Linux Commands A-Z Part 7: strace, sudo, systemctl, tail, tar, tmux, top, uname and More with Examples

By Ravindra Bagale, trainer LinkedIn Last updated: 27 October 2026

This is Part 7 of the Linux Commands A-Z reference: strace to uname. These are the commands you use to trace a failing program, switch users and run admin commands safely, add swap, tune the kernel, manage services, read live logs, make backups, save output while you watch it, write conditions in scripts, measure time, set the clock, keep sessions alive, watch CPU and memory, clean text, trace network paths, see folder trees, empty huge logs, find what a command name really is, raise limits, set default permissions, unmount disks and identify the kernel. Every command has why, what, an options table and step-by-step examples with real output and its meaning.

What you'll learn in this chapter

Debug failing programs with strace and see live load with top
Use su and sudo safely and know who you are
Add swap with swapon and tune the kernel with sysctl and ulimit
Manage services with systemctl and read logs with tail
Make backups with tar and keep logs with tee
Write safer scripts with test, time, tr and type
Keep long jobs alive with tmux and trace networks with traceroute
Handle files and disks with tree, truncate, umask, umount, uname and timedatectl

1. An everyday example: a Pune wedding caterer

Why do we need this?

The head caterer watches each cook to see where the delay is, hands the store-room key to a helper for one task only, brings extra tables when the hall is full, adjusts the gas flame, starts and stops each counter, reads the latest orders from the bottom of the list, packs leftovers in boxes, keeps a copy of every order slip, checks that each dish is ready before serving, times the biryani, sets the hall clock right, and keeps the menu board in place even if he steps out.

What is it?

Watching cooks is strace and top. The store key is sudo. Extra tables are swap. The gas flame is sysctl. Counters are systemctl. Latest orders are tail. Boxes are tar. The slip copy is tee. Checking dishes is test. Timing is time. The clock is timedatectl. The menu board that stays is tmux.

How to do it (step by step)

Each step uses a command from this part.

2. A five-minute service health check using Part 7 commands

Why do we need this?

Before the deep dives, see how these commands work together when a service misbehaves.

What is it?

Load, then service state, then logs, then system calls.

Question	Command
Is the box busy?	`top -b -n 1 \| head -5`
Is the service up?	`systemctl status app`
What do the logs say?	`tail -n 50 /var/log/app.log`
What file is it stuck on?	`strace -p PID`
Enough open files?	`ulimit -n`

How to do it (step by step)

Run the check.

systemctl is-active billing; tail -n 1 /var/log/billing/app.log

Output:

failed
FATAL cannot open /etc/billing/app.yml: Permission denied

What it means: The service died on a config permission.

Confirm and fix.

sudo -u billing test -r /etc/billing/app.yml || sudo chmod 640 /etc/billing/app.yml; sudo systemctl restart billing; systemctl is-active billing

Output:

active

What it means: Readable now, service back.

3. strace: Trace system calls

strace in depth: see what a program asks the kernel

Why do we need this?

An app fails with no useful log line. It cannot find a file, a permission is wrong, or it hangs on the network. strace shows every system call, so you see the exact file or socket that failed.

What is it?

strace runs a command (or attaches to a PID with -p) and prints each system call with its arguments and result. -f follows child processes, -e trace= filters calls, -o writes to a file, -c gives a summary table, -T shows time spent in each call.

Common options

Option	What it does
`strace cmd`	Trace a new command.
`-p PID`	Attach to a running process.
`-f`	Follow forks.
`-e trace=openat`	Only file opens.
`-c`	Summary of calls.
`-o file`	Save output.

How to do it (step by step)

Why does the app not start?

strace -e trace=openat ./billing 2>&1 | grep ENOENT

Output:

openat(AT_FDCWD, "/etc/billing/app.yml", O_RDONLY) = -1 ENOENT (No such file or directory)

What it means: The config file is missing at that path.

Attach to a stuck process.

sudo strace -p 4120

Output:

connect(5, {sa_family=AF_INET, sin_port=htons(5432), sin_addr=inet_addr("10.0.2.9")}, 16

What it means: It waits on a database connection to 10.0.2.9:5432.

Where is time spent?

strace -c -f ./report.sh

Output:

% time     seconds  usecs/call     calls    errors syscall
 71.20    0.412000        103      4000           read
 18.10    0.105000         52      2010           write

What it means: Mostly reading: many small reads.

Save for later.

strace -f -o /tmp/app.trace ./app; grep -c EACCES /tmp/app.trace

Output:

What it means: Three permission denials to check.

Practise this in the tasks below: Practice tasks

Real use: A Hinjewadi payments team found a missing CA bundle path with strace -e trace=openat in two minutes.

4. su: Switch user

su in depth: switch user

Why do we need this?

You need to run something as the app user or as root, for example to test file access the way the service sees it.

What is it?

su starts a shell as another user. su - gives a full login environment (home, PATH). su -c runs one command. -s picks a shell, useful for system users with nologin. It asks for the target user password; sudo asks for yours.

Common options

Option	What it does
`su - user`	Login as user.
`su -`	Become root.
`su -c "cmd" user`	One command.
`-s /bin/bash`	Choose shell.
`exit`	Return.

How to do it (step by step)

Become the app user.

sudo su - appsvc -s /bin/bash

Output:

[appsvc@web01 ~]$

What it means: A full login shell as appsvc.

Test access as that user.

sudo su -s /bin/bash -c "cat /srv/app/.env" appsvc

Output:

cat: /srv/app/.env: Permission denied

What it means: The service cannot read its own env file.

Check who you are.

whoami

Output:

appsvc

What it means: You are the app user now.

Go back.

exit

Output:

logout

What it means: Back to your own shell.

Practise this in the tasks below: Practice tasks

Real use: A Kothrud school IT admin uses su - teacher to reproduce what a teacher sees on the lab Linux PCs.

5. sudo: Run a command as another user

sudo in depth: run as root safely

Why do we need this?

Nobody should log in as root every day. sudo gives just enough power for one command and logs who did what.

What is it?

sudo runs a command as root (or -u user) after asking for your own password. Rules live in /etc/sudoers and /etc/sudoers.d, edited only with visudo. sudo -l lists what you may run, -i opens a root login shell, -k forgets the cached password.

Common options

Option	What it does
`sudo cmd`	As root.
`-u user cmd`	As another user.
`-l`	What can I run?
`-i`	Root login shell.
`-k`	Forget cached password.
`visudo -f`	Edit a rules file safely.

How to do it (step by step)

Run one admin command.

sudo systemctl restart nginx

What it means: Restarted, and logged in the secure log.

What am I allowed?

sudo -l

Output:

User ravi may run the following commands on web01:
    (root) /usr/bin/systemctl restart nginx

What it means: Only one command is allowed.

Run as the app user.

sudo -u appsvc touch /srv/app/tmp/test

What it means: Creates the file with the right owner.

Give a team limited rights.

sudo visudo -f /etc/sudoers.d/ops

Output:

%ops ALL=(root) /usr/bin/systemctl restart app

What it means: Ops group may restart only the app.

Practise this in the tasks below: Practice tasks

Real use: A Baner bank audit checks /var/log/secure for every sudo command run on production.

6. swapon: Enable and show swap

swapon in depth: add and check swap

Why do we need this?

A small cloud server with 1 GB RAM gets killed by the OOM killer during a build. A swap file gives breathing room.

What is it?

swapon enables a swap file or partition; swapoff disables it. --show lists active swap. A swap file is made with fallocate or dd, chmod 600, then mkswap. Add it to /etc/fstab to keep it after reboot. vm.swappiness (sysctl) controls how eagerly Linux swaps.

Common options

Option	What it does
`--show`	List swap.
`swapon /swapfile`	Enable.
`swapoff /swapfile`	Disable.
`-a`	Enable all in fstab.
`mkswap file`	Prepare a swap file.

How to do it (step by step)

Check current swap.

swapon --show

What it means: Empty: no swap at all.

Make a 2 GB swap file.

sudo fallocate -l 2G /swapfile && sudo chmod 600 /swapfile && sudo mkswap /swapfile

Output:

Setting up swapspace version 1, size = 2 GiB

What it means: Ready to enable.

Enable and check.

sudo swapon /swapfile; swapon --show

Output:

NAME      TYPE SIZE USED PRIO
/swapfile file   2G   0B   -2

What it means: 2 GB swap active.

Keep after reboot.

echo "/swapfile none swap sw 0 0" | sudo tee -a /etc/fstab

Output:

/swapfile none swap sw 0 0

What it means: Survives reboot.

Practise this in the tasks below: Practice tasks

Real use: A Wakad startup added a 2 GB swap file to its t3.micro CI runner and the nightly build stopped crashing.

7. sysctl: Read and set kernel settings

sysctl in depth: tune the kernel

Why do we need this?

A busy web server runs out of connection slots, or you must enable IP forwarding for a NAT box. These are kernel settings, changed with sysctl.

What is it?

sysctl reads and writes kernel parameters under /proc/sys. sysctl name reads, -w name=value changes until reboot, a file in /etc/sysctl.d makes it permanent, and sysctl --system reloads all files. -a lists everything.

Common options

Option	What it does
`sysctl name`	Read.
`-w name=value`	Set now.
`-a`	List all.
`--system`	Reload all files.
`-p file`	Load one file.

How to do it (step by step)

Read a value.

sysctl net.ipv4.ip_forward

Output:

net.ipv4.ip_forward = 0

What it means: Forwarding is off.

Turn it on now.

sudo sysctl -w net.ipv4.ip_forward=1

Output:

net.ipv4.ip_forward = 1

What it means: Works until reboot.

Make it permanent.

echo "net.ipv4.ip_forward = 1" | sudo tee /etc/sysctl.d/90-nat.conf; sudo sysctl --system | tail -1

Output:

net.ipv4.ip_forward = 1

What it means: Loaded from the file.

Lower swappiness.

sudo sysctl -w vm.swappiness=10

Output:

vm.swappiness = 10

What it means: The database server keeps more in RAM.

Practise this in the tasks below: Practice tasks

Real use: A Magarpatta gaming company raises net.core.somaxconn on its match servers before every tournament.

8. systemctl: Manage services

systemctl in depth: manage services

Why do we need this?

Nginx, the database, your own app: on modern Linux every service is a systemd unit. Start, stop, enable at boot and see why it failed, all with systemctl.

What is it?

systemctl start, stop, restart and reload control a unit now; enable and disable control boot; status shows state plus the last log lines; is-active and is-enabled suit scripts; daemon-reload reads changed unit files; list-units --failed shows broken ones; edit creates an override.

Common options

Option	What it does
`status unit`	State and logs.
`start/stop/restart`	Control now.
`enable --now`	Boot and start.
`is-active`	For scripts.
`daemon-reload`	Reload unit files.
`--failed`	Broken units.

How to do it (step by step)

Check a service.

systemctl status nginx

Output:

● nginx.service - The nginx HTTP and reverse proxy server
     Active: active (running) since Tue 2026-10-27 09:12:03 IST

What it means: Running since this morning.

Find failures.

systemctl --failed

Output:

  UNIT          LOAD   ACTIVE SUB    DESCRIPTION
● billing.service loaded failed failed Billing API

What it means: The billing API is down.

Fix and start at boot.

sudo systemctl daemon-reload; sudo systemctl enable --now billing

Output:

Created symlink /etc/systemd/system/multi-user.target.wants/billing.service

What it means: Running now and after reboot.

Script check.

systemctl is-active billing

Output:

active

What it means: One word, exit code 0.

Practise this in the tasks below: Practice tasks

Real use: A Hadapsar e-commerce warehouse runs its label printer service as a systemd unit with Restart=always.

9. tail: Show the last lines or follow a log

tail in depth: end of files and live logs

Why do we need this?

When a deploy goes wrong you want the newest log lines, and you want to watch them arrive while you test.

What is it?

tail prints the last 10 lines. -n N sets the count, -n +N starts from line N, -f follows new lines, -F follows even after log rotation, -c counts bytes. Pipe into grep to filter a live stream.

Common options

Option	What it does
`-n 50`	Last 50 lines.
`-n +2`	From line 2 (skip header).
`-f`	Follow.
`-F`	Follow across rotation.
`-c 200`	Last 200 bytes.

How to do it (step by step)

Newest lines.

tail -n 3 /var/log/nginx/error.log

Output:

2026/10/27 10:02:11 [error] connect() failed (111: Connection refused) while connecting to upstream

What it means: Upstream app is down.

Watch live.

tail -F /var/log/app/app.log | grep --line-buffered ERROR

Output:

ERROR order 5512 payment timeout

What it means: Only errors, as they happen.

Skip a CSV header.

tail -n +2 sales.csv | head -2

Output:

2026-10-01,Pune,4200
2026-10-01,Nashik,3100

What it means: Data rows only.

Two files at once.

tail -n 1 app1.log app2.log

Output:

==> app1.log <==
started
==> app2.log <==
started

What it means: Headers show each file.

Practise this in the tasks below: Practice tasks

Real use: A Shivajinagar hospital help desk keeps tail -F on the PACS log during every scanner upgrade.

10. tar: Pack files into an archive

tar in depth: archives and backups

Why do we need this?

Back up a website folder, ship a release, move configs between servers: tar packs many files into one, keeping permissions.

What is it?

tar c creates, x extracts, t lists; f names the archive; z gzip, j bzip2, J xz compress; v verbose; -C changes folder; --exclude skips paths; -p keeps permissions on extract. Full compression comparison is in the compression chapter.

Common options

Option	What it does
`czf a.tgz dir`	Create gzip archive.
`tzf a.tgz`	List.
`xzf a.tgz -C dir`	Extract into dir.
`cJf a.txz`	xz archive.
`--exclude=PAT`	Skip.
`-p`	Keep permissions.

How to do it (step by step)

Back up a site.

tar czf site-2026-10-27.tgz --exclude="*.log" /var/www/shop

Output:

tar: Removing leading `/' from member names

What it means: Normal: paths are stored relative.

Look inside.

tar tzf site-2026-10-27.tgz | head -3

Output:

var/www/shop/
var/www/shop/index.html
var/www/shop/css/

What it means: Contents listed without extracting.

Restore elsewhere.

mkdir /tmp/restore && tar xzf site-2026-10-27.tgz -C /tmp/restore

What it means: Restored under /tmp/restore/var/www/shop.

One file only.

tar xzf site-2026-10-27.tgz var/www/shop/index.html

What it means: Pulls just that file.

Practise this in the tasks below: Practice tasks

Real use: A Deccan chartered-accountant office tars its client folders every Friday and copies the archive to S3.

11. tee: Write output to screen and file

tee in depth: see output and save it

Why do we need this?

You run an upgrade and want to watch the output and keep a log at the same time. Or you need sudo to write a file that redirection cannot.

What is it?

tee copies standard input to the screen and to one or more files. -a appends instead of overwriting. sudo tee writes root-owned files because tee itself runs as root, unlike > which runs in your shell.

Common options

Option	What it does
`cmd \| tee file`	Screen and file.
`-a`	Append.
`tee f1 f2`	Two files.
`\| sudo tee file`	Write as root.
`> /dev/null`	Hide screen copy.

How to do it (step by step)

Log an upgrade.

sudo dnf -y update 2>&1 | tee update-2026-10-27.log | tail -1

Output:

Complete!

What it means: You saw it and saved it.

Append daily.

date | tee -a checks.log

Output:

Tue Oct 27 10:30:00 IST 2026

What it means: Adds a line, keeps old ones.

Write a root file.

echo "10.0.1.5 db01" | sudo tee -a /etc/hosts

Output:

10.0.1.5 db01

What it means: sudo echo > /etc/hosts would fail.

Quiet write.

echo "vm.swappiness = 10" | sudo tee /etc/sysctl.d/80-swap.conf > /dev/null

What it means: Written without echoing.

Practise this in the tasks below: Practice tasks

Real use: A Chakan auto plant logs every PLC firmware push with tee so the shift engineer can watch and QA can audit.

12. test: Check files and values

test in depth: conditions in scripts

Why do we need this?

Before a script deletes, copies or deploys, it must check: does the file exist, is the folder writable, is the number bigger than the limit?

What is it?

test (or [ ]) checks a condition and returns exit code 0 (true) or 1 (false). Files: -f file, -d dir, -e exists, -s not empty, -r/-w/-x. Strings: = != -z -n. Numbers: -eq -ne -gt -lt -ge -le. Bash also has [[ ]] with pattern matching.

Common options

Option	What it does
`-f path`	Regular file.
`-d path`	Directory.
`-z "$v"`	Empty string.
`a -gt b`	Greater (numbers).
`! expr`	Not.
`[[ $x == *.log ]]`	Pattern (bash).

How to do it (step by step)

Does a file exist?

test -f /etc/app.conf && echo yes || echo no

Output:

no

What it means: Create the config before starting.

Disk guard.

use=$(df --output=pcent / | tail -1 | tr -dc 0-9); [ "$use" -gt 90 ] && echo "disk full"

Output:

disk full

What it means: Stop the backup before it fills the disk.

Empty variable.

[ -z "$DB_HOST" ] && echo "DB_HOST missing"

Output:

DB_HOST missing

What it means: Fail early with a clear message.

Exit code.

[ -d /srv/app ]; echo $?

Output:

What it means: 0 means true.

Practise this in the tasks below: Practice tasks

Real use: A Kalyani Nagar travel portal deploy script checks [ -s build/index.html ] before switching traffic.

13. time: Measure how long a command takes

time in depth: measure how long a command takes

Why do we need this?

Is the new query faster? Did compression slow the backup? Measure instead of guessing.

What is it?

time runs a command and prints real (wall clock), user (CPU in your code) and sys (CPU in the kernel). If real is much bigger than user+sys, the command waited on disk or network. /usr/bin/time -v gives memory use too.

Common options

Option	What it does
`time cmd`	Real, user, sys.
`/usr/bin/time -v`	Max memory too.
`TIMEFORMAT=%R`	Only seconds (bash).
`time ( a; b )`	Time a group.

How to do it (step by step)

Time a backup.

time tar czf db.tgz /var/lib/pgsql/dump

Output:

real    1m42.311s
user    1m30.020s
sys     0m6.144s

What it means: CPU bound: compression is the cost.

Network wait.

time curl -s https://api.example.in/report > /dev/null

Output:

real    0m4.902s
user    0m0.020s
sys     0m0.011s

What it means: Almost all waiting: the API is slow.

Peak memory.

/usr/bin/time -v python3 etl.py 2>&1 | grep Maximum

Output:

Maximum resident set size (kbytes): 812344

What it means: About 800 MB at peak.

Compare two.

time gzip -k big.log; time xz -k big.log

Output:

real 0m3.1s
real 0m21.7s

What it means: xz is 7x slower here.

Practise this in the tasks below: Practice tasks

Real use: A Pimpri analytics team times its nightly ETL so it always ends before the 6 AM dashboard refresh.

14. timedatectl: Manage time and time zone

timedatectl in depth: time zone and clock sync

Why do we need this?

Logs in UTC, users in IST, a token rejected because the clock is 3 minutes off: time settings matter.

What is it?

timedatectl shows local time, UTC, time zone and whether NTP sync is on. set-timezone changes the zone, list-timezones lists them, set-ntp true turns on sync (chronyd or timesyncd). set-time sets the clock by hand when NTP is off.

Common options

Option	What it does
`timedatectl`	Status.
`set-timezone Asia/Kolkata`	Set zone.
`list-timezones`	List zones.
`set-ntp true`	Enable sync.
`set-time "2026-10-27 10:00"`	Manual time.

How to do it (step by step)

Check.

timedatectl

Output:

               Local time: Tue 2026-10-27 04:40:10 UTC
                Time zone: UTC (UTC, +0000)
System clock synchronized: yes

What it means: Synced, but in UTC.

Find the zone.

timedatectl list-timezones | grep Kolkata

Output:

Asia/Kolkata

What it means: Exact name to use.

Set IST.

sudo timedatectl set-timezone Asia/Kolkata; date

Output:

Tue Oct 27 10:10:10 IST 2026

What it means: Now in IST.

Turn on sync.

sudo timedatectl set-ntp true

What it means: Clock stays correct.

Practise this in the tasks below: Practice tasks

Real use: A Viman Nagar airline-catering firm keeps all kitchen servers on Asia/Kolkata with NTP so meal labels show correct times.

15. tmux: Split and keep terminal sessions

tmux in depth: sessions that survive disconnects

Why do we need this?

Your Wi-Fi drops in the middle of a database migration. With tmux the job keeps running and you reattach exactly where you were.

What is it?

tmux runs terminals inside a server process. new -s names a session, detach with Ctrl-b d, ls lists sessions, attach -t returns, Ctrl-b % and Ctrl-b " split panes, kill-session ends one. It is the modern choice over screen.

Common options

Option	What it does
`new -s name`	New session.
`Ctrl-b d`	Detach.
`ls`	List sessions.
`attach -t name`	Reattach.
`Ctrl-b %`	Split side by side.
`kill-session -t name`	End session.

How to do it (step by step)

Start a named session.

tmux new -s migrate

Output:

[migrate] 0:bash*

What it means: You are inside tmux.

Detach and list.

tmux ls

Output:

migrate: 1 windows (created Tue Oct 27 11:00:02 2026)

What it means: Still running after you left.

Come back.

tmux attach -t migrate

Output:

(migration output continues)

What it means: Same screen as before.

Clean up.

tmux kill-session -t migrate

What it means: Session gone.

Practise this in the tasks below: Practice tasks

Real use: A Kharadi SaaS on-call engineer runs every production migration inside tmux after losing one to a VPN drop.

16. top: Live view of processes

top in depth: live CPU and memory view

Why do we need this?

The server feels slow. In five seconds top tells you whether CPU, memory or I/O wait is the problem and which process causes it.

What is it?

top refreshes a table of processes. The header shows load average, CPU split (us, sy, wa, st) and memory. Keys: P sort by CPU, M by memory, k kill, 1 per-CPU view, q quit. -b -n 1 prints once for scripts; -p watches PIDs; -u a user.

Common options

Option	What it does
`P / M`	Sort CPU / memory.
`1`	Each CPU.
`-b -n 1`	One batch print.
`-p PID`	Watch PIDs.
`-u user`	One user.
`wa / st`	IO wait / stolen.

How to do it (step by step)

Read the header.

top -b -n 1 | head -3

Output:

top - 11:20:01 up 12 days,  load average: 7.81, 6.20, 3.10
Tasks: 212 total,   3 running
%Cpu(s): 12.0 us,  3.1 sy,  0.0 ni,  4.2 id, 80.5 wa,  0.0 st

What it means: 80% IO wait: the disk is the bottleneck.

Top memory users.

top -b -n 1 -o %MEM | sed -n 8,9p

Output:

   2210 mysql  20  0  6.1g  4.8g  S  2.0 61.3  java

What it means: MySQL holds 61% of RAM.

Watch one process.

top -p 2210

Output:

(live view of PID 2210)

What it means: Focused view.

Cloud steal.

top -b -n 1 | grep Cpu

Output:

%Cpu(s): 40.0 us, 2.0 sy, 0.0 wa, 35.0 st

What it means: 35% stolen: the burst instance ran out of credits.

Practise this in the tasks below: Practice tasks

Real use: A Swargate bus-ticketing team saw 35% steal in top and moved from t3 to m6i instances before Diwali.

17. tr: Translate or delete characters

tr in depth: translate and delete characters

Why do we need this?

Uppercase a code, turn commas into new lines, strip Windows line endings or remove digits: small text fixes in a pipe.

What is it?

tr reads stdin and maps characters from set1 to set2. -d deletes characters, -s squeezes repeats, -c uses the complement. Classes like [:lower:] [:upper:] [:digit:] [:space:] help. tr works on characters, not words; use sed for words.

Common options

Option	What it does
`tr a-z A-Z`	Uppercase.
`tr "," "\n"`	Comma to newline.
`-d "\r"`	Delete CR.
`-s " "`	Squeeze spaces.
`-dc "0-9"`	Keep only digits.

How to do it (step by step)

Uppercase.

echo "pune-411001" | tr a-z A-Z

Output:

PUNE-411001

What it means: Codes in one case.

Split a list.

echo "web1,web2,web3" | tr "," "\n"

Output:

web1
web2
web3

What it means: One host per line for a loop.

Fix Windows files.

tr -d "\r" < export.csv > clean.csv; file clean.csv

Output:

clean.csv: ASCII text

What it means: No more CRLF.

Only digits.

echo "Disk used: 91%" | tr -dc 0-9

Output:

What it means: Ready for a number test.

Practise this in the tasks below: Practice tasks

Real use: A Market Yard trader cleans supplier CSVs from Excel with tr -d "\r" before loading them into the stock system.

18. traceroute: Show the network path to a host

traceroute in depth: where packets stop

Why do we need this?

Ping fails or is slow. Is it your office, the ISP, or the cloud? traceroute shows each hop and the delay to it.

What is it?

traceroute sends packets with rising TTL so each router replies in turn. Each line is a hop with three timings; * means no reply. -n skips DNS, -T uses TCP (good through firewalls), -p sets the port, -m max hops. tracepath and mtr are alternatives.

Common options

Option	What it does
`-n`	No DNS.
`-T -p 443`	TCP to port.
`-m 15`	Max hops.
`-w 2`	Wait seconds.
`mtr`	Live version.

How to do it (step by step)

Trace a site.

traceroute -n api.example.in

Output:

1  192.168.1.1  1.1 ms
 2  10.40.0.1  6.0 ms
 3  * * *
 4  52.95.66.1  31.2 ms

What it means: Hop 3 hides ICMP but traffic passes.

Through a firewall.

sudo traceroute -T -p 443 -n api.example.in | tail -1

Output:

9  13.234.10.20  33.0 ms

What it means: TCP reaches the server.

Find the slow hop.

traceroute -n 8.8.8.8 | sed -n 3,4p

Output:

3  103.1.2.1  8.0 ms
 4  103.1.9.9  210.4 ms

What it means: The ISP link at hop 4 adds 200 ms.

Install if missing.

sudo dnf -y install traceroute

Output:

Complete!

What it means: Ready.

Practise this in the tasks below: Practice tasks

Real use: A Bhosari factory showed its ISP a traceroute with 200 ms at their router and got the link fixed.

19. tree: Show folders as a tree

tree in depth: see folder structure

Why do we need this?

Explaining a project layout or checking that a deploy copied the right folders is easier as a tree than with many ls calls.

What is it?

tree prints a folder and its children as an indented tree. -L limits depth, -d shows only folders, -a hidden files, -h sizes, -I excludes a pattern, --du folder sizes. It may need installing.

Common options

Option	What it does
`-L 2`	Two levels.
`-d`	Folders only.
`-a`	Hidden too.
`-h`	Sizes.
`-I "node_modules"`	Exclude.

How to do it (step by step)

Project layout.

tree -L 2 shop

Output:

shop
├── app
│   ├── main.py
│   └── models.py
├── deploy
└── README.md

3 directories, 3 files

What it means: Clear picture for a new team member.

Folders only.

tree -d -L 1 /etc/nginx

Output:

/etc/nginx
├── conf.d
└── default.d

What it means: Where configs live.

Skip big folders.

tree -L 2 -I "node_modules|.git" web

Output:

web
├── src
└── package.json

What it means: Readable output.

With sizes.

tree -h -L 1 /var/log | tail -2

Output:

└── [ 12M]  messages

4 directories, 18 files

What it means: Biggest log at a glance.

Practise this in the tasks below: Practice tasks

Real use: A Model Colony training institute pastes tree -L 2 output into every lab handout so students know where files go.

20. truncate: Shrink or grow a file to a size

truncate in depth: shrink or size files

Why do we need this?

A log has filled the disk but the app still holds it open. Deleting it does not free space; truncating it to zero does, instantly.

What is it?

truncate -s sets a file size: 0 empties it, 100M makes a sparse file, +10M grows, -10M shrinks. The inode stays the same, so open handles keep working. Use it for logs and for practice disk images.

Common options

Option	What it does
`-s 0 file`	Empty.
`-s 1G file`	Set size.
`-s +100M`	Grow.
`-s -1M`	Shrink.
`-c`	Do not create.

How to do it (step by step)

Disk full from a log.

df -h /var | tail -1

Output:

/dev/xvda1  20G  20G  0  100% /

What it means: No space left.

Empty it safely.

sudo truncate -s 0 /var/log/app/debug.log; df -h /var | tail -1

Output:

/dev/xvda1  20G  12G  8.0G  60% /

What it means: 8 GB back, app still logging.

Make a test disk file.

truncate -s 1G disk.img; ls -lh disk.img; du -h disk.img

Output:

-rw-r--r-- 1 ravi ravi 1.0G disk.img
0       disk.img

What it means: Sparse: 1 GB size, no space used yet.

Only if it exists.

truncate -c -s 0 old.log

What it means: No new file is created.

Practise this in the tasks below: Practice tasks

Real use: A Hinjewadi call-analytics team truncates a runaway debug log at 2 AM instead of restarting the dialer.

21. type: Show how a command name is resolved

type in depth: what will actually run

Why do we need this?

You type ls or python and get something odd. Is it an alias, a function, a builtin or a file on PATH? type tells you.

What is it?

type is a shell builtin that explains how a name is resolved. -a shows every match in order, -t prints one word (alias, keyword, function, builtin, file), -P forces a PATH search. It is more accurate than which because it knows aliases and functions.

Common options

Option	What it does
`type name`	Explain.
`-a`	All matches.
`-t`	One word.
`-P`	PATH file only.
`command -v`	Script friendly.

How to do it (step by step)

An alias?

type ll

Output:

ll is aliased to `ls -l --color=auto'

What it means: ll is an alias.

Builtin.

type cd

Output:

cd is a shell builtin

What it means: No file on disk.

Which python?

type -a python3

Output:

python3 is /usr/local/bin/python3
python3 is /usr/bin/python3

What it means: The /usr/local one runs first.

One word.

type -t deploy

Output:

function

What it means: A shell function from your profile.

Practise this in the tasks below: Practice tasks

Real use: A Bavdhan data-science team found that type -a python3 showed a stale /usr/local build breaking their notebooks.

22. ulimit: Show and set user limits

ulimit in depth: per-process limits

Why do we need this?

Nginx logs "Too many open files" under load, or a crash leaves no core dump. Both are ulimit settings.

What is it?

ulimit shows and sets shell limits inherited by child processes: -n open files, -u processes, -c core size, -a all. -S soft and -H hard; a user can raise soft up to hard. Make limits permanent in /etc/security/limits.conf or with LimitNOFILE= in a systemd unit.

Common options

Option	What it does
`-a`	All limits.
`-n`	Open files.
`-n 65535`	Raise for this shell.
`-c unlimited`	Allow core dumps.
`-Hn`	Hard limit.

How to do it (step by step)

Check open files.

ulimit -n

Output:

What it means: Too low for a busy proxy.

Check a running process.

grep "open files" /proc/$(pgrep -o nginx)/limits

Output:

Max open files            1024                 4096                 files

What it means: Soft 1024, hard 4096.

Fix for a service.

sudo systemctl edit nginx

Output:

[Service]
LimitNOFILE=65535

What it means: Set in the unit, then restart.

Allow core dumps.

ulimit -c unlimited; ./app

Output:

Segmentation fault (core dumped)

What it means: Core file for the developer.

Practise this in the tasks below: Practice tasks

Real use: A Yerawada OTT streaming team raised LimitNOFILE to 65535 on edge servers before a cricket final.

23. umask: Default permission mask

umask in depth: default permissions

Why do we need this?

New files on a shared folder come out readable by everyone, or a team cannot edit each other's files. The default mode is set by umask.

What is it?

umask removes permission bits from new files (base 666) and folders (base 777). 022 gives 644 and 755; 002 gives 664 and 775 for group work; 077 gives 600 and 700 for privacy. -S shows it as letters. Set it in ~/.bashrc or UMask= in systemd. Full permission detail is in the permissions chapter.

Common options

Option	What it does
`umask`	Show.
`-S`	Symbolic.
`umask 002`	Group writable.
`umask 077`	Private.
`UMask=0027`	systemd unit.

How to do it (step by step)

Current value.

umask

Output:

What it means: Files 644, folders 755.

Private session.

umask 077; touch secret.txt; ls -l secret.txt

Output:

-rw------- 1 ravi ravi 0 secret.txt

What it means: Only you can read.

Team folder.

umask 002; mkdir shared; ls -ld shared

Output:

drwxrwxr-x 2 ravi devs 6 shared

What it means: Group can write.

Letters.

umask -S

Output:

u=rwx,g=rwx,o=rx

What it means: Same as 002.

Practise this in the tasks below: Practice tasks

Real use: A Kondhwa law firm sets umask 077 for its document server so new case files are private by default.

24. umount: Detach a filesystem

umount in depth: detach filesystems

Why do we need this?

Before you detach an EBS volume, remove a USB disk or resize a partition, the filesystem must be unmounted cleanly.

What is it?

umount takes a mount point or device. "target is busy" means a process uses it: find it with lsof or fuser -m. -l lazy detaches now and cleans up later; -f forces NFS. Never pull a disk that is still mounted.

Common options

Option	What it does
`umount /data`	By mount point.
`umount /dev/xvdf1`	By device.
`-l`	Lazy.
`-f`	Force (NFS).
`fuser -vm /data`	Who is using it.

How to do it (step by step)

Try to unmount.

sudo umount /data

Output:

umount: /data: target is busy.

What it means: Something is still inside.

Find who.

sudo fuser -vm /data

Output:

                     USER        PID ACCESS COMMAND
/data:               ravi       3301 ..c.. bash

What it means: Your own shell sits in /data.

Leave and retry.

cd ~ && sudo umount /data && echo done

Output:

done

What it means: Unmounted cleanly.

Stale NFS.

sudo umount -f -l /mnt/nfs

What it means: Detached even though the NFS server is gone.

Practise this in the tasks below: Practice tasks

Real use: A Hadapsar media house unmounts its edit-suite disks with umount before the courier takes them to the client.

25. uname: Show kernel and system info

uname in depth: kernel and machine info

Why do we need this?

Is this server ARM or x86? Which kernel is running after the patch? Which binary should you download? uname answers.

What is it?

uname prints system info: -s kernel name, -r kernel release, -m machine hardware (x86_64, aarch64), -n hostname, -a everything. /etc/os-release tells the distribution, which uname does not.

Common options

Option	What it does
`-a`	All.
`-r`	Kernel release.
`-m`	Architecture.
`-n`	Hostname.
`-s`	Kernel name.

How to do it (step by step)

Everything.

uname -a

Output:

Linux web01 6.1.112-122.189.amzn2023.x86_64 #1 SMP x86_64 GNU/Linux

What it means: Amazon Linux 2023 kernel on x86_64.

After patching.

uname -r

Output:

6.1.115-126.197.amzn2023.x86_64

What it means: New kernel is running.

Right download.

uname -m

Output:

aarch64

What it means: Graviton: get the arm64 build.

Distribution.

grep PRETTY /etc/os-release

Output:

PRETTY_NAME="Amazon Linux 2023.6.20241010"

What it means: uname does not show this.

Practise this in the tasks below: Practice tasks

Real use: A Baner IoT company checks uname -m in its installer so the same script works on Raspberry Pi and x86 gateways.

26. Commands in this range already covered in depth

Why do we need this?

These commands already have a full why, what and how section in an earlier chapter. Repeating them here would only make the page longer.

What is it?

Each link opens the exact section with options, examples and output.

How to do it (step by step)

touch: Create empty files and change timestamps: -a, -m, -d and -r

27. Real examples from many industries

Why do we need this?

The same Linux skill shows up in every kind of company. Seeing it in many places helps you remember it.

What is it?

Each row is a made-up team. It shows who uses this and how.

How to do it (step by step)

Team and city	How they use it	Command
Kiran, payments, Hinjewadi	Traces missing files	`strace -e trace=openat ./app`
Swati, hospital IT, Shivajinagar	Watches PACS logs	`tail -F pacs.log`
Amit, e-commerce, Hadapsar	Restarts services	`systemctl restart api`
Priya, SaaS, Kharadi	Runs migrations in tmux	`tmux new -s migrate`
Rohan, CA office, Deccan	Weekly backups	`tar czf clients.tgz /srv/clients`
Anjali, OTT, Yerawada	Raises file limits	`LimitNOFILE=65535`

28. Common errors and how to fix them

Why do we need this?

Everyone hits these errors. Knowing the cause saves hours.

What is it?

Read the exact message first. Then match it to a row below.

How to do it (step by step)

Error you see	Why it happens	How to fix
`strace: attach: ptrace(PTRACE_SEIZE, 4120): Operation not permitted`	Not root or ptrace blocked	Run with sudo. `sudo strace -p 4120`
`su: Authentication failure`	Wrong target password or root has none	Use sudo su - or sudo -i. `sudo -i`
`ravi is not in the sudoers file. This incident will be reported.`	No sudo rights	Ask an admin to add you to wheel. `sudo usermod -aG wheel ravi`
`swapon: /swapfile: insecure permissions 0644, 0600 suggested.`	Swap file readable by others	chmod 600 it. `sudo chmod 600 /swapfile`
`sysctl: cannot stat /proc/sys/net/ipv4/ip_fwd: No such file or directory`	Wrong parameter name	Search the real name. `sysctl -a \| grep forward`
`Job for nginx.service failed because the control process exited with error code.`	Service failed to start	Read the journal. `journalctl -u nginx -n 30`
`tail: inotify cannot be used, reverting to polling`	Too many inotify watches	Raise max_user_watches. `sudo sysctl -w fs.inotify.max_user_watches=524288`
`tar: Exiting with failure status due to previous errors`	Some files unreadable	Read the earlier lines; run with sudo. `sudo tar czf b.tgz /etc`
`tee: /etc/hosts: Permission denied`	tee ran as you	Put sudo before tee. `echo x \| sudo tee -a /etc/hosts`
`[: too many arguments`	Unquoted variable with spaces	Quote the variable. `[ -z "$name" ]`
`umount: /data: target is busy.`	Process using the mount	Find and stop it. `fuser -vm /data`
`sessions should be nested with care, unset $TMUX to force`	Already inside tmux	Detach or use a new window. `tmux detach`

29. Troubleshooting step by step

Why do we need this?

When a Part 7 command does not do what you expect, go through these steps.

What is it?

Go top to bottom. Stop at the first step that shows the problem.

How to do it (step by step)

Are you the right user?

whoami; sudo -l

Is the service running?

systemctl status app

What did it log?

journalctl -u app -n 30

What does it touch?

sudo strace -f -e trace=file -p PID

Limits and kernel?

ulimit -a; sysctl -a | grep somaxconn

Disk or mount busy?

df -h; fuser -vm /data

30. Lab 1: Make a service, break it and fix it

Why do we need this?

Create a small systemd service, find why it fails with tail and strace, fix it and verify.

What is it?

A full hands-on lab. Run every step on a test Linux machine (an EC2 instance, a VM, or WSL).

How to do it (step by step)

Write a script.

printf "#!/bin/bash\nwhile true; do cat /etc/lab.conf; sleep 5; done\n" | sudo tee /usr/local/bin/lab.sh > /dev/null; sudo chmod +x /usr/local/bin/lab.sh

Create the unit.

printf "[Service]\nExecStart=/usr/local/bin/lab.sh\n" | sudo tee /etc/systemd/system/lab.service > /dev/null; sudo systemctl daemon-reload; sudo systemctl start lab

See the error.

journalctl -u lab -n 2 --no-pager

Output:

cat: /etc/lab.conf: No such file or directory

Fix and watch.

echo "mode=ok" | sudo tee /etc/lab.conf; journalctl -u lab -n 1 --no-pager

Output:

mode=ok

Clean up.

sudo systemctl stop lab; sudo rm /etc/systemd/system/lab.service /usr/local/bin/lab.sh /etc/lab.conf; sudo systemctl daemon-reload

31. Lab 2: Back up, time and guard a folder

Why do we need this?

Write a backup that checks conditions, times itself, logs with tee and runs in tmux.

What is it?

A full hands-on lab. Run every step on a test Linux machine (an EC2 instance, a VM, or WSL).

How to do it (step by step)

Start tmux.

tmux new -s backup

Guard.

[ -d /etc ] && [ "$(df --output=pcent /tmp | tail -1 | tr -dc 0-9)" -lt 90 ] && echo ok

Output:

ok

Back up and time it.

time sudo tar czf /tmp/etc.tgz /etc 2>&1 | tee /tmp/backup.log

Output:

real    0m1.204s

Verify.

tar tzf /tmp/etc.tgz | wc -l

Output:

Detach and clean.

tmux detach; rm /tmp/etc.tgz /tmp/backup.log

Ravindra Bagale's Tip

When something fails, read before you change: systemctl status, then tail the log, then strace. Change one thing at a time and note it with tee, so you can undo it.

32. Frequently asked questions

Q. su or sudo?

sudo: your own password, logged, limited. su needs the other password.

Q. tmux or screen?

tmux is newer with better panes; screen is everywhere on old systems.

Q. tail -f or -F?

-F keeps following after the log is rotated.

Q. Delete or truncate a full log?

Truncate if a process still writes it; delete does not free space until it closes.

Q. Is strace safe on production?

It slows the process a lot; use it briefly and with -e filters.

Q. which or type?

type knows aliases and functions; which only searches PATH.

33. Interview questions and answers

Beginner level

Q. How do you run one command as root?

sudo command.

Q. How do you see the last lines of a log?

tail -n 50 file.

Q. How do you check a service?

systemctl status name.

Q. How do you see the kernel version?

uname -r.

Mid level level

Q. Write a root-owned file from a pipe.

echo x | sudo tee file.

Q. Enable IP forwarding permanently.

File in /etc/sysctl.d then sysctl --system.

Q. Too many open files in nginx.

LimitNOFILE in a systemd override, restart.

Q. Disk full but rm freed nothing.

A process holds it open: truncate or restart, check lsof +L1.

Senior level

Q. A service fails with no log. Your approach?

status, journalctl -u, run ExecStart by hand as the service user, strace -f -e trace=file.

Q. Load is 12 on 4 CPUs. Next steps?

top for us vs wa, vmstat trend, then the top process or disk.

Q. Design sudo for a support team.

Group in /etc/sudoers.d with only needed commands, edited with visudo, logs reviewed.

Q. Backups must not fill the disk. How?

test the free space first, tar with exclude, time it, tee a log, cron it.

Try at home

Make a 1 GB swap file on a test VM and remove it afterwards.
Write a systemd unit for a tiny script and make it start at boot.
Use strace -c on ls -R / and note the top three system calls.
Back up your home folder with tar, excluding .cache, and list it.

Practice Tasks

About this scenario

Maple Leaf Books is a bookselling business in Toronto. Emily Tremblay looks after its IT and cloud work. They count money in CAD and run their AWS resources in the ca-central-1 Region. In the tasks below you do real jobs for them using what this lesson teaches. All names, account IDs, IP addresses and numbers are made up for practice.

0 / 24