# Top 20 largest files in current directory
du -ah . | sort -rh | head -20

# Find files larger than 100MB
find . -type f -size +100M -exec ls -lh {} \;

# Quick directory sizes
du -sh */ | sort -rh

# Search for text in all files recursively
grep -r "search term" /path/to/search

# With line numbers and file names
grep -rn "function" src/

# Only show matching filenames
grep -rl "TODO" .

# Case insensitive, only .js files
grep -ri "error" --include="*.js" .

# Replace spaces with underscores
rename 's/ /_/g' *.jpg

# Add prefix to all files
for f in *.txt; do mv "$f" "prefix_$f"; done

# Remove extension from all files
for f in *.bak; do mv "$f" "${f%.bak}"; done

# Show last lines as file grows (like tailing logs)
tail -f /var/log/nginx/error.log

# Follow with highlights
tail -f app.log | grep --color=always "ERROR"

# Show last N lines and follow
tail -n 50 -f /var/log/syslog

# Find process using port 3000
lsof -i :3000
# or
ss -tlnp | grep :3000
# or
netstat -tlnp | grep :3000

# Kill process on port 3000
kill $(lsof -t -i:3000)

# Real-time process view (like Task Manager)
htop
# If not installed: top

# Sort by memory usage
ps aux --sort=-%mem | head -15

# Find zombie processes
ps aux | awk '{if($8=="Z") print}'

# Process tree
pstree -p

# Run command in background
long-running-command &

# Bring back to foreground
fg

# List background jobs
jobs

# Send specific job to background
Ctrl+Z (pause) -> bg (background)

# Test if port is open
nc -zv example.com 443
# or
telnet example.com 443

# DNS lookup
dig example.com
# or
nslookup example.com

# Trace route
traceroute example.com

# HTTP request (no curl needed!)
wget -qO- http://localhost:3000/health

# Real-time network usage
iftop
# or
nethogs   # Per-process bandwidth

# Download speed test
curl -o /dev/null -w "Speed: %{speed_download} bytes/s\n" https://example.com/file.zip

# Check disk usage
df -h

# Check inode usage (sometimes you run out of inodes, not space!)
df -i

# Find largest directories
du -sh /* | sort -rh | head -10

# Clean package cache
apt clean && apt autoremove -y    # Ubuntu/Debian
yum clean all                     # RHEL/CentOS

# Clean journal logs
journalctl --vacuum-size=100M

# Clean old logs
find /var/log -name "*.gz" -mtime +30 -delete
find /var/log -name "*.log" -mtime +30 -exec truncate -s 0 {} \;

# Overview
free -h

# Detailed per-process memory
smem     # If installed

# Swap usage
swapon --show

# Clear page cache (safe to do)
sync && echo 3 > /proc/sys/vm/drop_caches

# Pretty-print JSON from API response
curl -s api.example.com/data | python3 -m json.tool

# Extract specific field
curl -s api.example.com/data | python3 -c "import sys,json; print(json.load(sys.stdin)['key'])"

# Validate JSON
python3 -m json.tool < data.json > /dev/null && echo "Valid JSON" || echo "Invalid"

# Get column 2 from CSV
awk -F',' '{print $2}' data.csv

# Sum a column
awk -F',' '{sum+=$2} END {print sum}' data.csv

# Filter rows where column > value
awk -F',' '$2 > 100' data.csv

# Count lines, words, characters
wc file.txt

# Count occurrences of each word
tr ' ' '\n' < file.txt | sort | uniq -c | sort -rn | head -20

# Find unique lines
sort file.txt | uniq -u

# Create user with home directory
useradd -m -s /bin/bash newuser

# Set password
passwd newuser

# Add to sudo group
usermod -aG sudo newuser

# Switch user
su - newuser

# Run command as another user
sudo -u www-data command

# Start/stop/restart service
systemctl start nginx
systemctl restart nginx
systemctl status nginx

# Enable/disable at boot
systemctl enable nginx
systemctl disable nginx

# View logs for service
journalctl -u nginx -f

# Failed services
systemctl list-units --failed

# Edit crontab
crontab -e

# List current jobs
crontab -l

# Format:
# ┌───────────── minute (0-59)
# │ ┌───────────── hour (0-23)
# │ │ ┌───────────── day of month (1-31)
# │ │ │ ┌───────────── month (1-12)
# │ │ │ │ ┌───────────── day of week (0-6, Sun=0)
# * * * * * command

# Examples:
0 */6 * * * /path/to/script.sh        # Every 6 hours
*/30 * * * * /path/to/every30min.sh    # Every 30 minutes
0 9 * * 1-5 /path/to/weekday.sh       # 9 AM weekdays
@reboot /path/to/onboot.sh             # On system boot

# UFW (Uncomplicated Firewall)
ufw status                    # Check status
ufw enable                    # Enable firewall
ufw allow 22                  # Allow SSH
ufw allow 80                  # Allow HTTP
ufw allow 443                 # Allow HTTPS
ufw deny 3306                 # Block MySQL from outside
ufw reload                    # Apply changes

# iptables (if no UFW)
iptables -L -n                # List rules
iptables -A INPUT -p tcp --dport 22 -j ACCEPT

# Generate key pair
ssh-keygen -t ed25519 -C "my-key"

# Copy key to server
ssh-copy-id user@server

# Disable password login (after setting up keys)
# In /etc/ssh/sshd_config:
# PasswordAuthentication no
# PermitRootLogin no
# Port 2222  # Change default port

# Restart SSH after changes
systemctl restart sshd

# Check status
fail2ban-client status

# Check specific jail
fail2ban-client status sshd

# Unban an IP
fail2ban-client set sshd unbanip 1.2.3.4

# View banned IPs
fail2ban-client status sshd | grep "Banned IP"

# Undo last commit (keep changes staged)
git reset --soft HEAD~1

# Discard all uncommitted changes
git checkout -- .

# Stash everything
git stash save "WIP feature X"

# See what changed since last commit
git diff --stat

# Find who changed a line
git blame filename

# Search commit messages
git log --grep="bug fix"

# Interactive rebase (clean up history)
git rebase -i HEAD~5

# Merge conflict? See which files are conflicted
git diff --name-only --diff-filter=U

# Abort a bad merge
git merge --abort

# Force push (be careful!)
git push --force-with-lease origin main

# Recover deleted branch
git reflog  # Find the SHA, then git checkout -b recovered-name SHA

# Running containers
docker ps              # Only running
docker ps -a           # All including stopped

# Container details
docker inspect container_id | jq '.[0].State'

# Enter running container
docker exec -it container_name sh

# Container logs
docker logs -f container_name

# Resource usage
docker stats

# Cleanup (free significant disk space!)
docker system prune -af
docker volume prune -f

# Why won't it start?
docker logs container_name

# Run with shell instead of entrypoint
docker run --rm -it --entrypoint sh image_name

# Copy file out of container
docker cp container_name:/path/to/file ./local_file

# Image size breakdown
docker history image_name

# Server health overview
echo "=== CPU ===" && top -bn1 | head -5 && \
echo "=== MEM ===" && free -h && \
echo "=== DISK ===" && df -h / && \
echo "=== LOAD ===" && uptime && \
echo "=== TOP PROCESSES ===" && ps aux --sort=-%cpu | head -6

# Multiple logs at once
tail -f /var/log/nginx/access.log /var/log/nginx/error.log

# Filter errors in real time
tail -f /var/log/app.log | grep -E "ERROR|FATAL|CRITICAL"

# Log rotation check
ls -lh /var/log/*.gz | tail -5

# How long has the server been up?
uptime

# Last reboot date
who -b

# Recent logins
last -10

# Command history with timestamps
export HISTTIMEFORMAT='%F %T '
history | tail -20

# Add to ~/.bashrc
alias ll='ls -alF'
alias la='ls -A'
alias l='ls -CF'
alias ..='cd ..'
alias ...='cd ../..'
alias ports='ss -tlnp'
alias myip='curl -s ifconfig.me'
alias weather='curl -s wttr.in'
alias serve="python3 -m http.server 8000"
alias dstop='docker stop $(docker ps -q)'
alias gpush='git add -A && git commit -m "update" && git push'
alias nrestart='sudo systemctl restart nginx'
alias nlogs='sudo tail -f /var/log/nginx/error.log'
alias dfree='df -h | grep -E "^/dev|^Filesystem"'
alias psgrep='ps aux | grep -v grep | grep'

# Server slow?
top → htop → check CPU/memory → kill rogue process

# Disk full?
df -h → du -sh /* | sort -rh → find large files → clean

# Website down?
systemctl status nginx → ss -tlnp → tail -f /var/log/nginx/error.log

# Can't connect?
ss -tlnp → ufw status → iptables -L → ping → traceroute

# Got hacked?
last → w → cat /var/log/auth.log | grep "Failed" → fail2ban status