Linux Commands Cheat Sheet

This is an original planning guide. It is not a vendor manual, an official standard, or legal advice. Example addresses use documentation ranges. Review every command before you paste it.

A command is a sentence with a user and a directory

Every command in a ticket has a user, a working directory, and the exact line. A line that worked in your interactive shell may depend on an alias, a function, or a PATH the next person does not have. Prefer the form that man will describe. If you use a shorthand, say so.

find walks a tree. The path comes first, then the tests, then the action. find /srv/www -type f -name '*.log' is a search. Adding -delete is a different command and does not belong in a search ticket. grep searches the contents of files. The pattern is a regular expression unless you pass -F for a fixed string. Quoting the pattern keeps the shell from eating stars and spaces.

Pipes pass text, not objects. The next command sees lines. If you need a field, cut or awk can take it, and you still check a sample line because a column can move. Do not parse ls. The listing is for a human. find -printf or stat is for a script.

sudo runs a command as another user, usually root, under the rules in sudoers. A ticket that says sudo without the command is incomplete. A script that uses sudo -n will fail closed when a password is required, which is what you want in a job, and it will not magically have permission. The sudoers auditor is a separate guide. This page only asks you to name the command you are allowing.

Find the logs, then grep one host name

The lab search is files under /var/log whose names end in .log, on a host you are allowed to read. The find line is find /var/log -type f -name '*.log'. The quotes keep the shell from expanding the star before find sees it. If you are not root, some files will be skipped. That skip is a permission result, not an empty log.

The grep is grep -F 'edge-01' on a file you named, or grep -R -F 'edge-01' /var/log/app if the ticket says to walk a directory the account may read. -F means the name is literal. -n adds line numbers so the ticket can cite one. A pattern with a dot is a regular expression if you forget -F, and a dot matches any character. Literal first, regex when you meant a regex.

Read the first matches before you send the output anywhere. A log can contain a token a person pasted by mistake. The line you keep in the ticket is the timestamp and the event, not a secret that happened to be on the same line. If the line has a secret, rotate the secret. Do not file it.

The command explainer, the find builder, and the grep builder on this site show the line they will not run. Compare that line to the one in the ticket. Then run it yourself on the path you named.

You want	Start from	Do not start from
Files by name	find path -type f -name 'exact*'	ls \| grep, which breaks on odd names
A literal string in a file	grep -F -n 'string' file	grep string file, if the string has a dot or a star
A column from a simple line	awk or cut on a sample you checked	A one-liner you have not run on one real line
Disk space by mount	df -hT	A guess from a full filesystem error alone

A change you can finish

Run the search as the user who will own it later. Keep one matching line and one explanation of what you will do with it. A search that prints ten thousand lines is a search to narrow, not a search to paste into chat.

If the next step changes files, it is a new ticket line with a rollback. find and grep do not get an action flag added in the same breath as the search.

Write the path, the user, and the question the command answers.
Quote patterns so the shell does not expand them.
Run the search and read a sample, including a line that should not match.
Narrow the path if the output is larger than you will read.
Keep the line and the command in the ticket.
Remove any secret from the note and rotate it if it was real.
Only then write a second command if something must change.

Mistakes that outlive the command

the Linux command page fails in the same few ways. Each one looks finished on the day you type it. The list is here so the ticket can forbid them before the window, not so you can recognise them in an incident review.

find -delete or grep with an in-place edit in a command you called a search.
An unquoted star, so the shell expands it in the current directory and find never sees the pattern.
grep without -F on a name that contains a dot, matching more than the host.
Parsing ls in a script because the columns looked stable on your laptop.
sudo in front of a command to hide a directory the service account should have been able to read.
Walking / as root because the file might be anywhere. Name a path.
Pasting a log line that contains a token into the ticket.
An alias on your workstation that does not exist on the server, so the ticket's command is not the one you ran.

Decisions to write down before the window

Decision 1 for the Linux command page. The path is specific. /var/log/app or /srv/www, not the whole filesystem, unless the ticket explains why. Write that decision in the ticket before you change the host. The proof is the smallest command or screen that confirms it, recorded with the hostname and the time. If the host disagrees, the ticket changes. A second change does not go on top of a failed check. The rollback is the previous value you wrote down, not a reboot that hides which line mattered.

Decision 2 for the Linux command page. Patterns are quoted. Fixed strings use grep -F. A regex is labelled as a regex. Write that decision in the ticket before you change the host. The proof is the smallest command or screen that confirms it, recorded with the hostname and the time. If the host disagrees, the ticket changes. A second change does not go on top of a failed check. The rollback is the previous value you wrote down, not a reboot that hides which line mattered.

Decision 3 for the Linux command page. The user is named. Root is used when the files are root-only, and the sample you keep does not include secrets. Write that decision in the ticket before you change the host. The proof is the smallest command or screen that confirms it, recorded with the hostname and the time. If the host disagrees, the ticket changes. A second change does not go on top of a failed check. The rollback is the previous value you wrote down, not a reboot that hides which line mattered.

Decision 4 for the Linux command page. Search and change are separate lines. No -delete, no in-place edit, on the search line. Write that decision in the ticket before you change the host. The proof is the smallest command or screen that confirms it, recorded with the hostname and the time. If the host disagrees, the ticket changes. A second change does not go on top of a failed check. The rollback is the previous value you wrote down, not a reboot that hides which line mattered.

Decision 5 for the Linux command page. The command in the ticket is the command that will run on the host, without an alias. Write that decision in the ticket before you change the host. The proof is the smallest command or screen that confirms it, recorded with the hostname and the time. If the host disagrees, the ticket changes. A second change does not go on top of a failed check. The rollback is the previous value you wrote down, not a reboot that hides which line mattered.

Decision 6 for the Linux command page. A pipe is used when you need a field, and you checked one input line and one output line. Write that decision in the ticket before you change the host. The proof is the smallest command or screen that confirms it, recorded with the hostname and the time. If the host disagrees, the ticket changes. A second change does not go on top of a failed check. The rollback is the previous value you wrote down, not a reboot that hides which line mattered.

Decision 7 for the Linux command page. sudo is the command plus the rule, not a habit. The sudoers guide is the audit. Write that decision in the ticket before you change the host. The proof is the smallest command or screen that confirms it, recorded with the hostname and the time. If the host disagrees, the ticket changes. A second change does not go on top of a failed check. The rollback is the previous value you wrote down, not a reboot that hides which line mattered.

Decision 8 for the Linux command page. Output that is huge gets a narrower path before it gets a scrollback. Write that decision in the ticket before you change the host. The proof is the smallest command or screen that confirms it, recorded with the hostname and the time. If the host disagrees, the ticket changes. A second change does not go on top of a failed check. The rollback is the previous value you wrote down, not a reboot that hides which line mattered.

Decision 9 for the Linux command page. The explainer's line matches the ticket before anyone presses enter on the host. Write that decision in the ticket before you change the host. The proof is the smallest command or screen that confirms it, recorded with the hostname and the time. If the host disagrees, the ticket changes. A second change does not go on top of a failed check. The rollback is the previous value you wrote down, not a reboot that hides which line mattered.

Decision 10 for the Linux command page. Rollback of a search is nothing, because a search did not change the host. If you cannot say that, it was not a search. Write that decision in the ticket before you change the host. The proof is the smallest command or screen that confirms it, recorded with the hostname and the time. If the host disagrees, the ticket changes. A second change does not go on top of a failed check. The rollback is the previous value you wrote down, not a reboot that hides which line mattered.

Decision 11 for the Linux command page. The working directory is in the ticket when the command uses a relative path. An absolute path does not need one, and you said which it is. Write that decision in the ticket before you change the host. The proof is the smallest command or screen that confirms it, recorded with the hostname and the time. If the host disagrees, the ticket changes. A second change does not go on top of a failed check. The rollback is the previous value you wrote down, not a reboot that hides which line mattered.

Command checks before the line goes in the ticket

Check 1 in Command checks before the line goes in the ticket. The path in the command is the path in the ticket. Record the device name, the result, and the time on the same line. If the result does not match this check, stop and fix the ticket before you add another change. The rollback for this check is the previous value you wrote down, not a reboot. A reboot hides whether the check was the one that mattered. When the check passes, move to the next one. When it fails, the incident is this check.

Check 2 in Command checks before the line goes in the ticket. The pattern is quoted. Record the device name, the result, and the time on the same line. If the result does not match this check, stop and fix the ticket before you add another change. The rollback for this check is the previous value you wrote down, not a reboot. A reboot hides whether the check was the one that mattered. When the check passes, move to the next one. When it fails, the incident is this check.

Check 3 in Command checks before the line goes in the ticket. grep -F is set if the string is literal. Record the device name, the result, and the time on the same line. If the result does not match this check, stop and fix the ticket before you add another change. The rollback for this check is the previous value you wrote down, not a reboot. A reboot hides whether the check was the one that mattered. When the check passes, move to the next one. When it fails, the incident is this check.

Check 4 in Command checks before the line goes in the ticket. A sample match and a sample non-match were read. Record the device name, the result, and the time on the same line. If the result does not match this check, stop and fix the ticket before you add another change. The rollback for this check is the previous value you wrote down, not a reboot. A reboot hides whether the check was the one that mattered. When the check passes, move to the next one. When it fails, the incident is this check.

Check 5 in Command checks before the line goes in the ticket. No action flag is present on a search. Record the device name, the result, and the time on the same line. If the result does not match this check, stop and fix the ticket before you add another change. The rollback for this check is the previous value you wrote down, not a reboot. A reboot hides whether the check was the one that mattered. When the check passes, move to the next one. When it fails, the incident is this check.

Check 6 in Command checks before the line goes in the ticket. The user who ran it is the user who will run it next time. Record the device name, the result, and the time on the same line. If the result does not match this check, stop and fix the ticket before you add another change. The rollback for this check is the previous value you wrote down, not a reboot. A reboot hides whether the check was the one that mattered. When the check passes, move to the next one. When it fails, the incident is this check.

Check 7 in Command checks before the line goes in the ticket. No secret from the output was copied into the ticket. Record the device name, the result, and the time on the same line. If the result does not match this check, stop and fix the ticket before you add another change. The rollback for this check is the previous value you wrote down, not a reboot. A reboot hides whether the check was the one that mattered. When the check passes, move to the next one. When it fails, the incident is this check.

Check 8 in Command checks before the line goes in the ticket. The command does not depend on an alias. Record the device name, the result, and the time on the same line. If the result does not match this check, stop and fix the ticket before you add another change. The rollback for this check is the previous value you wrote down, not a reboot. A reboot hides whether the check was the one that mattered. When the check passes, move to the next one. When it fails, the incident is this check.

Check 9 in Command checks before the line goes in the ticket. A pipe's field was checked against one real line. Record the device name, the result, and the time on the same line. If the result does not match this check, stop and fix the ticket before you add another change. The rollback for this check is the previous value you wrote down, not a reboot. A reboot hides whether the check was the one that mattered. When the check passes, move to the next one. When it fails, the incident is this check.

Check 10 in Command checks before the line goes in the ticket. Root was not used to avoid fixing a directory mode. Record the device name, the result, and the time on the same line. If the result does not match this check, stop and fix the ticket before you add another change. The rollback for this check is the previous value you wrote down, not a reboot. A reboot hides whether the check was the one that mattered. When the check passes, move to the next one. When it fails, the incident is this check.

Check 11 in Command checks before the line goes in the ticket. The explainer output and the ticket agree. Record the device name, the result, and the time on the same line. If the result does not match this check, stop and fix the ticket before you add another change. The rollback for this check is the previous value you wrote down, not a reboot. A reboot hides whether the check was the one that mattered. When the check passes, move to the next one. When it fails, the incident is this check.

Check 12 in Command checks before the line goes in the ticket. A second person can read the line without asking what the star does. Record the device name, the result, and the time on the same line. If the result does not match this check, stop and fix the ticket before you add another change. The rollback for this check is the previous value you wrote down, not a reboot. A reboot hides whether the check was the one that mattered. When the check passes, move to the next one. When it fails, the incident is this check.

Check 13 in Command checks before the line goes in the ticket. The same line was pasted into the ticket after it ran, not a tidied version that you have not executed. Record the device name, the result, and the time on the same line. If the result does not match this check, stop and fix the ticket before you add another change. The rollback for this check is the previous value you wrote down, not a reboot. A reboot hides whether the check was the one that mattered. When the check passes, move to the next one. When it fails, the incident is this check.

Check 14 in Command checks before the line goes in the ticket. The hostname in the prompt matches the hostname in the ticket for the Linux command page. Record the device name, the result, and the time on the same line. If the result does not match this check, stop and fix the ticket before you add another change. The rollback for this check is the previous value you wrote down, not a reboot. A reboot hides whether the check was the one that mattered. When the check passes, move to the next one. When it fails, the incident is this check.

Check 15 in Command checks before the line goes in the ticket. The result line includes the time and the person, not only the command. Record the device name, the result, and the time on the same line. If the result does not match this check, stop and fix the ticket before you add another change. The rollback for this check is the previous value you wrote down, not a reboot. A reboot hides whether the check was the one that mattered. When the check passes, move to the next one. When it fails, the incident is this check.

Check 16 in Command checks before the line goes in the ticket. You can point at the rollback value without searching a chat history. Record the device name, the result, and the time on the same line. If the result does not match this check, stop and fix the ticket before you add another change. The rollback for this check is the previous value you wrote down, not a reboot. A reboot hides whether the check was the one that mattered. When the check passes, move to the next one. When it fails, the incident is this check.

Check 17 in Command checks before the line goes in the ticket. Done is a sentence a second person can repeat: the proof for the Linux command page happened, and the next host is not started early. Record the device name, the result, and the time on the same line. If the result does not match this check, stop and fix the ticket before you add another change. The rollback for this check is the previous value you wrote down, not a reboot. A reboot hides whether the check was the one that mattered. When the check passes, move to the next one. When it fails, the incident is this check.

Tools for this guide

These tools run in the browser on this site. They do not log into your machines.

Guides in this cluster

These supporting pages belong to this pillar. A published page is linked. The others are named until they are published.