Linux CLI recipes

Useful command-line patterns for day-to-day system work.

find + exec / xargs

Delete all .pyc files under the current tree:

find . -name "*.pyc" -delete

Run a command on each result — {} is the placeholder, \; terminates:

find /etc -name "*.conf" -exec grep -l "timeout" {} \;

For large result sets, xargs batches arguments and is faster than -exec … \;:

find . -name "*.log" -print0 | xargs -0 rm -f

The -print0 / -0 pair handles filenames with spaces or newlines safely.

Count lines across many files at once:

find src/ -name "*.py" | xargs wc -l | tail -1

journalctl — reading systemd logs

Follow a unit's logs live (like tail -f):

journalctl -u nginx.service -f

Show logs since last boot only:

journalctl -b -u sshd

Filter by time range:

journalctl --since "2024-01-10 09:00" --until "2024-01-10 10:00"

Show the last 100 lines without paging:

journalctl -u myapp -n 100 --no-pager

ss — socket statistics (replaces netstat)

List all listening TCP ports with PID:

ss -tlnp

Show established connections to port 443:

ss -tnp state established '( dport = :443 )'

Show Unix sockets (useful for debugging IPC):

ss -xlp

rsync — efficient file transfer

Mirror a directory to a remote host, preserving permissions:

rsync -av --delete src/ user@host:/dest/

Dry-run first to see what would change:

rsync -av --dry-run src/ user@host:/dest/

Exclude build artefacts:

rsync -av --exclude '__pycache__' --exclude '*.pyc' src/ dest/

tar — create and extract archives

Create a compressed archive:

tar -czf archive.tar.gz /path/to/dir

Extract to a specific directory:

tar -xzf archive.tar.gz -C /opt/restore/

List contents without extracting:

tar -tzf archive.tar.gz | head -20

Permissions — chmod and chown

Set owner and group recursively:

chown -R www-data:www-data /var/www/html

Give the owner full permissions, group read+exec, others nothing:

chmod 750 /opt/myapp/bin/server

Make a script executable:

chmod +x deploy.sh

The numeric shorthand: owner/group/others each get a 3-bit value (r=4, w=2, x=1). 644 = rw-r--r-- (typical for files); 755 = rwxr-xr-x (typical for directories and scripts).

systemctl --user — per-user services

Enable and start a user-level timer without root:

systemctl --user enable --now backup.timer
systemctl --user status backup.timer
journalctl --user-unit backup.service -n 50

See also: Git workflows for git log --grep to search commit history.