Ravindra BagaleCourses & study guides मराठी Track your progress

Chapter 4: Linux Advanced Commands

By Last updated:

Friends, with basic commands we can only move around the server. With advanced commands – searching logs, automating work, managing services, checking the network and disk – you do the daily work of a cloud engineer. In a real job nobody opens a 2 GB log file in nano; we use grep, awk and pipes. The example in this chapter stays the same: the EC2 web server of a dairy brand like Amul (sample data, for practice) – its logs, backups and services. Come on, let's learn to work like a pro.

What you will learn in this chapter

  • Searching with grep and find
  • Text processing: awk and sed
  • Pipes, redirection, here-docs
  • Archives: tar, gzip and zip
  • Services, systemctl, journalctl
  • Network and disk commands
  • Scheduling jobs with cron
  • Variables, ssh and scp
  • Monitoring and shell scripts

Concepts in this chapter

  1. 4.1Searching text: grep
  2. 4.2Finding files: find
  3. 4.3Text processing: awk and sed
  4. 4.4Pipes and redirection
  5. 4.5Archiving and compression: tar, gzip, zip
  6. 4.6Services: service, systemctl and journalctl
  7. 4.7Networking commands
  8. 4.8Disk and storage commands
  9. 4.9Scheduling tasks: cron
  10. 4.10Environment variables
  11. 4.11Remote access: ssh and scp
  12. 4.12Monitoring: top and htop
  13. 4.13Basic shell scripting

Review and practice

  1. ★Common Mistakes I See Students Make
  2. ★Interview Questions
  3. ★Practice Questions and Lab Exercises

Extended teaching notes

Why this lesson matters

Cloud security is mostly IAM, network exposure, logging and secure defaults. The shared responsibility model means the provider patches the metal; you patch what you configure.

  • No public databases or public admin panels.
  • Roles / OIDC instead of long-lived access keys.
  • CloudTrail / Activity Logs / Audit Logs on and retained.
  • S3/Blob/GCS: Block Public Access; encrypt; least privilege.

Mini case study

Suppose we are on a purple-team exercise for an Indian mid-size company (sample data). Red notes a technique from this lesson against a lab clone. Blue must show the control that stops it, the log that would have fired, and the ticket that hardens production. That is the standard this course trains you for.

Defender's worksheet (do this today)

  1. Write the lesson title, date and the exact lab target you are allowed to use.
  2. List three owned systems (VMs, apps, or cloud accounts) where this lesson applies.
  3. Run one safe check from the lesson on a lab system only. Paste the command and output.
  4. Write a two-sentence fix you would give a teammate.
  5. Name one related public advisory (CERT-In, CISA, NVD, or a vendor bulletin) with its date.

Indian workplace (sample data)

Suppose we are a junior analyst at Infosys, TCS, Wipro or a fintech SOC in Bengaluru/Pune. Turn this lesson into one checklist item with an owner, a due date and a place to store evidence (ticket + screenshot).

Global practice

Compare your notes with OWASP, CIS Benchmarks, NIST CSF/IR guidance or a cloud Well-Architected security question. Write five lines on what overlaps.

Everyday analogy

Explain the risk and the fix to a family member without jargon. If they can repeat the warning, you understand it well enough to teach juniors.

Key terms

  • Control: a safeguard (patch, config, process, detection).
  • Finding: a weakness backed by evidence.
  • Remediation: the fix plus how you verified it.
  • Scope: systems you have written permission to touch.
  • Least privilege: only the access the task needs.
  • Defence in depth: several layers so one failure does not end the story.

Common mistakes

  • Skipping written permission "just for a quick scan".
  • Practising on hostel, office or public targets without authorisation.
  • Collecting tool output without writing the fix.
  • Copying attack steps onto production to "verify". Defenders verify with versions, configs and patches.
  • Publishing screenshots that contain secrets, cookies or internal hostnames.

Recap

  • Evidence, fix, owner, date.
  • Own lab only.
  • Fix > spectacle.

Practice Tasks

About this scenario

Pune Fintech Labs is a finance business in Pune. Rohan Kulkarni looks after its IT and cloud work. They count money in INR and run their AWS resources in the ap-south-1 Region. In the tasks below you do real jobs for them using what this lesson teaches. All names, account IDs, IP addresses and numbers are made up for practice.

0 / 10

Easy Check memory

Why: If RAM is full the server slows down or kills apps.

What to do: Show used and free memory in human-readable units.

How:
  1. Find the Linux command that does this job.
  2. Add the options (like -r or -h) the task needs.
  3. Add the file names, folders or users in the right order.
  4. Use sudo if the job changes system files or users. Click Check answer.

Easy Find errors in a log

Why: grep shows only the lines that contain a word, so you find problems fast.

What to do: Show every line containing ERROR in /var/log/punefintech/app.log.

How:
  1. Find the Linux command that does this job.
  2. Add the options (like -r or -h) the task needs.
  3. Add the file names, folders or users in the right order.
  4. Use sudo if the job changes system files or users. Click Check answer.

Medium Count matching lines

Why: A count tells you quickly how often something happened today.

What to do: Count how many lines in /var/log/nginx/access.log contain " 404 ".

How:
  1. Find the Linux command that does this job.
  2. Add the options (like -r or -h) the task needs.
  3. Add the file names, folders or users in the right order.
  4. Use sudo if the job changes system files or users. Click Check answer.

Medium Case-insensitive search with line numbers

Why: Logs mix "Timeout" and "TIMEOUT". Line numbers help you open the exact spot.

What to do: Search for timeout in /var/log/punefintech/api.log, ignoring upper/lower case, and show line numbers.

How:
  1. Find the Linux command that does this job.
  2. Add the options (like -r or -h) the task needs.
  3. Add the file names, folders or users in the right order.
  4. Use sudo if the job changes system files or users. Click Check answer.

Medium Find files by name

Why: find searches folder trees for files that match a pattern.

What to do: Find all files ending in .log under /var/log/punefintech.

How:
  1. Find the Linux command that does this job.
  2. Add the options (like -r or -h) the task needs.
  3. Add the file names, folders or users in the right order.
  4. Use sudo if the job changes system files or users. Click Check answer.

Medium Permission number

Why: Key files must be private.

What to do: What chmod number gives the owner read+write and nobody else anything?

How:
  1. Write down the numbers the task gives you.
  2. Work it out step by step on paper.
  3. Type only the final answer in the box.
  4. Click Check answer.

Hard Find big files

Why: When the disk is full, find large files first.

What to do: Find files bigger than 100 MB anywhere under /var.

How:
  1. Find the Linux command that does this job.
  2. Add the options (like -r or -h) the task needs.
  3. Add the file names, folders or users in the right order.
  4. Use sudo if the job changes system files or users. Click Check answer.

Hard Search a whole folder

Why: Settings can hide in any file. A recursive search checks them all.

What to do: Find every line that mentions DB_HOST in all files under /etc/punefintech, with line numbers.

How:
  1. Find the Linux command that does this job.
  2. Add the options (like -r or -h) the task needs.
  3. Add the file names, folders or users in the right order.
  4. Use sudo if the job changes system files or users. Click Check answer.

Hard Find old files

Why: Old files fill the disk. -mtime +N finds files changed more than N days ago.

What to do: Find regular files under /backup/punefintech that were changed more than 56 days ago.

How:
  1. Find the Linux command that does this job.
  2. Add the options (like -r or -h) the task needs.
  3. Add the file names, folders or users in the right order.
  4. Use sudo if the job changes system files or users. Click Check answer.

Hard Find a running process

Why: A pipe sends the full process list into grep so you see only what matters.

What to do: List all processes and show only the lines that contain node.

How:
  1. Find the Linux command that does this job.
  2. Add the options (like -r or -h) the task needs.
  3. Add the file names, folders or users in the right order.
  4. Use sudo if the job changes system files or users. Click Check answer.

See all practice tasks in the Task Hub →