Linux Commands A-Z Part 4: hostname, ip, journalctl, jq, kill, lsof, lvcreate and More with Examples

hostname in depth: the server's name and IPs

Why do we need this?

Prompts, logs, monitoring and certificates all show the host name. A wrong name puts alerts on the wrong server. You also often need the server IP quickly.

What is it?

hostname prints or sets the current host name. A change made with hostname alone is lost at reboot; on systemd systems use hostnamectl to make it permanent. hostname -I lists all IP addresses of the machine.

Common options

How to do it (step by step)

1. Which server am I on?

hostname

Output:

web01

What it means: Always check before risky commands.

2. Full name.

hostname -f

Output:

web01.prod.example.in

What it means: Short name plus domain.

3. My IPs.

hostname -I

Output:

10.0.1.15 172.17.0.1

What it means: The server IP and the docker bridge.

4. Temporary change.

sudo hostname test01; hostname

Output:

test01

What it means: Gone after reboot. Use hostnamectl for permanent.

Practise this in the tasks below: Practice tasks

hostnamectl in depth: set the name permanently and see system info

Why do we need this?

New VMs come with random names like ip-10-0-1-15. You need a meaningful name that survives reboot, and a quick view of the OS, kernel and hardware.

What is it?

hostnamectl talks to systemd-hostnamed. It writes /etc/hostname, sets the running name and also shows OS, kernel, architecture, virtualization and machine ID in one screen.

Common options

How to do it (step by step)

1. See system info.

hostnamectl

Output:

  Static hostname: ip-10-0-1-15
Operating System: Rocky Linux 9.4 (Blue Onyx)
          Kernel: Linux 5.14.0-427.el9.x86_64
  Virtualization: amazon
    Architecture: x86-64

What it means: OS, kernel and cloud in one view.

2. Set a real name.

sudo hostnamectl set-hostname pay-api01.prod.example.in

What it means: Saved in /etc/hostname and live now.

3. Check.

cat /etc/hostname; hostname

Output:

pay-api01.prod.example.in
pay-api01.prod.example.in

What it means: Will survive reboot.

4. Add it to /etc/hosts too.

echo "127.0.1.1 pay-api01.prod.example.in pay-api01" | sudo tee -a /etc/hosts

Output:

127.0.1.1 pay-api01.prod.example.in pay-api01

What it means: Stops "unable to resolve host" warnings from sudo.

Practise this in the tasks below: Practice tasks

htop in depth: friendly live view of CPU, memory and processes

Why do we need this?

When a server is slow, you want to see at a glance which process eats CPU or memory, per core, and act on it. htop is easier to read and use than top.

What is it?

htop is an interactive process viewer (install from EPEL on RHEL). It shows bars for every CPU core, memory and swap, then a sortable list of processes. You can search, filter, show a tree, change priority and kill with function keys.

Common options

How to do it (step by step)

1. Install.

sudo dnf install -y epel-release && sudo dnf install -y htop

Output:

Complete!

What it means: On Ubuntu: sudo apt install htop.

2. Open and sort by memory.

htop  (press F6, pick PERCENT_MEM)

Output:

  1[|||||||       32%]  Mem[||||||||  5.1G/7.6G]
  PID USER  %CPU %MEM COMMAND
  811 mysql  3.1 41.0 /usr/sbin/mysqld

What it means: mysqld uses 41% of RAM.

3. Only the web user.

htop -u nginx

Output:

(only nginx processes listed)

What it means: Less noise.

4. Tree view.

htop  (press F5)

Output:

nginx: master
 ├─ nginx: worker
 └─ nginx: worker

What it means: Shows parents and children.

Practise this in the tasks below: Practice tasks

id in depth: user ID, group IDs and SELinux context

Why do we need this?

Permission problems come down to "who am I and which groups do I have". id answers with names and numbers, which matter for NFS, containers and file ownership.

What is it?

id prints the user ID (uid), main group (gid) and all groups of the current or named user. With -Z it also shows the SELinux context. Numbers matter because files store the number, not the name.

Common options

How to do it (step by step)

1. Who am I?

id

Output:

uid=1001(ravi) gid=1001(ravi) groups=1001(ravi),10(wheel),3000(devs)

What it means: UID 1001; wheel means sudo.

2. Am I root in a script?

[ "$(id -u)" -eq 0 ] && echo root || echo "not root"

Output:

not root

What it means: UID 0 is always root.

3. Does the app user exist?

id app

Output:

uid=990(app) gid=988(app) groups=988(app)

What it means: A system account with low UID.

4. NFS file shows a number as owner.

ls -ln /mnt/share/report.xlsx; id -u priya

Output:

-rw-r--r-- 1 1502 1502 ... report.xlsx
1003

What it means: UID differs between servers; that is why access fails.

Practise this in the tasks below: Practice tasks

ifconfig in depth: the old network tool (and its ip replacement)

Why do we need this?

Many guides, old scripts and some interviewers still use ifconfig. You must read its output, and know the ip command that replaces it on modern Linux.

What is it?

ifconfig is from the old net-tools package and is not installed by default on RHEL 8+ and new Ubuntu. It shows interfaces, IPs, MAC, MTU and packet counters, and can set an IP temporarily. Use ip addr and ip link instead.

Common options

How to do it (step by step)

1. Not found on a new server?

ifconfig

Output:

bash: ifconfig: command not found

What it means: Install net-tools or use ip.

2. Install if you must.

sudo dnf install -y net-tools

Output:

Complete!

What it means: Gives ifconfig, netstat and route.

3. Read one interface.

ifconfig eth0

Output:

eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 9001
        inet 10.0.1.15  netmask 255.255.255.0
        ether 0a:1b:2c:3d:4e:5f
        RX errors 0  dropped 0

What it means: UP and RUNNING, IP 10.0.1.15, no errors.

4. Same with ip.

ip -br addr show eth0

Output:

eth0  UP  10.0.1.15/24 fe80::81b:2cff:fe3d:4e5f/64

What it means: -br gives one short line.

Practise this in the tasks below: Practice tasks

iostat in depth: is the disk the bottleneck?

Why do we need this?

A database is slow, CPU looks idle, but load is high. Usually the disk is too busy. iostat shows how busy each disk is and how long requests wait.

What is it?

iostat is in the sysstat package. It reports CPU iowait and, with -x, per-disk reads, writes, throughput, average wait (r_await, w_await) and %util. The first report is since boot; use an interval and look at later reports.

Common options

How to do it (step by step)

1. Install.

sudo dnf install -y sysstat

Output:

Complete!

What it means: Also gives sar and mpstat.

2. Watch disks.

iostat -xz 2 3

Output:

Device   r/s   w/s  rkB/s  wkB/s r_await w_await %util
nvme1n1 820.0 410.0 52480 26240   18.40   25.10  99.2

What it means: 99% util and 18 to 25 ms waits: the data disk is saturated.

3. Check CPU iowait.

iostat -c 2 2

Output:

avg-cpu:  %user %system %iowait  %idle
           6.1     2.4    38.7   52.8

What it means: 38% of CPU time waiting for disk.

4. Find the process.

sudo iotop -o -b -n 1 | head -4

Output:

Total DISK READ: 51.2 M/s
  PID  USER  DISK READ  COMMAND
  811 mysql  49.8 M/s   mysqld

What it means: mysqld does the reading; check its slow queries.

Practise this in the tasks below: Practice tasks

ip in depth: addresses, links, routes and neighbours

Why do we need this?

Every network problem starts with: does the server have the right IP, is the link up, and is the route right? ip answers all three on any modern Linux.

What is it?

ip from iproute2 replaces ifconfig, route and arp. Objects: addr (IP addresses), link (interfaces), route (routing table), neigh (ARP), rule. Changes are live but not saved; save them with nmcli or netplan.

Common options

How to do it (step by step)

1. Brief view.

ip -br a

Output:

lo      UNKNOWN 127.0.0.1/8 ::1/128
eth0    UP      10.0.1.15/24

What it means: eth0 is up with 10.0.1.15.

2. Routes.

ip r

Output:

default via 10.0.1.1 dev eth0 proto dhcp metric 100
10.0.1.0/24 dev eth0 proto kernel scope link src 10.0.1.15

What it means: Internet traffic goes to gateway 10.0.1.1.

3. Which path to the DB?

ip route get 10.0.2.15

Output:

10.0.2.15 via 10.0.1.1 dev eth0 src 10.0.1.15

What it means: Goes through the gateway.

4. Errors on the link?

ip -s link show eth0

Output:

RX: bytes  packets  errors  dropped
 9128371   71233    0       0

What it means: Zero errors: the cable or virtual NIC is fine.

5. Add a test IP.

sudo ip addr add 10.0.1.99/24 dev eth0; ip -br a show eth0

Output:

eth0  UP  10.0.1.15/24 10.0.1.99/24

What it means: Lost on reboot; use nmcli for permanent.

Practise this in the tasks below: Practice tasks

iptables in depth: read and add packet filter rules

Why do we need this?

Docker, Kubernetes, old servers and many cloud images still use iptables rules. When traffic is blocked or a port forward fails, you must read them.

What is it?

iptables manages kernel netfilter rules in tables (filter, nat, mangle) and chains (INPUT, OUTPUT, FORWARD, PREROUTING, POSTROUTING). Rules are checked top to bottom; the first match wins. On RHEL 8+ it is a front end to nftables, and firewalld is preferred.

Common options

How to do it (step by step)

1. List the input rules.

sudo iptables -L INPUT -n -v --line-numbers

Output:

Chain INPUT (policy ACCEPT)
num pkts bytes target prot source    destination
1   1200 88K  ACCEPT tcp  0.0.0.0/0 0.0.0.0/0  tcp dpt:22
2     45 2700 DROP   tcp  0.0.0.0/0 0.0.0.0/0  tcp dpt:8080

What it means: Port 8080 is dropped; 45 packets hit that rule.

2. Allow 8080 from the office only, above the DROP.

sudo iptables -I INPUT 2 -p tcp -s 203.0.113.0/24 --dport 8080 -j ACCEPT

What it means: Inserted at position 2, so it is checked before the DROP.

3. See Docker port forwards.

sudo iptables -t nat -L DOCKER -n

Output:

DNAT  tcp  0.0.0.0/0  0.0.0.0/0  tcp dpt:8081 to:172.17.0.2:80

What it means: Host 8081 goes to the container port 80.

4. Back up the rules.

sudo iptables-save > /root/iptables-$(date +%F).rules

What it means: Restore with iptables-restore.

Practise this in the tasks below: Practice tasks

jobs in depth: list what this shell is running

Why do we need this?

You started a few commands with & or stopped them with Ctrl+Z and lost track. jobs shows them so you can bring one back or kill it.

What is it?

jobs is a shell builtin. It lists jobs of the current shell only, with a job number, state (Running, Stopped, Done) and command. Use %N with fg, bg and kill. Jobs die with the shell unless you use nohup, disown or tmux.

Common options

How to do it (step by step)

1. Start two jobs.

tar czf /tmp/a.tgz /srv/app & sleep 900 &

Output:

[1] 5102
[2] 5103

What it means: Job numbers and PIDs.

2. List with PIDs.

jobs -l

Output:

[1]- 5102 Running   tar czf /tmp/a.tgz /srv/app &
[2]+ 5103 Running   sleep 900 &

What it means: Both still running.

3. Stop the sleep job.

kill %2; jobs

Output:

[1]-  Running   tar czf ...
[2]+  Terminated  sleep 900

What it means: Job 2 is gone.

4. Keep the tar after you log out.

disown %1

What it means: The shell forgets it, so logout does not kill it.

Practise this in the tasks below: Practice tasks

journalctl in depth: read systemd logs fast

Why do we need this?

A service failed to start, the server rebooted at night, or SSH logins are failing. On systemd systems all these logs are in the journal, and journalctl filters them by service, time and severity.

What is it?

journalctl reads the binary journal kept by systemd-journald. It can filter by unit (-u), boot (-b), time (--since, --until), priority (-p), and follow live (-f). Without Storage=persistent, logs are lost on reboot.

Common options

How to do it (step by step)

1. Why did nginx fail?

sudo journalctl -u nginx -n 5 --no-pager

Output:

nginx[2210]: nginx: [emerg] bind() to 0.0.0.0:80 failed (98: Address already in use)
systemd[1]: nginx.service: Failed with result 'exit-code'.

What it means: Port 80 is already taken by another process.

2. Errors from this boot.

sudo journalctl -b -p err --no-pager | tail -3

Output:

kernel: nvme1n1: I/O error, dev nvme1n1, sector 1024
...

What it means: A disk I/O error: check hardware.

3. What happened last night?

sudo journalctl --since "2026-10-25 23:00" --until "2026-10-26 01:00" -p warning

Output:

(warnings and errors in that window)

What it means: Narrow to the incident window.

4. Failed SSH logins.

sudo journalctl -u sshd --since today | grep -c "Failed password"

Output:

312

What it means: 312 failed password attempts today: check fail2ban.

5. How big is the journal?

journalctl --disk-usage

Output:

Archived and active journals take up 585.0M in the file system.

What it means: Shrink with --vacuum-size if disk is tight.

Practise this in the tasks below: Practice tasks

jq in depth: read and filter JSON on the command line

Why do we need this?

Cloud CLIs, APIs and Kubernetes all return JSON. Reading a 500-line JSON by eye is slow. jq picks the fields you need in one line.

What is it?

jq is a JSON processor. A filter like .name or .items[].id walks the structure. It can select with select(), build new objects, count with length, and print raw strings with -r for use in scripts.

Common options

How to do it (step by step)

1. Pretty print an API reply.

curl -s https://api.example.in/health | jq .

Output:

{
  "status": "ok",
  "db": "up",
  "version": "2.4.1"
}

What it means: Indented and colored.

2. One field for a script.

curl -s https://api.example.in/health | jq -r .status

Output:

ok

What it means: -r removes the quotes.

3. Instance IDs that are running.

aws ec2 describe-instances | jq -r '.Reservations[].Instances[] | select(.State.Name=="running") | .InstanceId'

Output:

i-0a1b2c3d4e5f60718
i-0f9e8d7c6b5a40312

What it means: Walk the arrays, filter, print.

4. Count pods not running.

kubectl get pods -o json | jq '[.items[] | select(.status.phase!="Running")] | length'

Output:

2

What it means: Wrap in [ ] to make a list, then length.

Practise this in the tasks below: Practice tasks

kill in depth: send signals to stop or reload a process

Why do we need this?

A process hangs, eats CPU, or needs to reload its config without downtime. kill sends it a signal, from a polite request to a forced stop.

What is it?

kill sends a signal to a PID. The default is SIGTERM (15): please exit and clean up. SIGHUP (1) often means reload. SIGKILL (9) cannot be caught: the kernel stops the process at once, with no cleanup. Always try 15 before 9.

Common options

How to do it (step by step)

1. Find the PID.

pgrep -a java

Output:

4121 java -jar /opt/report/report.jar

What it means: PID 4121.

2. Ask it to stop.

kill 4121; sleep 5; kill -0 4121 && echo alive || echo gone

Output:

gone

What it means: It exited cleanly.

3. Reload nginx config without dropping users.

sudo kill -HUP $(cat /run/nginx.pid)

What it means: Workers restart with the new config; connections stay.

4. Last resort for a stuck process.

kill -9 4121

What it means: No cleanup: temp files and locks may remain.

Practise this in the tasks below: Practice tasks

killall in depth: signal processes by name

Why do we need this?

A program started 20 worker processes and they all hang. Killing 20 PIDs one by one is slow. killall uses the name.

What is it?

killall (psmisc package) sends a signal to every process with an exact name. pkill is similar but matches patterns. Be careful on shared servers: it hits every user's process of that name unless you add -u.

Common options

How to do it (step by step)

1. How many workers?

pgrep -c php-fpm

Output:

21

What it means: 21 processes.

2. Stop them and wait.

sudo killall -w php-fpm

What it means: Returns when all have exited.

3. Only one user's.

killall -u ravi python3

What it means: Other users are not touched.

4. Match a script name.

pkill -f "report_job.py"

What it means: killall would only see "python3"; -f matches the arguments.

Practise this in the tasks below: Practice tasks

last in depth: who logged in and when the server rebooted

Why do we need this?

After an incident someone asks: who was on the server, and when did it reboot? last answers from the login records.

What is it?

last reads /var/log/wtmp and lists logins, logouts, reboots and shutdowns, newest first, with source IP and duration. lastb reads failed logins from /var/log/btmp. lastlog shows each user's most recent login.

Common options

How to do it (step by step)

1. Recent logins.

last -n 3

Output:

ravi   pts/0  49.36.12.8   Mon Oct 26 01:02   still logged in
priya  pts/1  10.0.1.5     Sun Oct 25 22:10 - 23:40  (01:30)
reboot system boot 5.14.0-427  Sun Oct 25 21:58   still running

What it means: ravi is on now; priya stayed 1.5 hours; reboot at 21:58.

2. When did it reboot?

last reboot | head -2

Output:

reboot system boot 5.14.0-427 Sun Oct 25 21:58 still running
reboot system boot 5.14.0-427 Tue Oct 20 03:00 - 21:57 (5+18:57)

What it means: Up almost 6 days before last night.

3. Failed login attempts.

sudo lastb -n 3

Output:

root ssh:notty 185.220.1.2 Mon Oct 26 00:59 - 00:59
admin ssh:notty 185.220.1.2 Mon Oct 26 00:59 - 00:59

What it means: A bot is guessing passwords.

4. Last login per user.

lastlog | grep -v "Never"

Output:

Username Port From        Latest
ravi     pts/0 49.36.12.8  Mon Oct 26 01:02:11

What it means: Find unused accounts to disable.

Practise this in the tasks below: Practice tasks

less in depth: read big files and outputs page by page

Why do we need this?

A log of 2 million lines will flood your screen with cat and freeze an editor. less opens it instantly and lets you search, jump and follow.

What is it?

less is a pager: it shows one screen at a time and reads only what it needs. Keys: Space next page, b back, /word search, n next match, G end, g start, F follow like tail -f, q quit. man uses less.

Common options

How to do it (step by step)

1. Open a big log.

less -N /var/log/app/app.log

Output:

      1 2026-10-26 00:00:01 INFO start
      2 2026-10-26 00:00:02 INFO db connected
:

What it means: Opens at once, even for gigabytes.

2. Search for an error.

/ERROR  then n

Output:

2026-10-26 00:41:10 ERROR payment timeout id=7781

What it means: n jumps to the next match, N goes back.

3. Wide CSV without wrapping.

less -S sales.csv

Output:

date,region,store,amount,tax,discount,channel...

What it means: Use the arrow keys to scroll sideways.

4. Follow a live log.

less +F /var/log/nginx/access.log

Output:

Waiting for data... (interrupt to abort)

What it means: Ctrl+C stops following so you can search; F starts again.

Practise this in the tasks below: Practice tasks

ln in depth: hard links and symbolic links

Why do we need this?

You want one stable path like /opt/app/current pointing to the latest release, or a config in two places without copying. Links do this, and switching a release becomes one command.

What is it?

ln creates links. A hard link is a second name for the same inode (same data); it cannot cross filesystems or point to folders. A symbolic link (-s) is a small file holding a path; it can point anywhere but breaks if the target is removed.

Common options

How to do it (step by step)

1. Point current to a release.

sudo ln -s /opt/app/releases/v41 /opt/app/current; ls -l /opt/app/current

Output:

lrwxrwxrwx 1 root root 24 Oct 26 01:30 /opt/app/current -> /opt/app/releases/v41

What it means: The arrow shows the target.

2. Deploy v42 by switching the link.

sudo ln -sfn /opt/app/releases/v42 /opt/app/current; readlink -f /opt/app/current

Output:

/opt/app/releases/v42

What it means: -n treats the old link as a file, so it is replaced, not entered.

3. Hard link: same inode.

ln data.csv data-copy.csv; ls -li data*.csv

Output:

1310722 -rw-r--r-- 2 ravi ravi 9.1M data.csv
1310722 -rw-r--r-- 2 ravi ravi 9.1M data-copy.csv

What it means: Same inode number, link count 2, no extra space.

4. Find broken links.

find /etc -xtype l

Output:

/etc/nginx/sites-enabled/old-site

What it means: The target was deleted; remove or fix the link.

Practise this in the tasks below: Practice tasks

locate in depth: find files instantly from a database

Why do we need this?

find over the whole disk can take minutes. When you only need "where is a file called X", locate answers in milliseconds.

What is it?

locate (mlocate or plocate package) searches a database of file names built by updatedb, usually once a day by a timer. It is fast but can be out of date: new files are missing and deleted files may still show. Run sudo updatedb to refresh.

Common options

How to do it (step by step)

1. Install and build.

sudo dnf install -y mlocate && sudo updatedb

Output:

Complete!

What it means: The first build reads the whole disk once.

2. Find a file.

locate sshd_config

Output:

/etc/ssh/sshd_config
/usr/share/man/man5/sshd_config.5.gz

What it means: Instant, every path containing the name.

3. A file you just created is missing.

touch /tmp/newfile.txt; locate newfile.txt; echo "code=$?"

Output:

code=1

What it means: The database is older than the file.

4. Refresh and retry.

sudo updatedb; locate newfile.txt

Output:

/tmp/newfile.txt

What it means: Now it is found.

Practise this in the tasks below: Practice tasks

logger in depth: write your own messages to the system log

Why do we need this?

Your backup script ran at 2 AM. Did it work? If it writes to the system log, the result sits next to every other event, reaches central logging and can trigger alerts.

What is it?

logger sends a message to syslog and the systemd journal. -t sets a tag (shown as the program name), -p sets facility and priority like user.err. Read it back with journalctl -t tag or in /var/log/messages.

Common options

How to do it (step by step)

1. Log a success.

logger -t backup "nightly backup ok size=4.2G"

What it means: Nothing is printed; it went to the log.

2. Read it.

journalctl -t backup -n 1 --no-pager

Output:

Oct 26 02:00:41 web01 backup[5541]: nightly backup ok size=4.2G

What it means: Tag, PID and time are added.

3. Log a failure with error priority.

logger -t backup -p user.err "nightly backup FAILED rc=23"

What it means: Monitoring that watches err level will alert.

4. Use it in a script.

rsync -a /srv/ backup01:/b/ && logger -t backup ok || logger -t backup -p user.err failed

What it means: One line, both outcomes logged.

Practise this in the tasks below: Practice tasks

logrotate in depth: stop logs from filling the disk

Why do we need this?

An app writes 2 GB of logs a day. Without rotation the disk fills in a week and the app crashes. logrotate renames, compresses and deletes old logs on a schedule.

What is it?

logrotate runs daily (cron or a systemd timer) and reads /etc/logrotate.conf plus files in /etc/logrotate.d/. Each block lists log paths and rules: daily or weekly, rotate N, compress, missingok, notifempty, and postrotate to tell the app to reopen logs. copytruncate is for apps that cannot reopen.

Common options

How to do it (step by step)

1. Write a rule for the app.

printf '/var/log/app/*.log {\n daily\n rotate 14\n compress\n delaycompress\n missingok\n notifempty\n maxsize 500M\n copytruncate\n}\n' | sudo tee /etc/logrotate.d/app

Output:

/var/log/app/*.log {
 daily
 rotate 14
 ...

What it means: Daily, keep 14, compress, or earlier at 500 MB.

2. Dry run.

sudo logrotate -d /etc/logrotate.d/app

Output:

considering log /var/log/app/app.log
  log needs rotating

What it means: Shows what would happen; changes nothing.

3. Force once.

sudo logrotate -f /etc/logrotate.d/app; ls /var/log/app

Output:

app.log  app.log.1

What it means: Rotated now; next run compresses app.log.1.

4. When did it last run?

sudo grep app.log /var/lib/logrotate/logrotate.status

Output:

"/var/log/app/app.log" 2026-10-26-1:35:0

What it means: The state file records each log.

Practise this in the tasks below: Practice tasks

ls in depth: list files the way admins do

Why do we need this?

Every task starts with "what is in this folder": sizes, owners, permissions, newest files, hidden files. ls -l is the first thing interviewers expect you to read.

What is it?

ls lists folder contents. -l gives the long format: type and permissions, link count, owner, group, size, change time, name. -a shows hidden dot files, -h human sizes, -t sorts by time, -S by size, -r reverses, -d shows the folder itself, -i inode, -Z SELinux label.

Common options

How to do it (step by step)

1. Read the long format.

ls -lh /etc/ssh/sshd_config

Output:

-rw-------. 1 root root 3.6K Oct 20 10:12 /etc/ssh/sshd_config

What it means: - file; rw for root only; . means an SELinux label; 3.6 KB.

2. Newest files first.

ls -lt /var/log | head -4

Output:

total 98340
-rw-r----- 1 root root 2.1M Oct 26 01:40 secure
-rw-r----- 1 root root 8.4M Oct 26 01:40 messages
-rw------- 1 root root  12K Oct 26 01:30 cron

What it means: Which logs are being written now.

3. Biggest first, hidden too.

ls -lAhS ~ | head -4

Output:

total 2.2G
-rw-r--r-- 1 ravi ravi 2.0G Oct 12 old.iso
-rw------- 1 ravi ravi  41K Oct 26 .bash_history

What it means: Find the space hog in a home folder.

4. The folder, not its contents.

ls -ld /srv/devs

Output:

drwxrws--- 2 root devs 4096 Oct 26 01:10 /srv/devs

What it means: s in the group part is setgid.

5. SELinux labels.

ls -Z /var/www/html

Output:

unconfined_u:object_r:httpd_sys_content_t:s0 index.html

What it means: httpd_sys_content_t lets the web server read it.

Practise this in the tasks below: Practice tasks

lsblk in depth: see disks, partitions and mounts as a tree

Why do we need this?

Before you format, mount, extend or dd anything, you must know which disk is which. lsblk shows every block device, its size and where it is mounted, in a clear tree.

What is it?

lsblk reads sysfs and lists disks, partitions, LVM volumes, RAID and loop devices. -f adds filesystem type, label and UUID; -o picks columns. It changes nothing, so it is always safe to run.

Common options

How to do it (step by step)

1. See everything.

lsblk

Output:

NAME          SIZE TYPE MOUNTPOINTS
nvme0n1        20G disk
├─nvme0n1p1     1G part /boot
└─nvme0n1p2    19G part
  ├─rl-root    17G lvm  /
  └─rl-swap     2G lvm  [SWAP]
nvme1n1        50G disk

What it means: The second disk nvme1n1 has no partitions or mounts: it is the new one.

2. Filesystems and UUIDs for fstab.

lsblk -f /dev/nvme1n1

Output:

NAME      FSTYPE UUID                                 MOUNTPOINTS
nvme1n1p1 xfs    7c1e2f3a-9b8d-4e5f-a1b2-c3d4e5f60718 /data

What it means: Use the UUID in /etc/fstab, not the device name.

3. Disks only.

lsblk -d -o NAME,SIZE,MODEL

Output:

NAME    SIZE MODEL
nvme0n1  20G Amazon Elastic Block Store
nvme1n1  50G Amazon Elastic Block Store

What it means: Quick inventory.

4. After growing a cloud disk.

lsblk /dev/nvme1n1

Output:

nvme1n1      80G disk
└─nvme1n1p1  50G part /data

What it means: Disk is 80G but the partition is still 50G: grow it with growpart.

Practise this in the tasks below: Practice tasks

lscpu in depth: what CPU does this server have?

Why do we need this?

Sizing a database, licensing software per core, or checking if a VM got the cores you paid for all need CPU facts. lscpu shows them neatly.

What is it?

lscpu reads /proc/cpuinfo and sysfs and summarizes architecture, CPU count, threads per core, cores per socket, sockets, model, speed, caches, NUMA nodes and virtualization.

Common options

How to do it (step by step)

1. Summary.

lscpu | grep -E "^(Architecture|CPU\(s\)|Thread|Core|Socket|Model name)"

Output:

Architecture:            x86_64
CPU(s):                  4
Model name:              Intel(R) Xeon(R) Platinum 8259CL CPU @ 2.50GHz
Thread(s) per core:      2
Core(s) per socket:      2
Socket(s):               1

What it means: 4 vCPUs = 2 cores x 2 threads.

2. Just the count for a script.

nproc

Output:

4

What it means: Use it to set worker counts, e.g. make -j$(nproc).

3. Is it a VM?

lscpu | grep -i hypervisor

Output:

Hypervisor vendor:       KVM

What it means: Running on KVM (AWS Nitro).

4. ARM or Intel?

lscpu | head -1

Output:

Architecture:            aarch64

What it means: aarch64 means ARM (like AWS Graviton): use ARM images.

Practise this in the tasks below: Practice tasks

lsof in depth: list open files, ports and deleted files

Why do we need this?

Disk full but du shows little, a port is busy, or "too many open files" errors appear. All three are about open files, and lsof shows them.

What is it?

In Linux everything is a file: regular files, folders, sockets, pipes and devices. lsof lists them per process with PID, user, file descriptor and name. Filters: -p PID, -u user, -i network, +D folder, +L1 deleted but open.

Common options

How to do it (step by step)

1. Who listens on 443?

sudo lsof -i :443 -sTCP:LISTEN -P -n

Output:

COMMAND  PID USER FD  TYPE NODE NAME
nginx   1043 root 7u  IPv4 TCP  *:443 (LISTEN)

What it means: nginx, PID 1043.

2. Disk full: find deleted open files.

sudo lsof +L1 | head -3

Output:

COMMAND  PID USER FD  SIZE/OFF NLINK NAME
java    4121 app  12w 7340032000  0 /var/log/app/debug.log (deleted)

What it means: 7 GB still held by java. Restart it (or truncate the fd) to free space.

3. How many files does a process have open?

sudo lsof -p 4121 | wc -l

Output:

1019

What it means: Close to a 1024 limit: raise LimitNOFILE.

4. Connections to the database.

sudo lsof -i TCP:5432 -P -n | grep -c ESTABLISHED

Output:

48

What it means: 48 open DB connections.

Practise this in the tasks below: Practice tasks

lvcreate in depth: create LVM logical volumes

Why do we need this?

Partitions are hard to resize. With LVM you pool disks into a volume group and cut flexible logical volumes that you can grow later, even online. lvcreate makes those volumes.

What is it?

LVM has three layers: physical volumes (pvcreate on a disk or partition), a volume group (vgcreate) that pools them, and logical volumes (lvcreate) that you format and mount. -L sets a size, -l uses extents or a percent like 100%FREE, -n names it, -s makes a snapshot.

Common options

How to do it (step by step)

1. Prepare the disk and group.

sudo pvcreate /dev/nvme1n1 && sudo vgcreate vgdata /dev/nvme1n1

Output:

Physical volume "/dev/nvme1n1" successfully created.
Volume group "vgdata" successfully created

What it means: 50 GB pool named vgdata.

2. Create a 20 GB volume.

sudo lvcreate -L 20G -n lvapp vgdata

Output:

Logical volume "lvapp" created.

What it means: Device is /dev/vgdata/lvapp.

3. Format and mount.

sudo mkfs.xfs /dev/vgdata/lvapp && sudo mkdir -p /app && sudo mount /dev/vgdata/lvapp /app && df -h /app

Output:

/dev/mapper/vgdata-lvapp   20G  175M   20G   1% /app

What it means: Ready to use; add it to /etc/fstab.

4. Grow it later, online.

sudo lvextend -r -L +10G /dev/vgdata/lvapp

Output:

Size of logical volume vgdata/lvapp changed from 20.00 GiB to 30.00 GiB.
data blocks changed from 5242880 to 7864320

What it means: -r grows the filesystem too. No downtime.

5. Check.

sudo lvs

Output:

  LV    VG     Attr       LSize
  lvapp vgdata -wi-ao---- 30.00g

What it means: 30 GB, active and open.

Practise this in the tasks below: Practice tasks