LearningEvery command our lessons run
The Linux commands a working engineer reaches for: every one our lessons ask you to type, and the important ones no lesson teaches yet. Each card gives the forms worth knowing, who is allowed to run it, and how to get the same answer on a Mac — with a line for Windows. Open a command for the details, and follow a link to the lesson that explains it.
Every one of these is an ordinary program running in user mode, or a builtin the shell runs itself; none runs inside the kernel. When a command needs the kernel it asks through a system call, and the kernel checks whether the caller may. Who can run it says how that check goes: any user, only root (the administrator account, user id 0) or a process holding the one Linux capability that grants that power, or root only for some of its forms.
List, signal, prioritise and pin the programs running on a machine.
bg — backgroundLets a stopped job carry on running in the background.
bgThe shell sends SIGCONT to its own child process group, which needs no privilege.
fg.chrtRuns a program, or changes a running one, under a real-time scheduling policy such as SCHED_FIFO, which runs ahead of every ordinary process.
chrt -f 50 programSCHED_FIFO at real-time priority 50.chrt -p PIDReal-time policies can starve the rest of the machine, so the kernel asks for root or CAP_SYS_NICE (or a raised RLIMIT_RTPRIO limit) before granting one. Showing a policy needs nothing.
taskpolicy moves a process between Apple’s quality-of-service tiers, which is not real-time scheduling.start /realtime program starts a program in the real-time priority class.fg — foregroundBrings a stopped or background job back to the foreground of the terminal.
fgfg %2The shell does this itself, by moving the terminal’s foreground process group and sending SIGCONT to its own children.
Start-Job runs work in a separate background process instead.htopA friendlier top: per-CPU bars, scrolling, a tree view, and keys to search, filter, renice and kill.
htopF5 toggles the process tree.Like top, it reads /proc; its kill and renice keys follow the usual rules.
htop package.htop.Not yet taught in a lesson.
ionice — I/O niceSets a process’s I/O scheduling class and priority, so a backup or scan does not starve interactive disk use.
ionice -c3 tar czf backup.tgz dirLowering your own I/O priority is allowed; the real-time class, or another user’s process, needs root.
taskpolicy -d throttle program sets a program’s disk I/O policy.Not yet taught in a lesson.
killSends a signal to a process: by default a polite request to terminate, or with -9 an order the process cannot catch.
kill PIDSIGTERM, asking the process to clean up and exit.kill -9 PIDSIGKILL, which the kernel carries out without asking the process.kill -- -PGIDThe kernel lets you signal processes running as your own user. Signalling someone else’s needs root, or the CAP_KILL capability.
/bin/kill.taskkill /pid N ends a process (add /f to force it), and Stop-Process -Id N does the same in PowerShell.niceStarts a program with a lower (or higher) scheduling priority, expressed as a nice value from −20, most favoured, to 19, least.
nice -n 10 makemake ten steps “nicer”, so other work gets the CPU first.Anyone may make their own work nicer. A negative value, which takes CPU from others, needs root or the CAP_SYS_NICE capability.
start /belownormal program starts a program at a lower priority class. Windows has six classes (low, below normal, normal, above normal, high, realtime) rather than nice values.nohup — no hangupRuns a command immune to the hangup signal, so it keeps going after you close the terminal.
nohup make -j4 &make in the background, ignoring hangups; output goes to nohup.out.Ignoring a signal is your own process’s choice, and the kernel needs no permission for it.
schtasks) or a service.numactl — NUMA controlShows a machine’s NUMA layout (which memory is near which CPUs) and runs a program with a chosen memory and CPU placement.
numactl --hardwareReading the layout and choosing a placement for your own program are ordinary requests the kernel grants to anyone.
numactl package.start /node N program starts a program on NUMA node N.pgrep — process grepAlso covers pkill
Finds processes by name or other attributes and prints their IDs; pkill signals them instead.
pgrep -a nginxnginx.pkill -HUP nginxSIGHUP to them, often a “reload your configuration” request.Finding is open to anyone; pkill follows kill’s rules, so another user’s processes need root.
tasklist /fi "imagename eq x.exe" and taskkill /im x.exe.Not yet taught in a lesson.
ps — process statusA snapshot of the processes running now: their IDs, owners, states and the commands that started them.
psps -e-e, every).ps -efps -e | wc -lThe kernel publishes every process under /proc for any user to read, so anyone can list everything; only a few details of other users’ processes, such as their environment, are withheld.
ps; -e and -f work, though the columns differ from Linux’s.tasklist lists processes, and PowerShell’s Get-Process returns them as objects you can sort and filter.pstree — process treeDraws the processes as a tree of parents and children, so you can see which shell or service started what.
pstree -pIt reads what the kernel publishes under /proc, which any user may read.
pstree.Not yet taught in a lesson.
reniceChanges the nice value of a process that is already running.
renice -n 5 -p PIDYou may make your own processes nicer. Making any process less nice, or touching another user’s process, needs root or CAP_SYS_NICE.
tasksetPins a process to a chosen set of CPUs (its affinity), so the scheduler runs it only there.
taskset -c 3 ./serverserver allowed to run only on CPU 3.taskset -p PIDYou may set the affinity of your own processes. Changing another user’s needs root or CAP_SYS_NICE.
start /affinity 8 program takes a hexadecimal mask of allowed processors (8 is binary 1000, processor 3).top — the processes at the top of CPU useA live, refreshing table of the busiest processes, with the CPU split into time in user programs and time in the kernel.
topq to quit.top (us, sy)us share is CPU time in user mode, sy time in the kernel on programs’ behalf.It only reads what the kernel publishes under /proc, which any user may read. Killing or renicing from inside it follows the same rules as kill and renice.
htop is a friendlier alternative to install.top: the same idea with different keys and columns; top -o cpu sorts by CPU. Activity Monitor is the graphical version.Get-Process | Sort-Object CPU -Descending gives a one-off ranking.Find where time goes: counters, samples, traces and the kernel’s own log.
bpftool — BPF toolLists and inspects the eBPF programs and maps loaded into the kernel.
bpftool prog listbpftool map listEnumerating the kernel’s eBPF objects is a privileged bpf() operation: root, or CAP_SYS_ADMIN.
bpftool or with linux-tools.bpftraceA small language for tracing: attach a few lines of code to a kernel or program event and print counts, histograms or stacks as it runs.
bpftrace -e 'tracepoint:syscalls:sys_enter_openat { printf("%s\n", comm); }'It loads eBPF programs into the kernel, which needs root or the CAP_BPF and CAP_PERFMON capabilities.
bpftrace package.dtrace, whose language inspired bpftrace’s; it needs root and is limited by System Integrity Protection.dmesgPrints the kernel’s own log: hardware found at boot, driver messages, and warnings such as the out-of-memory killer choosing a victim.
dmesgdmesg | grep -i raidAny user may read it unless kernel.dmesg_restrict is set to 1, as many distributions now do; then it needs root or CAP_SYSLOG.
wevtutil and PowerShell’s Get-WinEvent from the command line.freeHow memory is being used: in use, free, held as page cache and buffers, and how much is available for new work.
free -hIt reads /proc/meminfo, which any user may read.
vm_stat prints page counts; top’s PhysMem line and Activity Monitor’s Memory tab summarise them.Memory counters.gdb — GNU debuggerThe GNU debugger: stops a program at breakpoints, steps through it, and prints variables, registers and stack traces; also reads core dumps.
gdb ./progrun, break main, bt for a backtrace.gdb -p PIDgdb prog coreStarting a program under it is always allowed; attaching to a running one follows ptrace’s rules, as for strace.
gdb package.lldb, installed with the Xcode Command Line Tools; LLDB documents a command-by-command map from GDB.Not yet taught in a lesson.
iostat — input/output statisticsPer-device disk statistics: requests per second, throughput, average wait and how busy each device is.
iostat -x 1The counters come from /proc/diskstats, which any user may read.
sysstat package.iostat with different columns (kilobytes per transfer, transfers per second, megabytes per second) and no -x.typeperf or Get-Counter with the PhysicalDisk counters.iotopA top for disk I/O: which processes are reading and writing, and how fast.
iotop -oIt reads per-task I/O accounting through a kernel interface that needs root, or the CAP_NET_ADMIN capability granted to its binary.
iotop package.Not yet taught in a lesson.
ltrace — library call traceLike strace one level up: prints the shared-library calls a program makes, such as malloc and strlen.
ltrace ./progIt uses ptrace, under the same rules as strace.
ltrace package; not available on every architecture.dtrace’s pid provider traces function calls, as root.Not yet taught in a lesson.
mpstatPer-CPU utilisation at an interval: user, system, I/O wait, interrupts and idle for each core, so one saturated core stands out.
mpstat -P ALL 1It reads what the kernel publishes under /proc, which any user may read.
sysstat package.typeperf with the per-processor counters.Not yet taught in a lesson.
perf — performanceLinux’s performance tool: counts hardware events such as cache misses, samples where CPU time goes, and records traces, all through the kernel’s performance-counter interface.
perf stat ./progperf stat -e cache-references,cache-misses ./progperf topperf record -g ./progperf report reads the result.Measuring your own programs is allowed by default. Watching the whole system or the kernel needs root, the CAP_PERFMON capability, or a lowered kernel.perf_event_paranoid setting.
perf or linux-tools matched to the running kernel.sample profiles one process from the command line; Instruments (and its command-line form xctrace) comes with Xcode.pidstatPer-process statistics at an interval: CPU, memory, disk, or the voluntary and forced context switches of each process.
pidstat -w 1It reads each process’s counters from /proc, which any user may read.
sysstat package.top -stats pid,command,csw shows each process’s context-switch count (csw).typeperf with the Process and Thread counters, which include context switches per second.pmap — process mapPrints a process’s memory map: each region’s address, size, permissions and the file it maps.
pmap -x PIDYour own processes are open to you; another user’s map needs root, like reading their /proc/PID/maps.
vmmap PID.Not yet taught in a lesson.
sar — system activity reporterThe system activity reporter: records CPU, memory, disk and network statistics all day, so you can look back at what happened at 3 a.m.
sar -u 1 5sar -n DEVIt reads what the kernel publishes under /proc, which any user may read.
sysstat package, with its collection service enabled.logman).Not yet taught in a lesson.
strace — system-call tracePrints every system call a program makes, with its arguments and result: the most direct view of a program’s conversation with the kernel.
strace lsstrace -f bash -c 'ls; true'-f, follow forks).strace -c lsstrace -p PIDTracing a program you start is always allowed. Attaching to a running process uses ptrace, which most distributions limit (through the Yama ptrace_scope setting) to your own descendants unless you have root or CAP_SYS_PTRACE.
strace package; often preinstalled.dtruss prints system calls using DTrace; it needs root, and System Integrity Protection stops it tracing Apple’s own programs. fs_usage shows file-system calls.timeRuns a command and reports how long it took: wall-clock time, and CPU time spent in user mode and in the kernel.
time cat big.log > /dev/nullreal is elapsed, user and sys are CPU.The shell starts the program and asks the kernel for its child’s resource usage when it ends, which needs no privilege.
/usr/bin/time is a separate program with more detail./usr/bin/time.Measure-Command { … } reports elapsed time. Beware cmd’s time: it shows or sets the system clock.uptimeHow long the machine has been up, how many users are logged in, and the load averages over the last 1, 5 and 15 minutes.
uptimeIt reads /proc/loadavg and /proc/uptime, which any user may read.
perfmon) charts processor counters live.valgrindRuns a program on a simulated CPU that checks every memory access: finds leaks, use after free and reads of uninitialised memory; its other tools profile caches and calls.
valgrind --leak-check=full ./progIt runs your program as an ordinary user process, only much slower.
valgrind package.leaks finds leaks, and the compilers’ AddressSanitizer finds bad accesses.Not yet taught in a lesson.
vmstat — virtual memory statisticsOne line per interval summarising the whole machine: runnable processes, memory, swapping, block I/O, interrupts, context switches and the CPU split.
vmstat 1It reads system-wide counters from /proc, open to any user.
vm_stat shows memory and paging only; top and Activity Monitor give the rest.typeperf prints chosen performance counters at an interval, and PowerShell’s Get-Counter returns them.Names, inodes, permissions and who holds a file open.
chattr — change attributesSets ext2/3/4 attribute flags such as immutable (i), which even root cannot write through until it is cleared.
chattr +i filechattr +a logThe immutable and append-only flags need CAP_LINUX_IMMUTABLE, in practice root.
chflags uchg file sets the user-immutable flag.attrib +r sets read-only, a weaker flag.Not yet taught in a lesson.
chgrp — change groupChanges a file’s group.
chgrp staff filestaff.An owner may move a file to any group they belong to; anything else needs root (CAP_CHOWN).
icacls.Not yet taught in a lesson.
chmod — change modeChanges a file’s permission bits: read, write and execute for its owner, its group and everyone else, plus the setuid, setgid and sticky bits.
chmod 755 filechmod g+rw data.txtchmod u+s programOnly a file’s owner may change its mode. Changing anyone else’s file needs root or the CAP_FOWNER capability.
chmod +a also edits macOS access control lists.icacls shows and edits them.chown — change ownerChanges which user (and group) owns a file.
chown alice filealice the owner.chown :staff fileGiving a file to another user needs root or CAP_CHOWN; otherwise anyone could hand files to others. An owner may change only the group, and only to a group they belong to.
icacls file /setowner user, or takeown to take ownership yourself; both need an administrator.cp — copyCopies files, or with -a whole trees with their permissions, owners and times kept.
cp report.txt /dev/nullcp -a /lower /upperThe kernel checks ordinary file permissions: you need write and search permission on the directory being changed. Keeping another user as owner (-a run by an ordinary user) silently falls back to you.
cp; -a works.copy and robocopy, or PowerShell’s Copy-Item, which also answers to cp on Windows.fileGuesses what a file holds by reading its first bytes, not its name: an ELF executable, a script, text, an image.
file /bin/lsIt only reads the file, so it needs read permission and nothing else.
file package, in most installs.findWalks a directory tree and prints (or acts on) the files that match tests: name, type, size, age, owner.
find . -name '*.log' -mtime +7find / -xdev -size +1Gfind . -type f -print0 | xargs -0 rmIt needs read and search permission on each directory it walks; others are reported as errors.
find: the common tests match; the path argument is required.Get-ChildItem -Recurse -Filter; cmd’s find searches text instead.Not yet taught in a lesson.
getcap — get capabilitiesShows the capabilities attached to an executable.
getcap /usr/bin/pingcap_net_raw=ep: ping may open raw sockets without root.Reading a file’s capabilities is reading an extended attribute, open to anyone who can reach the file.
libcap tools.getfacl — get file access control listShows a file’s POSIX access control list: named users and groups with their own permissions, beyond the three classes of ls -l.
getfacl fileReading an ACL needs only search permission on the path; setting one (setfacl) is, like chmod, for the owner or root.
acl package; usually present.ls -le shows it and chmod +a edits it.icacls file or PowerShell’s Get-Acl.ln — linkMakes a second name for a file: a hard link (another directory entry for the same inode), or with -s a symbolic link holding a path.
ln target nameln -s target nametarget.The kernel checks ordinary file permissions: you need write and search permission on the directory being changed. Many distributions also refuse a hard link to a file you neither own nor can read and write (fs.protected_hardlinks).
mklink (/h for a hard link), or PowerShell’s New-Item -ItemType HardLink or SymbolicLink. PowerShell’s documentation notes that a symbolic link needs an administrator.ls — listLists a directory’s entries; with flags, each file’s type, permissions, link count, owner, size, time and inode number.
ls -lls -ils -ld /tmpls -l /proc/self/fdls process itself.ls -ZListing needs read permission on the directory, and -l needs search permission to look each entry up; nothing more.
ls: -l and -i match; -O shows file flags and -e shows ACLs.dir, or PowerShell’s Get-ChildItem, which also answers to ls on Windows.lsattr — list attributesLists the file-system-specific attribute flags of a file on ext2/3/4: immutable, append-only, indexed directory and more.
lsattr -d dirI marks a hashed-tree (indexed) directory.Reading flags needs read access to the file; setting the immutable or append-only flag (chattr) needs CAP_LINUX_IMMUTABLE.
ls -lO and set by chflags.attrib shows and sets read-only, hidden, system and archive attributes.lsof — list open filesLists open files and the processes holding them, including deleted files still kept alive by an open descriptor.
lsof +L1Any user sees their own processes’ files; seeing every process’s needs root, because another user’s descriptors are hidden from you.
lsof package; often present.mkdir — make directoryCreates a directory. Under /sys/fs/cgroup the same call creates a new control group.
mkdir namemkdir -p a/b/cThe kernel checks ordinary file permissions: you need write and search permission on the directory being changed.
mkdir (also md), and PowerShell has a mkdir function.mv — moveRenames or moves a file. Within one file system it only rewrites directory entries; across file systems it copies and deletes.
mv a ba to b: the inode and its data stay where they are.The kernel checks ordinary file permissions: you need write and search permission on the directory being changed.
move, or PowerShell’s Move-Item, which also answers to mv on Windows.readlink — read linkPrints where a symbolic link points; with -f, the fully resolved absolute path.
readlink -f /usr/bin/python3readlink /proc/PID/exeIt reads the link itself, which needs only search permission on the path.
-f.(Get-Item link).Target in PowerShell.Not yet taught in a lesson.
rm — removeRemoves a name from a directory. The file itself is freed only when its last name is gone and no process still has it open.
rm big.logThe kernel checks ordinary file permissions: you need write and search permission on the directory being changed. In a sticky directory such as /tmp you may remove only your own files.
del, or PowerShell’s Remove-Item, which also answers to rm on Windows.rmdir — remove directoryRemoves an empty directory.
rmdir nameThe kernel checks ordinary file permissions: you need write and search permission on the directory being changed.
rmdir (also rd).setcap — set capabilitiesAttaches Linux capabilities to an executable, so it starts with one specific power of root instead of all of them.
setcap 'cap_net_bind_service=ep' gallerygallery bind ports below 1024 without being root.Setting capabilities on a file needs root or CAP_SETFCAP; otherwise any user could award themselves powers.
libcap tools (package libcap2-bin or libcap).stat — statusPrints everything an inode records about a file: size, blocks, inode number, link count, owner, permissions and its three timestamps.
stat /etc/hostnameIt needs only search permission on the directories in the path; the file itself need not be readable.
stat with a terser default; stat -x prints the Linux-style layout.Get-Item file | Format-List * shows a file’s attributes and times.touchCreates an empty file, or updates an existing file’s access and modification times.
touch fileIt works on ordinary files and pipes under ordinary permissions.
New-Item file.Not yet taught in a lesson.
Devices, mounts, file-system layout and the bytes on disk.
blockdev — block deviceQueries or sets a block device’s parameters: sector sizes, read-ahead, read-only flag.
blockdev --getss /dev/sdXIt opens the device node and issues ioctl calls, which needs root.
diskutil info reports a disk’s block size.fsutil fsinfo sectorinfo C: reports sector sizes and alignment.ddCopies raw bytes from one file or device to another in blocks of a chosen size.
dd if=bigfile of=/dev/null bs=1Mdd if=/dev/sda …Copying your own files needs nothing; reading or writing a disk device needs root, because only root may open it.
dd.df — disk freeHow full each mounted file system is, in blocks or with -i in inodes.
df -hdf -iIt asks the kernel for each file system’s totals, which any user may read.
df; -h and -i work.Get-Volume or Get-PSDrive.du — disk usageHow much space files and directories use, adding up the blocks actually allocated.
du -sh dirIt walks the tree, so it needs read and search permission on each directory it counts.
du.du, Sysinternals).dumpe2fs — dump ext2 file systemPrints an ext2/3/4 file system’s superblock and every block group’s layout: where its bitmaps, inode table and free blocks are.
dumpe2fs -h /dev/sdXIt reads the raw device, which needs root.
e2fsck — ext2 file system checkThe ext2/3/4 checker: walks every inode, bitmap and directory and reconciles them.
e2fsck -fn /dev/sdX-f) but change nothing (-n).It opens the raw device, which needs root.
fallocate — file allocateReserves disk space for a file without writing it, so later writes cannot fail for lack of space.
fallocate -l 1G fileAllocating space in a file you can write is an ordinary request, within your disk quota.
mkfile creates a file of a given size, writing zeros (with -n it records the size without allocating).fsutil file createnew name length creates a file of a given length.fdiskShows and edits a disk’s partition table.
fdisk -lIt reads and writes the raw disk device, which only root may open.
diskutil list and diskutil partitionDisk; macOS’s own fdisk edits only old MBR tables.diskpart.Not yet taught in a lesson.
filefrag — file fragmentationShows how a file is laid out on disk: its extents and how many pieces it is in.
filefrag -v fileIt asks the file system for the file’s map through an ioctl, allowed to anyone who can read the file.
findmnt — find mountShows the mount table as a tree: which file system is mounted where, with its options and propagation.
findmntIt reads /proc/self/mountinfo, which any process may read.
mount with no arguments lists mounts.mountvol lists volumes and their mount points; Get-Volume describes them.fio — flexible I/O testerA flexible I/O benchmark: describes a workload (random or sequential, block size, queue depth, direct or buffered) and measures throughput and latency.
fio --name=r --rw=randread --bs=4k --iodepth=32 --direct=1 --size=1G --runtime=30An ordinary program on files you can write; benchmarking a raw device needs root.
fio package.fio.Not yet taught in a lesson.
fsck — file system checkChecks a file system’s structures for consistency and repairs them, usually on an unmounted file system after a crash.
fsck /dev/sdX1It reads and writes the raw device, which only root may open.
e2fsck.fsck_apfs, or diskutil verifyVolume and repairVolume.chkdsk (with /f to fix), or PowerShell’s Repair-Volume.hdparmGets and sets low-level settings of ATA disks, such as the drive’s own write cache.
hdparm -W 0 /dev/sdXIt sends commands to the drive itself through the device node, which needs root.
hdparm package.lsblk — list block devicesLists block devices — disks, partitions, RAID and device-mapper volumes — as a tree, with sizes and whether each is a spinning disk.
lsblk -d -o NAME,ROTAROTA 1 for rotational (spinning) media.It reads /sys/block, which any user may read.
diskutil list.Get-Disk and Get-PhysicalDisk (its MediaType says HDD or SSD), or diskpart’s list disk.mdadmCreates, monitors and repairs Linux software RAID arrays.
mdadm --detail /dev/md0cat /proc/mdstatIt drives the md devices, which only root may open.
mdadm package.diskutil appleRAID manages AppleRAID sets.diskpart’s RAID volumes.Not yet taught in a lesson.
mkfs — make file systemCreates a new, empty file system on a device: superblock, bitmaps, inode table and root directory.
mkfs -t ext4 /dev/sdX1mkfs.ext4).Writing a raw disk device needs write permission on its /dev node, which only root (or the disk group) has.
mkfs.ext4.newfs_apfs, or diskutil eraseVolume.format, or PowerShell’s Format-Volume.mkswap — make swapPrepares a partition or file to be used as swap space.
mkswap /swapfileIt writes the device or a root-owned file; enabling it afterwards needs CAP_SYS_ADMIN.
dynamic_pager).mountAttaches a file system to a directory in the tree; with no arguments, lists what is mounted.
mount -t ext4 /dev/sdb1 /mnt/usb/mnt/usb.mount --bind a ba appear at b too.mount -t overlay …Mounting changes what every process sees, so the kernel requires root or CAP_SYS_ADMIN, except inside your own mount namespace or for entries marked user in /etc/fstab.
mount; diskutil mount is the usual way to mount a disk.mountvol, or Disk Management.partedA partition editor that also handles GPT tables and resizing, scriptable from the command line.
parted -lThe raw disk device needs root.
diskutil partitionDisk and resizeVolume.diskpart.Not yet taught in a lesson.
rsync — remote syncCopies files locally or over the network, sending only what differs from the destination.
rsync -a src/ dst/Like cp, it works under ordinary file permissions at each end.
rsync package; often present.openrsync under the name rsync; the original is in Homebrew.robocopy mirrors trees and skips unchanged files.smartctl — SMART controlReads a drive’s own health records (SMART): reallocated sectors, wear, temperature and error logs.
smartctl -a /dev/sdaIt sends commands straight to the drive, which needs root.
smartmontools package.smartmontools.Not yet taught in a lesson.
swapon — swap onStarts using a prepared swap area; with --show, lists the ones in use.
swapon /swapfileswapon --showListing is open to anyone; enabling or disabling swap needs root or CAP_SYS_ADMIN.
sysctl vm.swapusage shows how much swap is in use.sync — synchroniseAsks the kernel to write all dirty cached data to disk now.
syncAny process may ask the kernel to write back its caches.
tar — tape archiveBundles files into one archive, or unpacks one, keeping names, permissions and times.
tar czf out.tgz dirc) a gzip-compressed (z) archive file (f).tar xf out.tgzIt reads and writes ordinary files under ordinary permissions; restoring other users’ ownership needs root.
tar, usable from cmd and PowerShell.tune2fs — tune ext2 file systemShows or changes the settings of an ext2/3/4 file system, such as its features and reserved blocks.
tune2fs -l /dev/sdXIt reads and writes the device directly, which needs root.
umount — unmountDetaches a mounted file system.
umount /mnt/usbThe same rule as mount: root or CAP_SYS_ADMIN.
umount, or diskutil unmount.mountvol path /d removes a volume’s mount point.Small programs joined by pipes, each doing one thing to a stream of lines.
awk — Aho, Weinberger and Kernighan, its authorsA small language for column-shaped text: splits each line into fields and runs a pattern–action program over them.
awk '{print $1}' access.logawk '$9 == 500 {n++} END {print n}' access.logIt works on ordinary files and pipes under ordinary permissions.
-split.Not yet taught in a lesson.
base64Encodes bytes as Base64 text, or decodes it back.
base64 -d token.txtIt works on ordinary files and pipes under ordinary permissions.
-d decodes).certutil -encode and -decode.Not yet taught in a lesson.
cat — concatenateReads files (or its input) and writes them to its output, one after another; also the quickest way to read a kernel file under /proc or /sys.
cat notes.txtcat /proc/self/mapscat process itself.cat log | grep err | wc -lIt reads and writes ordinary files and pipes under ordinary permissions; the kernel asks nothing more.
cat; macOS has no /proc, so the kernel files it reads on Linux do not exist.type, or PowerShell’s Get-Content, which also answers to cat on Windows.cutPrints selected fields or character positions from each line.
cut -d: -f1 /etc/passwdIt works on ordinary files and pipes under ordinary permissions.
-split operator.Not yet taught in a lesson.
diff — differenceShows how two files differ, line by line; -u prints the unified format that patches and code reviews use.
diff -u old newIt works on ordinary files and pipes under ordinary permissions.
fc, or PowerShell’s Compare-Object.Not yet taught in a lesson.
echoWrites its arguments to its output.
echo hello > out.txtout.txt for echo’s output before it runs.It reads and writes ordinary files and pipes under ordinary permissions; the kernel asks nothing more.
/bin/echo in coreutils.echo; PowerShell’s is Write-Output.grep — global regular expression print (from the ed command g/re/p)Prints the lines that match a pattern.
grep error logerror.grep -F word filegrep -r TODO .grep -i -c xIt reads and writes ordinary files and pipes under ordinary permissions; the kernel asks nothing more.
grep; the common flags match.findstr, or PowerShell’s Select-String.headPrints the first lines of its input, then exits.
head -n 20 fileyes | headhead exits, yes is killed by SIGPIPE on its next write.It reads and writes ordinary files and pipes under ordinary permissions; the kernel asks nothing more.
Get-Content -TotalCount or Select-Object -First.hexdumpThe util-linux hex dumper; hexdump -C gives the familiar offset, hex and text columns.
hexdump -C fileIt works on ordinary files and pipes under ordinary permissions.
hexdump, same -C.Format-Hex.Not yet taught in a lesson.
lessShows long output one screen at a time, scrolling both ways and searching with /.
cat big.log | grep error | lessIt reads and writes ordinary files and pipes under ordinary permissions; the kernel asks nothing more.
less package, in every distribution.more, or PowerShell’s Out-Host -Paging.moreThe older pager: shows output a screen at a time, forwards only.
more fileIt reads and writes ordinary files and pipes under ordinary permissions; the kernel asks nothing more.
more is less in a compatibility mode.more.sed — stream editorA stream editor: applies editing commands, most often a substitution, to each line as it passes.
sed 's/old/new/g' fileold with new on each line.sed -i 's/a/b/' fileIt reads and writes ordinary files and pipes under ordinary permissions; the kernel asks nothing more.
sed -i '' ….-replace operator.sha256sumComputes a file’s SHA-256 digest, to check that a download is exactly what was published.
sha256sum filesha256sum -c SHA256SUMSIt works on ordinary files and pipes under ordinary permissions.
shasum -a 256 file.Get-FileHash (SHA-256 by default).Not yet taught in a lesson.
sortSorts lines; can also merge already-sorted files.
sort filesort -m a bsort | uniq -cIt reads and writes ordinary files and pipes under ordinary permissions; the kernel asks nothing more.
sort.sort (/r reverses); PowerShell’s Sort-Object sorts objects.stringsPrints the runs of printable characters inside a binary: error messages, paths, version strings.
strings prog | grep -i versionIt works on ordinary files and pipes under ordinary permissions.
Not yet taught in a lesson.
tailPrints the last lines of a file; with -f, keeps printing as the file grows.
tail -n 50 logtail -f logIt reads and writes ordinary files and pipes under ordinary permissions; the kernel asks nothing more.
Get-Content -Tail 50, with -Wait to follow.teeCopies its input to its output and to files at once, like a T-junction in a pipe.
make 2>&1 | tee build.logIt works on ordinary files and pipes under ordinary permissions.
Tee-Object.Not yet taught in a lesson.
tr — translateTranslates or deletes characters as they stream past.
tr a-z A-Ztr -d '\r'It works on ordinary files and pipes under ordinary permissions.
-replace does the job.Not yet taught in a lesson.
uniq — uniqueDrops (or counts) repeated adjacent lines, so it is almost always run after sort.
uniq -cIt reads and writes ordinary files and pipes under ordinary permissions; the kernel asks nothing more.
Get-Unique (also on sorted input), or Group-Object for counts.wc — word countCounts lines, words and bytes.
wc -lps -e | wc -lIt reads and writes ordinary files and pipes under ordinary permissions; the kernel asks nothing more.
Measure-Object -Line.xargsTurns lines of input into arguments for another command, running it once or in batches.
find . -name '*.o' | xargs rmxargs -P4 -n1 cmdcmd processes at once, one argument each.It works on ordinary files and pipes under ordinary permissions.
xargs.ForEach-Object.Not yet taught in a lesson.
xxdPrints a file as hexadecimal and text side by side, or turns such a dump back into bytes.
xxd file | headIt works on ordinary files and pipes under ordinary permissions.
Format-Hex.Not yet taught in a lesson.
yesPrints a line (default y) forever: a quick way to answer prompts, or to make a writer that never stops.
yes | headSIGPIPE.It reads and writes ordinary files and pipes under ordinary permissions; the kernel asks nothing more.
Compile, link, disassemble and look inside executables and runtimes.
cc — C compilerThe traditional name for “the system’s C compiler”; on Linux it usually runs gcc, on macOS clang.
cc -Wall -o pipeline pipeline.cpipeline.Compiling, linking and reading program files are ordinary file reads and writes; the kernel asks nothing more.
xcode-select --install).cl.clangThe LLVM C and C++ compiler, flag-compatible with gcc for everyday use, and able to target other machines (here RISC-V) from one install.
clang --target=riscv64-linux-gnu -O2 -S f.cCompiling, linking and reading program files are ordinary file reads and writes; the kernel asks nothing more.
clang package.xcode-select --install).gcc — GNU Compiler CollectionThe GNU C compiler: turns C source into assembly, object files and finally a linked executable, driving the assembler and linker for you.
gcc -c main.cmain.o, without linking.gcc add3.c -o add3add3.gcc -S -O2 f.cf.s, optimised.Compiling, linking and reading program files are ordinary file reads and writes; the kernel asks nothing more.
gcc package (with build-essential on Debian and Ubuntu).xcode-select --install), gcc is really Apple’s clang under that name; real GCC comes from Homebrew.gitVersion control: records snapshots of a tree and the history between them.
git bisectgit log --since="12 months ago" --name-only --pretty=format:git commitReading and writing a repository's files and its history is ordinary file access; the kernel asks nothing more.
git package.xcode-select --install).goThe Go toolchain: builds, tests and runs Go programs, with switches that expose the compiler’s decisions.
go build -gcflags='-m'go build -racego test -raceCompiling, linking and reading program files are ordinary file reads and writes; the kernel asks nothing more.
javaAlso covers javac, jcmd, jmap, jstack
The Java launcher, with the JDK tools beside it: javac compiles to bytecode, and jcmd, jmap and jstack inspect a running JVM.
javac Main.javaMain.class bytecode.jcmd PID Thread.printjmap -histo:live PIDjstack PIDCompiling, linking and reading program files are ordinary file reads and writes; the kernel asks nothing more.
/usr/bin/java is a stub until one is installed.ld.soThe dynamic linker: the program the kernel starts first for a dynamically linked executable, which loads its libraries and binds its symbols before main runs.
LD_PRELOAD=lib.so proglib.so first, so its symbols win.It runs inside your own process. For setuid programs it switches to secure-execution mode, ignoring LD_LIBRARY_PATH and restricting LD_PRELOAD, so they cannot be hijacked.
/lib64/ld-linux-x86-64.so.2.dyld, controlled by DYLD_* variables.ldconfigRebuilds the cache the dynamic linker searches for libraries, after libraries are installed.
ldconfig -pPrinting the cache is open to all; rebuilding it writes /etc/ld.so.cache, which needs root.
dyld keeps its own shared cache.lddLists the shared libraries a program needs and where the dynamic linker would find each one.
ldd /bin/lsIt runs the dynamic linker in a listing mode, so never point it at a program you do not trust.
otool -L prog.dumpbin /dependents prog.exe.llvm-objdumpLLVM’s version of objdump, which can disassemble any architecture LLVM supports, such as RISC-V on an x86 or ARM laptop.
llvm-objdump -d f.oCompiling, linking and reading program files are ordinary file reads and writes; the kernel asks nothing more.
llvm package.xcode-select --install) as objdump; the full LLVM tools are in Homebrew.makeRebuilds only what is out of date, following the rules and dependencies in a Makefile; -j runs independent steps in parallel.
makemake -j4Compiling, linking and reading program files are ordinary file reads and writes; the kernel asks nothing more.
xcode-select --install).nmake, a make for Microsoft’s tools.nm — name listLists the symbols in an object file: which functions and variables it defines and which it still needs from elsewhere.
nm main.oT marks a defined function, U an undefined symbol the linker must resolve.Compiling, linking and reading program files are ordinary file reads and writes; the kernel asks nothing more.
xcode-select --install).dumpbin /symbols.nvcc — NVIDIA CUDA compilerNVIDIA’s CUDA compiler: splits a .cu file into host code and GPU kernels and compiles each.
nvcc vec.cu -o vecCompiling, linking and reading program files are ordinary file reads and writes; the kernel asks nothing more.
objdump — object dumpShows what is inside an object file or executable: section headers, symbols, relocations, and with -d the machine code disassembled.
objdump -d progobjdump -dr main.oobjdump -T /bin/zshCompiling, linking and reading program files are ordinary file reads and writes; the kernel asks nothing more.
objdump, with the Xcode Command Line Tools (xcode-select --install); otool -tv is Apple’s own disassembler.dumpbin /disasm, from Visual Studio.python3Runs Python 3 programs, or an interactive prompt.
python3 app.pyCompiling, linking and reading program files are ordinary file reads and writes; the kernel asks nothing more.
/usr/bin/python3 prompts to install the Command Line Tools; python.org and Homebrew provide others.readelf — read ELFPrints the structure of an ELF file, Linux’s executable format: its header, program headers (what to load where) and section headers.
readelf -h progreadelf -l progreadelf -n /bin/lsCompiling, linking and reading program files are ordinary file reads and writes; the kernel asks nothing more.
otool -l prints their load commands.dumpbin /headers prints theirs.rustcAlso covers cargo
The Rust compiler; projects usually drive it through cargo, Rust’s build tool and package manager.
rustc main.rscargo updateCompiling, linking and reading program files are ordinary file reads and writes; the kernel asks nothing more.
rustup.rustup.rustup.setarch — set architectureRuns a program with a changed execution domain, most usefully with address-space layout randomisation turned off.
setarch -R ./show-R), so addresses repeat from run to run.Changing the execution domain of a program you start is an ordinary request through personality().
What kernel is running, which modules it loaded, and the hardware it found.
dmidecode — DMI decodeDecodes the firmware’s description of the hardware: maker, model, serial number, memory slots and BIOS version.
dmidecode -t memoryThe firmware tables it reads are readable only by root.
dmidecode package.system_profiler SPHardwareDataType.msinfo32, or Get-CimInstance.Not yet taught in a lesson.
insmod — insert moduleInserts one module file into the kernel, with no dependency handling.
insmod hello.koRoot or CAP_SYS_MODULE, as for modprobe.
kmutil load -p path.lscpu — list CPUSummarises the processors: architecture, cores, threads per core, sockets, NUMA nodes and cache sizes.
lscpulscpu -eIt only reads what the kernel publishes under /proc or /sys, which any user may read.
sysctl hw and sysctl machdep.cpu.lsmod — list modulesLists the kernel modules loaded right now, their sizes and which other modules use them.
lsmodIt only reads what the kernel publishes under /proc or /sys, which any user may read. (here /proc/modules).
kmutil showloaded lists loaded kernel extensions.driverquery lists installed drivers.lspci — list PCILists the devices on the PCI and PCI Express buses; -vv adds their capabilities, such as MSI interrupts and link speed.
lspcilspci -vvAny user sees the device list, but some of each device’s configuration space is readable only by root, so -vv shows more under sudo.
system_profiler SPPCIDataType, or ioreg for the full device tree.Get-PnpDevice.lsusb — list USBLists the USB buses and the devices attached to them.
lsusb -tIt only reads what the kernel publishes under /proc or /sys, which any user may read.
usbutils package; often present.system_profiler SPUSBHostDataType.Get-PnpDevice.Not yet taught in a lesson.
modprobe — module probeLoads a kernel module by name, loading the modules it depends on first; -r removes one.
modprobe e1000emodprobe -r e1000eAdding code to the running kernel is the most powerful thing a process can do, so it needs root or CAP_SYS_MODULE.
kmutil load, as root, for extensions Apple’s security settings allow.pnputil /add-driver … /install installs a driver package, as an administrator.nproc — number of processorsPrints how many processors this process may use: the logical CPUs, after any affinity or container limit.
nprocmake -j.It asks the kernel for its own CPU affinity mask.
sysctl -n hw.ncpu; Homebrew’s coreutils adds nproc.NUMBER_OF_PROCESSORS environment variable.rmmod — remove moduleRemoves a loaded module, if nothing is using it.
rmmod e1000eRoot or CAP_SYS_MODULE.
kmutil unload.pnputil /delete-driver removes a driver package.sysctl — system controlReads and sets kernel tunables, the files under /proc/sys.
sysctl vm.dirty_ratiosysctl -w vm.dirty_ratio=10Reading most settings is open to anyone; writing one needs root.
sysctl, with different names (hw.ncpu, vm.swapusage).unamePrints the kernel’s name, release, version and the machine’s architecture.
uname -auname -r6.8.0-45-generic.uname -vPREEMPT).Any process may ask the kernel who it is.
sw_vers gives the macOS version.ver, or systeminfo for more.Interfaces, sockets, routes, packets and firewall rules.
curlSends one request to a URL and prints the response: the everyday tool for testing HTTP APIs.
curl -i https://example.comcurl -X POST -d @body.json -H 'Content-Type: application/json' URLcurl -w '%{time_total}\n' -o /dev/null -s URLOrdinary client sockets.
curl.exe.Not yet taught in a lesson.
digAsks DNS servers a question and prints the full answer: records, their time-to-live, and which server replied.
dig example.comdig +trace example.comOrdinary UDP and TCP queries.
bind9-dnsutils or bind-utils).nslookup, or PowerShell’s Resolve-DnsName.Not yet taught in a lesson.
ethtool — Ethernet toolQueries and tunes a network card’s driver: link speed, offloads, ring sizes and per-queue counters.
ethtool -S eth0Reading is mostly open to anyone; changing settings needs root or CAP_NET_ADMIN.
ethtool package; often present.ifconfig and networksetup -getMedia show the link.Get-NetAdapterStatistics.hostnamePrints, or sets, the machine’s host name, which a UTS namespace can make different per container.
hostnamehostname web1Printing is open to anyone; setting it needs root or CAP_SYS_ADMIN in the UTS namespace.
hostnamectl sets it permanently on systemd.scutil --set HostName sets it permanently.hostname prints it.ipShows and changes network interfaces, addresses, routes and network namespaces.
ip addrip routeip netns add webweb.ip netns exec web ip link set lo upShowing is open to anyone; changing interfaces, routes or namespaces needs root or CAP_NET_ADMIN.
ifconfig and route.ifconfig, route, netstat -rn and networksetup.ipconfig, route print, or Get-NetIPAddress.iperfMeasures the throughput between two machines: one runs a server, the other sends to it as fast as the path allows.
iperf3 -siperf3 -c hostOrdinary TCP or UDP sockets on an unprivileged port.
iperf3 package.iperf3.iptables — IP tablesEdits the kernel’s packet-filter rules: which packets to accept, drop or rewrite.
iptables -L -n -vChanging (and on most systems even listing) firewall rules needs root or CAP_NET_ADMIN.
pfctl controls macOS’s packet filter, pf.New-NetFirewallRule and Windows Defender Firewall.mtrCombines traceroute and ping: keeps probing every hop and shows loss and latency per hop live.
mtr example.commtr -r -c 100 prints a report instead.Its helper, mtr-packet, needs raw sockets, so it is installed setuid root (or with CAP_NET_RAW) and ordinary users can run mtr.
mtr package.mtr, run with sudo.pathping.Not yet taught in a lesson.
nc — netcatNetcat: opens a raw TCP or UDP connection, or listens for one, and pipes it to your terminal.
nc -zv host 5432nc -l 9000Ordinary sockets; listening below port 1024 needs root or CAP_NET_BIND_SERVICE.
Test-NetConnection host -Port 5432 checks a port.Not yet taught in a lesson.
netstat — network statisticsThe older tool for sockets, routes and protocol counters; -s prints per-protocol statistics.
netstat -sIt reads /proc/net, which any user may read.
net-tools package; deprecated in favour of ss and ip.netstat.netstat ships with Windows.nft — netfilter tablesThe nftables front end: the current Linux firewall, which replaces iptables with one rule language for every protocol.
nft list rulesetRoot or CAP_NET_ADMIN, as for iptables.
nftables package, standard on current distributions.pfctl.Not yet taught in a lesson.
opensslA toolkit for keys, certificates and TLS: inspect a server’s certificate chain, make keys, compute hashes.
openssl s_client -connect host:443openssl x509 -in cert.pem -noout -textOrdinary files and sockets.
/usr/bin/openssl is LibreSSL, a fork; OpenSSL itself is in Homebrew.Not yet taught in a lesson.
pingSends ICMP echo requests and reports each reply’s round-trip time, to test whether a host is reachable.
ping -c 4 example.comModern Linux lets ordinary users send pings through ICMP sockets (net.ipv4.ping_group_range); older systems gave the binary the CAP_NET_RAW capability.
ping ships with Windows (-n sets the count).scp — secure copyCopies files to or from another machine over SSH.
scp file host:/tmp/scp -r host:dir .The same as ssh.
Not yet taught in a lesson.
ssLists sockets: listening ports, connections and their states, and their queues.
ss -ltnss -tnss -ltnpAny user sees every socket; which process owns another user’s socket (-p) is shown only to root.
netstat.netstat -an, or lsof -i for owning processes.netstat -ano, or Get-NetTCPConnection.ssh — secure shellLogs in to another machine, or runs one command there, over an encrypted, authenticated connection.
ssh user@hostssh -L 5432:db:5432 bastionA client program; the server checks your key or password. It refuses a private key file other users can read.
tcTraffic control: shapes, delays and drops outgoing packets with queueing disciplines.
tc qdisc showtc qdisc add dev eth0 root netem delay 100msShowing is open to anyone; changing a discipline needs root or CAP_NET_ADMIN.
Not yet taught in a lesson.
tcpdumpCaptures packets on an interface and prints or saves them, filtered by a small expression language.
tcpdump -i eth0 port 443tcpdump -w out.pcapCapturing needs a raw packet socket, which needs root or CAP_NET_RAW (and CAP_NET_ADMIN for promiscuous mode).
tcpdump package; often present.pktmon, Windows’s built-in packet monitor.tracerouteLists the routers on the path to a host, by sending probes whose time-to-live runs out one hop further each time.
traceroute example.comThe default probes are ordinary UDP packets, which any user may send.
traceroute package; tracepath is often present instead.tracert.wgetDownloads files over HTTP, HTTPS or FTP, retrying and resuming as needed.
wget URLOrdinary client sockets.
wget; curl -O does the same.curl.exe -O, or PowerShell’s Invoke-WebRequest.Not yet taught in a lesson.
wrkAn HTTP load generator: holds many connections open and reports requests per second and latency.
wrk -t1 -c50 -d10s http://localhost:8080/Ordinary client sockets.
wrk.Start and stop background services, read their logs, and schedule work.
crontab — cron tableEdits your table of commands to run on a schedule.
crontab -ecrontab -lEach user has their own table; the cron daemon runs each entry as the user who owns it.
launchd.schtasks, or Task Scheduler.Not yet taught in a lesson.
journalctl — journal controlReads the systemd journal: the logs of services and the kernel, filtered by unit, time or priority.
journalctl -u nginxjournalctl -kdmesg shows.journalctl -fIt shows the entries the calling user may read: their own, and everything when run as root or as a member of the groups the system grants log access.
log show and log stream read the unified log.Get-WinEvent.Not yet taught in a lesson.
systemctl — system controlControls systemd, the first process on most Linux systems: starts, stops, enables and inspects services.
systemctl status nginxsystemctl restart nginxsystemctl list-units --failedAnyone may ask about a service; starting, stopping or enabling a system service needs root or an administrator’s approval.
launchctl controls launchd, macOS’s first process.sc query, or the Services console.Not yet taught in a lesson.
Namespaces, containers, virtual machines and the user identities they map.
chroot — change rootRuns a program with a different directory as its root, /.
chroot /srv/jail /bin/sh/srv/jail as the whole file system.Changing the root directory needs root or CAP_SYS_CHROOT, because it could fool setuid programs.
dockerBuilds and runs containers: processes in their own namespaces and cgroups, on a layered file system, managed by the Docker daemon.
docker run --rm -it ubuntu bashdocker run --cpus=2 --memory=1g imgdocker run -v "$PWD":/app imgThe command talks to the Docker daemon, which runs as root unless set up in rootless mode, so Docker warns that only trusted users should control it: whoever does can mount any host directory into a container.
idPrints your user ID, group ID and every group you belong to: the identity the kernel checks permissions against.
idid -uIt asks the kernel for the calling process’s own credentials.
whoami /all.kubectlThe command-line client for Kubernetes: sends declared objects to the cluster’s API server and reads their state back.
kubectl apply -f deployment.yamlkubectl get podskubectl delete namespace nsThe local machine asks nothing of you; the cluster decides what you may do with its own access rules.
kubectl.winget.lsns — list namespacesLists the namespaces on the system and how many processes are in each.
lsnsAny user sees the namespaces of their own processes; root sees them all.
Not yet taught in a lesson.
nsenter — namespace enterRuns a program inside another process’s namespaces, such as a running container’s.
nsenter -t PID -n ss -ltnJoining another process’s namespaces needs root (CAP_SYS_ADMIN, and permission to inspect that process).
Not yet taught in a lesson.
passwd — passwordChanges a password. It must write the root-owned password file, so it is a setuid-root program: the classic example of borrowed authority.
passwdls -l /usr/bin/passwds in its permissions is the setuid bit.Any user may change their own password, because the program runs as root and checks who called it; changing another user’s needs root.
net user name * prompts for a new password.runcThe low-level runtime that actually creates a container’s namespaces, cgroups and mounts from an OCI bundle; Docker and Kubernetes call it for you.
runc run idconfig.json here.Creating namespaces and mounts needs root, unless it runs in rootless mode inside a user namespace.
su — substitute userStarts a shell (or runs a command) as another user, after that user’s password.
su - alicealice.Any user may run it: like passwd, it is setuid root and switches identity only after checking the target’s password.
runas /user:name cmd.Not yet taught in a lesson.
useradd — user addCreates a user account: an entry in /etc/passwd, a user ID, a group and usually a home directory.
useradd -m alicealice with a home directory.It writes the system’s account files, which only root may change.
adduser wraps it.sysadminctl -addUser, or dscl.net user name /add, or New-LocalUser.virshThe command-line client for libvirt, which manages KVM virtual machines: start, stop, inspect and migrate them.
virsh list --allvirsh migrate --live vm qemu+ssh://dest/systemSystem-wide VMs need root or the libvirt group; each user may also run their own session VMs.
Move-VM live-migrates).whoAlso covers w
Lists who is logged in, on which terminal and since when; w adds what each is running and the load average.
wIt reads the login records, which any user may read.
who from coreutils, w from procps-ng.query user (quser).Not yet taught in a lesson.
The programs that read what you type, and the manual that explains the rest.
bash — Bourne-again shellThe Bourne-again shell, the default interactive shell on most Linux systems.
bash -c 'ls; true'An ordinary program.
env — environmentPrints the environment, or runs a program with variables added or removed.
envenv -i PATH=/bin shsh with an empty environment except PATH.The environment is your own process’s memory.
set in cmd, or Get-ChildItem Env:.Not yet taught in a lesson.
man — manualShows the manual page for a command, system call or file format; the number picks the section.
man lsls command (section 1).man 2 forkfork system call (section 2).man -k wordIt reads documentation files.
help in cmd, or Get-Help in PowerShell.sh — shellThe POSIX shell: reads commands, starts a process for each, and wires up pipes and redirections.
sh script.shsh comfile >outputoutput for the command before running it.A shell is an ordinary program that starts other programs.
/bin/sh re-executes as bash, dash or zsh, chosen by a system link.sudoRuns one command as root (or another user), if the system’s sudoers policy lets you.
sudo perf topperf top with root’s powers.sudo -lAny user may run it, but it grants anything only to users the sudoers file names. It works because it is a setuid-root program that checks the policy first.
sudo command.watchReruns a command every few seconds and shows its output full-screen, highlighting what changed.
watch -n 1 -d 'ss -tn'It just runs the command repeatedly.
watch.Not yet taught in a lesson.
whichAlso covers type
Prints which file would run for a command name, by searching PATH.
which python3python3 resolves to.type lsIt only looks at directories.
type and command -v are more exact.where, or PowerShell’s Get-Command.Not yet taught in a lesson.
zsh — Z shellThe Z shell: compatible with sh for scripts, with richer completion and prompts.
zshAn ordinary program.
zsh package.The programs that ship with PostgreSQL: the server, its client, and backup, upgrade and repair tools.
initdbCreates a new database cluster: the data directory, its system catalogs and the template databases. Settings such as data checksums, encoding and default collation are fixed here.
initdb -D datadirinitdb -D datadir --data-checksumsIt works on the data directory’s files, so it must run as the operating-system user that owns them, usually postgres. Not as root: the server refuses to run as root, and so does initdb.
pg_amcheckChecks tables and B-tree indexes for corruption, using the amcheck extension, across a whole database.
pg_amcheck -d db --heapallindexedA client program: the operating system asks nothing special. What it may do inside the database is decided by the PostgreSQL role it connects as. Its checks run as the connected role, which needs permission to use amcheck.
pg_basebackupTakes a physical copy of a running cluster over the replication protocol: the starting point for a standby or a point-in-time recovery.
pg_basebackup -D backup -X stream -Ppg_basebackup --incremental=manifest -D incA client program: the operating system asks nothing special. What it may do inside the database is decided by the PostgreSQL role it connects as. The role needs the REPLICATION attribute.
pg_checksumsEnables, disables or verifies data-page checksums on a cluster that has been shut down cleanly.
pg_checksums --enable -D datadirIt works on the data directory’s files, so it must run as the operating-system user that owns them, usually postgres. Not as root: the server refuses to run as root, and so does initdb.
pg_controldataPrints the cluster’s control file: its state, the latest checkpoint’s position, the next transaction ID, and whether checksums are on.
pg_controldata -D datadirIt works on the data directory’s files, so it must run as the operating-system user that owns them, usually postgres. Not as root: the server refuses to run as root, and so does initdb.
Not yet taught in a lesson.
pg_ctl — PostgreSQL controlStarts, stops, reloads and promotes a server running on a data directory.
pg_ctl -D datadir startpg_ctl -D datadir stop -m fastpg_ctl promote -D datadirIt works on the data directory’s files, so it must run as the operating-system user that owns them, usually postgres. Not as root: the server refuses to run as root, and so does initdb.
pg_dumpExports one database as SQL or an archive, taking a consistent snapshot while the database stays in use.
pg_dump -Fc db > db.dumppg_restore.pg_dump -s dbA client program: the operating system asks nothing special. What it may do inside the database is decided by the PostgreSQL role it connects as. It needs read access to everything it dumps.
pg_isreadyChecks whether a server is accepting connections, for scripts and health checks.
pg_isready -h hostA client program: the operating system asks nothing special. What it may do inside the database is decided by the PostgreSQL role it connects as.
Not yet taught in a lesson.
pg_receivewalStreams the write-ahead log from a server to local files as it is written, for continuous archiving.
pg_receivewal -D walarchive --slot=archiverA client program: the operating system asks nothing special. What it may do inside the database is decided by the PostgreSQL role it connects as. The role needs REPLICATION.
pg_restoreRestores a pg_dump archive, optionally in parallel and selectively.
pg_restore -j 8 -d db db.dumpA client program: the operating system asks nothing special. What it may do inside the database is decided by the PostgreSQL role it connects as.
pg_rewindResynchronises a former primary with the new primary after a failover by copying only the blocks that diverged, instead of a whole new base backup.
pg_rewind -D datadir --source-server='host=newprimary'It works on the data directory’s files, so it must run as the operating-system user that owns them, usually postgres. Not as root: the server refuses to run as root, and so does initdb. The target needs wal_log_hints or data checksums.
pg_test_fsyncMeasures how fast this machine can make writes durable with each sync method, to choose wal_sync_method and to catch storage that lies about flushing.
pg_test_fsync -f /data/testfileIt writes and syncs a test file anywhere you can write.
pg_upgradeUpgrades a cluster to a new major version in place, reusing the data files instead of dumping and reloading them.
pg_upgrade -b oldbin -B newbin -d olddata -D newdata --checkpg_upgrade … --linkIt works on the data directory’s files, so it must run as the operating-system user that owns them, usually postgres. Not as root: the server refuses to run as root, and so does initdb.
pg_waldump — WAL dumpDecodes write-ahead-log files into readable records, for debugging and for measuring what the log contains.
pg_waldump --stats segmentIt reads WAL files, so it needs read access to them, normally as the data directory’s owner.
pgbench — PostgreSQL benchmarkRuns a benchmark against PostgreSQL: a built-in TPC-B-like workload or your own scripts, with many clients, reporting transactions per second and latency.
pgbench -i -s 50 dbpgbench -c 32 -j 8 -T 60 dbA client program: the operating system asks nothing special. What it may do inside the database is decided by the PostgreSQL role it connects as.
Not yet taught in a lesson.
postgresThe database server itself. Normally started for you by a service manager or pg_ctl; run by hand mainly in single-user mode for emergency repair.
postgres --single -D datadir dbIt works on the data directory’s files, so it must run as the operating-system user that owns them, usually postgres. Not as root: the server refuses to run as root, and so does initdb.
psqlPostgreSQL’s interactive terminal: sends SQL to a server and prints the results, with backslash commands for everything else.
psql -h host -U user db\d table\x\timingA client program: the operating system asks nothing special. What it may do inside the database is decided by the PostgreSQL role it connects as.
vacuumdbRuns VACUUM and ANALYZE across a database or a whole cluster from the shell.
vacuumdb --all --analyze-in-stagesA client program: the operating system asks nothing special. What it may do inside the database is decided by the PostgreSQL role it connects as.
No commands match. Clear the search or turn a filter back on.