Linux Command Cheatsheet: Files, Processes, Networking and systemd

# Build pipelines: each tool does one thing, glue them together.

# Top 10 IPs in an access log
awk '{print $1}' access.log | sort | uniq -c | sort -nr | head -10

# Disk usage of subdirectories, biggest first
du -sh */ 2>/dev/null | sort -hr | head

# Find huge files (>100 MB), oldest first
find / -type f -size +100M -printf '%T@ %p %s\n' 2>/dev/null \
  | sort -n | head

# Find listening TCP ports + owning processes (no root needed for own pids)
ss -tulpen | column -t | sort -k5

# Stream from a remote log via ssh, locally grep
ssh prod 'sudo journalctl -u api -f' | grep -E 'ERROR|WARN'

# Compose with xargs to handle huge lists
git ls-files '*.py' | xargs grep -l 'TODO'

# Substitute output as files via process substitution
diff <(sort a.txt) <(sort b.txt)

# /etc/systemd/system/my-api.service
[Unit]
Description=My API
After=network-online.target
Wants=network-online.target

[Service]
Type=simple
User=app
Group=app
WorkingDirectory=/srv/my-api
EnvironmentFile=/etc/my-api.env
ExecStart=/usr/bin/python -m my_api
Restart=on-failure
RestartSec=5

# Hardening
NoNewPrivileges=true
ProtectSystem=strict
ProtectHome=true
PrivateTmp=true
ReadWritePaths=/var/lib/my-api
CapabilityBoundingSet=
AmbientCapabilities=

# Resource limits
LimitNOFILE=65536
MemoryMax=512M
CPUQuota=200%

[Install]
WantedBy=multi-user.target

# Lifecycle
systemctl daemon-reload
systemctl enable --now my-api
systemctl status my-api
journalctl -u my-api -f --since "10 min ago"

#!/usr/bin/env bash
# Strict mode — every script you write
set -euo pipefail
IFS=$'\n\t'

# Trap cleanup on exit
tmp=$(mktemp -d)
cleanup() { rm -rf "$tmp"; }
trap cleanup EXIT INT TERM

# Args + defaults
host=${1:?usage: $0  [path]}
path=${2:-/var/log}

# Functions
log() { printf '%(%Y-%m-%dT%H:%M:%S%z)T %s\n' -1 "$*" >&2; }

# Branching
if [[ $host == *.local ]]; then
    log "Local domain detected"
elif [[ $host =~ ^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
    log "IP literal"
fi

# Loops
for f in "$path"/*.log; do
    [[ -f $f ]] || continue
    wc -l "$f"
done

# Capture command output safely
hostname=$(uname -n)
echo "running on $hostname"

# Arrays
declare -a hosts=(api1.example.com api2.example.com)
for h in "${hosts[@]}"; do
    ping -c 1 "$h" >/dev/null && log "$h up"
done

#!/usr/bin/env bash
# health-check.sh — disk + processes + service + log spike check, in one script.
set -euo pipefail

WARN=80                              # percent
SERVICE=my-api

# 1. Disk on / and /var
df -hP / /var | awk -v w="$WARN" '
    NR>1 {
        pct=$5; gsub("%","",pct);
        if (pct+0 >= w) printf("DISK %s on %s\n", $5, $6);
    }'

# 2. Top processes by RSS
ps -eo pid,user,rss,cmd --sort=-rss | head -6

# 3. Service liveness via systemd
if systemctl is-active --quiet "$SERVICE"; then
    echo "$SERVICE: active"
else
    echo "$SERVICE: DOWN"
    journalctl -u "$SERVICE" --since "5 min ago" | tail
fi

# 4. Error spike in last 5 min
since=$(date -d '5 min ago' +'%Y-%m-%d %H:%M:%S')
err_count=$(journalctl -u "$SERVICE" --since "$since" \
            | grep -cE 'ERROR|FATAL' || true)
echo "errors_last_5min=$err_count"
[[ $err_count -gt 50 ]] && echo "WARN: error spike"

# 5. Open file descriptors
echo "fd_in_use=$(lsof -u app 2>/dev/null | wc -l)"