Handy One-Liners Worth Memorising

A field kit of terminal one-liners for disk hunts, process wrangling, quick servers and safe deletes.

Every seasoned admin carries a mental toolbox of one-liners. Here are the ones that pay for themselves the first week.

Disk detective

When a disk fills, walk down into the biggest folders instead of guessing: du -h --max-depth=1 . | sort -rh | head. Repeat inside the winner. Remember df shows what the filesystem thinks is used, so if du and df disagree, look for a deleted-but-open file with lsof.

History and reuse

  • !! — the whole previous command; sudo !! re-runs it as root.
  • !$ — the last argument of the previous command (e.g. mkdir foo; cd !$).
  • Ctrl+r — reverse-search your history as you type.

Everyday rescues

  • cd - — jump back to the previous directory.
  • python3 -m http.server 8000 — share the current folder over HTTP in one line.
  • <cmd> | tee file — see output and save it at once.
  • ls | xargs -P4 -I{} gzip {} — run a command over many inputs, four in parallel.

Example

Example · bash
# Which directory is filling the disk? Descend into the biggest.
du -h --max-depth=1 . | sort -rh | head

# du says full but df says empty? A deleted file is still held open.
sudo lsof -nP | grep '(deleted)' | sort -k7 -n | tail

# Re-run the last command as root
sudo !!

# Reuse the last argument: make a dir then enter it
mkdir -p releases/2026-07 && cd !$

# Instantly serve the current folder over HTTP
python3 -m http.server 8000

# Parallelise work over many files (4 at a time), safely previewed first
find logs -name '*.log' -print          # LOOK before you leap
find logs -name '*.log' | xargs -P4 -I{} gzip {}

When to use it

  • A sysadmin runs 'du -sh /* 2>/dev/null | sort -rh | head -10' to identify disk hogs across the entire filesystem in one command.
  • A developer uses 'watch -n 2 "ss -tnp state established | wc -l"' to monitor active connection counts every 2 seconds during a load test.
  • A DevOps engineer runs 'for h in $(cat hosts.txt); do ssh $h uptime; done' to check uptime across a fleet of servers in seconds.

More examples

Find disk space hogs

Uses du+sort to rank top-level directories by size and find to locate individual large files across the filesystem.

Example · bash
# Top 10 largest items from filesystem root
du -sh /* 2>/dev/null | sort -rh | head -10
# 8.2G  /usr
# 3.8G  /var
# 1.1G  /opt

# Largest files over 100MB anywhere
find / -type f -size +100M -exec ls -lh {} \; 2>/dev/null

Monitor connections and processes

Uses watch to refresh a command's output on an interval, creating a live dashboard from simple commands.

Example · bash
# Watch active TCP connection count every 2 seconds
watch -n 2 'ss -tnp state established | wc -l'

# Monitor top CPU consumers in real time
watch -n 1 'ps aux --sort=-%cpu | head -6'

Fleet command execution loop

Shows sequential and parallel server loops; 'wait' ensures all background SSH jobs complete before the script proceeds.

Example · bash
# Run a command across multiple servers from a list
for host in web1 web2 web3; do
  echo "=== $host ==="
  ssh "$host" 'uptime && df -h / | tail -1'
done

# Parallel version using & (fire-and-forget)
for host in web1 web2 web3; do
  ssh "$host" 'systemctl restart nginx' &
done
wait  # wait for all background jobs to finish

Related

linux pro text comboslinux disk usagelinux sudo

Discussion

  • Be the first to comment on this lesson.