Linux Essentials: Commands Every Engineer Must Know
Core Linux commands for filesystem navigation, text processing, process management, and system inspection — a daily-use reference for working engineers.
Linux mastery is built on muscle memory. After 25+ years working with RHEL, CentOS, Fedora, Ubuntu, Debian, and FreeBSD systems, the commands below are the ones I reach for every single day. This page is deliberately dense — it is a reference, not a tutorial. If a flag or idiom looks unfamiliar, run man <command> to dig deeper.
ls -la # long listing including hidden filesls -lh # human-readable sizes (K, M, G)ls -lt # sort by modification time, newest firstls -lS # sort by file size, largest firstls --color=auto -F # colorized + type indicator (/, *, @)
Use find when you need real-time results or complex filters. Use locate when you want speed and the file hasn’t changed recently. Run sudo updatedb in a cron job nightly to keep the index fresh.
cp -av /src /dst # archive mode + verbose (preserves permissions/timestamps)cp -p file1 file2 # preserve mode, ownership, timestampscp --backup=numbered f1 f2 # keep numbered backups of the destinationmv -iv oldname newname # interactive + verbose rename/moverm -rf /path/to/dir # force-remove recursively (no confirmation — be careful)rm -i file # prompt before each removal
rm -rf with a misplaced space or variable is catastrophic. Always double-check the path. Consider trash-cli on workstations, or at minimum alias rm='rm -i' in your .bashrc.
This is where Linux really shines. Master these tools and you rarely need a dedicated log-analysis GUI.
grep
awk
sed
cut / sort / uniq / wc
grep -rn "ERROR" /var/log/app/ # recursive + line numbersgrep -i "timeout" access.log # case-insensitivegrep -v "DEBUG" app.log # invert match (exclude)grep -E "WARN|ERROR|CRIT" syslog # extended regex (alternation)grep -A3 -B3 "OOM" /var/log/messages # 3 lines of context around matchgrep -c "404" access.log # count matching linesgrep -l "pattern" /etc/**/*.conf # list filenames only
# Print specific columns (tab/space-delimited)awk '{print $1, $4}' access.log# Sum a columnawk '{sum += $5} END {print "Total:", sum}' report.txt# Filter rows by field valueawk '$9 == "500"' access.log# Use custom field separatorawk -F: '{print $1, $3}' /etc/passwd# Print lines between two patternsawk '/START/,/END/' logfile.txt
ps aux # all processes, BSD styleps -ef # all processes, POSIX styleps aux | grep nginx # filter by nameps -o pid,ppid,cmd,%mem,%cpu --sort=-%cpu | head -20 # custom columns, sort by CPUtop # live view (press M to sort by memory, P by CPU)htop # nicer UI; F5 for tree view, F6 to sort
Prefer kill -15 (SIGTERM) first — it gives the process a chance to flush buffers and clean up. Only escalate to kill -9 (SIGKILL) if the process doesn’t respond after a few seconds.
uname -r # kernel versionuname -a # full kernel info (arch, hostname, date)hostnamectl # systemd-based hostname + OS infocat /etc/os-release # distribution name and versionlscpu # CPU topology, cores, threads, cachelsblk -f # block devices + filesystem types + mount pointslspci # PCI devices (NICs, GPUs, controllers)lsusb # USB devicesdmidecode -t system # hardware/BIOS info (requires root)