Linux commands cheat sheet, grouped by job

You’ll write a 28-line cheat sheet as a plain text file, add a tiny search command to your shell, and then test fourteen of its lines on rocky01 and three Ubuntu lines on ubu01. Everything here only reads, apart from the file in your home folder. Log in to rocky01 as student.

1Write your own cheat sheet file

Paste this whole block:

mkdir -p ~/cheat
cat > ~/cheat/linux.txt <<'EOF'
look     [read]   hostnamectl   # name, OS, kernel, VM or not
look     [read]   uptime   # load average for 1, 5, 15 minutes
look     [read]   free -h   # memory: read the available column
look     [read]   df -hT -x tmpfs -x devtmpfs   # disk use per file system
process  [read]   ps aux --sort=-%mem | head -n 11   # top 10 by memory (11 = header + 10)
process  [read]   top -b -n 1 -o %CPU | head -n 17   # CPU snapshot for a ticket
process  [change] kill -TERM PID   # ask a process to stop cleanly
process  [danger] kill -KILL PID   # stop at once, no clean-up
network  [read]   ip -br address   # addresses, one line each
network  [read]   ss -tulnp   # who listens on which port
network  [read]   getent hosts NAME   # resolve a name the way apps do
logs     [read]   journalctl -u UNIT --since "1 hour ago"   # one service, recent lines
logs     [read]   journalctl -p err -b   # errors since the last boot
disk     [read]   du -xh --max-depth=1 /var | sort -rh | head   # biggest folders under /var
disk     [read]   lsof +L1   # deleted files still held open
disk     [danger] find DIR -name '*.gz' -mtime +30 -delete   # delete old files, dry run first
service  [read]   systemctl --failed   # failed units
service  [change] systemctl restart UNIT   # restart, then check is-active
user     [read]   chage -l USER   # password and account expiry
storage  [read]   lvs   # logical volumes and sizes
storage  [change] lvextend -r -L +1G VG/LV   # grow a volume and its file system
package  [read]   dnf history list | head   # rocky: what changed and when
package  [read]   apt history-list   # ubuntu: what changed and when
firewall [read]   firewall-cmd --list-all   # rocky: zone, services, ports
firewall [read]   ufw status verbose   # ubuntu: rules and defaults
schedule [read]   systemctl list-timers   # timers and their next run
kernel   [read]   sysctl vm.swappiness   # read one kernel setting
kernel   [change] sysctl --system   # load every sysctl.d file again
EOF
wc -l ~/cheat/linux.txt
grep -c '\[read\]' ~/cheat/linux.txt

You should see this:

28 /home/student/cheat/linux.txt
22

Each line is a job word, a label in brackets, the command and a short note after the #. Plain text is on purpose: it works over SSH on any server, grep can search it, and you can keep it in Git with your other notes. 22 of the 28 lines only read.

✅ Checkpoint: wc reports 28 lines and grep counts 22 read lines.

2Add a search command and try it

Add a small shell function to your .bashrc, load it, and search:

cat >> ~/.bashrc <<'EOF'
# cheat WORD: search my tested commands (Lesson 80)
cheat() { grep -i -- "$*" ~/cheat/linux.txt; }
EOF
source ~/.bashrc
cheat disk
cheat danger

You should see this:

look     [read]   df -hT -x tmpfs -x devtmpfs   # disk use per file system
disk     [read]   du -xh --max-depth=1 /var | sort -rh | head   # biggest folders under /var
disk     [read]   lsof +L1   # deleted files still held open
disk     [danger] find DIR -name '*.gz' -mtime +30 -delete   # delete old files, dry run first
process  [danger] kill -KILL PID   # stop at once, no clean-up
disk     [danger] find DIR -name '*.gz' -mtime +30 -delete   # delete old files, dry run first

grep -i ignores case and the -- stops grep from reading a search word that starts with a dash as an option. “disk” also found the df line from the look group, because its note says “disk use”, which is the reason the notes are worth writing. cheat danger is the line to run before you hand the file to a junior: these two need a second pair of eyes every time.

✅ Checkpoint: cheat disk prints four lines and cheat danger prints two.

3Test the look and process lines

Run this:

uptime
free -h
ps -eo pid,user,%mem,rss,cmd --sort=-rss --no-headers | head -n 4

You should see something like this:

 10:14:52 up  1:12,  1 user,  load average: 0.08, 0.05, 0.01
               total        used        free      shared  buff/cache   available
Mem:           1.7Gi       1.0Gi       189Mi        17Mi       672Mi       724Mi
Swap:          2.0Gi        12Mi       2.0Gi
   1175 mysql     5.6 101376 /usr/libexec/mariadbd --basedir=/usr
    812 root      2.6 46848 /usr/bin/python3 -sP /usr/sbin/firewalld --nofork --nopid
   1348 zabbix    2.0 36864 /usr/sbin/zabbix_proxy -c /etc/zabbix/zabbix_proxy.conf
   1046 root      1.8 32768 /usr/bin/python3 -sP /usr/sbin/tuned -l -P

rocky01 now runs MariaDB, Nginx, PHP-FPM, the Zabbix proxy and agent, and the Podman status page, so available memory is lower than in Lesson 22, but still healthy. MariaDB holds the most real memory. The ps line is the scriptable version of the cheat sheet’s ps aux --sort=-%mem | head -n 11.

✅ Checkpoint: You can name the biggest process on rocky01 and say how much memory is available.

4Test the network and log lines

Run this:

ip -br address show enp0s3
sudo ss -tlnp | grep -E ':(22|80|3306) '
sudo journalctl -p err -b --no-pager | tail -n 3

You should see something like this:

enp0s3           UP             10.10.10.11/24 fe80::a00:27ff:fe4c:110b/64
LISTEN 0      128          0.0.0.0:22         0.0.0.0:*    users:(("sshd",pid=1012,fd=7))
LISTEN 0      80         127.0.0.1:3306       0.0.0.0:*    users:(("mariadbd",pid=1175,fd=19))
LISTEN 0      511          0.0.0.0:80         0.0.0.0:*    users:(("nginx",pid=1290,fd=6),("nginx",pid=1289,fd=6),("nginx",pid=1288,fd=6))
LISTEN 0      128             [::]:22            [::]:*    users:(("sshd",pid=1012,fd=8))
LISTEN 0      511             [::]:80            [::]:*    users:(("nginx",pid=1290,fd=7),("nginx",pid=1289,fd=7),("nginx",pid=1288,fd=7))
-- No entries --

SSH and Nginx listen on every address, MariaDB only on 127.0.0.1, which is what Lesson 56 set up. The spaces in the grep pattern matter: without the space after the port, :80 would also match 8080, where the Podman status page from Lesson 57 listens. “No entries” from journalctl means no errors since the last boot; if you see a few, read them, they’re usually old news from start-up.

Try it yourself: check one port exactly in the Command Builder.

✅ Checkpoint: ss shows sshd on 22, nginx on 80 and mariadbd on 127.0.0.1:3306.

5Test the disk, service and storage lines

Run this:

sudo du -xh --max-depth=1 /var 2>/dev/null | sort -rh | head -n 4
systemctl --failed --no-pager
sudo lvs vg_data

You should see something like this:

1.1G	/var
612M	/var/cache
298M	/var/lib
164M	/var/log
  UNIT LOAD ACTIVE SUB DESCRIPTION

0 loaded units listed.
  LV      VG      Attr       LSize Pool Origin Data%  Meta%  Move Log Cpy%Sync Convert
  lv_app  vg_data -wi-ao---- 4.25g
  lv_db   vg_data -wi-ao---- 2.00g
  lv_logs vg_data -wi-ao---- 1.50g

-x keeps du on the root file system, so /var/lib/mysql (on lv_db) isn’t counted under /var/lib. The dnf cache is the biggest folder, which is normal after a few months of updates. No failed units, and vg_data still has the three volumes from Lessons 44, 45 and 56.

✅ Checkpoint: du lists /var first, systemctl --failed lists 0 units and lvs shows lv_app, lv_db and lv_logs.

6Test the user, package, firewall, schedule and kernel lines

Run this:

sudo chage -l priya | head -n 4
sudo dnf history list | head -n 3
sudo firewall-cmd --list-services
systemctl list-timers --no-pager | grep -c '\.timer'
sysctl vm.swappiness

You should see something like this:

Last password change					: Oct 27, 2026
Password expires					: never
Password inactive					: never
Account expires						: never
ID     | Command line                                         | Date and time    | Action(s)      | Altered
------------------------------------------------------------------------------------------------------------
    41 | install -y zabbix-proxy-sqlite3 zabbix-selinux-polic | 2026-10-24 15:02 | Install        |   12
dhcpv6-client http ntp ssh
9
vm.swappiness = 30

priya’s password never expires, because Lesson 15 set ageing rules only for arjun. The newest dnf transaction is the Zabbix install from Lesson 61; your IDs and dates will differ. The firewall allows SSH, HTTP for SaatShop, NTP for ubu01’s chrony and the DHCPv6 client, and the ports from Lessons 57 and 61 appear under ports in --list-all. swappiness is 30 because tuned’s virtual-guest profile sets it.

✅ Checkpoint: All five commands ran, and you can say which of them would change anything (none).

7Copy the sheet to ubu01 and test the Ubuntu lines

On ubu01, as student, copy the file with your Lesson 33 key and run three Ubuntu lines:

mkdir -p ~/cheat
scp rocky01:cheat/linux.txt ~/cheat/
grep -i ubuntu ~/cheat/linux.txt
sudo ufw status | head -n 1
systemctl is-active ssh
ls /var/log/syslog /var/log/auth.log

You should see something like this:

linux.txt                                     100% 1622     1.1MB/s   00:00
package  [read]   apt history-list   # ubuntu: what changed and when
firewall [read]   ufw status verbose   # ubuntu: rules and defaults
Status: active
active
/var/log/auth.log  /var/log/syslog

The Ubuntu lines say so in their note, and the same file now serves both servers. ufw has been active since Lesson 34, the SSH unit is called ssh here (sshd on Rocky), and the classic log files have their Ubuntu names. Add the cheat function to ubu01’s .bashrc the same way as in step 2.

✅ Checkpoint: ubu01 has ~/cheat/linux.txt and the three Ubuntu commands worked.

8Record where and when you tested it

On each VM, put a “tested on” line at the top of the file:

sed -i "1i # tested $(date +%F) on $(hostname -s), kernel $(uname -r)" ~/cheat/linux.txt
head -n 2 ~/cheat/linux.txt

You should see something like this on rocky01:

# tested 2026-10-27 on rocky01, kernel 6.12.0-211.16.1.el10_2.0.1.x86_64
look     [read]   hostnamectl   # name, OS, kernel, VM or not

On ubu01 the line ends with kernel 7.0.0-15-generic. When a colleague asks “does this still work?”, the first line answers it. Re-test and update the line after every major upgrade (Lesson 52), because that’s when commands, options and log formats move.

✅ Checkpoint: The first line of the file on both VMs names the host, the date and the kernel.