Linux Commands A-Z Part 8: uniq, useradd, usermod, vim, vmstat, xargs, yum, zcat and More with Examples

uniq in depth: remove and count duplicates

Why do we need this?

Which IP hit the site most? How many orders per city? Which error repeats? Sort the lines, then uniq -c counts them.

What is it?

uniq removes adjacent duplicate lines, so input is usually sorted first. -c prefixes counts, -d shows only duplicated lines, -u only unique ones, -i ignores case, -f N skips fields. sort -u is a shortcut when you only need unique lines.

Common options

How to do it (step by step)

1. Top IPs.

cut -d" " -f1 access.log | sort | uniq -c | sort -rn | head -3

Output:

   4210 49.36.12.8
    980 103.21.4.7
    120 10.0.1.5

What it means: One IP sends most traffic; check if it is a bot.

2. Orders per city.

cut -d, -f2 orders.csv | sort | uniq -c

Output:

  310 Mumbai
  452 Pune

What it means: Pune leads.

3. Duplicated user ids.

sort ids.txt | uniq -d

Output:

u1042

What it means: One id appears twice: a data bug.

4. Without sort.

printf "a\nb\na\n" | uniq

Output:

a
b
a

What it means: Not adjacent, so not removed: sort first.

Practise this in the tasks below: Practice tasks

uptime in depth: how long and how loaded

Why do we need this?

Did the server reboot last night? Is it overloaded right now? uptime answers in one line.

What is it?

uptime prints current time, how long since boot, logged-in users and load average for 1, 5 and 15 minutes. Compare load with the CPU count (nproc): load above it means work is queuing. -p pretty format, -s boot time.

Common options

How to do it (step by step)

1. Check.

uptime

Output:

 11:42:10 up 41 days,  3:10,  2 users,  load average: 0.42, 0.51, 0.48

What it means: Stable, light load.

2. Rebooted?

uptime -s

Output:

2026-10-27 02:13:44

What it means: It restarted at 2:13 AM: find out why.

3. Overloaded?

uptime; nproc

Output:

load average: 9.80, 8.40, 6.10
4

What it means: Load 9.8 on 4 CPUs: work is queuing.

4. Pretty.

uptime -p

Output:

up 6 weeks, 2 days, 3 hours

What it means: Easy for a report.

Practise this in the tasks below: Practice tasks

useradd in depth: create users

Why do we need this?

A new developer joins, or an app needs its own service account. Create it properly with a home, shell and groups.

What is it?

useradd creates an account. -m makes the home folder, -s sets the shell, -G adds extra groups, -c a comment, -u a UID, -r a system account, -e an expiry date. Then set a password with passwd or add an SSH key.

Common options

How to do it (step by step)

1. A developer.

sudo useradd -m -s /bin/bash -G devs -c "Sneha Patil" sneha; id sneha

Output:

uid=1005(sneha) gid=1005(sneha) groups=1005(sneha),1002(devs)

What it means: Home, shell and group ready.

2. Set a first password.

sudo passwd sneha

Output:

passwd: all authentication tokens updated successfully.

What it means: She can log in.

3. A service account.

sudo useradd -r -s /sbin/nologin -d /srv/billing billing

What it means: No login shell: safer.

4. A contractor with expiry.

sudo useradd -m -e 2026-12-31 vendor1; sudo chage -l vendor1 | grep "Account expires"

Output:

Account expires						: Dec 31, 2026

What it means: Locks itself at year end.

Practise this in the tasks below: Practice tasks

userdel in depth: remove users

Why do we need this?

When someone leaves, their account must go, but their files may be needed for audit. Decide first, then remove.

What is it?

userdel removes an account. -r also removes the home folder and mail spool. It refuses if the user is logged in; -f forces. Files elsewhere stay with a bare UID owner; find them with find / -nouser. Locking (usermod -L) is often safer first.

Common options

How to do it (step by step)

1. Back up the home.

sudo tar czf /backup/amit-home.tgz /home/amit

What it means: Kept for audit.

2. Remove with home.

sudo userdel -r amit

What it means: Account and home gone.

3. Still logged in.

sudo userdel -r rahul

Output:

userdel: user rahul is currently used by process 4410

What it means: End the session first.

4. Find leftovers.

sudo find / -xdev -nouser 2>/dev/null | head -2

Output:

/srv/reports/q3.xlsx
/tmp/amit-test

What it means: Give these to a new owner.

Practise this in the tasks below: Practice tasks

usermod in depth: change users

Why do we need this?

Someone moves to the DevOps team, needs docker access, changes name or goes on long leave. usermod changes an existing account.

What is it?

usermod -aG adds groups (always use -a with -G, or other groups are removed). -L locks, -U unlocks, -s changes the shell, -d -m moves the home, -l renames, -e sets expiry. Group changes apply at next login.

Common options

How to do it (step by step)

1. Give docker access.

sudo usermod -aG docker sneha; id -nG sneha

Output:

sneha devs docker

What it means: Works after she logs in again.

2. The -a mistake.

sudo usermod -G docker raj; id -nG raj

Output:

raj docker

What it means: devs was removed: always use -aG.

3. Lock during leave.

sudo usermod -L priya; sudo passwd -S priya

Output:

priya LK 2026-10-27 0 99999 7 -1 (Password locked.)

What it means: Locked, files untouched.

4. Unlock on return.

sudo usermod -U priya

What it means: Access back.

Practise this in the tasks below: Practice tasks

vgcreate in depth: build an LVM volume group

Why do we need this?

You want one big flexible storage pool from several disks, so volumes can grow later without downtime. That pool is a volume group.

What is it?

vgcreate makes a volume group from physical volumes (pvcreate, Part 5). vgs and vgdisplay show it, vgextend adds a disk, vgreduce removes one. Then lvcreate (Part 4) carves logical volumes from it.

Common options

How to do it (step by step)

1. Prepare disks.

sudo pvcreate /dev/xvdf /dev/xvdg

Output:

  Physical volume "/dev/xvdf" successfully created.
  Physical volume "/dev/xvdg" successfully created.

What it means: Two PVs.

2. Create the group.

sudo vgcreate vgdata /dev/xvdf /dev/xvdg

Output:

  Volume group "vgdata" successfully created

What it means: A 200 GB pool.

3. Check it.

sudo vgs

Output:

  VG     #PV #LV #SN Attr   VSize   VFree
  vgdata   2   0   0 wz--n- 199.99g 199.99g

What it means: All free for volumes.

4. Grow it later.

sudo pvcreate /dev/xvdh && sudo vgextend vgdata /dev/xvdh

Output:

  Volume group "vgdata" successfully extended

What it means: 300 GB, no downtime.

Practise this in the tasks below: Practice tasks

vim in depth: edit files on any server

Why do we need this?

Every Linux server has vi or vim, even with no GUI. You must be able to open a config, change a line, save and quit.

What is it?

vim has modes. Normal mode moves and edits (dd delete line, yy copy, p paste, u undo, /text search, gg top, G bottom). i enters Insert mode, Esc returns. Commands start with : like :w save, :q quit, :wq save and quit, :q! quit without saving, :%s/a/b/g replace, :set number.

Common options

How to do it (step by step)

1. Open at an error line.

vim +42 /etc/nginx/nginx.conf

Output:

(cursor on line 42)

What it means: Straight to the problem.

2. Change and save.

i ... Esc :wq

Output:

"/etc/nginx/nginx.conf" 88L, 2410B written

What it means: Saved.

3. Replace a port everywhere.

:%s/8080/9090/g

Output:

3 substitutions on 3 lines

What it means: All three changed.

4. Read-only file.

:w

Output:

E45: 'readonly' option is set (add ! to override)

What it means: Open with sudo instead.

Practise this in the tasks below: Practice tasks

vmstat in depth: memory, CPU and IO over time

Why do we need this?

top shows a moment; vmstat shows a trend every few seconds, so you see swapping, IO wait or CPU queues build up.

What is it?

vmstat DELAY COUNT prints rows: r runnable processes, b blocked, swpd and free memory, si/so swap in/out, bi/bo block IO, us sy id wa st CPU. The first row is the average since boot. -S M shows megabytes, -w wide.

Common options

How to do it (step by step)

1. Watch for 10 seconds.

vmstat -S M 2 5

Output:

procs ---memory--- --swap-- ---io--- ----cpu----
 r  b swpd free  si  so  bi  bo us sy id wa st
 1  0    0  812   0   0  10  40  8  2 89  1  0

What it means: Healthy: low wa, no swapping.

2. Memory pressure.

vmstat 2 3 | tail -1

Output:

 3  2 1024  60 450 620  900 1200 20 10 30 40  0

What it means: High si/so: the box is swapping.

3. CPU queue.

vmstat 1 3 | tail -1

Output:

 14  0 0 2000 0 0 0 5 95 5 0 0 0

What it means: 14 waiting on 4 CPUs: add CPU or fix the hot loop.

4. Log a trend.

vmstat -t 60 60 > vm-hour.log

What it means: One hour, timestamped.

Practise this in the tasks below: Practice tasks

w in depth: who is on and what they run

Why do we need this?

Before a reboot, check who is logged in and what they are doing, so you do not cut a colleague's migration.

What is it?

w shows uptime and load like uptime, then one row per session: user, TTY, from where, login time, idle time and current command. -h hides the header, -s short format. who gives less detail; last shows history.

Common options

How to do it (step by step)

1. Before a reboot.

w

Output:

11:55:02 up 41 days,  2 users,  load average: 0.30, 0.25, 0.20
USER  TTY   FROM        LOGIN@  IDLE  WHAT
ravi  pts/0 10.0.0.12   11:40   0.00s w
meena pts/1 10.0.0.31   10:02   2.00s psql billing

What it means: Meena is in psql: ask first.

2. One user.

w -h meena

Output:

meena pts/1 10.0.0.31 10:02 2.00s psql billing

What it means: Same row, no header.

3. Warn everyone.

sudo wall "Reboot at 12:30 for kernel patch"

Output:

Broadcast message from ravi@web01 (pts/0): Reboot at 12:30 for kernel patch

What it means: Everyone sees it.

4. Idle sessions.

w -h | awk "\$5 ~ /days/"

Output:

test pts/3 10.0.0.9 Mon10 3days -bash

What it means: A forgotten session.

Practise this in the tasks below: Practice tasks

watch in depth: repeat a command and see changes

Why do we need this?

Waiting for a pod to become Ready, a disk to fill or a queue to drain? watch reruns the command every few seconds.

What is it?

watch runs a command every 2 seconds full screen. -n sets the interval, -d highlights differences, -t hides the header, -g exits when output changes, -e exits on error. Quote commands with pipes.

Common options

How to do it (step by step)

1. Watch disk.

watch -n 5 df -h /data

Output:

Every 5.0s: df -h /data
/dev/xvdf  100G  71G  29G  71% /data

What it means: Updates live during the copy.

2. Highlight changes.

watch -d "ss -tn state established | wc -l"

Output:

143

What it means: Connection count changes are highlighted.

3. Stop when done.

watch -g -n 10 "kubectl get pod api-0 | tail -1"

Output:

api-0  1/1  Running

What it means: Exits once the pod changes state.

4. Queue drain.

watch -n 30 "redis-cli llen jobs"

Output:

(integer) 1240

What it means: Count falls as workers finish.

Practise this in the tasks below: Practice tasks

wc in depth: count lines, words and bytes

Why do we need this?

How many errors today? How many users in the CSV? How big is the payload? wc counts.

What is it?

wc prints lines, words and bytes. -l lines only, -w words, -c bytes, -m characters (multi-byte aware), -L longest line. With many files it adds a total. Reading from a pipe prints only the number.

Common options

How to do it (step by step)

1. Count errors.

grep -c ERROR app.log; grep ERROR app.log | wc -l

Output:

57
57

What it means: Same result two ways.

2. Rows in a CSV.

wc -l users.csv

Output:

1001 users.csv

What it means: 1000 users plus a header.

3. Many files.

wc -l *.log

Output:

  120 api.log
  340 web.log
  460 total

What it means: Total at the end.

4. Marathi text.

echo "पुणे" | wc -c; echo "पुणे" | wc -m

Output:

13
5

What it means: Bytes and characters differ for Devanagari.

Practise this in the tasks below: Practice tasks

whereis in depth: binary, source and man page

Why do we need this?

Is a tool installed at all, and where is its man page? whereis searches standard system folders.

What is it?

whereis lists the binary, source and manual files for a name from standard locations, not your PATH. -b binaries only, -m man pages only, -s sources. It does not see aliases or functions; use type for that.

Common options

How to do it (step by step)

1. Find a tool.

whereis nginx

Output:

nginx: /usr/sbin/nginx /usr/share/nginx /usr/share/man/man8/nginx.8.gz

What it means: Binary and man page.

2. Not installed.

whereis htop

Output:

htop:

What it means: Nothing found: install it.

3. Man page only.

whereis -m crontab

Output:

crontab: /usr/share/man/man1/crontab.1.gz /usr/share/man/man5/crontab.5.gz

What it means: Two sections exist.

4. Binary only.

whereis -b python3

Output:

python3: /usr/bin/python3 /usr/local/bin/python3

What it means: Two copies on disk.

Practise this in the tasks below: Practice tasks

which in depth: the file PATH will run

Why do we need this?

Two Java versions are installed and the wrong one runs. which shows the first match on PATH.

What is it?

which prints the full path of the command that PATH resolves first. -a shows all matches. It is an external program, so it may miss aliases and functions; type and command -v are more exact in scripts.

Common options

How to do it (step by step)

1. Which java?

which java

Output:

/usr/bin/java

What it means: The system Java runs.

2. All of them.

which -a java

Output:

/usr/bin/java
/opt/jdk-21/bin/java

What it means: JDK 21 is later on PATH.

3. Fix PATH.

export PATH=/opt/jdk-21/bin:$PATH; which java

Output:

/opt/jdk-21/bin/java

What it means: Now JDK 21 wins.

4. Script check.

command -v docker >/dev/null || echo "install docker"

Output:

install docker

What it means: Missing tool detected.

Practise this in the tasks below: Practice tasks

who in depth: logged-in users and boot

Why do we need this?

Quick check: who is logged in, from where, and when did the system boot?

What is it?

who lists logged-in sessions with terminal, login time and source. -b last boot time, -r run level, -q names and count, -H headers. who am i shows your own session. w adds what each user runs.

Common options

How to do it (step by step)

1. Who is on?

who

Output:

ravi   pts/0  2026-10-27 11:40 (10.0.0.12)
meena  pts/1  2026-10-27 10:02 (10.0.0.31)

What it means: Two people.

2. Last boot.

who -b

Output:

         system boot  2026-09-16 08:31

What it means: Up since mid-September.

3. Count.

who -q

Output:

ravi meena
# users=2

What it means: Two sessions.

4. My session.

who am i

Output:

ravi  pts/0  2026-10-27 11:40 (10.0.0.12)

What it means: Your IP shows.

Practise this in the tasks below: Practice tasks

whoami in depth: which user am I

Why do we need this?

After sudo, su or inside a container, it is easy to forget which user you are. Scripts also need to refuse to run as root, or insist on it.

What is it?

whoami prints the effective user name. id -un is the same; id shows UID, groups too. In scripts compare $(id -u) with 0 to detect root.

Common options

How to do it (step by step)

1. Who am I?

whoami

Output:

ravi

What it means: Your own user.

2. With sudo.

sudo whoami

Output:

root

What it means: Commands run as root.

3. Root guard.

[ "$(id -u)" -eq 0 ] || { echo "run as root"; exit 1; }

Output:

run as root

What it means: Script stops early.

4. In a container.

docker run --rm alpine whoami

Output:

root

What it means: Containers often default to root: set USER.

Practise this in the tasks below: Practice tasks

xargs in depth: turn lines into arguments

Why do we need this?

find gives a list of files and you want to delete, compress or copy each. xargs feeds the list to a command, in batches or in parallel.

What is it?

xargs reads items from stdin and runs a command with them as arguments. -0 pairs with find -print0 for safe names with spaces, -n sets items per run, -P runs in parallel, -I {} places the item anywhere, -r skips running on empty input, -t prints each command.

Common options

How to do it (step by step)

1. Compress old logs.

find /var/log/app -name "*.log" -mtime +7 -print0 | xargs -0 -r gzip -v

Output:

api-2026-10-12.log:  88.1% -- replaced with api-2026-10-12.log.gz

What it means: Safe with spaces, nothing runs if empty.

2. Parallel pings.

cat hosts.txt | xargs -P 8 -I {} ping -c1 -W1 {}

Output:

64 bytes from 10.0.1.5: icmp_seq=1 ttl=64 time=0.4 ms

What it means: Eight at a time.

3. Placeholder.

ls *.csv | xargs -I {} cp {} /backup/{}.bak

What it means: Each file copied with a new name.

4. See what runs.

echo a b c | xargs -n 1 -t echo

Output:

echo a
a
echo b
b
echo c
c

What it means: One run per item.

Practise this in the tasks below: Practice tasks

xz in depth: strongest common compression

Why do we need this?

Archiving a year of logs or shipping a big release, you want the smallest file and do not mind waiting longer. xz gives that.

What is it?

xz compresses a file to .xz and removes the original; -d or unxz decompresses, -k keeps the original, -0 to -9 sets level, -T0 uses all CPUs, -l lists ratio, xzcat reads without extracting. tar cJf makes .tar.xz. Detailed comparison is in the compression chapter.

Common options

How to do it (step by step)

1. Compress, keep original.

xz -k -T0 audit-2025.log; ls -lh audit-2025.log*

Output:

-rw-r--r-- 1 ravi ravi 2.1G audit-2025.log
-rw-r--r-- 1 ravi ravi  96M audit-2025.log.xz

What it means: About 22 times smaller.

2. Ratio.

xz -l audit-2025.log.xz | tail -1

Output:

    1       1     95.8 MiB  2,048.0 MiB  0.047  CRC64  audit-2025.log.xz

What it means: 4.7% of the original.

3. Read without extracting.

xzcat audit-2025.log.xz | grep -c "login failed"

Output:

3120

What it means: Search a compressed archive.

4. Tar with xz.

tar cJf release-4.2.tar.xz release/

What it means: Smallest release download.

Practise this in the tasks below: Practice tasks

yes in depth: repeat an answer or make load

Why do we need this?

An old installer keeps asking "Continue? [y/N]". yes answers for you. It can also make quick test data or CPU load.

What is it?

yes prints y (or any text you give) forever until stopped. Pipe it into a prompting command, cut it with head -n for N lines, or run it to load one CPU core. Prefer a tool's own -y flag when it has one.

Common options

How to do it (step by step)

1. Answer prompts.

yes | ./legacy-install.sh | tail -1

Output:

Install complete.

What it means: Every prompt got y.

2. Test lines.

yes "order,Pune,100" | head -n 3

Output:

order,Pune,100
order,Pune,100
order,Pune,100

What it means: Quick test data.

3. Load a CPU.

yes > /dev/null & top -b -n 1 | grep yes

Output:

4512 ravi 20 0 8.3m 1.8m R 99.7 0.0 yes

What it means: One core at 100% to test alerts.

4. Stop it.

kill %1

Output:

[1]+  Terminated  yes > /dev/null

What it means: Load gone.

Practise this in the tasks below: Practice tasks

yum in depth: packages on older Red Hat systems

Why do we need this?

Amazon Linux 2, CentOS 7 and RHEL 7 still run many production servers. Their package tool is yum; on newer systems yum is an alias for dnf.

What is it?

yum install, remove, update and search manage RPM packages with dependencies; info shows details, list installed lists them, provides finds which package owns a file, history shows and undoes transactions, -y answers yes. Same commands as dnf (Part 2).

Common options

How to do it (step by step)

1. Install.

sudo yum install -y httpd

Output:

Installed:
  httpd-2.4.62-1.amzn2.x86_64
Complete!

What it means: Apache installed.

2. Which package has a file?

yum provides "*/bin/dig"

Output:

bind-utils-9.11.4-26.P2.amzn2.13.x86_64 : Utilities for querying DNS name servers

What it means: Install bind-utils for dig.

3. History.

sudo yum history | head -4

Output:

ID | Command line   | Date and time    | Action(s)
 42 | update         | 2026-10-27 02:00 | Update

What it means: Last night's update is 42.

4. Undo it.

sudo yum history undo 42 -y

Output:

Complete!

What it means: Packages back to before.

Practise this in the tasks below: Practice tasks

zcat in depth: read gzip files without extracting

Why do we need this?

Rotated logs are .gz. To search last week's errors you do not want to extract gigabytes to disk first.

What is it?

zcat prints the decompressed content of .gz files to stdout and leaves them compressed. zgrep searches, zless pages, zdiff compares. -f also passes plain files through. xzcat and bzcat do the same for .xz and .bz2.

Common options

How to do it (step by step)

1. Read a rotated log.

zcat /var/log/messages-20261020.gz | head -1

Output:

Oct 14 00:00:01 web01 systemd[1]: Started Daily rotation of log files.

What it means: No extraction needed.

2. Count errors in a week.

zcat app.log.*.gz | grep -c ERROR

Output:

812

What it means: Across all rotated files.

3. Search directly.

zgrep -h "order 5512" app.log.3.gz

Output:

2026-10-24 18:02:11 order 5512 payment timeout

What it means: Found the old incident.

4. Mixed files.

zcat -f app.log app.log.1.gz | wc -l

Output:

91240

What it means: Plain and gzip together.

Practise this in the tasks below: Practice tasks