DEV Community

Linux Server Administration: The Skills That Actually Make You Dangerous in Production

Yashvi Kothari on August 12, 2026

Linux Server Administration: The Skills That Actually Make You Dangerous in Production Most people learning DevOps start with Kubernetes...

Read full post

Yashvi Kothari • Aug 12

This command:

find /var/www -name "*.log" -mtime +30

means “find .log files under /var/www that were last modified more than 30 days ago.”

Breakdown:

find — Linux command for searching files/directories.
/var/www — starting directory. find searches it recursively, including subdirectories.
-name "*.log" — only match filenames ending in .log.
- * means any sequence of characters.
- The quotes prevent the shell from expanding *.log before find sees it.
-mtime +30 — match files whose modification time is more than 30 days ago.

Example

Suppose /var/www contains:

/var/www/app/access.log       ← modified 5 days ago
/var/www/app/error.log        ← modified 45 days ago
/var/www/site/debug.log       ← modified 90 days ago
/var/www/site/index.html      ← modified 100 days ago

The command would output:

/var/www/app/error.log
/var/www/site/debug.log

Important `-mtime` detail

-mtime measures age in 24-hour periods, with rounding down. So -mtime +30 is slightly stricter than simply saying “older than 30 calendar days”; in practice, it selects files whose rounded-down age is greater than 30 days.

If you're using this to delete old logs, don't immediately add -delete—it's safer to inspect the results first.

Yashvi Kothari • Aug 12

If you're asking whether this is valid for every 5 minutes:

*/5 * * * *

Yes. It means:

*/5 — every 5 minutes (0, 5, 10, 15, ... 55)
* — every hour
* — every day of the month
* — every month
* — every day of the week

So it runs at 12:00, 12:05, 12:10, 12:15, ...

`*/5` vs `0:05`

In a cron expression, you don't write 0:05. The */5 goes in the minute field.

*/5 * * * *

means every 5 minutes.

If you meant incron specifically, that's different from cron: incron is event-driven (e.g., “when this file changes”), so it doesn't use */5 to schedule periodic execution.

Yashvi Kothari • Aug 12

For exactly 00:05 (5 minutes past midnight):

```cron id="r8x2kp"
5 0 * * *




That means **every day at 00:05**.

If you mean **05:00 (5 AM)**:



```cron id="m3v7qa"
0 5 * * *

So:

Time	Cron
Every 5 minutes	`/5 * * *`
Every day at 00:05	`5 0 * * *`
Every day at 05:00	`0 5 * * *`

Yashvi Kothari • Aug 12

In cron, / means “step” or “every N units.”

So:

*/5

means “every 5.”

For the minute field:

*/5 * * * *

means:

minute: 0, 5, 10, 15, 20, 25, 30, 35, 40, 45, 50, 55

Think of it like this

* = all values
/5 = take every 5th value
*/5 = every 5

Examples:

*/2   → every 2 minutes
*/5   → every 5 minutes
*/10  → every 10 minutes
*/15  → every 15 minutes

The / is called the step value operator in cron.

Yashvi Kothari • Aug 12

If you mean every 2 hours and 13 minutes (every 133 minutes), standard cron can't express that reliably with a simple */... expression, because cron fields reset at the hour boundary.

If you mean at minute 13 of every 2nd hour, use:

13 */2 * * *

That runs at:

00:13
02:13
04:13
06:13
08:13
...
22:13

So:

13 = minute 13
*/2 = every 2 hours
* * * = every day/month/day-of-week

If you literally mean every 2 hours 13 minutes, tell me the starting time (e.g. 00:00), because that needs a different approach.

Yashvi Kothari • Aug 12

To run once every day at 2:13 AM:

```cron id="z7p3kx"
13 2 * * *




Breakdown:

* `13` → minute = 13
* `2` → hour = 2 AM
* `*` → every day of the month
* `*` → every month
* `*` → every day of the week

So it runs at **02:13 every day**.

Yashvi Kothari • Aug 12

If you mean run on the 15th of every month, but only if the 15th is a Saturday:

```cron id="k4m8tz"
0 0 15 * 6




This runs at **00:00 on the 15th when the 15th is Saturday**.

However, there is an important cron detail: in standard cron, the **day-of-month** and **day-of-week** fields are usually treated with **OR**, not AND, when both are restricted.

So `0 0 15 * 6` can mean:

> Run on the 15th **OR** every Saturday.

For a true **“15th AND Saturday”**, use a cron job that checks the date:



```bash
0 0 15 * * [ "$(date +\%u)" -eq 6 ] && /path/to/script

Here 6 means Saturday in date +%u.

Yashvi Kothari • Aug 12

If you mean run on the 15th day of every month, at a specific time:

At midnight on the 15th

0 0 15 * *

At 2:13 AM on the 15th

13 2 15 * *

The fields are:

minute hour day-of-month month day-of-week
  13    2       15         *       *

So 15 in the third field means the 15th of every month.

Yashvi Kothari • Aug 12

To run once a year on December 15th at midnight:

```cron id="v4x8nm"
0 0 15 12 *




Breakdown:

* `0` → minute 0
* `0` → hour 0 (midnight)
* `15` → 15th day
* `12` → December
* `*` → any day of the week

So it runs **December 15 at 00:00 every year**.

Yashvi Kothari • Aug 12

This:

>> /var/log/backup.log 2>&1

is shell redirection. It sends both normal output and errors into /var/log/backup.log.

1. `>> /var/log/backup.log`

>> means append output to the file.

Example:

./backup.sh >> /var/log/backup.log

If backup.sh prints:

Backup started
Backup completed

those lines are added to the end of backup.log.

> = overwrite the file
>> = append to the file

2. `2>&1`

Linux programs have standard streams:

0 = stdin   → input
1 = stdout  → normal output
2 = stderr  → error output

2>&1 means:

Send stderr (2) to the same place as stdout (1).

So:

./backup.sh >> /var/log/backup.log 2>&1

means:

Normal output (1) ──┐
                   ├──> /var/log/backup.log
Error output (2) ──┘

In a cron job

You might see:

0 2 * * * /usr/local/bin/backup.sh >> /var/log/backup.log 2>&1

This means:

Run the backup every day at 2:00 AM, append normal output and errors to /var/log/backup.log.

Yashvi Kothari • Aug 12

These are all systemctl commands for managing the Nginx service, but each does something different.

Command	What it does
`systemctl start nginx`	Start Nginx now
`systemctl stop nginx`	Stop Nginx now
`systemctl restart nginx`	Stop + start Nginx now
`systemctl reload nginx`	Reload Nginx configuration without fully stopping it
`systemctl status nginx`	Show Nginx's current status/log information
`systemctl enable nginx`	Configure Nginx to start automatically at boot

1. `start`

systemctl start nginx

Starts Nginx immediately.

If Nginx is already running, there's generally nothing useful to do.

Important: start does not automatically make Nginx start after reboot.

2. `stop`

systemctl stop nginx

Stops Nginx immediately.

Your website will become unavailable while Nginx is stopped.

3. `restart`

systemctl restart nginx

Essentially:

stop → start

Useful when you want to completely restart Nginx.

For example, after making certain changes where a full restart is required.

4. `reload`

systemctl reload nginx

Tells Nginx to re-read its configuration without doing a full stop/start.

This is commonly preferred after changing Nginx configuration:

nginx -t
systemctl reload nginx

reload is usually less disruptive because existing connections can continue while Nginx applies the new configuration.

5. `status`

systemctl status nginx

Shows information such as:

● nginx.service - A high performance web server
   Active: active (running)

It can also show recent service log messages.

This doesn't start, stop, or modify Nginx.

6. `enable`

systemctl enable nginx

This means:

Start Nginx automatically when the system boots.

It does not necessarily start Nginx right now.

If you want both:

systemctl enable --now nginx

This means:

Enable at boot + start immediately.

Easy way to remember

start    → start NOW
stop     → stop NOW
restart  → stop + start NOW
reload   → reload config NOW
status   → tell me what's happening
enable   → start automatically at BOOT

And one very common combination for Nginx configuration changes is:

nginx -t && systemctl reload nginx

First test the configuration; only reload if the test succeeds.

Yashvi Kothari • Aug 12

This command is commonly used to find which directories are taking the most disk space:

du -sh /* | sort -rh | head -20

Let's break it down:

1. `du -sh /*`

du = disk usage

-s → show only a summary for each item
-h → human-readable sizes (K, M, G, etc.)
/* → every file/directory directly under /

Example output:

45G     /var
12G     /home
8.2G    /usr
2.1G    /opt
500M    /root

2. `|`

The pipe sends the output of the command on the left to the command on the right.

du -sh /*  →  sort -rh

3. `sort -rh`

Sorts the results by size.

-r → reverse order, largest first
-h → understand human-readable sizes like 45G, 500M, 2K

Without -r, the smallest would come first.

4. `| head -20`

head shows the first lines.

head -20

means:

Show the first 20 results.

Since sort -rh puts the largest first, you get the 20 largest items.

Overall meaning

du -sh /* | sort -rh | head -20

means:

Show me the 20 largest files/directories directly under /, sorted from largest to smallest.

For example:

50G    /var
18G    /home
9.5G   /usr
4.2G   /opt
1.1G   /root
...

This is a useful command when you get an alert like:

/dev/sda1 is 95% full

and want to quickly find where the space is being used.

Yashvi Kothari • Aug 12

Sure. sed is a stream editor, commonly used to find and replace text.

The basic command:

sed -i 's/old/new/g' file.txt

means:

Find old in file.txt, replace it with new, and save the changes.

Break it down

sed       → text editor/processor
-i        → modify the file directly
s         → substitute
old       → text to find
new       → replacement text
g         → replace all occurrences on each line
file.txt  → file to modify

The important part is:

s/old/new/g

Think of it as:

s / FIND / REPLACE / OPTIONS

Example 1: Simple replacement

File:

Hello old world
old value
old configuration

Run:

sed -i 's/old/new/g' file.txt

Result:

Hello new world
new value
new configuration

Example 2: Replace a word

Before:

server=localhost
database=localhost
cache=localhost

Command:

sed -i 's/localhost/192.168.1.10/g' config.txt

After:

server=192.168.1.10
database=192.168.1.10
cache=192.168.1.10

Example 3: Change a port

Before:

server {
    listen 80;
}

Command:

sed -i 's/listen 80/listen 8080/g' nginx.conf

After:

server {
    listen 8080;
}

Example 4: Change a configuration value

Before:

APP_ENV=development

Command:

sed -i 's/APP_ENV=development/APP_ENV=production/g' .env

After:

APP_ENV=production

Example 5: Replace only the first occurrence

Suppose:

old old old

Using:

sed -i 's/old/new/' file.txt

Result:

new old old

Without g, sed replaces only the first match on each line.

With g:

sed -i 's/old/new/g' file.txt

Result:

new new new

So:

s/old/new/     → first occurrence per line
s/old/new/g    → all occurrences per line

Example 6: Replace only on a specific line

File:

server=localhost
port=80
debug=true

Change only line 2:

sed -i '2s/80/8080/' file.txt

Result:

server=localhost
port=8080
debug=true

The 2 means:

Only perform the substitution on line 2.

Example 7: Replace on a range of lines

sed -i '2,4s/old/new/g' file.txt

Means:

On lines 2 through 4, replace old with new.

Example 8: Delete lines

sed isn't only for replacement.

Delete line 3:

sed -i '3d' file.txt

Delete blank lines:

sed -i '/^$/d' file.txt

Here:

^ = beginning of line
$ = end of line
^$ = empty line
d = delete

Example 9: Comment out a line

Before:

PermitRootLogin yes

Command:

sed -i 's/^PermitRootLogin/#PermitRootLogin/' sshd_config

After:

#PermitRootLogin yes

^PermitRootLogin means:

Match PermitRootLogin only when it appears at the beginning of the line.

Example 10: Replace an entire line

Suppose:

server_name old.example.com;

You want:

server_name new.example.com;

You can use:

sed -i 's/^server_name.*/server_name new.example.com;/' nginx.conf

Here:

^             → beginning of line
server_name   → literal text
.*            → everything after it

So it replaces the entire matching line.

Very important: `-i`

Compare:

sed 's/old/new/g' file.txt

This prints the modified content, but doesn't change file.txt.

Whereas:

sed -i 's/old/new/g' file.txt

actually modifies file.txt.

For safety, you can create a backup:

sed -i.bak 's/old/new/g' file.txt

Now you have:

file.txt      → modified
file.txt.bak  → original

This is particularly useful when modifying things like Nginx, SSH, or application configuration files.

Cheat sheet

# Replace first occurrence on each line
sed -i 's/old/new/' file.txt

# Replace ALL occurrences
sed -i 's/old/new/g' file.txt

# Replace on line 5
sed -i '5s/old/new/' file.txt

# Replace lines 5-10
sed -i '5,10s/old/new/g' file.txt

# Delete line 5
sed -i '5d' file.txt

# Delete blank lines
sed -i '/^$/d' file.txt

# Modify file but keep backup
sed -i.bak 's/old/new/g' file.txt

The key thing to remember is:

s/what/with-what/g = substitute what with with-what, globally on each line.

Yashvi Kothari • Aug 12

This command:

sed -i '2,4s/old/new/g' file.txt

means:

In lines 2 through 4 of file.txt, replace every old with new, and modify the file directly.

Break it down

2,4   → lines 2 through 4
s     → substitute
old   → text to find
new   → replacement
g     → all occurrences on each selected line
-i    → save changes directly to file.txt

Suppose file.txt contains:

line 1: old
line 2: old old
line 3: hello old
line 4: old world old
line 5: old

Run:

sed -i '2,4s/old/new/g' file.txt

Result:

line 1: old
line 2: new new
line 3: hello new
line 4: new world new
line 5: old

Notice:

Line 1 → unchanged
Lines 2–4 → old replaced with new
Line 5 → unchanged

Compare

sed -i 's/old/new/g' file.txt

→ Replace throughout the entire file.

sed -i '2s/old/new/g' file.txt

→ Replace only on line 2.

sed -i '2,4s/old/new/g' file.txt

→ Replace only on lines 2, 3, and 4.

A useful pattern to remember:

[line/range] [operation]
    ↓
  2,4      s/old/new/g

So 2,4 is the range, and s/old/new/g is the operation performed on that range.

Yashvi Kothari • Aug 12

If you want to replace old with new only on line 1 and line 5, you can use:

sed -i '1s/old/new/g;5s/old/new/g' file.txt

Easier to understand

1s/old/new/g   → do replacement on line 1
;
5s/old/new/g   → do replacement on line 5

The ; separates two sed commands.

For example:

1: old hello
2: old hello
3: old hello
4: old hello
5: old hello

After:

sed -i '1s/old/new/g;5s/old/new/g' file.txt

you get:

1: new hello
2: old hello
3: old hello
4: old hello
5: new hello

Another way

You can use a pattern to select specific lines:

sed -i '1s/old/new/g;5s/old/new/g' file.txt

For just two specific lines, this is the clearest approach.

Yashvi Kothari • Aug 12

022 in umask means remove these permissions from the default permissions.

Think of it as:

umask 022
       ↑↑↑
       ││└─ others: remove write
       │└── group:  remove write
       └─── owner:  remove nothing

Why files become `644`

New files start with a maximum base permission of:

Apply umask 022:

  666
- 022
-----
  644

So:

644 = rw-r--r--

Owner → rw-
Group → r--
Others → r--

Why directories become `755`

Directories start with:

Apply 022:

  777
- 022
-----
  755

So:

755 = rwxr-xr-x

Owner → rwx
Group → r-x
Others → r-x

What does each digit mean?

0 2 2
│ │ │
│ │ └── Others: remove write (2)
│ └──── Group:  remove write (2)
└────── Owner:  remove nothing (0)

Permission values:

4 = read
2 = write
1 = execute

So umask 022 essentially means:

Owner keeps full default permissions, while group and others don't get write permission.

That's why 022 is a very common default on Linux servers.

Example

Important -mtime detail

*/5 vs 0:05

Think of it like this

At midnight on the 15th

At 2:13 AM on the 15th

1. >> /var/log/backup.log

2. 2>&1

In a cron job

1. start

2. stop

3. restart

4. reload

5. status

6. enable

Easy way to remember

1. du -sh /*

2. |

3. sort -rh

4. | head -20

Overall meaning

Break it down

Example 1: Simple replacement

Example 2: Replace a word

Example 3: Change a port

Example 4: Change a configuration value

Example 5: Replace only the first occurrence

Example 6: Replace only on a specific line

Example 7: Replace on a range of lines

Example 8: Delete lines

Example 9: Comment out a line

Example 10: Replace an entire line

Very important: -i

Cheat sheet

Break it down

Compare

Easier to understand

Another way

Why files become 644

Why directories become 755

What does each digit mean?

Important `-mtime` detail

`*/5` vs `0:05`

1. `>> /var/log/backup.log`

2. `2>&1`

1. `start`

2. `stop`

3. `restart`

4. `reload`

5. `status`

6. `enable`

1. `du -sh /*`

2. `|`

3. `sort -rh`

4. `| head -20`

Very important: `-i`

Why files become `644`

Why directories become `755`