5 Essential Linux Commands Every Admin Should Know

You can spend years learning Linux, but a surprisingly small set of commands carries you through the vast majority of day-to-day administration. Master these five — really master them, including the flags that matter — and you will troubleshoot faster, script with confidence, and spend less time reaching for the manual.

1. grep — find anything, instantly

grep searches text and command output for patterns. It is the single most useful command for digging through logs and config files.

# find every line containing "error" under /var/log (case-insensitive)
grep -ri "error" /var/log

# show line numbers, and 3 lines of context around each match
grep -n -C 3 "timeout" app.log

# invert the match: show lines that do NOT contain "debug"
grep -v "debug" app.log

# combine with a pipe to filter another command's output
ss -tan | grep ESTAB

Learn -i (ignore case), -r (recursive), -n (line numbers), -v (invert) and -E (extended regex) and you can find almost anything.

2. ss — what is listening and connected

ss is the modern replacement for netstat and is dramatically faster. Use it to answer “what is listening on this box?” and “who is connected?”

# every listening TCP/UDP port, with the owning process
ss -tulpn

# all established TCP connections
ss -tan state established

# connections to a specific port
ss -tn dst :443

3. journalctl — read the logs properly

On systemd-based distributions, journalctl is how you read logs without hunting through files by hand.

# follow a service's logs live (like tail -f)
journalctl -u nginx -f

# only errors and worse, since the last boot
journalctl -p err -b

# everything in the last hour
journalctl --since "1 hour ago"

The combination of -u (unit), -p (priority), -b (boot) and --since/--until lets you zero in on exactly the window you care about.

4. rsync — fast, resumable copies and backups

rsync copies only what changed, can resume interrupted transfers, and works seamlessly over SSH — making it the backbone of countless backup scripts.

# mirror a directory locally, preserving permissions, with progress
rsync -avh --progress /data/ /backup/data/

# copy to a remote server over SSH
rsync -avz /data/ user@server:/srv/data/

# preview what WOULD change without touching anything
rsync -avh --dry-run --delete /data/ /backup/data/

Always test destructive options like --delete with --dry-run first.

5. htop — understand load at a glance

htop is an interactive, colour-coded view of processes, CPU and memory. Sort by CPU or memory, filter by name, view the process tree, and send signals (including kill) without leaving the screen. When a server is “slow”, htop is usually the fastest way to see why.

From running commands to watching continuously

These commands are perfect for answering questions in the moment. But you do not want to be running them by hand at 3 a.m. to discover a disk filled up an hour ago — that is where continuous monitoring comes in.

Key takeaways

• grep finds patterns in files and output — learn -i, -r, -n, -v.
• ss shows listening ports and live connections, faster than netstat.
• journalctl filters systemd logs by unit, priority, boot and time.
• rsync gives you efficient, resumable copies and backups — test with --dry-run.
• htop shows what is eating CPU and memory in real time.

Get comfortable with these five and you will handle most of what a Linux server throws at you.