Whether you’re managing one server or a hundred, these are the commands you’ll reach for constantly. Some are obvious, some less so — but all of them are worth knowing inside out.
1. htop — Interactive Process Viewer
htop is the improved version of top — a real-time, colour-coded view of running processes, CPU usage, and memory consumption. It’s interactive: you can sort by CPU or memory, kill processes directly, and filter by user.
sudo apt install htop # Install on Debian/Ubuntu
htopPress F6 to sort by a column, F9 to send a signal to a process, q to quit.
2. df and du — Disk Usage
df shows filesystem disk space usage across all mounted volumes. du shows disk usage for specific directories.
# Show disk usage in human-readable format
df -h
# Find the largest directories under /var
du -sh /var/* | sort -rh | head -20The du command with sort -rh piped is one of the most useful one-liners for diagnosing a full disk — it shows you exactly which directories are consuming the most space.
3. ss — Socket Statistics (replaces netstat)
ss is the modern replacement for netstat. It shows open sockets, listening ports, and active connections. Faster and more informative than its predecessor.
# Show all listening TCP ports with process names
ss -tlnp
# Show all established connections
ss -tnp state established4. journalctl — Systemd Log Viewer
On systemd-based systems (Ubuntu, Debian, RHEL), journalctl is your primary log viewing tool. It provides structured access to all system and service logs.
# View logs for a specific service
journalctl -u nginx --since "1 hour ago"
# Follow logs in real-time (like tail -f)
journalctl -u nginx -f
# Show only errors and above
journalctl -p err -b5. grep with -r and -i — Recursive Case-Insensitive Search
You already know grep, but combining flags unlocks its real power for config file searching and log analysis.
# Search recursively for a string in all config files
grep -ri "max_connections" /etc/mysql/
# Find lines containing an IP address in access logs
grep "192.168.1.100" /var/log/nginx/access.log
# Show surrounding context lines
grep -C 3 "ERROR" /var/log/app.log6. rsync — Fast, Resumable File Transfer
rsync is the standard tool for copying files between servers or to backup locations. It only transfers changed blocks, making subsequent syncs fast, and it preserves permissions and timestamps.
# Sync a directory to a remote server
rsync -avz /var/www/html/ user@remote:/var/www/html/
# Dry run to preview what would be transferred
rsync -avz --dry-run /source/ /destination/
# Delete files on destination that no longer exist on source
rsync -avz --delete /source/ /destination/7. crontab — Schedule Tasks
cron runs scheduled tasks. The syntax trips up beginners, but it’s straightforward once you’ve seen it a few times: minute hour day month weekday command.
# Edit current user's crontab
crontab -e
# Example: Run a backup script every day at 2am
0 2 * * * /home/steve/scripts/backup.sh
# Run every 15 minutes
*/15 * * * * /usr/bin/php /var/www/cron.phpUse crontab.guru to verify your cron expressions before deploying them.
8. awk — Column-Based Text Processing
awk is a powerful text processing tool for extracting specific columns from structured output — logs, CSVs, command output.
# Print only the IP address column from nginx logs
awk '{print $1}' /var/log/nginx/access.log | sort | uniq -c | sort -rn | head -20
# Print specific columns from df output
df -h | awk '{print $1, $5}'9. strace — System Call Tracer
strace traces system calls made by a process — invaluable for debugging mysterious application failures where logs give you nothing useful.
# Trace a command and log to file
strace -o /tmp/trace.log ls /var/log
# Attach to a running process by PID
strace -p 1234
# Filter for only file-related calls
strace -e trace=file ls /var/log10. tmux — Terminal Multiplexer
tmux lets you run multiple terminal sessions inside a single SSH connection, and — crucially — keeps them running after you disconnect. No more losing work because your SSH session dropped.
# Start a new named session
tmux new -s mysession
# Detach from session (keeps it running)
# Press: Ctrl+B then D
# List all sessions
tmux ls
# Reattach to a session
tmux attach -t mysessionIf you run long-running commands — database migrations, large file transfers, system updates — always do it inside tmux. Your SSH connection dropping will never abort a job again.
Practise on a Cloud VPS
The best way to get comfortable with these commands is to spin up a cheap VPS and experiment. Vultr and DigitalOcean both offer low-cost instances you can create and destroy in minutes — perfect for a Linux practice environment.
👉 Get $100 free credit on Vultr | 👉 Get $200 free credit on DigitalOcean
Disclosure: This article contains affiliate links. I may earn a commission if you sign up through these links, at no extra cost to you.