Linux command line essentials

In short

The Linux command line is a text interface in which a shell (usually bash) reads commands, asks the kernel to run them as processes, and prints the result on a terminal. It matters because almost every server, cloud instance, build agent, database host and network device an Indian IT engineer touches is Linux with no graphical desktop, so file handling, permissions, logs, processes and services are all driven from the shell. University syllabi examine it under Operating Systems / Linux lab (shell commands, file permissions, process management, shell programming) and GATE-CS examines the underlying OS concepts (processes, signals, scheduling, file systems). Placement and interview rounds at TCS, Infosys, Wipro, HCLTech, Cognizant, Accenture, Capgemini, LTIMindtree and every support/DevOps/SRE role test it directly - "find the biggest file", "why is the CPU at 100%", "change permission to 755" - and certifications RHCSA, LFCS and CompTIA Linux+ are built on it.

Explained

Shell, kernel and how a command is executed

• Kernel manages CPU, memory, devices and files; the shell is a user-space program that parses your line and asks the kernel to execute it. Common shells: bash (default on most distros), sh (POSIX), zsh, dash, ksh, fish. echo $SHELL shows yours.
• Steps when you press Enter: shell expands aliases → expands braces, tildes, variables, command substitution and arithmetic → splits into words → expands wildcards (pathname expansion) → resolves the command → forks a child process → execs the binary → waits → collects the exit status.
• Built-in vs external: cd, export, echo, pwd, alias are built into the shell (no new process); ls, cp, grep are binaries on disk. type cmd, which cmd, command -v cmd tell you which.
• PATH: colon-separated list of directories searched for external commands. echo $PATH. A command in the current directory needs ./script.sh because . is not on PATH (deliberately, for safety).
• Exit status $?: 0 = success, 1-125 = error, 126 = found but not executable, 127 = command not found, 128+N = killed by signal N (so 137 = 128+9 = SIGKILL).
• Command structure: command [-short --long options] [arguments]. man ls, info, ls --help, apropos permission are the built-in documentation; manual sections 1 = user commands, 5 = file formats, 8 = admin commands (man 5 passwd differs from man 1 passwd).
• Shell types: login shell (reads /etc/profile, ~/.bash_profile), non-login interactive (~/.bashrc), non-interactive script. Logout-persistent settings go in ~/.bashrc/~/.bash_profile.

Filesystem hierarchy, navigation and file operations

• Linux has a single inverted tree rooted at / - no drive letters; other disks are mounted onto directories (mount, /etc/fstab, lsblk, df -h).
• FHS directories: /bin, /sbin, /usr (programs), /etc (configuration), /var (logs, spool, mail - /var/log), /home (user data), /root (root's home), /tmp (world-writable scratch), /opt (third-party), /proc and /sys (virtual kernel interfaces), /dev (device files), /boot (kernel, initramfs), /mnt, /media, /run.
• Paths: absolute starts at /; relative uses . (current), .. (parent), ~ (home), - (previous directory, with cd -).
• Navigation and listing: pwd, cd, ls -l (long), -a (hidden), -h (human sizes), -t (by time), -R (recursive), -i (inode). tree.
• Create/remove/copy/move: touch, mkdir -p, cp -r, cp -p (preserve), mv (rename and move are the same operation), rm -r, rmdir, ln (hard link - same inode), ln -s (symbolic link - a path pointer that can cross filesystems and can dangle).
• Viewing: cat, tac, less (pager, / to search, q to quit), head -n 20, tail -n 50, tail -f (follow a growing log - the single most used log command), wc -l, file, stat, od -c.
• File types in the first character of ls -l: - regular, d directory, l symlink, c character device, b block device, p named pipe, s socket.
• Searching: find /var/log -name "*.log" -size +100M -mtime -7, find . -type f -exec grep -l error {} +, locate (database, needs updatedb), which, whereis.
• Timestamps: atime (access), mtime (content modified), ctime (inode changed) - there is no creation time in traditional ext filesystems. Filesystems: ext4 (default on most Indian deployments), XFS (RHEL default), Btrfs, ZFS, and tmpfs for RAM-backed mounts.

Users, groups, ownership and permissions

• Every file has an owner (user), a group, and three permission triads: user / group / others, each with read (r = 4), write (w = 2), execute (x = 1).
• On a directory: r = list names, w = create/delete/rename entries inside, x = enter/traverse and access by name. A directory with r but no x is almost useless; w on a directory lets you delete a file you cannot write.
• Commands: chmod 755 file, chmod u+x,go-w file, chmod -R, chown user:group file, chgrp, umask, ls -l, stat -c %a file (numeric mode).
• Special bits: setuid (4) - run with owner's identity (/usr/bin/passwd); setgid (2) - on a binary run with group's identity, on a directory new files inherit the directory's group (team shares); sticky bit (1) - in a world-writable directory only the owner can delete their files (/tmp is mode 1777).
• umask is a mask of bits to *remove*. Base mode is 666 for files and 777 for directories (files never get x by default). Typical defaults: 022 for root, 002 or 022 for users.
• Accounts: /etc/passwd (name:x:UID:GID:comment:home:shell), /etc/shadow (hashed passwords, root-readable only), /etc/group. UID 0 = root. useradd, usermod -aG group user, userdel, passwd, id, whoami, groups, who, w, last.
• Privilege escalation: su - (become another user), sudo cmd (run one command as root, configured in /etc/sudoers via visudo, logged). Best practice is sudo with logging, never shared root passwords.
• ACLs for finer control: setfacl -m u:ravi:rw file, getfacl file; the + after the mode in ls -l indicates an ACL. SELinux (RHEL) / AppArmor (Ubuntu) add a mandatory-access layer *on top of* permissions - a denial can come from SELinux even when the mode looks right (getenforce, ausearch).
• Legal note: accessing files or accounts you are not authorised to is an offence under the Information Technology Act, 2000 (unauthorised access and related provisions, including sections 43 and 66) - permissions are a technical control, not the only one.

Redirection, pipes and text processing

• Three standard streams: stdin (0), stdout (1), stderr (2).
• Redirection: > overwrite, >> append, < input, 2> errors, &> or >file 2>&1 both, 2>/dev/null discard errors, <<EOF here-document, |& not portable - prefer 2>&1 |.
• Pipe | connects one command's stdout to the next command's stdin; tee writes to a file and passes data on; xargs converts input lines into arguments (find . -name '*.tmp' -print0 | xargs -0 rm).
• Filters: grep (-i ignore case, -v invert, -r recursive, -n line numbers, -c count, -E extended regex, -w whole word), sort (-n, -r, -k2, -u), uniq -c (needs sorted input), cut -d: -f1, tr, paste, join, comm, nl, diff, patch, split, rev.
• sed - stream editor: sed 's/old/new/g' f, sed -i in place, sed -n '10,20p', sed '/^#/d'.
• awk - field/record processor: awk -F: '{print $1, $3}' /etc/passwd, awk '$9==500 {n++} END{print n}' access.log, awk '{s+=$1} END{print s/NR}'.
• Regular expressions: ^ start, $ end, . any char, * zero or more, + one or more (ERE), [abc], [^abc], \{2,4\}, \<word\>. Distinguish regex from shell globbing (*, ?, [a-z], {a,b}), which the shell expands before the command ever runs.
• Quoting: 'single' = no expansion; "double" = expands $var, ` cmd , \; backslash escapes one character. $(cmd) is command substitution; $((2+3))` is arithmetic.

Processes, jobs, signals and resource monitoring

• A process is a running program with a PID, a parent (PPID), an owner, a state and a priority. PID 1 is init/systemd, the ancestor of all.
• Inspect: ps aux (BSD style) or ps -ef (System V), ps -eo pid,ppid,%cpu,%mem,comm --sort=-%cpu, pgrep -f name, pstree, top/htop (interactive), /proc/<pid>/.
• States: R running, S interruptible sleep, D uninterruptible sleep (usually disk/NFS wait), T stopped, Z zombie (finished but parent has not reaped it - fix by fixing or restarting the parent; a zombie uses no CPU).
• Job control: cmd & background, Ctrl+Z suspend, jobs, fg %1, bg %1, nohup cmd & or setsid/screen/tmux to survive logout, disown.
• Signals: kill -l lists them. SIGHUP 1 (hang-up / reload config), SIGINT 2 (Ctrl+C), SIGQUIT 3, SIGKILL 9 (cannot be caught or ignored - last resort, no cleanup), SIGTERM 15 (default, graceful), SIGSTOP 19 / SIGCONT 18, SIGUSR1 10. kill -15 PID, killall name, pkill -u ravi.
• Priority: nice -n 10 cmd (range −20 highest to +19 lowest; only root can set negative), renice -n 5 -p PID.
• Resources: free -h (note the available column, not free - Linux uses spare RAM as cache), vmstat 1, iostat, uptime (1/5/15-minute load averages), df -h (disk space), df -i (inodes - a disk can be "full" with inodes exhausted), du -sh *, lsof, ss -tulpn (replaces netstat), dmesg, sar.
• Services and boot: systemctl start|stop|restart|reload|status|enable|disable|is-enabled name, systemctl list-units --type=service, unit files in /etc/systemd/system, systemctl daemon-reload after editing; logs via journalctl -u nginx -f, journalctl --since "1 hour ago". Older SysV: service name status, chkconfig, runlevels 0-6 (now systemd targets).
• Scheduling: crontab -e with five fields min hour day-of-month month day-of-week; */5 * * * * = every five minutes; @reboot; system-wide in /etc/crontab and /etc/cron.d. at for one-off, systemd timers as the modern alternative. Always use absolute paths in cron - cron's PATH is minimal.

Packages, archives, networking and remote access

• Package managers: Debian/Ubuntu - apt update, apt install, apt remove, dpkg -i, dpkg -l; RHEL/Rocky/CentOS/Oracle Linux - dnf/yum install, rpm -qa, rpm -ql pkg; SUSE - zypper. India-specific distributions include BOSS GNU/Linux from C-DAC (used in government offices and schools) and KITE GNU/Linux in Kerala's school IT programme.
• Archives and compression: tar -cvzf app.tar.gz dir/ create, -xvzf extract, -tvf list; gzip/gunzip, bzip2, xz, zip/unzip. Mnemonic: *c*reate, e*x*tract, *t*est/list; z = gzip, j = bzip2, J = xz, f = file.
• Networking: ip a / ip r (replace ifconfig, route), ping, traceroute/mtr, dig/nslookup, curl -I url, wget, ss -tulpn, telnet host port or nc -zv host port for port checks, /etc/hosts, /etc/resolv.conf, firewall via firewall-cmd or ufw/iptables/nftables.
• Remote work: ssh user@host, key-based login (ssh-keygen, ssh-copy-id, private key mode must be 600), scp file user@host:/path, rsync -avz --progress src/ host:/dst/ (incremental, resumable - preferred for large transfers), sftp, ~/.ssh/config, port forwarding ssh -L 8080:localhost:80 host.
• Editors: vi/vim - command mode vs insert mode (i), :w write, :q quit, :wq, :q! discard, dd delete line, yy/p copy-paste, /text search, :%s/a/b/g replace all. nano for quick edits. Knowing vi is expected because it is present on every server.
• Logs and compliance: application and system logs live under /var/log (syslog, messages, secure/auth.log, dmesg), rotated by logrotate (/etc/logrotate.conf). CERT-In's directions of 28 April 2022 require Indian service providers to maintain ICT system logs for 180 days within Indian jurisdiction, so retention and rotation settings are a real audit item; personal data in logs also attracts the Digital Personal Data Protection Act, 2023 (operative provisions are being brought in through notified rules, so check the current status before quoting obligations).

Shell scripting essentials

• A script starts with a shebang: #!/bin/bash; make it executable with chmod +x script.sh; run as ./script.sh or bash script.sh.
• Variables: name="ravi" (no spaces around =), use as $name or ${name}; export VAR to pass to child processes; readonly; positional parameters $0 $1 $2, $# count, $@ all args, $$ own PID, $? last exit status, $! last background PID.
• Conditions: if [ "$a" -eq 5 ]; then ... elif ... else ... fi. Numeric tests -eq -ne -lt -le -gt -ge; string tests =, !=, -z empty, -n non-empty; file tests -f regular file, -d directory, -e exists, -r -w -x, -s non-empty. Prefer [[ ... ]] in bash and always quote variables.
• Loops: for i in 1 2 3, for f in *.log, for ((i=0;i<5;i++)), while read -r line; do ...; done < file, until, with break/continue. case ... esac for menus.
• Functions: backup() { tar -czf "$1.tar.gz" "$1"; }; return sets an exit status, echo returns data.
• Robustness: set -euo pipefail (exit on error, on unset variable, and on any failing stage of a pipeline), trap 'rm -f "$tmp"' EXIT, mktemp for temp files, logger to write to syslog, shellcheck to lint.
• Operators: && run if previous succeeded, || run if it failed, ; always, ( ) subshell, { } current shell.

Key points

• Shell - a program that interprets commands; bash is the usual default and reads ~/.bashrc for interactive sessions.
• Everything is a file - devices, pipes, sockets and kernel data (/proc, /sys) are accessed with file operations.
• Absolute vs relative path - absolute begins with /; relative is resolved from the current directory.
• Permission digits - r=4, w=2, x=1 per triad; 755 = rwxr-xr-x, 644 = rw-r--r--, 600 = private file.
• Directory x bit - needed to enter or traverse; without it, read permission alone cannot open files inside.
• umask - subtracts bits from base 666 (files) / 777 (directories); it masks, it does not set.
• Special bits - setuid 4, setgid 2, sticky 1; /tmp is 1777 so users cannot delete each other's files.
• Three streams - stdin 0, stdout 1, stderr 2; 2>&1 merges errors into output.
• Pipe vs redirection - | feeds another command, > feeds a file; > overwrites, >> appends.
• grep/sed/awk - search lines, edit streams, process fields; the standard text toolkit.
• Glob vs regex - the shell expands globs before execution; regex is interpreted by the command.
• SIGTERM 15 vs SIGKILL 9 - 15 asks politely and allows cleanup; 9 cannot be caught, so data may be lost.
• Zombie process - exited but not reaped by its parent; consumes a PID slot, not CPU.
• Load average - runnable+waiting processes over 1/5/15 min; compare it against the number of CPU cores.
• Inode - the metadata structure; df -i exhaustion makes a disk "full" with free bytes remaining.
• **tail -f and journalctl -u … -f** - the first move when diagnosing a live service.
• systemctl + crontab - run services at boot and jobs on a schedule; cron needs absolute paths.
• rsync over scp - incremental, resumable, bandwidth-friendly for large or repeated transfers.
• **set -euo pipefail** - the one-line habit that stops a script from continuing after a silent failure.

Formulas and examples

Example 1 - umask to effective permissions. A user has umask 027. What mode does a new file and a new directory get?

• File: base 666; umask 027 removes group w (2) and others r,w,x (7) → user 6, group 6−2 = 4, others 6−6 = 0 → 640 (rw-r-----).
• Directory: base 777 → user 7, group 7−2 = 5, others 7−7 = 0 → 750 (rwxr-x---).
• Check: umask -S prints u=rwx,g=rx,o=. To make new files group-writable for a team, use umask 002 → file 664, directory 775.

Example 2 - symbolic and numeric chmod on a shared project directory. Requirement: owner full access, group read/write/enter, others nothing, and every new file inside must belong to the group devs.

• Owner rwx = 4+2+1 = 7; group rwx = 7; others = 0 → 770. Setgid = 2 → full mode 2770.
• chgrp devs /srv/project && chmod 2770 /srv/project → ls -ld shows drwxrws---. The s replaces the group x; a capital S would mean setgid set *without* x, which is a misconfiguration.
• A script inside needing execution for all: chmod 755 run.sh = rwxr-xr-x. A private SSH key: chmod 600 ~/.ssh/id_rsa - ssh refuses a key readable by others.

Example 3 - reading a load average. uptime on a 4-vCPU cloud VM reports load average: 3.60, 2.90, 1.80.

• 1-minute: 3.60/4 = 0.90 → 90% busy; 5-minute: 2.90/4 = 0.725 → 72.5%; 15-minute: 1.80/4 = 0.45 → 45%.
• Load is rising, so investigate now: top -o %CPU, then ps -eo pid,%cpu,comm --sort=-%cpu | head. On 8 cores the same 3.60 would be only 45% - a load figure is meaningless without the core count (nproc).
• If a process shows state D with low CPU, the bottleneck is I/O, not CPU - check iostat -x 1 and df -h.

Example 4 - exit status arithmetic. A job is killed with kill -9 4821; the shell reports status 137.

• 137 − 128 = 9 = SIGKILL, so it was force-killed (commonly by an administrator, or by the kernel OOM-killer - confirm with dmesg | grep -i oom).
• Compare: 143 = 128+15 = SIGTERM (graceful shutdown), 130 = 128+2 = Ctrl+C, 127 = command not found (usually a typo or missing PATH entry), 126 = found but not executable (missing chmod +x).

Example 5 - log retention and transfer sizing. An application writes 2.5 GiB of logs a day. Compliance requires 180 days of retention; gzip achieves roughly 10:1 on text logs.

• Raw: 2.5 × 180 = 450 GiB. Compressed at 10:1: 45 GiB - so logrotate with compress and rotate 180 (daily) fits comfortably on a 100 GiB volume, while uncompressed would not.
• Shipping one day's compressed archive (2.5/10 = 0.25 GiB) over a 8 Mbit/s link: 0.25 × 1024 = 256 MiB = 256 × 8 = 2048 Mibit → 2048 × 1.048576 ≈ 2147 Mbit → 2147/8 ≈ 268 s ≈ 4.5 minutes. Uncompressed it would take about 45 minutes, which is why rsync -z and tar -czf are standard.

Where it is used

• IT services and support (TCS, Infosys, Wipro, HCLTech, Tech Mahindra, Cognizant, Accenture, Capgemini): L1/L2 production-support engineers triage incidents with tail, grep, df, ps, systemctl against SLAs.
• DevOps, cloud and SRE roles: AWS EC2, Azure VMs and Google Compute instances are reached over SSH; every container image build, deployment script and CI job is shell underneath.
• Banking, telecom and public-sector systems: core banking, UPI/NPCI switch infrastructure, BSNL/Jio/Airtel network elements and NIC-hosted government portals run on RHEL/Oracle Linux; C-DAC's BOSS Linux is deployed in government offices and schools.
• Data engineering and analytics: Hadoop, Spark, Kafka, PostgreSQL and MySQL are administered from the shell; awk, sort, cut still beat writing a program for quick log forensics.
• Embedded, networking and security: routers, set-top boxes and IoT gateways run embedded Linux with BusyBox; SOC analysts and penetration testers work from Kali/Parrot command lines.
• Academic and exam settings: OS labs, GATE-CS process/file-system questions, and certification tracks RHCSA, LFCS and CompTIA Linux+.

Interview questions

• Q: What is the difference between chmod 777 and chmod 755? A: 777 gives read, write and execute to everyone, which is a security risk; 755 gives full access to the owner and read-plus-execute to group and others - the normal mode for scripts and web directories.
• Q: Difference between a hard link and a soft link? A: A hard link is another directory entry for the same inode, limited to one filesystem and not allowed for directories; a symbolic link stores a path, can cross filesystems and point to directories, and breaks if the target is removed.
• Q: How do you find which process is using the most memory? A: ps -eo pid,user,%mem,rss,comm --sort=-%mem | head or press M in top; then confirm with free -h whether memory pressure is real or just page cache.
• Q: df shows space free but writes fail with "No space left on device" - why? A: The filesystem has run out of inodes (check df -i), or a deleted file is still held open by a process (check lsof | grep deleted) and the space is not released until it closes.
• Q: Difference between kill -9 and kill -15? A: -15 (SIGTERM) asks the process to shut down and lets it flush and clean up; -9 (SIGKILL) is handled by the kernel, cannot be trapped, and risks corrupt files or orphaned locks.
• Q: What is a zombie process and how do you remove it? A: A process that has exited but whose status has not been reaped by its parent; you cannot kill it, you fix or restart the parent so it calls wait, or PID 1 adopts and reaps it.
• Q: What does grep -r "pass" . | grep -v test do? A: It searches recursively from the current directory for lines containing "pass" and then removes matching lines that also contain "test" - a pipeline of filters.
• Q: How would you schedule a backup every day at 2:30 a.m.? A: crontab -e and add 30 2 * * * /usr/local/bin/backup.sh >> /var/log/backup.log 2>&1, using absolute paths because cron runs with a minimal environment.
• Q: What does umask 022 mean practically? A: New files are created 644 and new directories 755 - group and others lose write permission while keeping read.
• Q: Why is 2>&1 written after > file and not before? A: Redirections are applied left to right; > file 2>&1 points stdout to the file and then duplicates stderr onto it, whereas 2>&1 > file would leave stderr on the original terminal.
• Q: How do you keep a long job running after you log out? A: Run it under nohup cmd &, setsid, tmux or screen, or as a systemd service - otherwise SIGHUP on logout ends it.
• Q: What is the difference between $() and ${}? A: $(cmd) is command substitution (runs a command and inserts its output); ${var} is parameter expansion (inserts a variable's value, with optional defaults such as ${var:-default}).

Common mistakes

• Running rm -rf with a variable or wildcard unchecked - rm -rf $DIR/ with DIR empty becomes rm -rf /; test with echo first and avoid a stray space.
• Writing a = 5 in a shell script - spaces around = make the shell look for a command named a; it must be a=5.
• Leaving variables unquoted, so a filename with a space or a glob is split into several arguments; always use "$var".
• Confusing glob with regex, for example grep *.log instead of grep -r "pattern" *.log, or expecting ls patterns to behave like grep patterns.
• Setting permissions instead of ownership (or the reverse), and chmod 777 to "fix" a problem that was really a missing directory x bit, a wrong group or an SELinux denial.
• Using uniq without sort first - uniq only collapses *adjacent* duplicate lines, so counts come out wrong.
• Forgetting that cron has a minimal PATH and no interactive environment, so a script that works in the shell fails silently at 2 a.m.; and editing a systemd unit without systemctl daemon-reload.

Related topics

Operating systems: processes and scheduling · Cloud computing basics · Containers: Docker and Kubernetes · DevOps and CI/CD basics · Monitoring and site reliability engineering · Computer networks and TCP/IP