Shell Scripting Complete 14: 30 Real-World Bash Scripts for Ops, DevOps and Data Teams

By Ravindra Bagale, trainer · LinkedIn · Last updated: 25 October 2026

1. An everyday example: a toolbox at home

Why do we need this?

Every Pune home has a small toolbox: a screwdriver, a tester, tape, a spanner. You do not buy a new tool each time a tap leaks; you reach for the one you already have. These 30 scripts are your toolbox. When the disk fills, a site goes down or a report is due, you pick the right script, change two lines and use it.

What is it?

Toolbox = this script collection. Each tool = one script. Checking the tool before use = bash -n and shellcheck. Safety gloves = set -euo pipefail, quotes and a dry run. Putting tools back = trap cleanup and logs.

How to do it (step by step)

2. The template every script starts from

Why do we need this?

Same header, logging and cleanup in every script makes them easy to read and safe to run.

What is it?

Script 1 is a template: strict mode, a log function, die, a usage line, a temp folder with trap cleanup, and a flock guard. All other scripts in this chapter are shorter because they assume these parts.

How to do it (step by step)

1. Script 1: template.sh.

#!/usr/bin/env bash
set -Eeuo pipefail
log(){ printf '%(%F %T)T [%s] %s\n' -1 "$1" "${*:2}" >&2; }
die(){ log ERROR "$*"; exit 1; }
(( $# >= 1 )) || { echo "usage: ${0##*/} TARGET" >&2; exit 2; }
exec 9>"/tmp/${0##*/}.lock"; flock -n 9 || die 'already running'
tmp=$(mktemp -d); trap 'rm -rf "$tmp"' EXIT
trap 'log ERROR "line $LINENO: $BASH_COMMAND"' ERR
log INFO "start target=$1"

Output:

2026-10-25 12:00:00 [INFO] start target=web1

What it means: Copy this first.

3. Backup and cleanup (scripts 2-6)

Why do we need this?

Lost data and full disks are the two most common emergencies.

What is it?

These scripts make dated archives, keep only the last N, delete old files with a dry run first, rotate logs and sync folders to another server.

How to do it (step by step)

1. Script 2: dated backup.

src=${1:?folder}; dst=/backup
f="$dst/${src##*/}-$(date +%F_%H%M).tgz"
tar czf "$f" -C "${src%/*}" "${src##*/}" && echo "saved $f $(du -h "$f" | cut -f1)"

Output:

saved /backup/www-2026-10-25_0200.tgz 412M

What it means: Name has date and time.

2. Script 3: keep last 7.

ls -1t /backup/www-*.tgz | tail -n +8 | xargs -r rm -v --

Output:

removed '/backup/www-2026-10-17_0200.tgz'

What it means: Oldest removed.

3. Script 4: delete old with dry run.

dir=${1:?}; days=${2:-30}; mode=${3:-dry}
if [[ $mode == run ]]; then find "$dir" -type f -mtime +"$days" -delete -print; else find "$dir" -type f -mtime +"$days" -print; fi | wc -l

Output:

148

What it means: Run with 'run' only after checking.

4. Script 5: rotate a log.

l=/var/log/app/app.log
cp "$l" "$l.$(date +%F)" && : > "$l" && gzip "$l.$(date +%F)"; ls /var/log/app

Output:

app.log  app.log.2026-10-25.gz

What it means: Copy, empty, compress.

5. Script 6: sync to backup server.

rsync -az --delete --exclude '*.tmp' /srv/data/ backup@10.0.2.9:/vault/data/ && echo synced

Output:

synced

What it means: Only changes travel.

4. Health checks (scripts 7-12)

Why do we need this?

Finding a problem before users call you is the main job of monitoring.

What is it?

Each check prints a clear line and exits 1 when something is wrong, so cron, a timer or a monitor can alert.

How to do it (step by step)

1. Script 7: all disks.

rc=0; while read -r use mnt; do use=${use%\%}; (( use > 85 )) && { echo "FULL $mnt ${use}%"; rc=1; }; done < <(df -P -x tmpfs -x devtmpfs | awk 'NR>1{print $5, $6}'); exit $rc

Output:

FULL /var 91%

What it means: Every mount checked.

2. Script 8: memory.

avail=$(awk '/MemAvailable/{print int($2/1024)}' /proc/meminfo); (( avail < 300 )) && { echo "LOW MEM ${avail}MB"; exit 1; }; echo "mem ok ${avail}MB"

Output:

mem ok 1840MB

What it means: MemAvailable is the right number.

3. Script 9: load vs CPUs.

read -r l1 _ < /proc/loadavg; c=$(nproc); (( $(echo "$l1 > $c" | bc) )) && echo "HIGH load $l1 on $c cpus" || echo "load ok $l1"

Output:

load ok 0.42

What it means: Load above CPU count is busy.

4. Script 10: services up.

for s in nginx sshd crond; do systemctl is-active --quiet "$s" || { echo "DOWN $s"; sudo systemctl restart "$s"; }; done

Output:

DOWN nginx

What it means: Restart if down.

5. Script 11: URL check.

while read -r u; do code=$(curl -s -o /dev/null -w '%{http_code} %{time_total}' --max-time 10 "$u"); echo "$u $code"; done < urls.txt

Output:

https://shop.example.in 200 0.31
https://api.example.in/health 503 0.05

What it means: Status and time.

6. Script 12: SSL expiry.

h=${1:?host}; end=$(echo | openssl s_client -servername "$h" -connect "$h:443" 2>/dev/null | openssl x509 -noout -enddate | cut -d= -f2)
days=$(( ( $(date -d "$end" +%s) - $(date +%s) ) / 86400 )); echo "$h $days days"; (( days > 15 ))

Output:

shop.example.in 54 days

What it means: Exit 1 when under 15 days.

5. Log reports (scripts 13-16)

Why do we need this?

Managers ask 'how many errors today' and 'who is hitting us'; logs have the answer.

What is it?

These use grep, awk, sort and uniq to count, rank and summarise web and app logs, and to watch a log live for a keyword.

How to do it (step by step)

1. Script 13: top IPs and URLs.

log=${1:-/var/log/nginx/access.log}
echo 'Top IPs'; awk '{print $1}' "$log" | sort | uniq -c | sort -rn | head -5
echo 'Top URLs'; awk '{print $7}' "$log" | sort | uniq -c | sort -rn | head -5

Output:

Top IPs
    540 49.36.12.8
Top URLs
    902 /

What it means: Two rankings.

2. Script 14: status code summary.

awk '{c[$9]++} END{for(k in c) printf "%s %d\n", k, c[k]}' /var/log/nginx/access.log | sort

Output:

200 8812
404 120
500 7

What it means: How healthy today.

3. Script 15: errors per hour.

grep ' ERROR ' app.log | awk '{print substr($2,1,2)":00"}' | sort | uniq -c

Output:

     3 09:00
    41 10:00

What it means: Spike at 10.

4. Script 16: watch and alert.

tail -Fn0 /var/log/app/app.log | while read -r line; do [[ $line == *'OutOfMemory'* ]] && logger -t oomwatch -p user.err "$line"; done

What it means: Runs forever; use a service.

6. Users and security (scripts 17-20)

Why do we need this?

Audits ask who can log in, who failed to log in, and which files are open to everyone.

What is it?

These scripts list real users, count failed SSH logins by IP, create users from a CSV, and find world-writable files.

How to do it (step by step)

1. Script 17: human users.

awk -F: '$3>=1000 && $7 !~ /nologin|false/ {print $1, $6, $7}' /etc/passwd

Output:

ec2-user /home/ec2-user /bin/bash
asha /home/asha /bin/bash

What it means: UID 1000+ with a shell.

2. Script 18: failed SSH by IP.

journalctl -u sshd --since today | grep -oP 'Failed password .* from \K[0-9.]+' | sort | uniq -c | sort -rn | head

Output:

    212 185.220.101.4
     18 45.95.147.2

What it means: Attackers ranked.

3. Script 19: users from CSV.

while IFS=, read -r user group; do [[ $user == user ]] && continue; id "$user" &>/dev/null || sudo useradd -m -G "$group" "$user" && echo "ok $user"; done < new-users.csv

Output:

ok rahul
ok meera

What it means: Skips header and existing.

4. Script 20: world-writable files.

sudo find / -xdev -type f -perm -0002 ! -path '/proc/*' -print 2>/dev/null | head

Output:

/opt/app/conf/db.yml

What it means: Fix with chmod o-w.

7. Deploy helpers (scripts 21-24)

Why do we need this?

A repeatable deploy with a quick rollback beats a careful manual one every time.

What is it?

Release folders with a current symlink give instant rollback. A health check after switch decides to keep or roll back. A parallel command runner and a wait-for-port helper finish the set.

How to do it (step by step)

1. Script 21: symlink deploy.

rel=/srv/app/releases/$(date +%Y%m%d%H%M); mkdir -p "$rel"
tar xzf app.tgz -C "$rel"
ln -sfn "$rel" /srv/app/current && sudo systemctl reload app && echo "live $rel"

Output:

live /srv/app/releases/202610251230

What it means: Atomic switch.

2. Script 22: rollback.

prev=$(ls -1d /srv/app/releases/* | sort | tail -2 | head -1); ln -sfn "$prev" /srv/app/current && sudo systemctl reload app && echo "rolled back to $prev"

Output:

rolled back to /srv/app/releases/202610241100

What it means: Previous release.

3. Script 23: run on many hosts.

cmd=${1:?command}; while read -r h; do ssh -o ConnectTimeout=5 "$h" "$cmd" 2>&1 | sed "s/^/[$h] /" & done < hosts.txt; wait

Output:

[web1] active
[web2] active

What it means: Prefixed output.

4. Script 24: wait for port.

h=${1:?}; p=${2:?}; for i in {1..30}; do (echo > "/dev/tcp/$h/$p") 2>/dev/null && { echo "$h:$p open"; exit 0; }; sleep 2; done; echo "$h:$p closed"; exit 1

Output:

db1:5432 open

What it means: No nc needed.

8. Files and data (scripts 25-28)

Why do we need this?

Teams get CSVs, images and dumps every day that need the same small processing.

What is it?

These scripts total a CSV column by key, find duplicate files by checksum, bulk rename safely, and dump a database with a dated, compressed name.

How to do it (step by step)

1. Script 25: CSV totals by city.

awk -F, 'NR>1{s[$2]+=$3} END{for(c in s) printf "%-10s %10.2f\n", c, s[c]}' sales.csv | sort -k2 -nr

Output:

Pune         184500.00
Nagpur        92010.50

What it means: Sum by key.

2. Script 26: duplicate files.

find "${1:-.}" -type f -exec md5sum {} + | sort | awk '$1==p{print $2} {p=$1}'

Output:

./photos/IMG_0012 (1).jpg

What it means: Same checksum, extra copy.

3. Script 27: safe bulk rename.

for f in *' '*; do n=${f// /_}; [[ -e $n ]] && { echo "skip $f"; continue; }; mv -- "$f" "$n"; done

Output:

skip Q3 report.pdf

What it means: Never overwrites.

4. Script 28: database dump.

f=/backup/shop-$(date +%F).sql.gz; mysqldump --single-transaction shop | gzip > "$f" && echo "dump $(du -h "$f" | cut -f1)"

Output:

dump 88M

What it means: pipefail catches dump errors.

9. Small daily tools (scripts 29-30)

Why do we need this?

A one-command server summary and a quick menu save many small minutes every day.

What is it?

Script 29 prints a server report card. Script 30 is a menu with select and case that wraps other scripts for support staff who do not know the commands.

How to do it (step by step)

1. Script 29: server report card.

printf '%-10s %s\n' Host "$(hostname)" Uptime "$(uptime -p)" Load "$(cut -d' ' -f1-3 /proc/loadavg)" Mem "$(free -h | awk '/Mem/{print $3"/"$2}')" Disk "$(df -h / | awk 'NR==2{print $5}')" IP "$(hostname -I | cut -d' ' -f1)"

Output:

Host       ip-10-0-1-5
Uptime     up 9 days, 3 hours
Load       0.12 0.20 0.18
Mem        1.1Gi/3.8Gi
Disk       41%
IP         10.0.1.5

What it means: One look summary.

2. Script 30: support menu.

PS3='Choose: '
select o in 'Disk check' 'Restart nginx' 'Last errors' Quit; do
  case $REPLY in
    1) df -h ;;
    2) sudo systemctl restart nginx && echo restarted ;;
    3) journalctl -p err -n 20 --no-pager ;;
    4) break ;;
  esac
done

Output:

1) Disk check
2) Restart nginx
3) Last errors
4) Quit
Choose: 2
restarted

What it means: Safe actions only.

10. Real examples from many industries

Why do we need this?

The same Linux skill shows up in every kind of company. Seeing it in many places helps you remember it.

What is it?

Each row is a made-up team. It shows who uses this and how.

How to do it (step by step)

11. Common errors and how to fix them

Why do we need this?

Everyone hits these errors. Knowing the cause saves hours.

What is it?

Read the exact message first. Then match it to a row below.

How to do it (step by step)

12. Troubleshooting step by step

Why do we need this?

When a borrowed script fails, check its assumptions before its logic.

What is it?

Go top to bottom. Stop at the first step that shows the problem.

How to do it (step by step)

1. Paths exist?

ls -ld /backup /srv/app

2. Tools installed?

command -v rsync bc openssl mysqldump

3. Permissions?

id; sudo -l

4. Lint.

shellcheck script.sh

5. Trace.

PS4='+ ${LINENO}: ' bash -x script.sh

6. Logs.

journalctl -t script -n 50

13. Lab 1: Backup with retention and a report

Why do we need this?

Combine scripts 2, 3 and 29 into one nightly job that backs up a folder, keeps 3 copies and prints a summary.

What is it?

A full hands-on lab. Run every step on a test Linux machine (an EC2 instance, a VM, or WSL).

How to do it (step by step)

1. Test data.

mkdir -p ~/lab50/www ~/lab50/backup && echo hi > ~/lab50/www/index.html

2. Script.

cat > ~/lab50/nightly.sh <<'X'
#!/usr/bin/env bash
set -euo pipefail
src=$HOME/lab50/www; dst=$HOME/lab50/backup
f="$dst/www-$(date +%F_%H%M%S).tgz"
tar czf "$f" -C "${src%/*}" "${src##*/}"
ls -1t "$dst"/www-*.tgz | tail -n +4 | xargs -r rm --
printf 'saved %s, copies %d, disk %s\n' "${f##*/}" "$(ls "$dst" | wc -l)" "$(df -h / | awk 'NR==2{print $5}')"
X
chmod +x ~/lab50/nightly.sh && shellcheck ~/lab50/nightly.sh && echo lint-ok

Output:

lint-ok

3. Run 5 times.

for i in 1 2 3 4 5; do ~/lab50/nightly.sh; sleep 1; done

Output:

saved www-2026-10-25_123001.tgz, copies 1, disk 41%
...
saved www-2026-10-25_123005.tgz, copies 3, disk 41%

4. Only 3 kept.

ls ~/lab50/backup | wc -l

Output:

3

5. Clean.

rm -r ~/lab50

14. Lab 2: Health check bundle with exit codes

Why do we need this?

Run scripts 7, 8 and 11 from one runner that collects results and exits 1 if any check fails, ready for a timer.

What is it?

A full hands-on lab. Run every step on a test Linux machine (an EC2 instance, a VM, or WSL).

How to do it (step by step)

1. Checks folder.

mkdir -p ~/checks && cd ~/checks && printf 'https://example.com\n' > urls.txt

2. Two checks.

printf '#!/usr/bin/env bash\navail=$(awk "/MemAvailable/{print int(\\$2/1024)}" /proc/meminfo); echo "mem ${avail}MB"; (( avail > 300 ))\n' > mem.sh
printf '#!/usr/bin/env bash\nwhile read -r u; do c=$(curl -s -o /dev/null -w %%{http_code} --max-time 10 "$u"); echo "$u $c"; [[ $c == 200 ]] || exit 1; done < urls.txt\n' > url.sh
chmod +x *.sh

3. Runner.

cat > run-all.sh <<'X'
#!/usr/bin/env bash
rc=0
for c in ./mem.sh ./url.sh; do if out=$("$c" 2>&1); then echo "PASS $c: $out"; else echo "FAIL $c: $out"; rc=1; fi; done
exit $rc
X
chmod +x run-all.sh

4. Run.

./run-all.sh; echo rc=$?

Output:

PASS ./mem.sh: mem 1840MB
PASS ./url.sh: https://example.com 200
rc=0

5. Break one.

echo https://example.com/nope-404 >> urls.txt; ./run-all.sh; echo rc=$?

Output:

PASS ./mem.sh: mem 1840MB
FAIL ./url.sh: https://example.com 200
https://example.com/nope-404 404
rc=1

6. Clean.

cd ~ && rm -r ~/checks

15. Frequently asked questions

16. Interview questions and answers

Beginner level

Mid level level

Senior level

17. Related chapters

• Linux Ops Refresh for DevOps
• Bash Scripting for Automation
• Linux grep and find Commands with Examples
• How to Set Up Passwordless SSH Between Linux Servers

Revision, comparison and interview cards

Revise this lesson in a few minutes. Save the cards on your phone or download them as PNG files. The QR code on each card opens this lesson.

More cards: Ravi Sir's Cards.