Linux notes

Name, type and depth

The dot starts at the current directory. Use -type f for files, -type d for directories and -type l for symlinks. -name is case-sensitive and -iname ignores case. Quote patterns so find handles them. -maxdepth 2 descends up to two levels.

find . -type f -name '*.jar' -print
find . -type f -iname '*.pdf' -print
find . -maxdepth 2 -type d -name config -print
find . -type l -print

Time, size and permissions

-mmin -10 finds content changed in the last 10 minutes. -mtime -1 uses 24-hour periods and selects changes less than a day old. -newermt compares against an explicit date. With GNU find, -size +100M finds files larger than 100 MiB and -perm -0002 checks whether others have write permission.

find ./logs -type f -mmin -10 -print
find ./logs -type f -mtime -1 -print
find . -type f -newermt '2026-01-15 00:00:00' -print
find . -type f -size +100M -ls
find . -type f -perm -0002 -ls

Combine filters and skip directories

Adjacent tests must both match. -o means “or”, and parentheses group alternatives. In the second example, -prune skips .git and node_modules and the right-hand expression applies to the rest of the tree.

find . -type f \( -iname '*.jpg' -o -iname '*.png' \) -print
find . -type d \( -name .git -o -name node_modules \) -prune -o -type f -name '*.sh' -print

Search errors and inspect JAR files

-exec passes paths as arguments through {}. With +, it batches paths per invocation, which suits grep. With \;, it runs once per file, as jar tf requires. In the final example, -ok prompts for each deletion after you review the list.

find ./logs -type f -name '*.log' -mmin -10 -exec grep -niH -- 'ERROR' {} +
find . -type f -name '*.jar' -exec jar tf {} \; | grep -E '\.xml$'
find ./tmp -type f -name '*.tmp' -mtime +7 -print
find ./tmp -type f -name '*.tmp' -mtime +7 -ok rm -- {} \;

Files by process and processes by file

-p selects a PID, -u a user and -c a command-name prefix. -a requires all selection filters to match. In the output, COMMAND and PID identify the process, FD the descriptor and NAME the file or socket. Replace 1234 with the PID you are investigating.

lsof -p 1234
lsof -u "$USER"
lsof -a -c java -u "$USER"
lsof -- ./logs/application.log
lsof -a -p 1234 -d 1,2

Ports and connections by process

-i selects Internet sockets. -n skips name resolution and -P keeps port numbers numeric. -sTCP:LISTEN shows only listening TCP sockets. The last example combines the PID with established TCP connections.

lsof -nP -iTCP:8080 -sTCP:LISTEN
lsof -nP -iUDP:53
lsof -nP -a -p 1234 -iTCP -sTCP:ESTABLISHED

Directories and deleted files still open

+d checks the first level and +D traverses the whole tree, which can be slow. +L1 shows open files with no links. If you deleted a log and the disk is still full, check which process has it open. On Linux, permissions may limit what the current user can see.

lsof +d ./logs
lsof +D ./logs
lsof +L1
lsof -a -p 1234 +L1

Listening ports and PIDs

These examples use Linux netstat from net-tools. -t selects TCP, -u UDP, -l listening sockets, -n numeric values and -p the PID and program if permissions allow. UDP rows can have an empty state. -4 and -6 restrict the address family.

netstat -lntup
netstat -4 -lnt
netstat -6 -lnu
netstat -lnt | awk '$4 ~ /:8080$/'

TCP connections and states

-a includes listeners and connections. Local Address is the local endpoint and Foreign Address is the peer. ESTABLISHED indicates an open connection. TIME_WAIT follows a recent close. -o adds timer information.

netstat -ant
netstat -anto
netstat -ant | awk '$6 == "ESTABLISHED"'
netstat -ant | awk '/^tcp/ {print $6}' | sort | uniq -c

Routes, interfaces and statistics

-r shows routes, -i interface counters and -s protocol statistics. On Linux, you can also use ss for sockets, ip route for routes and ip -s link for interface counters.

netstat -rn
netstat -i
netstat -st
ss -lntup
ss -tn state established
ip route
ip -s link

List, sort and count

Inspect permissions and sizes, include hidden files and explore two levels of the tree. The last command counts regular files in the current directory.

ls -lah
ls -lv
ls -lrth
ls -1 | sort -r
ls -ld */
tree -L 2
find . -maxdepth 1 -type f -printf '.' | wc -c

Search by name or content

Quote patterns. In grep, -r searches recursively, -n shows line numbers and -w matches whole words. locate queries an index.

locate archivo.txt
find . -type f -name '*.jar' -ls
find . -type d -name 'config' 2>/dev/null
find . -type f -name '*.backup' -mmin -2 -ls
find . -type f \( -iname '*.jpg' -o -iname '*.png' \)
grep -rnw -- 'pattern' ./project
grep -ril -- 'pattern' ./project
find . -type f -name '*.xml' ! -exec grep -qF '<device>' {} \; -print

Copy, create and link

cp -a copies the tree and preserves attributes where permissions allow. rm removes the named symbolic link.

mkdir -p backup/config
touch example.log
cp -a source/. backup/
ln -s /path/to/source source-link
rm -- source-link

Disk usage

df reports space by filesystem. du measures directory usage. sort -h sorts sizes with units.

df -h
du -h -d 2 .
du -sh .[!.]* *
du -ah . | sort -hr | head -n 10
du -x -m . | sort -n | tail -n 20

Batch operations

Use null-delimited names to handle spaces and newlines. Inspect the list before replacing ls with an operation that changes files.

find . -type f -name '*.log' -print0 | xargs -0 -r ls -ld --
find . -type f -name '*.tmp' -print
find . -type f -name '*.tmp' -ok rm -- {} \;

Line endings and encoding

cat -e displays carriage returns as ^M. In Vim, use :set fileformat=unix and save with :wq.

cat -e script.sh
file script.sh
dos2unix script.sh
sed -i 's/\r$//' script.sh
iconv -f UTF-8 -t 'ASCII//TRANSLIT' input.txt > output.txt
iconv -f UTF-8 -t UTF-8 input.txt >/dev/null

Read and edit text

The second command shows lines 10 through 20. Write replacements to a new file so you can review the result.

tail -n 100 application.log
sed -n '10,20p' application.log
sed 's/OLD_TEXT/NEW_TEXT/g' input.txt > updated.txt
truncate -s 0 example.log

Tar archives and gzip logs

List the contents before extracting. The z* tools read compressed logs directly.

tar -cf backup.tar source/
tar -czf backup.tar.gz source/
tar -tzf backup.tar.gz
tar -xzf backup.tar.gz -C destination/
find . -type f -name '*.css' -print0 | tar --null -T - -cf styles.tar
gzip -k application.log
zcat application.log.gz
zgrep -i 'error' application.log.gz
zless application.log.gz
zdiff old.log.gz new.log.gz

CPU, memory and disk

Sort processes by resident memory or CPU and inspect memory, disk activity and block devices.

free -h
vmstat 1
iostat -xz 1
lsblk
sudo fdisk -l
ps aux --sort=-rss | head
ps -eo pid,pcpu,pmem,rss,args --sort=-pcpu | head
ps -eo pid,ppid,stat,args | awk '$3 ~ /^Z/'

Processes and open files

Identify the PID before sending a signal. SIGTERM lets the process shut down cleanly.

pgrep -af 'java'
lsof -p 1234 -Fn | grep -i '\.jar$' | sort
lsof +D /var/log
kill -TERM 1234

Logs and core dumps

Filter the journal by boot, service or PID. coredumpctl inspects core dumps recorded by systemd.

journalctl -xe
journalctl -b -p err
journalctl -u NetworkManager
journalctl _PID=1234
coredumpctl list
coredumpctl info 1234

Analyse logs with awk

These examples assume a sample log with the client in column one, latency in column two and path in column seven. Adjust the fields to match your server format.

awk '$2 > 200 && $7 ~ /[?&]id=/ {print $2, $1, $7}' access.log | sort -nr
awk '$7 ~ /[?&]id=/ {count++} END {print count+0}' access.log
grep -F '2026-01-15' audit.log | grep -F 'example-event' | sort -u

DNS, ports and connections

Use a host in your authorised environment. A DNS answer shows what that resolver sees, but cannot establish by itself whether NAT is in use.

nslookup example.com
ip addr show
traceroute example.com
nc -zv -w 5 example.com 443
ss -lntup
ss -Htn state established '( sport = :1521 or dport = :1521 )' | wc -l
sudo tcpdump -i any -c 20

TLS certificates and Java keystores

Inspect the certificate and verify its fingerprint through a trusted channel before importing it. keytool prompts for a password if required.

openssl s_client -connect example.com:443 -servername example.com </dev/null
openssl s_client -connect example.com:443 -servername example.com </dev/null \
  | openssl x509 -out server.crt
openssl x509 -in server.crt -noout -subject -issuer -fingerprint -sha256
keytool -importcert -file server.crt -alias example -keystore truststore.p12
keytool -list -keystore truststore.p12

Transfer over SSH

scp copies in both directions. In an sftp session, get downloads and put uploads.

scp example.txt user@host.example:/tmp/
scp user@host.example:/tmp/example.txt .
sftp user@host.example
get example.txt
put example.txt

NFS and CIFS mounts

Inspect mounts and test a specific mount point with mount. For CIFS, use a local credentials file with mode 600. These sample entries belong in /etc/fstab.

server.example:/export /mnt/nfs nfs ro,_netdev 0 0
//server.example/share /mnt/share cifs ro,_netdev,credentials=/etc/samba/share.creds 0 0

On the NFS server, exportfs displays exports. On the client, findmnt shows what is mounted. Inspect the active local firewall rules when diagnosing connectivity.

sudo exportfs -v
sudo mount /mnt/nfs
findmnt
sudo nft list ruleset

Modes and ownership

Read is 4, write is 2 and execute is 1. Mode 755 grants the owner rwx and others r-x. Mode 644 grants the owner rw- and others r--.

stat example.txt
chmod a+r example.txt
find ./project -type d -exec chmod 755 {} +
find ./project -type f -name '*.php' -exec chmod 644 {} +
sudo chown user:group example.txt

Creation mask

umask clears bits from requested permissions. With 022, the usual bases 777 and 666 yield 755 for directories and 644 for files. Parentheses scope the change to a subshell.

umask
(umask 022; mkdir example-dir; touch example-file)

Users, groups and sessions

-aG appends a supplementary group and preserves existing memberships. newgrp starts a shell with the selected group. userdel -r also deletes the home directory.

id
groups
w
last
lastlog
write username pts/1
sudo groupadd examplegroup
sudo usermod -aG examplegroup username
newgrp examplegroup
sudo userdel username

On systems configured with pam_faillock, inspect the lockout records first and reset only the named account when appropriate.

sudo faillock --user username
sudo faillock --user username --reset

Environment and history

source runs the file in the current shell. bash -x traces commands and their expanded arguments during execution.

printenv
command -v java
whereis java
source ./environment.sh
bash -n script.sh
bash -x script.sh
history
fc -l -10

Schedule and watch tasks

crontab lists or edits recurring jobs, at schedules a one-off job and watch repeats a command.

crontab -l
crontab -e
at 18:30
watch -n 5 date

Time, distribution and RPM

timedatectl displays clock settings on systemd systems. rpm -Uvh installs or upgrades a local package and rpm -e uninstalls it by name.

date
date -u
timedatectl status
sudo timedatectl set-time '2026-01-15 14:30:00'
cat /etc/os-release
rpm -qa
sudo rpm -Uvh ./example.rpm
sudo rpm -e example

Maven and tests

-DskipTests skips test execution. -Dmaven.test.skip=true also skips test compilation in plugins that honour it. -U forces checks for updated snapshots and missing releases.

mvn clean install
mvn install -DskipTests
mvn -U clean install -Dmaven.test.skip=true

JVM, libraries and environment

jcmd can list threads of a compatible JVM running under the same user. Use ldd on trusted executables. Adjust paths and the SID to match your installation.

jcmd -l
jcmd 1234 Thread.print
ldd /bin/ls
export JAVA_HOME=/opt/jdk
export ORACLE_HOME=/opt/oracle
export ORACLE_SID=EXAMPLE
export PATH="$JAVA_HOME/bin:$ORACLE_HOME/bin:$PATH"

Tomcat file creation mask

When Tomcat starts via catalina.sh, you can set UMASK in bin/setenv.sh. With 0027, the bases 777 and 666 yield 750 for directories and 640 for files.

UMASK=0027