# See disk usage per top-level directory
du -sh /* 2>/dev/null | sort -rh | head -15

# Find the largest files in /var/log
find /var/log -type f -exec du -h {} + | sort -rh | head -10

# Check what's mounted where
df -hT

   Owner   Group   Others
    rwx     rwx     rwx
    |||     |||     |||
    |||     |||     ||└─ execute (enter directory / run file)
    |||     |||     |└── write (modify file / create files in dir)
    |||     |||     └─── read (view contents / list directory)
    (same pattern for owner and group)

# Numeric mode
chmod 755 script.sh         # Owner: rwx, Group: r-x, Others: r-x
chmod 600 id_ed25519        # Owner: rw-, others: nothing

# Symbolic mode
chmod u+x script.sh         # Add execute for owner
chmod g-w file.txt          # Remove write for group
chmod o= file.txt           # Remove all permissions for others
chmod a+r file.txt          # Add read for all (a = all)

# Recursive
chmod -R 755 /var/www/html/ # Apply to directory and all contents

chown alice file.txt              # Change owner to alice
chown alice:developers file.txt   # Change owner and group
chown -R www-data:www-data /var/www/  # Recursive
chown :developers file.txt        # Change group only

# Check current umask
umask

# Set temporarily
umask 027

# Set permanently (add to ~/.bashrc or /etc/profile)
echo "umask 027" >> ~/.bashrc

# Setuid (passwd runs as root regardless of who calls it)
ls -la /usr/bin/passwd
# -rwsr-xr-x 1 root root ...

# Sticky bit on /tmp (prevents users deleting each other's files)
ls -ld /tmp
# drwxrwxrwt 1 root root ...

# Set sticky bit
chmod 1777 /shared/
chmod +t /shared/

# View user info
id alice                        # UID, GID, groups
getent passwd alice             # Full passwd entry
groups alice                    # List groups

# Create and manage users
sudo useradd -m -s /bin/bash alice     # Create with home dir and bash shell
sudo usermod -aG docker alice          # Add to supplementary group
sudo passwd alice                       # Set/change password
sudo userdel -r alice                  # Remove user and home dir

# Create groups
sudo groupadd developers
sudo groupdel developers

# Run single command as root
sudo apt update

# Open root shell
sudo -i

# Run as another user
sudo -u postgres psql

# Check what you're allowed to do
sudo -l

# Snapshot of all processes
ps aux
# Columns: USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND

# Process tree (shows parent-child relationships)
ps auxf
pstree -p

# Real-time monitor
top                             # Basic — press q to quit
htop                            # Better UI, sortable columns

# Graceful stop (SIGTERM — process can clean up)
kill PID
kill -15 PID                    # Same as above (15 = SIGTERM)

# Force kill (SIGKILL — immediate, no cleanup)
kill -9 PID

# Kill by name
pkill nginx                     # All processes named "nginx"
pkill -f "python app.py"       # Match full command line
killall nginx                   # All processes with exact name

# Common signals
kill -HUP PID                   # Reload configuration (many daemons support this)
kill -STOP PID                  # Pause process
kill -CONT PID                  # Resume paused process

# Run command in background
long_running_task &

# Suspend current foreground process
# Press Ctrl+Z → [1]+  Stopped  long_running_task

# Resume in background
bg %1

# Bring back to foreground
fg %1

# List background jobs
jobs

# Prevent job from dying when terminal closes
nohup long_running_task &
disown %1                       # Detach from current shell

# Basic service management
systemctl start nginx            # Start now
systemctl stop nginx             # Stop now
systemctl restart nginx          # Stop + start
systemctl reload nginx           # Reload config without restart (if supported)
systemctl status nginx           # Show state, recent logs, PID

# Boot behaviour
systemctl enable nginx           # Start on boot
systemctl disable nginx          # Don't start on boot
systemctl enable --now nginx     # Enable AND start immediately

# Querying
systemctl is-active nginx        # Returns "active" or "inactive"
systemctl is-enabled nginx       # Returns "enabled" or "disabled"
systemctl list-units --type=service --state=running
systemctl list-timers            # Show scheduled timers

journalctl -u nginx              # All logs for nginx
journalctl -u nginx --since today
journalctl -u nginx --since "1 hour ago"
journalctl -u nginx -f           # Follow (live tail)
journalctl -p err                # Only errors and above
journalctl -b                    # Since last boot
journalctl --disk-usage          # Check journal size

# /etc/systemd/system/myapp.service
[Unit]
Description=My Application
After=network.target

[Service]
Type=simple
User=appuser
WorkingDirectory=/opt/myapp
ExecStart=/opt/myapp/bin/server
Restart=on-failure
RestartSec=5

[Install]
WantedBy=multi-user.target

# After creating/editing a unit file
sudo systemctl daemon-reload     # Re-read unit files
sudo systemctl enable --now myapp

# Find files by name
find /var/log -name "*.log"
find . -iname "readme*"          # Case-insensitive

# Find by type
find / -type d -name "config"    # Directories only
find . -type f -size +100M       # Files over 100MB

# Find by time
find . -mtime -7                 # Modified in last 7 days
find . -mmin -30                 # Modified in last 30 minutes

# Find and act
find /tmp -type f -mtime +30 -delete               # Delete old temp files
find . -name "*.py" -exec grep -l "TODO" {} \;     # Find files containing TODO

grep "error" /var/log/syslog     # Basic search
grep -i "error" log.txt          # Case-insensitive
grep -r "TODO" src/              # Recursive through directories
grep -n "pattern" file.txt       # Show line numbers
grep -c "error" log.txt          # Count matches
grep -v "debug" log.txt          # Invert (exclude matches)
grep -E "err|warn|crit" log.txt  # Extended regex (OR)
grep -A3 -B1 "error" log.txt    # 3 lines after, 1 before match

# Print specific columns
ps aux | awk '{print $1, $2, $11}'           # User, PID, Command
df -h | awk '{print $1, $5}'                 # Device, usage%

# Filter rows
awk -F: '$3 >= 1000 {print $1}' /etc/passwd  # Users with UID >= 1000

# Sum a column
awk '{sum += $5} END {print sum}' data.txt

# Conditional formatting
awk '$3 > 80 {print "HIGH:", $0}' cpu_report.txt

# Substitute (first occurrence per line)
sed 's/old/new/' file.txt

# Substitute all occurrences
sed 's/old/new/g' file.txt

# Edit in-place
sed -i 's/old/new/g' file.txt

# Delete lines
sed '/pattern/d' file.txt                    # Delete matching lines
sed '1,5d' file.txt                          # Delete lines 1-5

# Insert/append
sed '3i\New line here' file.txt              # Insert before line 3
sed '3a\New line here' file.txt              # Append after line 3

# Create archive
tar -czf archive.tar.gz directory/           # Gzip compressed
tar -cjf archive.tar.bz2 directory/          # Bzip2 compressed

# Extract
tar -xzf archive.tar.gz                      # Extract gzipped
tar -xzf archive.tar.gz -C /target/dir/      # Extract to specific dir

# List contents without extracting
tar -tzf archive.tar.gz

# Common flags: c=create, x=extract, z=gzip, j=bzip2, f=file, v=verbose, t=list

# curl — versatile HTTP client
curl https://api.example.com                  # GET request
curl -o file.zip https://example.com/file.zip # Download to file
curl -I https://example.com                   # Headers only
curl -X POST -d '{"key":"val"}' \
  -H "Content-Type: application/json" \
  https://api.example.com/endpoint

# wget — simple downloader
wget https://example.com/file.tar.gz          # Download file
wget -q -O - https://example.com/script.sh   # Output to stdout
wget -r -l 2 https://example.com/docs/       # Recursive download (2 levels)

# View a variable
echo $PATH
printenv PATH

# Modify PATH (prepend)
export PATH="/opt/mytools/bin:$PATH"

# List all variables
env
printenv

# Unset a variable
unset MY_VAR