File operations deal with "where things are," and process management deals with "what is running." This article covers "what is inside" and "how the machine is doing."
Viewing file contents#
cat — print everything at once
cat file.txt # 全部打印到终端
cat -n file.txt # 带行号
cat a.txt b.txt # 拼接两个文件输出Good for short files. Long files scroll past too quickly; use the next tool instead.
less — browse one page at a time
less file.txt # 进入浏览模式，按 q 退出
less -N file.txt # 带行号Keyboard shortcuts inside less:
Space/b— move down / up one page/关键词— search forward;nfor the next match,Nfor the previous match?关键词— search backwardg/G— jump to the beginning / endq— quit
head and tail — view the beginning and end
head file.txt # 前 10 行
head -n 20 file.txt # 前 20 行
tail file.txt # 后 10 行
tail -n 20 file.txt # 后 20 行tail -f — follow the end of a file in real time
tail -f /var/log/syslog # 日志有新内容就实时显示An excellent tool for watching logs. Press Ctrl+C to stop following.
Searching text#
grep — search text contents
grep "关键词" file.txt # 搜文件中的匹配行
grep -i "error" log.txt # 忽略大小写
grep -r "关键词" dir/ # 递归搜整个目录
grep -n "关键词" file.txt # 显示行号
grep -v "排除词" file.txt # 反向：显示不匹配的行
grep -c "关键词" file.txt # 只计数，不显示内容The most common combination:
grep -rn "TODO" . # 递归搜当前目录所有文件，显示行号
ps aux | grep nginx # 在 ps 输出中筛选
history | grep git # 在历史命令中搜索Simple text processing#
wc — count
wc file.txt # 行数 单词数 字节数
wc -l file.txt # 只看行数
wc -w file.txt # 只看单词数sort — sort lines
sort file.txt # 按字母排序
sort -n file.txt # 按数字排序
sort -r file.txt # 倒序
sort -u file.txt # 去重
du -sh * | sort -hr # 文件大小从大到小排（常用组合）cut — extract columns
cut -d':' -f1 /etc/passwd # 以 : 为分隔，取第 1 列
cut -d',' -f1,3 data.csv # 简单逗号分隔文本的第 1、3 列；不能解析带引号/逗号的通用 CSVdiff — compare two files
diff file1 file2 # 逐行对比差异
diff -y file1 file2 # 并排显示System information#
System overview
uname -a # 内核版本、架构等全部信息
hostname # 主机名
uptime # 开了多久了Memory and CPU
free -h # 内存使用情况（-h = 人类可读）
lscpu # CPU 详细信息（几核、什么型号）
nproc # 当前进程可用的处理单元数量，不等同物理核数How to read the output of free -h:
| Column | Meaning |
|---|---|
| total | Total memory |
| used | Used |
| available | Actually available (including reclaimable cache) |
Look at available, not free. Linux uses idle memory for caching, so a small free value with a large available value is normal.
Disks and devices
df -h # 各分区还剩多少空间
lsblk # 列出所有块设备（硬盘/U 盘）
lsusb # 列出 USB 设备
lspci # 列出 PCI 设备（显卡/网卡等）Checking distribution information
cat /etc/os-release # 你是什么 Linux（NixOS/Ubuntu/Arch...）Networking#
ip — inspect network interfaces (replaces the older ifconfig command)
ip a # 所有网络接口的 IP 地址
ip route # 路由表（默认网关在哪）ping — test connectivity
ping 192.0.2.1 # 示例地址；替换为已知可达且允许探测的目标
ping -c 4 example.com # 只发 4 个包就停ss — see what is listening on ports (replaces the older netstat command)
ss -tlnp # 只看 TCP 监听端口
ss -tlnp | grep 8080 # 8080 端口被谁占了curl — make HTTP requests from the command line
curl https://example.com # GET 请求，输出响应体
curl -I https://example.com # 只看响应头
curl -O https://example.com/file.zip # 下载文件（-O = 保留原名）
curl -o my.zip https://example.com/file.zip # 下载并重命名wget — download files
wget https://example.com/file.zip # 下载到当前目录
wget -c https://example.com/file.zip # 断点续传Quick reference for everyday tasks#
| I want to... | Command |
|---|---|
| View logs | tail -f /var/log/xxx.log |
| Find every TODO in the code | grep -rn "TODO" . |
| Check how much memory is available | free -h |
| Check how much disk space is left | df -h |
| Find which ports are in use | ss -tlnp | grep 端口号 |
| Download a file | curl -O URL |
| See where two files differ | diff file1 file2 |
| Count regular files in the current directory (GNU find) | find . -maxdepth 1 -type f -printf 'x\n' | wc -l |
/var/log/syslog does not exist on every distribution; systems using the systemd journal can use journalctl -f. The process information shown by ss -p is restricted by permissions. A failed ping may simply mean the destination filters ICMP.
References & further reading
Adapted from technical notes. Examples use generic names.