# Linux commands cheat sheet: files, processes, networking and more

> First published on the VMHeaven blog: [Linux commands cheat sheet: files, processes, networking and more](https://vmheaven.io/blog/guides/linux-commands-cheat-sheet)

**Short answer:** the tables below group the Linux commands a Linux VPS admin actually reaches for (files, processes, networking, permissions, packages), with the one-line version of what each does. Where a command has its own in-depth article, the text links to it.

## Files and directories

| Command | What it does |
| --- | --- |
| ls -la | List files, including hidden ones, with permissions and sizes |
| cd path | Change directory |
| pwd | Print the current directory |
| cp -r src dst | Copy, recursively for a directory |
| mv src dst | Move or rename |
| rm -rf path | Delete, recursively and without confirmation; there is no undo |
| mkdir -p a/b/c | Create a directory, and any missing parent directories |
| touch file | Create an empty file, or update its modified time |
| ln -s target link | Create a symbolic link |
| find /path -name '*.log' | Search for files by name, recursively |
| df -h | Disk space free, per mounted filesystem, in human-readable units |
| du -sh path | Total size of a directory |

For finding *what* is filling a disk rather than just how full it is, see [checking disk usage on Linux](https://vmheaven.io/blog/guides/check-disk-usage-linux).

## Permissions and ownership

| Command | What it does |
| --- | --- |
| chmod 755 file | Set exact permissions by octal mode |
| chmod +x file | Add execute, leaving read/write as they were |
| chown user:group file | Change the owning user and group |
| ls -l file | Show a file's current mode and owner |

## Processes

| Command | What it does |
| --- | --- |
| ps aux | List every running process |
| top / htop | Live, updating view of CPU and memory per process |
| kill PID | Ask a process to stop (SIGTERM) |
| kill -9 PID | Force-kill a process (SIGKILL, no cleanup) |
| pkill name | Kill by process name instead of PID |
| nohup cmd & | Run a command that survives the terminal closing |

> For anything that needs to keep running after you disconnect and that you want to come back to (not just survive, but reattach to), [tmux](https://vmheaven.io/blog/guides/tmux-cheat-sheet) does that better than `nohup`, which only keeps the process alive, not your terminal session with it.

## Networking

| Command | What it does |
| --- | --- |
| ip -4 addr show | Show IPv4 addresses on every interface |
| ip route | Show the routing table |
| ss -tlnp | List listening TCP ports and the process on each |
| ping host | Test reachability and round-trip time |
| curl -I url | Fetch just the HTTP headers of a URL |
| dig domain | Query DNS records for a domain |
| nc -zv host port | Test whether a single TCP port is open |

More on `ss`, `lsof` and the other ways to check what is listening in [checking open ports on Linux](https://vmheaven.io/blog/guides/check-open-ports-linux).

Setting an address so it stops changing on reboot is covered in [static IP addresses](https://vmheaven.io/blog/guides/static-ip-address), and clearing a stale DNS answer in [flushing the DNS cache](https://vmheaven.io/blog/guides/flush-dns-cache).

## Services and logs (systemd)

| Command | What it does |
| --- | --- |
| systemctl status name | Is a service running, and its recent log lines |
| systemctl restart name | Restart a service |
| systemctl enable name | Start a service automatically on boot |
| journalctl -u name -f | Follow a service's logs live |
| journalctl -xe | Jump to the end of the system log with extra context |

## Installing software

| Distribution | Install | Update everything |
| --- | --- | --- |
| Debian, Ubuntu | sudo apt install name | sudo apt update && sudo apt upgrade |
| RHEL, Rocky, Alma | sudo dnf install name | sudo dnf upgrade |
| Alpine | sudo apk add name | sudo apk update && sudo apk upgrade |

A command not found right after installing often means the shell has not reloaded its command path yet (`hash -r` fixes that), or the package installs under a different binary name than expected.

## Text processing

| Command | What it does |
| --- | --- |
| cat file | Print a file's contents |
| less file | Page through a file (q to quit) |
| grep text file | Search for text inside a file |
| grep -r text dir | Search recursively through a directory |
| tail -f file | Follow a file as new lines are written to it |
| wc -l file | Count lines in a file |
| sed 's/old/new/g' file | Replace text (stream editor) |

## Archives and transfers

| Command | What it does |
| --- | --- |
| tar -czvf out.tar.gz dir/ | Create a compressed archive |
| tar -xzvf out.tar.gz | Extract one |
| scp file user@host:/path | Copy a file to a remote server over SSH |
| rsync -av src/ user@host:/path/ | Sync a directory, only transferring what changed |

More tar flags and what each one does in [extracting tar.gz files on Linux](https://vmheaven.io/blog/guides/extract-tar-gz-linux).

## The one command that stops everyone

Sooner or later something opens vim (a `git commit`, `crontab -e`, a minimal server image with no nano installed), and the hardest part is getting back out:

`Esc` then `:wq` saves and quits; `:q!` quits and discards changes. The full table of exit commands, and why vim gets stuck in the first place, is in [how to exit vim](https://vmheaven.io/blog/guides/how-to-exit-vim).

## SSH, the entry point to all of the above

Every command on this page assumes you can already get into the server. For the order to run these in on a brand-new server (create a user, lock down SSH, set up a firewall), see [initial server setup](https://vmheaven.io/blog/guides/initial-server-setup).

## Frequently asked

### What is the most important Linux command for a beginner to learn first?

cd and ls (moving around and seeing what is there), followed by cat or less to read a file and sudo for anything that needs elevated permissions. Everything else builds on being able to navigate and read first.

### How do I see what is using CPU or memory on a Linux server?

top or htop for a live, updating view; ps aux for a one-time snapshot. htop is easier to read but is not always preinstalled; apt install htop or dnf install htop adds it.

### How do I find a file when I don't know which directory it's in?

find / -name 'filename' searches recursively from the root; locate filename is faster if the locate database is installed and up to date (updatedb refreshes it), but will not find anything created since the last update.

### What is the difference between kill and kill -9?

kill PID sends SIGTERM, asking the process to shut down cleanly and save its state. kill -9 PID sends SIGKILL, which the process cannot ignore or clean up after; use it only once a plain kill has failed.