As a Linux SysAdmin working in a production environment, your daily routine is all about keeping systems stable, secure, and performing at their best. From troubleshooting issues to monitoring resources and ensuring uptime, you wear many hats, and time is always of the essence.
While Linux offers thousands of commands, not all of them are part of your day-to-day toolbox. However, there’s a core set of powerful, reliable commands that you’ll find yourself using every single day, often multiple times.
1. htop – Interactive Process Viewer
If you’re still using top, it’s time to switch to htop, which is a powerful, user-friendly alternative that displays CPU, memory, swap usage, process tree, and more in a clean, interactive interface.
htop
Use the arrow keys to scroll, F6 to sort processes, and F9 to kill one, which is much easier than manually finding the PID and using the kill command.
2. lsof – List Open Files and Sockets
lsof stands for List Open Files, and it’s one of the most powerful tools for identifying which process is using a specific file, directory, or network port on a Linux system.
lsof -i :80
Example Output:
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME nginx 1234 root 6u IPv4 23456 0t0 TCP *:http (LISTEN)
This will show the PID, user, and command that’s currently using port 80, typically useful when your web server won’t start because the port is already in use.
3. journalctl – View System Logs (Systemd)
On systemd-based systems (like RHEL 7+ and Ubuntu 18.04+), journalctl is your go-to tool for accessing and analyzing system logs.
journalctl -xe
The -x flag adds explanatory catalog entries where available, and -e jumps to the end of the log so you see the most recent logs with a focus on errors and critical messages, which is super useful when something breaks.
Want to check logs for a specific service? Just add the -u flag followed by the service name:
journalctl -u nginx
The -u flag filters logs to a single service. If you ran systemctl restart nginx and it failed, running journalctl -u nginx immediately after shows you exactly what went wrong, no log file path to remember, no grep needed.
4. systemctl – Manage Systemd Services
Most modern Linux distributions use systemd as the default init system, and the systemctl command allows you to start, stop, restart, enable, disable, and check the status of services on your system.
Here are some of the most common and useful examples:
# Check the status of a service systemctl status apache2 # Restart the SSH service systemctl restart sshd # Enable Nginx to start at boot systemctl enable nginx
5. du – Check Disk Usage
Need to find out what’s taking up space on your server? The du (disk usage) command is the go-to tool for that.
du -sh /var/*
This command shows the size of each subdirectory inside /var. The -s flag gives you a summary (instead of listing every file), and -h makes the output human-readable (like MB, GB instead of just bytes).
120M /var/log 1.5G /var/lib 4.0K /var/tmp
That output shows /var/lib is using 1.5GB, which is the most common culprit is a database data directory or Docker image storage. Once you know the directory, drill down further with du -sh /var/lib/* to find the specific subdirectory eating the space.
6. df – Check Disk Space Usage
Want to know how much space is left on your server’s disks? Use the df command, which shows how much disk space is used and how much is still available on all mounted filesystems.
df -h
The Use% column is what matters. At 80%+ you should start investigating. At 95%+ services start failing: databases won’t write, logs can’t rotate, and application crashes follow quickly.
7. free – Check Memory and Swap Usage
Running low on memory? Use the free command to check how much RAM and swap your system is using.
free -h
The available column, not free, is what tells you how much memory is actually usable by new processes. Linux uses spare RAM for disk caching, so free often looks low even when the system is healthy. If available is near zero and swap is heavily used, you have a real memory problem.
8. uptime – Check System Uptime and Load Average
The uptime command shows you how long your Linux system has been running, how many users are logged in, and the system load averages over the last 1, 5, and 15 minutes.
uptime
Example Output:
10:42:35 up 3 days, 5:22, 2 users, load average: 0.10, 0.25, 0.32
Read the 3 load averages left to right: 1-minute, 5-minute, 15-minute. A healthy system has all 3 below your CPU core count. If the 1-minute number is high but the 15-minute is low, you caught a spike. If all 3 are high, the load has been sustained and needs investigation.
9. top – The Basic Real-Time System Monitor
top is not as user-friendly as htop, but it’s pre-installed on almost every Linux system. If you’re working on a minimal or freshly installed server where htop isn’t available yet, top is your quick fix.
top
Press M inside top to sort by memory usage, P to sort by CPU. If you’re on a fresh server and need to see what’s eating resources before you can install anything else, top is your first move.
10. ps aux – Take a Snapshot of Running Processes
Need a quick look at all the processes running on your system? ps aux gives you a complete snapshot – who’s running what, how much CPU and memory they’re using, and more.
ps aux | grep apache
This command lists all processes, and the grep apache part filters out just the ones related to Apache. Super handy when you’re tracking down services, debugging issues, or writing scripts that monitor process activity.
www-data 2345 0.0 0.5 85320 5120 ? S 08:12 0:00 /usr/sbin/apache2 -k start www-data 2346 0.0 0.4 85320 4096 ? S 08:12 0:00 /usr/sbin/apache2 -k start
To find what’s using the most memory right now:
ps aux --sort=-%mem | head
This sorts all processes by memory in descending order and shows the top 10. It’s faster than htop when you’re scripting a monitoring check or logging process state to a file.
11. netstat / ss – Check Network Connections
As a system administrator, it’s important to know which services are listening on which ports and what remote connections are active on your server.
For years, netstat was the go-to command. But now, ss (socket statistics) has taken its place – it’s faster, more modern, and actively maintained.
ss -tuln
What does options mean:
-tshows TCP connections.-ushows UDP connections.-lshows only listening sockets.-nshows port numbers instead of service names.
12. ip – Network Interface and Routing
The ip command is the modern replacement for the old ifconfig and route commands. If you’re still using ifconfig, it’s time to switch – ip is more powerful, actively maintained, and available by default on all modern Linux distributions.
Here are two important subcommands you’ll use daily:
ip a # Shows all IP addresses and network interfaces ip r # Displays the system's routing table
The inet line gives you the IP address. state UP confirms the interface is active. If you’re debugging a server that’s unreachable, check ip a first to confirm the interface is up and has the IP you expect, then check ip r to confirm the default gateway route is in place.
13. ping – Network Connectivity
One of the simplest and fastest tools to check if a host (website, server, or IP) is reachable from your system. It works by sending ICMP (Internet Control Message Protocol) echo requests and waiting for replies.
ping google.com
If the host is up and reachable, you’ll see replies with time, TTL (Time to Live), and packet statistics. Want to send only a few packets instead of flooding endlessly? Use the -c option (for count):
ping -c 4 google.com
14. traceroute / tracepath – Network Route Debugging
When a server or website isn’t responding, and ping is giving you no answers, it’s time to see how your packets are traveling across the network and where they’re getting stuck. That’s where traceroute (or its alternative tracepath) comes in.
These commands show the entire path your packet takes from your system to the destination, listing every intermediate router or hop along the way.
traceroute google.com
15. nc (Netcat) – Test Port Connectivity
nc, short for Netcat, is often called the Swiss Army knife of networking. One of its most common and powerful uses for sysadmins is to check if a port is open and reachable on a remote machine – super handy for troubleshooting services like SSH, web servers, or database ports.
Let’s say you want to test if SSH (port 22) is open on a remote server 192.168.1.10.
nc -zv 192.168.1.10 22
16. rsync – Sync Files Over SSH
When it comes to backing up or syncing files, nothing beats rsync, which is fast, efficient, and network-friendly. Unlike scp, which copies everything from scratch, rsync only transfers changed parts of files, which saves both time and bandwidth.
rsync -avz /data/ user@remote:/backup/
This command is used to sync or copy everything inside the /data/ directory from your local machine to a remote server over SSH, placing it into the /backup/ directory on that server.
17. crontab – Schedule Jobs (Task Automation)
As a sysadmin, you don’t want to manually run scripts every day, right? That’s where crontab comes in, which lets you schedule tasks to run automatically at specific times — whether it’s running backups, rotating logs, or sending reports.
crontab stands for “cron table” – a file that contains a list of commands to be run on a schedule by the cron daemon. It’s like your personal task scheduler for Linux.
crontab -e
Add entries like:
0 2 * * * /usr/bin/backup.sh
Each line in a crontab follows this 5-field format:
* * * * * command-to-run │ │ │ │ │ │ │ │ │ └── Day of the week (0 - 7) [Sunday = 0 or 7] │ │ │ └──── Month (1 - 12) │ │ └────── Day of the month (1 - 31) │ └──────── Hour (0 - 23) └────────── Minute (0 - 59)
18. tail -f – Live Log Monitoring
When something goes wrong on a Linux system, logs are usually the first place you should look. The tail -f command lets you watch logs in real time, which is super helpful for debugging.
tail -f /var/log/messages
Want to filter logs for a specific service or keyword? Combine it with grep:
tail -f /var/log/syslog | grep sshd
19. chmod and chown – File Permissions and Ownership
Managing file permissions is crucial on any Linux system, and these two commands help you control who can access what:
chmodsets permissions (read, write, execute).chownchanges the owner and group.
Examples:
chmod 755 script.sh chown user:user file.txt
20. find – Search for Files
Need to locate a file, but not sure where it is? find command is your best bet, which is powerful, flexible, and works on file name, size, type, or even modification date.
find /var/log -name "*.log"
Example Output:
/var/log/syslog /var/log/auth.log /var/log/nginx/access.log /var/log/nginx/error.log
To delete files in /tmp older than 7 days, a common cron job on production servers:
find /tmp -type f -mtime +7 -delete
Always run the same command without -delete first to confirm exactly which files will be removed before you delete anything.
Final Words
These 20 commands cover most of what you’ll actually run on a production Linux server: process monitoring, disk and memory checks, log reading, network debugging, file management, and scheduled jobs.
Pick 1 command you haven’t used much and run it on a server you manage right now. ss -tuln is a good starting point since most sysadmins are surprised by what’s actually listening on their servers.
Which of these do you run first when a server starts behaving badly? Drop your answer in the comments below.
