Instantly share code, notes, and snippets.

What would you like to do?
Linux Sysadmin Cheatsheet

Process Info

$ netstat -tulpn | grep web
tcp        0      0 :::80                       :::*                        LISTEN      10308/web
tcp        0      0 :::443                      :::*                        LISTEN      10308/web
$ ps aux | grep 10308
root     10308  0.2  0.4 318324 35332 ?        Sl   Sep22   4:20 web
root     28406  0.0  0.0 110472  2032 pts/0    S+   09:01   0:00 grep --color=auto 10308
$ ps -p 10308
10308 ?        00:04:20 web

Files Open per Process:

$ lsof -p 10308
$ tail -f /proc/10308/fd/1
$ tail -f /proc/10308/fd/2
$ strace -e trace=open -p 22254 -s 80 -o output.txt

Top 10 CPU:

$ ps aux --sort -%cpu | head -10
$ ps -eo pid,ppid,cmd,%mem,%cpu --sort=-%cpu | head

Top 10 Memory:

$ ps aux --sort -rss | head -10 | sort -rn
$ ps -eo pid,ppid,cmd,%mem,%cpu --sort=-%mem | head

Disk: I/O

$ iostat -x 1 3

Using Sysstat Package:

  • tps: Transactions per second (this includes both read and write)
  • rtps: Read transactions per second
  • wtps: Write transactions per second
  • bread/s: Bytes read per second
  • bwrtn/s: Bytes written per second
$ sar -b 1 3


vmstat - information about processes, memory, paging, block IO, traps, and cpu activity

$ vmstat 1 2
procs -----------memory---------- ---swap-- -----io---- --system-- -----cpu-----
 r  b   swpd   free   buff  cache   si   so    bi    bo   in   cs us sy id wa st
 0  0      0 1149460      0 271616    0    0    12     8    0    0  0  0 99  0  0
 0  0      0 1149456      0 271616    0    0     0     0    0 1635  0  0 100  0  0

Connection Related:

Connection flow: Thanks:

Consider two programs attempting a socket connection (call them a and b). Both set up sockets and transition to the LISTEN state. Then one program (say a) tries to connect to the other (b). a sends a request and enters the SYN_SENT state, and b receives the request and enters the SYN_RECV state. When b acknowledges the request, they enter the ESTABLISHED state, and do their business. Now a couple of things can happen:

    a wishes to close the connection, and enters FIN_WAIT1. b receives the FIN request, sends an ACK (then a enters FIN_WAIT2), enters CLOSE_WAIT, tells a it is closing down and the enters LAST_ACK. Once a acknowledges this (and enters TIME_WAIT), b enters CLOSE. a waits a bit to see if anythings is left, then enters CLOSE.

    a and b have finished their business and decide to close the connection (simultaneous closing). When a is in FIN_WAIT, and instead of receiving an ACK from b, it receives a FIN (as b wishes to close it as well), a enters CLOSING. But there are still some messages to send (the ACK that a is supposed to get for its original FIN), and once this ACK arrives, a enters TIME_WAIT as usual.

Active Connections:

$ netstat -n -A  inet | grep -v ""

Established Connections:

$ netstat -nputw | grep ESTABLISHED
$ netstat -antp | grep :3306 | grep ESTABLISHED

Time Wait Connections:

$ netstat -antp | grep TIME_WAIT

How many connections:

$ wc -l /proc/net/tcp

Listing Open files per Port:

$ lsof -i:3306

Listing Open files per User:

$ lsof -u glassfish

Tools to get Info:

Disk Space:

$ df -h


$ free -m

Used Space in Dir:

$ du -h


Query A Record:

$ dig A

Turn Off Authority Section:

$ dig +noauthority 

Remove Stats Section:

$ dig +nostats

Only the Answer:

$ dig +short


$ dig +trace

Notify all users logged onto a Linux Server:

$ wall "we will be rebooting this server at 4pm"

Send text to a users screen:

$ write ruan

Talk to user:

$ talk ruan

Handy tools:

Generate Passwords:

$ mkpasswd -l 15

$ openssl rand -base64 15

One Liners

Remove empty lines with awk:

$ cat aaa | grep -v Links | awk 'NF > 0'
Worms Ultimate Mayhem
Zero Gear


Replace a word foo with bar in sed:

$ sed -i 's/foo/bar/'g file.txt

Remove a word and remove the empty line with sed:

$ sed -i -e 's/dash//' -e '/^$/d' hist

Backups using DD:

Backup Entire Disk:

$ dd if=/dev/sda of=/dev/sdb

Create Image of a Hard Disk:

$ dd if=/dev/hda of=~/hdadisk.img

Restore to Disk from Image:

$ dd if=hdadisk.img of=/dev/hdb

Backup Partition to Image:

$ dd if=/dev/hda1 of=~/partition1.img

Backups using rsync:

Sync 2 directories with each other, src to dest:

$ rsync -zvr /opt/foo/ /tmp/bar

Sync, but keep the original timestamps:

$ rsync -azv  /opt/foo/ /tmp/bar

Sync only one file:

$ rsync -v /opt/foo/file.txt /tmp/bar/

Sync files from local to remote:

$ rsync -avz /opt/foo/ user@

Sync from remote to local:

$ rsync -avz user@ /opt/foo/

Sync all, but skip files that was modified at the destination:

$ rsync -avzu thegeekstuff@ /root/temp

Sync only directory structure, not files:

$ rsync -v -d user@ .

Include/Exclude during Sync:

$ rsync -avz --include 'P*' --exclude '*' user@ /root/temp/

C Language:

Simple C Program:


#include <stdio.h>
int main()
printf("Hello world\n");
return 0;

compile with gcc

$ gcc -o hello hello.c


$ ./hello
Hello world

Simple C++ Program:


#include <iostream>
using namespace std;
int main() 
int a;
int b;
cout<<"Enter first number:\n";
cin >> a;
cout <<"Enter the second number:\n";
cin>> b;
int result = a + b;
cout<<"Result is"<<"  "<<result<<endl;
return 0;

compile with g++

$ g++ -o count count.cpp


$ ./count
Enter first number:
Enter the second number:
Result is  50

Java App:

class ruan {
    public static void main(String[] arguments) {
        System.out.println("Hello Ruan");

class james {
    public static void main(String[] arguments) {
        System.out.println("Hello James");


$ javac


$ java ruan
Hello Ruan

$ java james
Hello James
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment