🌍 Earth Day: 15% OFF — Green hosting! View Plans
Tutorial

20 Linux Commands Every Server Admin Must Know

April 22, 2026

Back to Blog

Whether you are managing a single VPS or orchestrating a fleet of bare-metal servers, the command line is your primary workspace. Graphical panels are helpful, but they cannot replace the precision and speed of a well-crafted terminal command. In this guide, we will walk through 20 essential Linux commands that every server administrator should know by heart, complete with real-world examples you can start using today.

Who is this for? This guide targets administrators running Ubuntu or Debian-based servers, though nearly every command works across all major distributions. If you can SSH into a box, you are ready to follow along.

1. ls — List Directory Contents

The ls command is the first thing most admins type after logging in. It shows you what files and directories exist in your current location. The real power comes from its flags.

$ ls -lah /var/log/ total 12M drwxrwxr-x 12 root syslog 4.0K Mar 17 06:25 . drwxr-xr-x 14 root root 4.0K Jan 5 10:02 .. -rw-r----- 1 syslog adm 2.1M Mar 17 12:30 syslog -rw-r----- 1 syslog adm 156K Mar 17 06:25 auth.log -rw-r--r-- 1 root root 52K Mar 16 00:00 dpkg.log

-l gives the long format with permissions and sizes, -a shows hidden files (dotfiles), and -h makes file sizes human-readable (KB, MB, GB). You will use this combination dozens of times per day.

2. cd — Change Directory

Navigation is fundamental. While cd seems trivial, knowing the shortcuts saves real time across thousands of sessions.

$ cd /etc/nginx/ # absolute path $ cd .. # go up one level $ cd ~ # go to home directory $ cd - # go to previous directory

The cd - trick is especially useful when you are bouncing between two directories — it toggles back and forth like an undo button for navigation.

3. grep — Search File Contents

When something breaks, grep is how you find the needle in the haystack. It searches through file contents using patterns and regular expressions.

$ grep -rn "error" /var/log/syslog | tail -5 10234: Mar 17 08:12:03 server1 php-fpm[2341]: ERROR: unable to bind 10289: Mar 17 08:15:22 server1 nginx[1102]: [error] upstream timeout 10301: Mar 17 08:15:45 server1 postfix/smtp[3421]: error: connect $ grep -c "Failed password" /var/log/auth.log 847

The -r flag searches recursively through directories, -n shows line numbers, -i makes it case-insensitive, and -c gives you a count. Pipe it to tail or head to limit output.

4. find — Locate Files on Disk

Where grep searches inside files, find locates files themselves by name, size, modification time, or permissions.

$ find /home -name "*.log" -size +100M -mtime +30 /home/user1/logs/access.log.old /home/user2/app/storage/logs/laravel.log $ find /tmp -type f -mtime +7 -exec rm -f {} \; # Silently removes files older than 7 days in /tmp
Performance note: On servers with millions of files, find can be slow. Consider using locate (which uses a pre-built database) for faster filename searches, or limit your search scope to specific directories.

5. chmod & chown — Permissions and Ownership

File permissions are the backbone of Linux security. Get them wrong and you either lock yourself out or expose sensitive data to the world.

$ chmod 750 /home/deploy/app/ # rwxr-x--- $ chmod -R 644 /var/www/html/*.html # rw-r--r-- recursively $ chown -R www-data:www-data /var/www/html/ $ chown deploy:deploy /home/deploy/.env
PermissionNumericMeaningUse Case
rwxr-xr-x755Owner full, group+others read/executeWeb directories, scripts
rw-r--r--644Owner read/write, others read-onlyHTML, CSS, images
rwx------700Owner onlyHome directories, .ssh/
rw-------600Owner read/write only.env files, private keys

6. df & du — Disk Space Analysis

Disk full? These two commands tell you where the space went. df shows filesystem-level usage, du shows directory-level usage.

$ df -h Filesystem Size Used Avail Use% Mounted on /dev/sda1 100G 67G 28G 71% / /dev/sdb1 500G 312G 163G 66% /home $ du -sh /var/log/* | sort -rh | head -10 2.1G /var/log/journal 450M /var/log/syslog 128M /var/log/nginx

The combination of du -sh piped to sort -rh gives you the largest space consumers at a glance, sorted from biggest to smallest.

7. ps, top & htop — Process Management

Knowing what is running on your server is critical. These three tools give you different views of the same data.

ps — Snapshot View

Shows processes at a single point in time. Great for scripting and piping.

ps aux | grep nginx
ps -eo pid,ppid,%cpu,%mem,cmd --sort=-%mem | head

htop — Interactive View

Real-time, color-coded process viewer with CPU/memory bars. Sort by column, search, kill — all from a TUI.

htop -u www-data
htop -p 1234,5678
$ ps aux --sort=-%mem | head -6 USER PID %CPU %MEM VSZ RSS TTY STAT COMMAND mysql 1234 2.3 18.5 2048576 592832 ? Ssl /usr/sbin/mysqld postgres 2345 1.1 12.3 1245680 394240 ? Ss postgres: writer www-data 3456 0.8 4.2 524288 134656 ? S php-fpm: pool user1

8. kill & killall — Process Termination

When a process misbehaves, you need to stop it. Always try a graceful termination first.

$ kill 1234 # SIGTERM (graceful, default) $ kill -9 1234 # SIGKILL (force, last resort) $ killall php-fpm # Kill all processes by name $ pkill -u baduser # Kill all processes by user
Warning: Never use kill -9 as your first option. SIGKILL does not allow the process to clean up, which can lead to corrupted files, orphaned lock files, or incomplete database transactions. Always try kill (SIGTERM) first and wait a few seconds.

9. tar — Archive and Compress

Backups, deployments, migrations — tar is involved in all of them. The flags are famously confusing, so here is the cheat sheet.

$ tar -czf backup.tar.gz /var/www/html/ # Create gzip archive $ tar -xzf backup.tar.gz -C /restore/ # Extract to directory $ tar -tzf backup.tar.gz # List contents without extracting $ tar -cjf backup.tar.bz2 /data/ # bzip2 (slower, smaller)
FlagMeaning
-cCreate archive
-xExtract archive
-zUse gzip compression
-jUse bzip2 compression
-fSpecify filename (must be last flag)
-vVerbose (show progress)
-tList contents
-CChange to directory before extracting

10. scp & rsync — Remote File Transfer

Moving files between servers is a daily task. scp is simple, rsync is powerful.

$ scp -P 2847 backup.tar.gz root@remote:/backups/ $ rsync -avz --progress /var/www/ root@remote:/var/www/ $ rsync -avz --delete --exclude='.env' /app/ root@remote:/app/
Pro tip: Always use rsync over scp for large transfers. Rsync only transfers changed bytes (delta sync), supports resume on failure, and can preserve permissions, timestamps, and symlinks with the -a (archive) flag.

11. systemctl — Service Management

Modern Linux runs on systemd, and systemctl is how you control every service on the system.

$ systemctl status nginx ● nginx.service - A high performance web server Active: active (running) since Mon 2026-03-17 08:00:01 UTC PID: 1102 (nginx) $ systemctl restart php8.4-fpm $ systemctl enable --now redis-server # Enable + start in one shot $ systemctl list-units --failed # Show broken services

12. journalctl — System Logs

Forget digging through log files manually. journalctl gives you structured, filterable access to all systemd logs.

$ journalctl -u nginx --since "1 hour ago" $ journalctl -u mysql -f # Follow (live tail) $ journalctl -p err --since today # Only errors from today $ journalctl --disk-usage Archived and active journals take up 1.2G

13. crontab — Scheduled Tasks

Automation is what separates a busy admin from an efficient one. Cron handles recurring tasks with precision.

$ crontab -e # Edit current user's crontab $ crontab -l # List current crontab # minute hour day month weekday command 0 2 * * * /opt/scripts/backup.sh >> /var/log/backup.log 2>&1 */5 * * * * /usr/bin/php /var/www/app/artisan schedule:run 0 0 * * 0 certbot renew --quiet
ScheduleMeaningExample
* * * * *Every minuteHealth checks
*/5 * * * *Every 5 minutesQueue workers
0 * * * *Every hourLog rotation
0 2 * * *Daily at 2 AMBackups
0 0 * * 0Weekly (Sunday midnight)SSL renewal

14. nftables & iptables — Firewall Management

Your server's firewall is the first line of defense. Modern Ubuntu uses nftables, though iptables commands still work through a compatibility layer.

$ nft list ruleset # Show all rules $ nft add rule inet filter input tcp dport 443 accept $ ufw allow 22/tcp # UFW wrapper (simpler) $ ufw status numbered [ 1] 22/tcp ALLOW IN Anywhere [ 2] 80/tcp ALLOW IN Anywhere [ 3] 443/tcp ALLOW IN Anywhere
Critical: Always ensure SSH (port 22, or your custom port) is allowed BEFORE enabling the firewall. Locking yourself out of a remote server is a classic and painful mistake.

15. curl — HTTP Requests from the Terminal

Test APIs, download files, check headers — curl is the Swiss Army knife of HTTP.

$ curl -I https://example.com # Headers only HTTP/2 200 content-type: text/html; charset=UTF-8 server: nginx/1.24.0 $ curl -sk https://localhost:3001/api/v1/health {"status":"healthy","uptime":"48h32m"} $ curl -X POST -H "Content-Type: application/json" \ -d '{"username":"admin"}' https://api.example.com/login

16. wget — Download Files

While curl is versatile, wget excels at straightforward file downloads, especially recursive ones.

$ wget https://releases.ubuntu.com/24.04/ubuntu-24.04-live-server-amd64.iso $ wget -c https://example.com/large-file.tar.gz # Resume download $ wget -q -O - https://example.com/script.sh | bash # Pipe to bash

17. ssh — Remote Access

SSH is the lifeline to your servers. Beyond basic connections, it offers tunneling, key-based auth, and multiplexing.

$ ssh -p 2847 [email protected] $ ssh-keygen -t ed25519 -C "admin@server" # Generate key pair $ ssh-copy-id -p 2847 root@remote # Copy public key $ ssh -L 3306:localhost:3306 root@remote # Port tunnel
Best practice: Always use key-based authentication and disable password login in /etc/ssh/sshd_config. Set PasswordAuthentication no and PermitRootLogin prohibit-password. This single change blocks the vast majority of brute-force attacks.

18. tail & head — View File Portions

You rarely need to read an entire log file. tail and head let you focus on what matters.

$ tail -f /var/log/nginx/access.log # Follow in real-time $ tail -n 100 /var/log/syslog # Last 100 lines $ head -n 20 /etc/nginx/nginx.conf # First 20 lines $ tail -f /var/log/auth.log | grep "Failed" # Live filter

The tail -f command is arguably the most-used debugging tool in a server admin's arsenal. Combine it with grep to filter specific patterns in real-time.

19. awk & sed — Text Processing Power

These two tools transform text streams. sed edits text in a pipeline, awk processes structured data column by column.

$ awk '{print $1}' /var/log/nginx/access.log | sort | uniq -c | sort -rn | head 4521 192.168.1.50 2103 10.0.0.15 891 203.0.113.42 $ sed -i 's/listen 80;/listen 8080;/g' /etc/nginx/nginx.conf $ awk -F: '$3 >= 1000 {print $1}' /etc/passwd # List non-system users

That first awk pipeline is a classic — it extracts the IP address column from nginx logs, counts unique occurrences, and shows you the top visitors. Invaluable for spotting abuse or DDoS sources.

20. cat — Read and Concatenate Files

Simple, essential, and used in countless pipelines. cat reads files and outputs their contents to the terminal or another command.

$ cat /etc/hostname server1.panelica.com $ cat /etc/os-release PRETTY_NAME="Ubuntu 24.04.3 LTS" VERSION_ID="24.04" $ cat file1.txt file2.txt > merged.txt # Concatenate files

Quick Reference Cheat Sheet

TaskCommandCategory
List files with detailsls -lahNavigation
Search inside filesgrep -rn "pattern" /path/Search
Find files by namefind / -name "*.conf"Search
Check disk usagedf -h && du -sh /var/*Disk
View running processesps aux --sort=-%memProcess
Restart a servicesystemctl restart nginxService
Check recent logsjournalctl -u nginx --since "1h ago"Logs
Transfer filesrsync -avz /src/ user@host:/dst/Transfer
Compress directorytar -czf archive.tar.gz /dir/Archive
Top IPs in access logawk '{print $1}' log | sort | uniq -c | sort -rnAnalysis

Building Your Command Toolkit

These 20 commands form the foundation of everything you will do as a server administrator. They cover the essential categories of daily work:

Navigation
ls, cd, cat
Search
grep, find
Permissions
chmod, chown
Processes
ps, htop, kill
Services
systemctl, journalctl
  • Master these commands and you can troubleshoot 90% of server issues from the terminal
  • Combine commands with pipes (|) to build powerful one-liners
  • Create aliases in your ~/.bashrc for commands you type repeatedly
  • Use man command or command --help when you forget a flag
  • Practice in a safe environment before running commands on production servers
From CLI to Panel: While mastering the command line is essential for every server administrator, modern server management panels like Panelica provide a built-in web terminal, one-click service management, and visual dashboards that complement your CLI skills. The best administrators use both — the panel for routine tasks and efficiency, the CLI for precision troubleshooting and automation. Knowing the commands behind the buttons makes you a more effective admin regardless of which tools you use.
Share: