Introduction

After 11 years as a systems administrator, I keep coming back to the same set of commands every single day. Whether I'm debugging a production issue at 2am or building a new server from scratch, these tools never leave my terminal.

Let's go through the 10 most essential Linux commands every SysAdmin should have memorized.

1. ss — Socket Statistics

Replace netstat with ss for faster, more detailed network information:

# Show all listening TCP ports
ss -tlnp

# Show established connections
ss -tnp state established

# Find which process uses port 80
ss -tlnp | grep :80

2. lsof — List Open Files

Incredibly powerful for debugging. Every socket, file, and pipe is exposed:

# Files opened by a specific process
lsof -p 1234

# Which process has port 443 open
lsof -i :443

# Files opened by a specific user
lsof -u azim

3. strace — System Call Tracer

When a process misbehaves and logs tell you nothing, strace exposes every system call it makes:

# Trace a running process
strace -p 5678 -e trace=network

# Trace file operations only
strace -e trace=file ls /var/log

4. awk for Log Analysis

One-liner log analysis that would take hours in Excel:

# Count HTTP status codes in nginx access log
awk '{print $9}' /var/log/nginx/access.log | sort | uniq -c | sort -rn

# Find top 10 IPs by request count
awk '{print $1}' /var/log/nginx/access.log | sort | uniq -c | sort -rn | head -10

5. rsync — The Right Way to Copy

# Mirror directory with progress
rsync -avzP --delete /source/ user@remote:/dest/

# Dry run first (always!)
rsync -avzn /source/ /destination/

6. find with -exec

# Find and delete files older than 30 days
find /tmp -type f -mtime +30 -exec rm {} ;

# Find large files over 100MB
find / -type f -size +100M -exec ls -lh {} ; 2>/dev/null

7. systemctl Mastery

# Check service status with recent logs
systemctl status nginx -l --no-pager

# Find failed services
systemctl --failed

# Check boot time analysis
systemd-analyze blame | head -20

8. journalctl — Structured Logs

# Tail logs for a service in real time
journalctl -fu nginx

# Logs since last boot with priority errors
journalctl -b -p err

# Logs between timestamps
journalctl --since "2024-01-01 00:00" --until "2024-01-02 00:00"

9. tmux — Terminal Multiplexer

Never lose work during SSH disconnects again:

# Start a named session
tmux new -s production

# Detach (keep running): Ctrl+B, then D
# Reattach
tmux attach -t production

# List sessions
tmux ls

10. sar — System Activity Reporter

# CPU usage every 2 seconds, 10 times
sar -u 2 10

# Memory usage history
sar -r

# Disk I/O
sar -d -p 1 5

Conclusion

These commands form the backbone of daily sysadmin work. Master them, build muscle memory, and you'll handle production incidents faster and with more confidence. Save this list and practice each one in a safe environment.

What's your most-used Linux command? Drop it in the comments below!