Linux Commands For Developers: The 50 Commands You Use Daily

# grep — search file contents
grep -r "TODO" ./src # Recursive search
grep -rn "console.log" ./src # With line numbers
grep -rl "TODO" ./src # Only filenames (not content)
grep -E "error|warning" app.log # Extended regex (OR)
grep -v "DEBUG" app.log # Invert: exclude DEBUG lines
grep -A 3 -B 3 "ERROR" app.log # 3 lines after AND before match

# find — find files by any criteria
find . -name "*.ts" -type f # All TypeScript files
find . -mtime -1 -type f # Modified in last 24h
find . -size +10M -type f # Files over 10MB
find . -name "*.log" -exec rm {} \; # Delete all log files
find . -name "*.js" -exec grep -l "require" {} \; # JS files using require

# sed — stream editor for text transformation
sed 's/old/new/g' file.txt # Replace all occurrences
sed -i 's/old/new/g' file.txt # In-place replacement
sed -n '5,10p' file.txt # Print lines 5-10
sed '/^#/d' config.txt # Delete comment lines

# Process inspection
ps aux | grep node # Find Node.js processes
ps aux --sort=-%cpu | head -10 # Top 10 CPU-consuming processes
ps aux --sort=-%mem | head -10 # Top 10 memory consumers

# Kill processes
kill -9 PID # Force kill by PID
pkill -f "node server.js" # Kill by command name pattern
killall node # Kill all node processes

# Background jobs
nohup ./start.sh & # Run in background, survives logout
command & # Background job
jobs # List background jobs
fg 1 # Bring job 1 to foreground
bg 1 # Send job 1 to background

# Resource monitoring
top # Interactive process monitor
htop # Better top (if installed)
vmstat 1 # Memory/CPU stats every second
iostat 1 # Disk I/O stats
free -h # Memory usage human-readable

# Port and connection inspection
netstat -tlnp # All listening ports with PID
ss -tlnp # Modern alternative to netstat
lsof -i :3000 # What's using port 3000
lsof -p PID # All files opened by process
curl -I https://example.com # HTTP headers only
curl -o /dev/null -w "%{http_code}" https://example.com # Just status code

# SSH power user
ssh -L 5432:db-server:5432 user@bastion # Port forward: local 5432 → remote DB
ssh -R 8080:localhost:3000 user@server # Expose local port on remote
ssh -N -f user@server -L 5432:localhost:5432 # Background tunnel

# Network debugging
ping -c 4 google.com # 4 ICMP pings
traceroute google.com # Show network hops
curl -v https://example.com # Verbose: see headers, TLS, timing
wget -O output.html https://example.com # Download to file

# Real-time log watching
tail -f /var/log/app.log # Follow live updates
tail -f /var/log/app.log | grep ERROR # Follow + filter
journalctl -fu myservice # systemd service logs, follow

# Log analysis one-liners
# Count error occurrences by type:
grep "ERROR" app.log | awk '{print $5}' | sort | uniq -c | sort -rn

# Top 10 IP addresses from nginx access log:
awk '{print $1}' /var/log/nginx/access.log | sort | uniq -c | sort -rn | head -10

# Response time distribution from nginx:
awk '{print $NF}' /var/log/nginx/access.log | sort -n | awk '
BEGIN{a[""]=0} {a[int($1*10)/10]++} END{for(i in a)print i, a[i]}' | sort -n

# Find slow requests (>1s):
awk '$NF > 1.0 {print $0}' /var/log/nginx/access.log