedBy=multi-user.target

# After creating/modifying service file:
sudo systemctl daemon-reload            # Reload systemd
sudo systemctl enable myapp             # Enable on boot
sudo systemctl start myapp              # Start the service
Enter fullscreen mode Exit fullscreen mode

Interview Q&A: Services

Question Answer
Difference between restart and reload? restart stops and starts (brief downtime). reload reloads config without stopping (no downtime, preferred)
How to make a service start on boot? systemctl enable servicename
How to check why a service failed? systemctl status servicename and journalctl -u servicename
What is systemd? Init system and service manager for Linux. Manages services, boot process, logging

1.7 Process Management 

# View processes
top                                  # Real-time process viewer
htop                                 # Better interactive viewer (install: apt install htop)
ps aux                               # Snapshot of all processes
ps aux | grep nginx                  # Find specific process
pgrep -a nginx                       # Find process by name

# Kill processes
kill PID                             # Graceful termination (SIGTERM)
kill -9 PID                          # Force kill (SIGKILL)
killall nginx                        # Kill all processes by name
pkill -f "python app.py"             # Kill by full command match

# Background processes
command &                            # Run in background
nohup command &                      # Run in background, survive logout
screen -S session_name               # Create named screen session
screen -r session_name               # Reattach to session
tmux new -s session_name             # Create named tmux session
tmux attach -t session_name          # Reattach to session

# Check what's using a port
sudo lsof -i :80                     # What's on port 80?
sudo lsof -i :443                    # What's on port 443?
sudo ss -tlnp                        # All listening ports
sudo netstat -tlnp                   # All listening ports (legacy)
Enter fullscreen mode Exit fullscreen mode

Top comments (16)

Collapse
 
yashvikothari profile image
Yashvi Kothari •

This command:

find /var/www -name "*.log" -mtime +30
Enter fullscreen mode Exit fullscreen mode

means “find .log files under /var/www that were last modified more than 30 days ago.”

Breakdown:

  • find — Linux command for searching files/directories.
  • /var/www — starting directory. find searches it recursively, including subdirectories.

  • -name "*.log" — only match filenames ending in .log.

    • * means any sequence of characters.
    • The quotes prevent the shell from expanding *.log before find sees it.

  • -mtime +30 — match files whose modification time is more than 30 days ago.

Example

Suppose /var/www contains:

/var/www/app/access.log       ← modified 5 days ago
/var/www/app/error.log        ← modified 45 days ago
/var/www/site/debug.log       ← modified 90 days ago
/var/www/site/index.html      ← modified 100 days ago
Enter fullscreen mode Exit fullscreen mode

The command would output:

/var/www/app/error.log
/var/www/site/debug.log
Enter fullscreen mode Exit fullscreen mode

Important -mtime detail

-mtime measures age in 24-hour periods, with rounding down. So -mtime +30 is slightly stricter than simply saying “older than 30 calendar days”; in practice, it selects files whose rounded-down age is greater than 30 days.

If you're using this to delete old logs, don't immediately add -delete—it's safer to inspect the results first.

Collapse
 
yashvikothari profile image
Yashvi Kothari •

If you're asking whether this is valid for every 5 minutes:

*/5 * * * *
Enter fullscreen mode Exit fullscreen mode

Yes. It means:

  • */5 — every 5 minutes (0, 5, 10, 15, ... 55)
  • * — every hour
  • * — every day of the month
  • * — every month
  • * — every day of the week

So it runs at 12:00, 12:05, 12:10, 12:15, ...

*/5 vs 0:05

In a cron expression, you don't write 0:05. The */5 goes in the minute field.

*/5 * * * *
Enter fullscreen mode Exit fullscreen mode

means every 5 minutes.

If you meant incron specifically, that's different from cron: incron is event-driven (e.g., “when this file changes”), so it doesn't use */5 to schedule periodic execution.

Collapse
 
yashvikothari profile image
Yashvi Kothari •

For exactly 00:05 (5 minutes past midnight):

```cron id="r8x2kp"
5 0 * * *




That means **every day at 00:05**.

If you mean **05:00 (5 AM)**:



```cron id="m3v7qa"
0 5 * * *
Enter fullscreen mode Exit fullscreen mode

So:

Time Cron
Every 5 minutes */5 * * * *
Every day at 00:05 5 0 * * *
Every day at 05:00 0 5 * * *
Collapse
 
yashvikothari profile image
Yashvi Kothari •

In cron, / means “step” or “every N units.”

So:

*/5
Enter fullscreen mode Exit fullscreen mode

means “every 5.”

For the minute field:

*/5 * * * *
Enter fullscreen mode Exit fullscreen mode

means:

minute: 0, 5, 10, 15, 20, 25, 30, 35, 40, 45, 50, 55
Enter fullscreen mode Exit fullscreen mode

Think of it like this

  • * = all values
  • /5 = take every 5th value
  • */5 = every 5

Examples:

*/2   → every 2 minutes
*/5   → every 5 minutes
*/10  → every 10 minutes
*/15  → every 15 minutes
Enter fullscreen mode Exit fullscreen mode

The / is called the step value operator in cron.

Collapse
 
yashvikothari profile image
Yashvi Kothari •

If you mean every 2 hours and 13 minutes (every 133 minutes), standard cron can't express that reliably with a simple */... expression, because cron fields reset at the hour boundary.

If you mean at minute 13 of every 2nd hour, use:

13 */2 * * *
Enter fullscreen mode Exit fullscreen mode

That runs at:

00:13
02:13
04:13
06:13
08:13
...
22:13
Enter fullscreen mode Exit fullscreen mode

So:

  • 13 = minute 13
  • */2 = every 2 hours
  • * * * = every day/month/day-of-week

If you literally mean every 2 hours 13 minutes, tell me the starting time (e.g. 00:00), because that needs a different approach.

Collapse
 
yashvikothari profile image
Yashvi Kothari •

To run once every day at 2:13 AM:

```cron id="z7p3kx"
13 2 * * *




Breakdown:

* `13` → minute = 13
* `2` → hour = 2 AM
* `*` → every day of the month
* `*` → every month
* `*` → every day of the week

So it runs at **02:13 every day**.
Enter fullscreen mode Exit fullscreen mode
Collapse
 
yashvikothari profile image
Yashvi Kothari •

If you mean run on the 15th of every month, but only if the 15th is a Saturday:

```cron id="k4m8tz"
0 0 15 * 6




This runs at **00:00 on the 15th when the 15th is Saturday**.

However, there is an important cron detail: in standard cron, the **day-of-month** and **day-of-week** fields are usually treated with **OR**, not AND, when both are restricted.

So `0 0 15 * 6` can mean:

> Run on the 15th **OR** every Saturday.

For a true **“15th AND Saturday”**, use a cron job that checks the date:



```bash
0 0 15 * * [ "$(date +\%u)" -eq 6 ] && /path/to/script
Enter fullscreen mode Exit fullscreen mode

Here 6 means Saturday in date +%u.

Collapse
 
yashvikothari profile image
Yashvi Kothari •

If you mean run on the 15th day of every month, at a specific time:

At midnight on the 15th 

0 0 15 * *
Enter fullscreen mode Exit fullscreen mode

At 2:13 AM on the 15th 

13 2 15 * *
Enter fullscreen mode Exit fullscreen mode

The fields are:

minute hour day-of-month month day-of-week
  13    2       15         *       *
Enter fullscreen mode Exit fullscreen mode

So 15 in the third field means the 15th of every month.

Collapse
 
yashvikothari profile image
Yashvi Kothari •

To run once a year on December 15th at midnight:

```cron id="v4x8nm"
0 0 15 12 *




Breakdown:

* `0` → minute 0
* `0` → hour 0 (midnight)
* `15` → 15th day
* `12` → December
* `*` → any day of the week

So it runs **December 15 at 00:00 every year**.
Enter fullscreen mode Exit fullscreen mode
Collapse
 
yashvikothari profile image
Yashvi Kothari •

This:

>> /var/log/backup.log 2>&1
Enter fullscreen mode Exit fullscreen mode

is shell redirection. It sends both normal output and errors into /var/log/backup.log.

1. >> /var/log/backup.log

>> means append output to the file.

Example:

./backup.sh >> /var/log/backup.log
Enter fullscreen mode Exit fullscreen mode

If backup.sh prints:

Backup started
Backup completed
Enter fullscreen mode Exit fullscreen mode

those lines are added to the end of backup.log.

  • > = overwrite the file
  • >> = append to the file

2. 2>&1

Linux programs have standard streams:

0 = stdin   → input
1 = stdout  → normal output
2 = stderr  → error output
Enter fullscreen mode Exit fullscreen mode

2>&1 means:

Send stderr (2) to the same place as stdout (1).

So:

./backup.sh >> /var/log/backup.log 2>&1
Enter fullscreen mode Exit fullscreen mode

means:

Normal output (1) ──┐
                   ├──> /var/log/backup.log
Error output (2) ──┘
Enter fullscreen mode Exit fullscreen mode

In a cron job

You might see:

0 2 * * * /usr/local/bin/backup.sh >> /var/log/backup.log 2>&1
Enter fullscreen mode Exit fullscreen mode

This means:

Run the backup every day at 2:00 AM, append normal output and errors to /var/log/backup.log.

View full discussion (16 comments)