Everyday commands
The most important Linux commands for vServer and dedicated servers.
These commands work on Debian and Ubuntu. They are sorted by task. Commands with sudo are meant for a normal user. As root, leave out sudo.
Only run commands when you are clear what they do. Never copy deletion commands such as rm -rf without checking the path first. A mistyped path can delete entire directories.
Overview of the server
uptime | Uptime and load. The three numbers are the load over the last 1, 5 and 15 minutes. If they stay above the number of cores (nproc), the server is overloaded. |
|---|
htop | Processes, CPU and RAM usage live. Quit with q. Installation: sudo apt install htop |
|---|
free -h | Memory and swap. The column available matters most. The value free is often small, because Linux uses free memory as cache. |
|---|
nproc | Number of CPU cores |
|---|
hostnamectl | Hostname, operating system and kernel version |
|---|
Storage and disks
df -h | Usage of the file systems. If a partition is at 100 %, services often fail. |
|---|
df -i | Used inodes. Many tiny files can use up the space even though df -h still shows free storage. |
|---|
du -sh /path/* | Size of the folders in a directory. Sorted and without errors on permissions: sudo du -sh /var/* | sort -h |
|---|
lsblk | Disks and partitions as a tree |
|---|
sudo journalctl --disk-usage | Storage used by the logs. Shrink to seven days with sudo journalctl --vacuum-time=7d. |
|---|
Manage services
systemctl status service | State, latest log lines and start time of a service |
|---|
sudo systemctl restart service | Restart the service completely. Existing connections are dropped. |
|---|
sudo systemctl reload service | Reload the configuration without stopping the service. Useful for SSH, so the open session stays. |
|---|
sudo systemctl enable --now service | Start the service at boot and start it immediately |
|---|
sudo systemctl disable --now service | Stop the service and disable it at boot |
|---|
systemctl --failed | All services that ended with an error. Worth a look after a reboot. |
|---|
Read logs
journalctl -u service -n 100 | Last 100 log lines of a service |
|---|
journalctl -u service -f | Follow the logs of a service live, stop with Ctrl+C |
|---|
journalctl --since "1 hour ago" | All logs of the last hour |
|---|
tail -f /path/to/log | Follow a log file live, e.g. /var/log/nginx/error.log |
|---|
sudo grep -i error /var/log/syslog | Find lines containing a search term. Upper and lower case do not matter with -i. |
|---|
Network
ip -br a | Network addresses, short and clear. The IPv4 and IPv6 addresses of the interfaces. |
|---|
ip r | Routing table. Shows through which gateway the server reaches the network. |
|---|
sudo ss -tulpn | Open ports and the program behind them. An unknown service on an open port is a warning sign. |
|---|
ping -c 4 example.com | Check reachability. Four packets, then stop. |
|---|
curl -I https://example.com | Only the HTTP headers of a web page. Shows the status code, e.g. 200 OK. |
|---|
dig +short example.com | Check the DNS record of a domain. Requires the package dnsutils. |
|---|
Install and update packages
sudo apt update && sudo apt upgrade -y | Fetch package lists and update all packages. Details in the section Updates. |
|---|
sudo apt install -y package | Install a package. With -y without asking. |
|---|
apt list --upgradable | Shows which packages have an update |
|---|
sudo apt autoremove | Remove packages that are no longer needed |
|---|
Files and folders
ls -la /path | All files including hidden ones, with permissions and owner |
|---|
cp -r source target | Copy a folder, -r for recursive |
|---|
mv old new | Move or rename |
|---|
grep -R "text" /path | Search all files in a folder for a text |
|---|
find /path -name "*.log" -mtime +7 | Find files matching the pattern that are older than seven days. Only searches, does not delete. |
|---|
chmod 600 file | Only the owner may read and write. Needed for private keys. |
|---|
chown user:group file | Change the owner of a file |
|---|
Editor nano
Files on the server are usually edited with nano file. Save with Ctrl+O, exit with Ctrl+X. Search for text with Ctrl+W.
Processes
ps aux --sort=-%mem | head -n 10 | The ten processes using the most memory |
|---|
sudo kill PID | End a process by its process number (PID). The PID is shown in htop or ps. |
|---|
tmux | A session that keeps running after the connection drops. Ideal for long tasks. Installation: sudo apt install tmux |
|---|
Who is logged in?
who | Logged-in users |
|---|
last -n 20 | Last successful logins |
|---|
sudo lastb -n 20 | Last failed logins. Useful for spotting attacks on SSH. fail2ban (see fail2ban) should catch them. |
|---|
Security
sudo ufw status verbose | Show firewall rules, see Firewall |
|---|
sudo fail2ban-client status sshd | Show blocked addresses |
|---|
sudo sshd -t | Check the SSH configuration for errors before reloading the service |
|---|
Reboot
sudo reboot | Restart the server immediately. First check whether a reboot is needed (see Updates) and whether someone is working on it. |
|---|
sudo shutdown -r +5 | Restart in five minutes. Cancel with sudo shutdown -c. |
|---|
Help for a command
Use man command to open the manual page. command --help gives a short overview. Leave the manual page with q.
