Cheatsheets:LinuxCLI/SysOps

Languages: English · français · Esperanto

Quick reference for smart people — part of our Linux cheatsheets collection.

The everyday Linux system-administration commands: see who is on the box, spot CPU/RAM/disk hogs, manage users and groups, and control services with systemd.

New to the Linux command line? Every command here has a built-in manual — try man <command> or tldr for short examples.

Many commands in this cheatsheet may require root priveledges. Use sudo. Don't log in as root.

Who is logged in

who            # who is currently logged in
w              # who is logged in, and what they are running
last           # history of all logins (reads /var/log/wtmp)
id username    # a user's UID, GID and group memberships

Processes & resource hogs

ps aux                            # all processes, all users
ps aux --sort=-%cpu | head -10    # top CPU consumers
ps aux --sort=-%mem | head -10    # top memory consumers
htop                              # CLI interactive process manager (may require manual installation: older systems only pre-install `top`)
free -h                           # RAM and swap usage
uptime                            # load average and uptime
pgrep -af "$name"                 # Search by process name: show PID and command line

Column	Meaning
`USER`	owner of the process
`%CPU` / `%MEM`	CPU / memory share
`VSZ` / `RSS`	virtual / resident memory
`STAT`	state: R running, S sleeping, Z zombie
`COMMAND`	the program and its arguments

Killing processes:

kill -9 PID            # force-kill by PID (find it in ps)

pkill -u username      # kill every process of a user
pkill -f "pattern"     # kill processes whose command line matches

fuser "$port/tcp"      # Search by TCP port: show PID(s) bound to port
fuser -k "$port/tcp"   # Kill by TCP port: terminate process bound to port

kill -l                # list all signal names

Signal	Meaning
1 `HUP`	reload configuration
15 `TERM`	graceful shutdown (the default)
9 `KILL`	force kill — may cause memory leaks

kill -9 is a last resort — prefer plain kill (SIGTERM) so the process can save state and close files cleanly.

Disk usage

df -h                    # free space per mounted filesystem
df -h /                  # free space on one filesystem
df -i                    # inode usage
du -sh dir/              # total size of a directory
du -sh *                 # size of each item in the current directory
du -h --max-depth=1 dir/ # per subdirectory
du -sh /* 2>/dev/null | sort -h   # largest top-level folders

"Disk full" with df -h showing free space? Check inodes with df -i — millions of tiny files can exhaust the inode table first.

Users & groups

useradd -m -s /bin/bash john   # create john: home dir (-m) and bash shell (-s)
passwd john                    # set or change john's password
usermod -aG sudo john          # add john to the sudo (admin) group
usermod -d /new/home john      # change john's home directory
usermod -L john                # lock john's account
usermod -U john                # unlock it again
userdel -r john                # delete john and their home dir

groups username      # groups a user belongs to
groupadd deploy      # create a group
groupdel deploy      # delete a group
usermod -aG deploy john   # add john to the deploy group

Services & logs (systemd)

systemctl status nginx     # is it running? why not?
systemctl start nginx      # start now
systemctl stop nginx       # stop now
systemctl restart nginx    # stop, then start again
systemctl reload nginx     # reload config without a full restart
systemctl enable nginx     # start at boot
systemctl disable nginx    # don't start at boot
systemctl --failed         # units that failed to start

journalctl -u nginx            # logs for one service
journalctl -u nginx -f         # follow new log lines live
journalctl -u nginx -n 100     # last 100 lines
journalctl -u nginx --since "1 hour ago"
journalctl -xe                 # recent log + hints about errors

Emergencies quick reference

Scenario	Command
Server slow — find the CPU hog	`ps aux --sort=-%cpu \| head -10`
Out of RAM — find the memory hog	`ps aux --sort=-%mem \| head -10`
Disk 100% full — find the biggest folder	`du -sh /* 2>/dev/null \| sort -h`
A user is abusing the system — kick them out	`pkill -u username` or `sudo kill -9 PID`
Change a password immediately	`passwd username`
Lock / unlock an account	`usermod -L username` / `usermod -U username`
Who changed a file	`stat file.txt` (access / change / modification times)