Mastering Linux Administration: 20 Powerful Commands to Know

Linux is a powerful and versatile operating system that can be used for a wide range of purposes. For many system administrators, the command line interface is the primary way to interact with the system. Countless Linux commands can be used to perform various tasks, from simple file management to complex network configurations. However, even experienced Linux administrators may not be aware of some of the more advanced commands available. In this blog post, we’ll explore 20 Linux commands that Linux administrators should know.

20 commands that Linux admins should know

Here are 20 Linux commands that every Linux administrator should know; with examples to get you started:

vmstat
The vmstat command is a system monitoring tool in Linux that reports various virtual memory statistics such as processes, memory, paging, block IO, traps, and CPU usage. It provides a snapshot of the current system status and can help identify potential performance issues.
Example: vmstat -sSM 1
This command displays detailed statistics about memory usage and paging activity and updates them every 1 second. The options -sSM tell vmstat to display the statistics in a more detailed format, including the output in megabytes. The output of this command will show a variety of statistics, including memory available, memory used, page faults per second, pages freed and reclaimed per second, CPU time spent in system mode, user mode, waiting for I/O, and more. These statistics can be useful for monitoring the performance of a Linux system and identifying potential bottlenecks or issues with memory usage. Also, read Linux server needs a RAM upgrade? Check with top, free, vmstat and sar.
inotifywait
The inotifywait command is used to monitor file system events, such as file creation, modification, or deletion. This can be useful for automated backup scripts, or for triggering actions based on changes in the file system. Inotifywait can run in the background and wait for events to occur, then execute a command or script when an event is detected.
Example: inotifywait -m /path/to/directory
The inotifywait waits for changes to occur on the specified directory (/path/to/directory) and outputs the event details to the terminal in real-time. The -m option tells inotifywait to operate in monitoring mode, meaning that it will continue running indefinitely and report all changes made to the directory until the command is interrupted or terminated.
ncdu
The ncdu (NCurses Disk Usage) command is used to analyze disk usage and identify the files and directories that are taking up the most space. This is particularly useful when dealing with large and complex file systems and can help to free up disk space and improve performance. Ncdu produces a visual representation of the file system that can be navigated with the arrow keys. Also, read Linux: ncdu and mc to manage large directories.
Example: ncdu /home/
The ncdu /home/ command launches the ncdu utility and specifies the /home/ directory as the target for scanning. By specifying the directory, the command will provide a summary of disk usage for that directory and its subdirectories.
iostat
The iostat command is used to monitor the performance of block devices, such as hard disks or SSDs. It can show real-time information on I/O rates, I/O wait times, and CPU usage. This can be useful for identifying performance issues and optimizing the system for better performance.
Example: iostat -x 5
The “-x” option causes iostat to display extended statistics including utilization, wait, and queue length for each device, and the “5” argument specifies that the statistics should be updated every 5 seconds. Also, read iostat command in Linux with examples.
sar
The sar command is used to collect system performance statistics, such as CPU usage, memory usage, and disk activity. This data can be used for capacity planning, troubleshooting, and identifying trends in system usage over time. Sar can produce detailed reports that show the system’s performance over various time intervals.
Example: sar -u 5
This example collects and displays CPU utilization statistics every 5 seconds using the sar (System Activity Report) command. Specifically, the “-u” option specifies that the CPU utilization statistics should be displayed, including the percentage of time spent in user mode, system mode, and idle mode, as well as the percentage of time spent servicing interrupts and running softirqs. The “5” argument specifies the sampling interval, indicating that the statistics should be collected and displayed every 5 seconds.
Also, read Linux server needs a RAM upgrade? Check with top, free, vmstat and sar.
mtr
The mtr command is a combination of the ping and traceroute commands. It can be used to identify network connectivity issues, such as high latency or packet loss. Mtr produces a real-time output that shows the performance of each network hop, and can be useful for troubleshooting complex network issues.
Example: mtr google.com
When mtr is followed by a destination address or hostname, such as google.com, mtr will start a network diagnostic that sends packets to the destination, then displays the performance statistics for each router or hop along the path.
htop
The htop command is an advanced version of the top command, which is used to show system resource usage. Htop provides a more detailed and customizable view of the system, including real-time CPU and memory usage, as well as a list of running processes and their resource consumption. Htop can also be used to send signals to processes, such as sending a SIGTERM to terminate a process.
Also, read htop: Quick Guide & Customization and btop – the htop alternative.
fuser
The fuser command is used to identify which processes are using a particular file or directory. This can be useful for troubleshooting issues where a file is locked or in use by another process. Fuser produces a list of process IDs that are using the file or directory and can be used to kill those processes if necessary.
Example: sudo fuser /path/to/file
The fuser command will list the process IDs (PIDs) that are accessing the file specified by the /path/to/file parameter. Also, check out pstree command in Linux with examples.
lsof
The lsof command is similar to fuser, but provides a more detailed view of the system’s open files and network connections. Lsof can show which processes have open files or network connections, and what types of files and connections they are. This can be useful for troubleshooting issues with file or network permissions.
Example: lsof /path/to/file
strace
The strace command is used to trace system calls and signals made by a process. System calls are the fundamental functions that an operating system provides to applications, allowing them to access system resources such as files, devices, and memory. By tracing the system calls and signals made by a process, strace can provide insight into how an application is interacting with the system, and can be used to diagnose issues such as crashes or performance problems. The strace command is a powerful tool for both developers and system administrators.
Example: strace -c ls to trace the system calls made by the ls command.
This command will run the ls command and trace the system calls made by it. The -c option will also give a summary of the system calls and signals, along with the time and number of calls made. Also, read What is iowait and how does it affect Linux performance?
blktrace
The blktrace command is used to trace the I/O activities of block devices, such as hard disks or SSDs. This is useful for troubleshooting performance issues and identifying bottlenecks. Blktrace can produce detailed output that shows the timings of each read and write operation, as well as the processes that generated the I/O. blktrace can also compute I/O operations per second (IOPS).
Example: sudoblktrace -w 30 -d /dev/sda -o io-debugging
The above command starts tracing the I/O activity on the /dev/sda device. This can be useful for debugging storage-related performance issues or investigating I/O patterns on a device.
iptraf
The iptraf command is a console-based network monitoring utility for Linux. It provides real-time monitoring of network traffic and displays various statistics, such as IP traffic, TCP/UDP traffic, network packets and bytes, network errors, and more. The tool also includes a variety of filters that can be used to display specific types of traffic, such as traffic to a specific IP address or port. iptraf is useful for diagnosing network problems and analyzing network performance.
Example: iptraf -i eth0 to monitor traffic on the eth0 network interface.
rsync
The rsync command is a file synchronization tool for Unix-like systems. It can efficiently copy and synchronize files and directories locally or between remote systems over a network. It uses a delta-transfer algorithm which transfers only the differences between the source and destination files, minimizing the amount of data sent over the network. It can preserve permissions, ownerships, timestamps, and other attributes of copied files. Rsync can be used for backup and mirroring, and it supports secure encrypted connections using SSH. It is a powerful and versatile tool commonly used for file transfer and backup in Linux and other Unix-like systems.
Example: rsync -avz source/ destination/ to synchronize files and directories between the source and destination directories.
Also, read SCP Linux – Securely Copy Files Using SCP examples.
awk
The awk command is a versatile tool for text processing and data extraction on Unix-like operating systems. It is primarily used for processing and manipulating text files, extracting and transforming data, and generating reports. awk reads a text file line-by-line, splitting each line into fields, which can then be processed using built-in functions and regular expressions. awk provides a programming language with control structures such as loops and conditional statements, making it a powerful tool for complex text-processing tasks. It is often used in shell scripts and as part of command pipelines.
Example: awk '{print $1,$2}' file.txt to print the first and second fields of each line in the file.txt file.
ssh-keygen
The ssh-keygen command is used to generate, manage, and convert authentication keys for SSH. These keys can be used to establish secure connections between computers over a network. Specifically, ssh-keygen is used to generate public and private key pairs that can be used for automated authentication when logging into a remote system using SSH. The public key is typically stored on the remote system, while the private key is kept on the local system and protected by a passphrase. When connecting to the remote system, the local system uses its private key to authenticate itself to the remote system, providing a more secure and convenient alternative to traditional password-based authentication.
Example: ssh-keygen -t rsa to generate an RSA key pair.
The option -t rsa specifies the type of key to generate, which is RSA. The RSA algorithm is commonly used for creating public/private key pairs for SSH authentication. When this command is executed, the user will be prompted to enter a file name to save the generated key and a passphrase to encrypt the private key, if desired.
Also, read How to Convert OpenSSH keys to Putty (.ppk) on Linux.
screen
The screen command is a Linux utility that provides a way to run multiple terminal sessions within a single terminal window or remotely over an SSH connection. It allows users to create, manage, and detach from multiple terminal sessions, allowing them to keep processes running in the background even after they log out of a remote shell or lose a network connection. The screen command is commonly used by system administrators and developers who need to run long-running processes or manage multiple terminals in a single window. It also allows for sharing sessions between multiple users, making it a useful tool for collaboration.
Example: screen -S session_name to create a new screen session with the specified name.
watch
This Linux command is used to run a command or script repeatedly and display the output in real-time. It is useful for monitoring system status or the progress of long-running tasks. The default interval for refreshing the output is 2 seconds, but this can be changed using the -n option.
Example: watch -n 1 df -h to display the disk usage in human-readable format every second.
grep
This is used tosearch for specific text or patterns within one or more files. It can search for patterns using regular expressions and display the lines containing the matching text.
Example: grep -r "pattern" directory/ to recursively search for the specified pattern in the directory and its subdirectories.
Also, read grep command in Linux w/ examples.
find
The find command in Linux is used to search for files and directories in a directory hierarchy based on different criteria such as name, type, size, time of last access or modification, and ownership. It recursively descends the directory tree for each starting file and returns a list of files that match the specified search criteria. The find command is a powerful tool that can be used to locate and manipulate files based on various attributes.
Example: find /var/log/ -name "*.log" to find all files with a .log extension in the /var/log/ directory.
Also, read Using the find command in Linux with examples.
nmon
The nmon command is a system performance monitoring tool that provides real-time performance metrics for various system components such as CPU, memory, disk, network, and other resources. It can display data in different formats, including graphs, histograms, and text-based outputs. nmon can help identify performance bottlenecks and is particularly useful for system administrators working with large and complex systems.
Example: To run the nmon command with a specific output file and to monitor the CPU and memory usage in 5 seconds intervals, you can use the following command:
nmon -f -s5 -c 120 -m /tmp/nmon-output.nmon
This command will start nmon and write the output to the specified file /tmp/nmon-output.nmon. The -s option sets the interval between the nmon snapshots to 5 seconds and -c sets the number of snapshots to take, in this case, 120. The -m option enables memory usage monitoring in addition to the default CPU usage.
Also, read htop and top Alternatives: Glances, nmon.

Even more Linux commands!

Conclusion

Linux is a powerful operating system that offers many tools and commands to help users effectively manage and maintain their systems. While the basic commands are essential to any Linux Systems Administrator, it’s important also to explore the more advanced commands that can help you become more efficient and effective in your role.

By using the 20 commands outlined in this article, you can enhance your knowledge and skills as a Linux Systems Administrator and make the most of the powerful tools available to you. Keep learning and exploring new commands to take your Linux administration to the next level!