Linux system administrators have hundreds of terminal commands available, but a relatively small group handles most everyday server-management and troubleshooting work.
The following list was distilled from sysadmin forums, community discussions and professional Linux resources. It is not a scientific ranking—no central database records every command entered by every administrator—but these commands appeared repeatedly across the sources examined.
The examples apply to most modern Linux distributions, including AlmaLinux, Rocky Linux, Red Hat Enterprise Linux, Ubuntu and Debian. Some service names and log locations may differ between distributions.
1. ssh — Connect to a Remote Server
The ssh command establishes an encrypted connection to another machine. For sysadmins managing remote web servers, cloud instances and network devices, it is often the command that begins every working session.
ssh username@server.example.com
# Connect on a non-standard SSH port
ssh -p 2222 username@server.example.com
# Use a particular private key
ssh -i ~/.ssh/server_key username@server.example.comKey-based authentication is generally preferable to password authentication, particularly for automation and regularly accessed servers.
2. sudo — Run a Command with Elevated Privileges
The sudo command runs an authorised command with elevated privileges. It allows administrators to perform protected operations without remaining logged in permanently as the root user.
# Run one privileged command
sudo systemctl restart httpd
# Open a root login shell
sudo -i
# See which commands your account may run
sudo -lAlways review a command carefully before adding sudo. Elevated privileges turn an ordinary typing error into a potentially system-wide problem.
3. ls — List Files and Directories
The ls command displays directory contents. Its long format also exposes ownership, permissions, file sizes and modification times, making it useful for far more than simply finding a file.
$ ls -lah /var/log
total 3.2M
drwxr-xr-x. 9 root root 4.0K Jul 19 09:10 .
drwxr-xr-x. 20 root root 4.0K Jul 18 22:41 ..
-rw-------. 1 root root 128K Jul 19 09:08 secure
-rw-r-----. 1 root adm 2.1M Jul 19 09:10 messagesThe commonly used options are -l for detailed information, -a for hidden entries and -h for human-readable sizes.
4. cd and pwd — Navigate the Filesystem
cd changes the current directory, while pwd prints its complete path. Administrators use them constantly while moving among configuration, website, application and log directories.
$ cd /etc/httpd/conf.d
$ pwd
/etc/httpd/conf.d
# Return to the previous directory
$ cd -
# Move to the current user's home directory
$ cdConfirming the current directory before copying, moving or deleting files can prevent costly mistakes.
5. cat and less — Read Text Files
cat prints a file directly to the terminal and is convenient for short files. less is safer for long configuration files and logs because it provides scrolling and searching without loading the entire file onto the screen.
# Display a short file
cat /etc/os-release
# Open a long file for browsing
less /var/log/messages
# Show line numbers
cat -n /etc/hostsInside less, press / to search, n for the next match, G to jump to the end and q to quit.
6. grep — Search for Matching Text
The grep command searches files or piped output for matching text. It is one of the fastest ways to isolate errors, processes, configuration directives and suspicious entries.
# Case-insensitive search with line numbers
grep -in "error" /var/log/messages
# Recursively search configuration files
grep -RIns "PermitRootLogin" /etc/ssh
# Filter another command's output
ps aux | grep '[h]ttpd'Useful options include -i for case-insensitive matching, -n for line numbers, -R for recursive searches and -v for lines that do not match.
7. find — Locate Files and Directories
The find command locates filesystem objects using criteria such as name, type, size, owner, permissions and modification time. It can also execute another command against the results.
# Find a file by name
find /var/www -type f -iname "wp-config.php"
# Find files modified during the past 24 hours
find /var/www -type f -mtime -1
# Find files larger than 100 MB
find /var -xdev -type f -size +100M -printf '%s %p\n' 2>/dev/null | sort -nr | headTest a find expression without a destructive action first. Adding -delete or an -exec action before verifying the results can affect far more files than intended.
8. tail — View the End of a File
Because the newest log entries normally appear at the bottom, tail is one of the most useful troubleshooting commands. It can display the last few lines or continue following a file as new events are written.
# Display the last 100 lines
tail -n 100 /var/log/messages
# Follow new entries in real time
tail -F /var/log/httpd/error_log
# Follow and display only errors or warnings
tail -F /var/log/messages | grep -Ei "error|warning|failed"The uppercase -F option is helpful for logs because it continues following the filename if log rotation replaces the original file.
9. awk — Extract and Process Structured Text
awk processes text as fields and records. Sysadmins commonly use it to select columns, calculate totals and transform the output of other commands.
# Print filesystem name and percentage used
df -h | awk 'NR>1 {print $1, $5}'
# Display usernames from /etc/passwd
awk -F: '{print $1}' /etc/passwd
# Print processes using more than 20% CPU
ps aux | awk 'NR==1 || $3>20'awk is effectively a small programming language, but even basic column selection can make complicated command output much easier to read.
10. sed — Edit and Transform Text Streams
The sed stream editor searches, replaces, removes and transforms text. It is frequently used in administration scripts and bulk configuration changes.
# Preview a replacement without changing the file
sed 's/old.example.com/new.example.com/g' config.conf
# Print lines 20 through 40
sed -n '20,40p' config.conf
# Edit in place while retaining a backup
sed -i.bak 's/old-value/new-value/g' config.confWithout -i, the transformed content is sent to standard output and the original file remains unchanged. When editing in place, creating a backup such as -i.bak provides a simple recovery path.
11. ps and pgrep — Inspect Running Processes
The ps command takes a snapshot of running processes. pgrep provides a cleaner way to locate process IDs and commands matching a particular name.
# Display every process
ps aux
# Show the highest CPU consumers
ps aux --sort=-%cpu | head
# Find matching process IDs and full commands
pgrep -af "httpd|apache2"Before terminating a process, confirm its PID, owner and full command. Avoid sending SIGKILL immediately unless the process cannot be stopped cleanly.
12. top and htop — Monitor Processes in Real Time
top continuously displays CPU usage, memory consumption, system load and active processes. htop provides a more colourful and interactive alternative when it is installed.
# Start the standard process monitor
top
# Initially sort processes by CPU usage
top -o %CPU
# Alternative interactive monitor
htopInside top, press P to sort by CPU, M to sort by memory, 1 to show individual CPU cores and q to quit.
13. df — Check Filesystem Capacity
The df command reports space used and available on mounted filesystems. It is normally the first command run when a server reports a full disk.
$ df -hT
Filesystem Type Size Used Avail Use% Mounted on
/dev/vda2 xfs 80G 54G 26G 68% /
/dev/vda1 xfs 960M 310M 650M 33% /bootUse df -i when a filesystem reports that it is full despite apparently having free space. It may have exhausted its available inodes because of an excessive number of small files.
14. du — Discover What Is Using Disk Space
While df reports the capacity of an entire filesystem, du measures the space consumed by individual directories and files.
# Compare top-level directories under /var
du -xhd1 /var 2>/dev/null | sort -h
# Show the total size of a website
du -sh /var/www/example.com
# Display the 20 largest entries in the current directory
du -ahx . 2>/dev/null | sort -rh | head -20The -x option prevents the scan from crossing onto other mounted filesystems, while -h displays readable units such as megabytes and gigabytes.
15. free — Check Memory and Swap Usage
The free command provides a quick summary of physical memory and swap usage. The available figure is generally more useful than the raw free column because Linux deliberately uses spare memory for caching.
$ free -h
total used free shared buff/cache available
Mem: 15Gi 5.8Gi 1.2Gi 324Mi 8.0Gi 8.6Gi
Swap: 2.0Gi 128Mi 1.9GiHeavy swap use can indicate memory pressure, but it should be investigated alongside process usage, system load and historical monitoring data.
16. systemctl — Manage Services
On systemd-based Linux distributions, systemctl starts, stops, restarts, enables and inspects services.
# Check a service
systemctl status httpd --no-pager
# Restart it
sudo systemctl restart httpd
# Start it automatically during boot
sudo systemctl enable httpd
# List failed services
systemctl --failedApache is usually named httpd on Red Hat-derived systems and apache2 on Debian-derived systems. Other service names may also vary.
17. journalctl — Read systemd Logs
journalctl queries the systemd journal. It can filter events by service, boot, priority and time period, making it more precise than reading an entire log file.
# Logs for one service
journalctl -u httpd --since "30 minutes ago" --no-pager
# Follow the service log
journalctl -fu httpd
# Errors recorded during the current boot
journalctl -b -p err
# Logs from the previous boot
journalctl -b -1If a service refuses to start, checking systemctl status followed by journalctl -u will often reveal the immediate cause.
18. ip — Inspect Network Interfaces and Routes
The ip command displays and manages network interfaces, addresses and routing. It is the modern replacement for several older tools, including ifconfig and route.
# Concise interface and address summary
ip -br address
# Display the routing table
ip route
# Show the route Linux would use for an address
ip route get 1.1.1.1
# Display interface statistics
ip -s linkRunning ip route get is particularly useful on servers with multiple addresses, gateways or network interfaces.
19. ss — Inspect Ports and Network Connections
The ss command displays sockets, listening ports and active network connections. It is the modern replacement for most netstat use cases.
# Show listening TCP and UDP ports with processes
sudo ss -lntup
# Show established TCP connections
ss -nt state established
# Check whether anything is listening on port 80
sudo ss -lntp 'sport = :80'The frequently used options mean listening sockets (-l), numeric addresses (-n), TCP (-t), UDP (-u) and process details (-p).
20. curl — Test URLs, APIs and Connectivity
curl transfers data using HTTP, HTTPS and several other protocols. Sysadmins use it to test websites, inspect headers, verify redirects, call APIs and determine whether a service is reachable.
# Retrieve response headers and follow redirects
curl -I -L --max-time 10 https://example.com
# Display only the final HTTP status code
curl -sS -o /dev/null -w '%{http_code}\n' https://example.com
# Test a local virtual host using a particular IP address
curl -I --resolve example.com:443:192.0.2.10 https://example.com
# Request JSON from an API
curl -sS https://api.example.com/status | jqA successful network connection does not necessarily mean an application is healthy. The HTTP status, response headers, certificate and returned content can each reveal a different type of problem.
Commands Work Best Together
The real strength of the Linux terminal comes from combining small commands. Pipes send the output of one command into another, allowing an administrator to reduce a large amount of information to the exact answer required.
# Find recent authentication failures
journalctl -u sshd --since today | grep -i "failed"
# Show the largest top-level directories
du -xhd1 /var 2>/dev/null | sort -h
# Identify the busiest processes
ps aux --sort=-%cpu | head
# Watch active connections to HTTPS
watch -d "ss -nt state established | grep ':443'"Other commands—including cp, mv, rm, mkdir, chmod, chown, lsof, dmesg, dig, ping, tar, rsync and distribution-specific package managers—remain important. However, mastering the 20 command groups above provides a strong foundation for everyday Linux server administration.
A Final Word of Caution
Linux assumes that an authorised administrator knows what a command will do. Before running an unfamiliar command as root, consult its manual with man command, verify all paths and test searches or replacements without their destructive options. A few seconds spent checking a command can prevent hours of recovery work.
