31 Essential Linux Commands Every Developer Should Know

Whether you are troubleshooting a failing microservice, inspecting dropped packets, or automating remote backups, modern Linux administration leans heavily on a core set of command-line tools.

Here is a practical breakdown of 31 essential Linux commands, categorized by workflow, with practical flags and real-world examples.

---

1. Service & System Logs

systemctl

Inspect and control systemd system and service manager units.

# Check status of Nginx service
systemctl status nginx

# Enable service at boot and start immediately
sudo systemctl enable --now docker

journalctl

Query and inspect binary logs collected by systemd-journald.

# Jump to end with catalog explanations (essential for diagnosing service failures)
journalctl -xe

# Inspect failed unit with full context and explanations
journalctl -xeu docker.service

# Follow logs for specific unit in real time (last 100 entries)
journalctl -u nginx.service -n 100 -f

# Show error-level logs from current boot
journalctl -b -p err

dmesg

Print kernel ring buffer messages. Indispensable for tracking hardware events, disk controller errors, and Out Of Memory (OOM) killer terminations.

# Show human-readable timestamps and search for OOM killer invocations
sudo dmesg -T | grep -i -E "oom|out of memory|killed process"

# View recently attached storage devices
sudo dmesg -T | grep -i "attached"

---

2. Networking & Traffic Inspection

ss

Modern socket statistics utility replacing legacy netstat. Dumps active TCP, UDP, and UNIX socket information with process bindings.

# Show listening TCP/UDP sockets with numeric ports and owning process
sudo ss -tulnp

# Show established connections targeted at HTTPS port 443
ss -tn state established '( dport = :443 )'

ip

Configure network devices, interface IPs, routing tables, and ARP neighbors (replaces ifconfig and route).

# List all network interfaces and assigned IPs in concise format
ip -br addr show

# View routing table and default gateway
ip route show

ping

Check network layer reachability and latency between hosts using ICMP echo requests.

# Send 4 ICMP requests with 1-second timeout
ping -c 4 1.1.1.1

# Ping through explicit network interface
ping -c 3 -I eth0 192.168.1.1

tcpdump

Packet analyzer capturing raw network frames matching Berkeley Packet Filter (BPF) syntax.

# Capture 20 packets on eth0 on port 80 or 443 without DNS resolution
sudo tcpdump -i eth0 -nn -c 20 "port 80 or port 443"

# Save network traffic to PCAP file for Wireshark inspection
sudo tcpdump -i eth0 -w /tmp/traffic.pcap "tcp port 22"

---

3. Storage & Filesystem Management

df

Report filesystem disk space usage and inode availability.

# View disk usage in human-readable sizes (GB/MB) with filesystem types
df -hT

# Check inode consumption (crucial when disk shows full but space is available)
df -hi

du

Estimate file and folder space usage recursively.

# List human-readable sizes of immediate home items, sorted ascending by size
du -sh ~/* | sort -h

# Find 10 largest subdirectories inside /var/log
sudo du -h --max-depth=1 /var/log | sort -hr | head -n 10

# Total summarized size of single directory
du -sh /var/lib/docker

ncdu

NCurses disk usage analyzer. Provides a fast, interactive terminal browser to navigate disk consumption by directory.

# Interactively explore home directory disk consumption
ncdu ~

# Scan root filesystem while excluding remote mounts and virtual filesystems
sudo ncdu -x /

find

Search for files and directories across a filesystem tree based on name, size, type, or modification time.

# Search current directory recursively for matching filename
find . -name "filename"

# Case-insensitive search for config files modified in the last 24 hours
find /etc -iname "*.conf" -mtime -1

# Find files larger than 100MB and list their human-readable sizes
find /var/log -type f -size +100M -exec ls -lh {} +

lsblk

List block devices in a clear tree hierarchy, showing disks, partitions, mount points, and UUIDs.

# List block devices with filesystem types and mount points
lsblk -f

# Output custom columns including sizes and UUIDs
lsblk -o NAME,SIZE,TYPE,FSTYPE,MOUNTPOINT,UUID

mount

Attach storage devices and partitions to specific mount points in the filesystem tree.

# Mount ext4 partition as read-only
sudo mount -o ro /dev/sdb1 /mnt/data

# Remount root partition in read-write mode
sudo mount -o remount,rw /

fdisk

Disk partition table manipulator for MBR and GPT partition layouts.

# List partitions on specific drive non-interactively
sudo fdisk -l /dev/nvme0n1

# Launch interactive partition editor on disk
sudo fdisk /dev/sdb

---

4. Performance & System Monitoring

free

Display physical RAM and swap memory allocation.

# Human-readable wide format showing buffers and cache breakdown
free -m -w

# Memory summary in gigabytes
free -h --total

vmstat

Report virtual memory, processes, CPU utilization, I/O wait, and paging statistics.

# Sample system stats every 2 seconds for 5 intervals with timestamp
vmstat -t 2 5

# Display memory stats in megabytes
vmstat -S M

inxi

Full-featured CLI system information tool. Dumps detailed hardware specs, kernel versions, GPU drivers, audio, and networking details with sensitive data masked.

# Display comprehensive system summary with extra detail and privacy filtering
inxi -Fxxxz

sensors

Read hardware monitoring chips (lm-sensors) for real-time CPU core temperatures, fan RPMs, and motherboard voltages.

# Query active hardware sensors and temperatures
sensors

# Watch temperature sensors update continuously every 2 seconds
watch -n 2 sensors

htop and btop

Interactive process managers and resource dashboards offering visual meters, tree views, mouse support, and detailed container/GPU tracking.

# Launch interactive process viewer with per-core CPU and memory meters
htop

# Launch modern terminal resource dashboard (CPU, memory, disks, network, processes)
btop

lsof

List open files, process descriptors, Unix pipes, and network sockets.

# Find which process is listening on or using port 8080
sudo lsof -i :8080

# List files opened by specific user
sudo lsof -u www-data

uptime

Display current time, running uptime duration, active user sessions, and 1-, 5-, and 15-minute load averages.

# Standard uptime and load averages
uptime

# Pretty duration output
uptime -p

---

5. User & Account Administration

useradd

Low-level command to provision new user accounts.

# Create user with home directory, default bash shell, and supplementary groups
sudo useradd -m -s /bin/bash -G sudo,docker deployer

usermod

Modify configuration attributes of existing user accounts.

# Append user to supplementary group without removing existing groups (-aG)
sudo usermod -aG docker ubuntu

# Lock user account to prevent login
sudo usermod -L baduser

passwd

Update and manage user authentication passwords.

# Set password for specified user
sudo passwd deployer

# Force user to change password on next interactive login
sudo passwd -e deployer

chage

Configure password aging and account expiration policies.

# View password expiration and warning status
sudo chage -l deployer

# Require password rotation every 90 days with 7-day advance warning
sudo chage -M 90 -W 7 deployer

---

6. Automation, Remote Access & Transfers

crontab

Schedule recurring background cron jobs.

# Edit active user's cron table
crontab -e

# Example schedule entry: run daily backup at 02:30 AM
# 30 2 * * * /usr/local/bin/backup.sh >> /var/log/backup.log 2>&1

# List active scheduled jobs
crontab -l

rsync

Fast remote and local file-synchronization tool utilizing a delta-transfer algorithm.

# Sync local directory to remote host with archive mode, compression, and progress
rsync -avzP --delete /var/www/html/ deployer@192.168.1.10:/var/www/html/

# Perform dry run before executing changes
rsync -avzPn /src/ /dest/

ssh

Secure Shell client for encrypted terminal sessions and remote execution.

# Connect using specific SSH key and custom port
ssh -i ~/.ssh/prod_key.pem -p 2222 admin@app.example.com

# Execute remote command non-interactively
ssh admin@app.example.com "systemctl status postgresql"

scp

Copy files between hosts securely over SSH transport.

# Upload local file to remote server
scp -P 2222 ./nginx.conf admin@app.example.com:/etc/nginx/nginx.conf

# Recursively download remote directory
scp -r admin@app.example.com:/var/log/app/ ./local_logs/

wget

Non-interactive network downloader supporting HTTP, HTTPS, and FTP protocols, with resume capability and recursive downloading.

# Download a file from a URL to the current directory
wget URL

# Download remote file with custom output filename and resume support
wget -c -O package.tar.gz https://example.com/package.tar.gz

# Download in the background and log output to file
wget -b -o wget.log https://example.com/largefile.iso

---

7. Security & Firewall

ufw

Uncomplicated Firewall — simplified management interface for Linux netfilter (iptables/nftables).

# Set default policies and enable firewall
sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw enable

# Allow SSH and HTTPS traffic
sudo ufw allow OpenSSH
sudo ufw allow 443/tcp

# View active firewall rules with index numbers
sudo ufw status numbered

---

Summary Matrix

Category	Commands	Common Use Case
Services & Logs	systemctl, journalctl, dmesg	Manage daemons, inspect service & kernel boot messages
Networking	ss, ip, ping, tcpdump	Sockets, network routing, packet capture & latency
Storage & Search	df, du, ncdu, find, lsblk, mount, fdisk	Disk capacity, tree sizes, interactive disk usage, file search
Performance & Hardware	free, vmstat, htop, btop, sensors, inxi, lsof, uptime	Resource visualization, hardware specs, sensors, I/O bottlenecks
User Administration	useradd, usermod, passwd, chage	User creation, group membership, password aging rules
Automation & Remote	crontab, rsync, ssh, scp, wget	Scheduled tasks, delta backups, remote access, web downloads
Security	ufw	Host port filtering & inbound rule configuration