Essential Linux Commands Every DevOps Engineer Needs

DevOps runs on Linux. Whether you're debugging a container, checking why a disk filled up, or tailing logs during an incident, these are the commands you'll reach for daily — grouped by the job they do.

Table of Contents

• What's eating my disk?
• Why is it slow?
• Is it the network?
• Logs: finding the needle
• Process control
• Permissions & ownership
• The power combo: pipes

What's eating my disk?

df -h                      # filesystem usage
du -sh /var/log/* | sort -rh | head   # biggest dirs
ncdu /                     # interactive disk explorer (install it, thank us later)

Why is it slow?

top / htop                 # CPU and memory per process
iostat -xz 2               # disk I/O, watch %util and await
free -h                    # memory (look at "available", not "free")
vmstat 1                   # CPU, IO, and context switches over time

Is it the network?

ss -tulpn                  # who is listening on which port
curl -v https://api.local  # TLS, DNS, and HTTP in one shot
dig example.com +short     # DNS answers fast
ping / traceroute / mtr    # reachability and where packets die
nc -zv host 443            # is the port open?

Logs: finding the needle

journalctl -u nginx -f             # follow a systemd unit's logs
journalctl --since "1 hour ago" -p err
tail -f app.log | grep --line-buffered ERROR
grep -r "timeout" /var/log/ | head -50
zcat app.log.2.gz | grep ERROR     # search rotated logs

Process control

ps aux | grep java       # find the PID
kill -15 PID             # ask nicely (SIGTERM) — try this first
kill -9 PID              # last resort only; skips cleanup
systemctl status|restart|enable nginx
strace -p PID            # what syscalls is it stuck on?

Permissions & ownership

ls -la                   # who owns what, who can read it
chmod 640 app.conf       # owner rw, group r, world nothing
chown app:app /srv/app
sudo -u app id           # verify a service account

The power combo: pipes

Linux shines when you chain small tools: cat access.log | awk '{print $1}' | sort | uniq -c | sort -rn | head instantly shows your top talking IPs. Learn grep, awk, sort, uniq, and xargs — they answer questions in seconds that would take a dashboard minutes.

Bookmark this page. Six months of real incidents will teach you the rest.

Related Articles

• AWS for DevOps Engineers: The Services That Actually Matter
• Ansible for Beginners: Automate Server Configuration

---

Last Updated: October 2026 Author: CloudOpsGuide Team Difficulty: Beginner Estimated Reading Time: 10 minutes