Bash CLI One-Liners Cheatsheet Bash CLI One-Liners Cheatsheet

find /var/log -name '*.gz' -mtime +30 -delete        # old compressed logs
find . -type f -size +100M                           # large files
find . -name '*.sh' -exec chmod +x {} +              # batch chmod
find . -type f -name '*.yaml' | xargs grep -l 'image:'
find . -name '*.log' -print0 | xargs -0 rm --        # -print0/-0: safe with spaces
find . -type d -empty -delete                        # remove empty dirs
find /etc -newer /etc/hostname -type f               # changed since that file
ls *.png | xargs -P4 -I{} convert {} {}.webp         # -P4: 4 parallel jobs

grep -r 'TODO' src/                    # recursive
grep -rn --include='*.tf' 'aws_s3' .   # line numbers, filter by glob
grep -E 'error|fatal|panic' app.log    # extended regex, alternation
grep -o 'req_id=[a-f0-9]*' app.log     # print only the match
grep -c '500' access.log               # count matching lines
grep -v '^#' config | grep -v '^$'     # strip comments and blanks
grep -B2 -A5 'Traceback' app.log       # context: 2 before, 5 after
grep -i -l 'password' -r . 2>/dev/null # files containing, case-insensitive

sort file | uniq -c | sort -rn | head            # frequency count, descending
sort -t: -k3 -n /etc/passwd                      # numeric sort on field 3
sort -u hosts.txt                                # sort + dedupe in one
sort -h                                          # human sizes: 1K < 2M < 3G
uniq -d sorted.txt                               # only duplicated lines
wc -l < file                                     # line count, no filename
comm -23 <(sort a.txt) <(sort b.txt)             # lines in a but not b
awk '{print $1}' access.log | sort | uniq -c | sort -rn | head   # top IPs

tar czf app.tar.gz app/                # create gzip archive
tar xzf app.tar.gz -C /opt/           # extract to a directory
tar tzf app.tar.gz                    # list contents without extracting
tar czf - /data | ssh host 'cat > /backup/data.tar.gz'   # archive over ssh
tar --exclude='.git' --exclude='node_modules' -czf src.tar.gz .
tar caf app.tar.zst app/              # -a: pick compressor by extension
zstd -T0 bigfile                      # zstd on all cores; much faster than gzip
gzip -dk file.gz                      # decompress, keep original
zcat access.log.gz | grep ' 500 '     # search inside without extracting

curl -I https://example.com                       # headers only
curl -sfSL https://example.com/health             # silent, fail on HTTP errors
curl -o out.bin -L https://example.com/dl         # follow redirects, save
curl -w '%{http_code} %{time_total}s\n' -o /dev/null -s https://api.example.com
curl -X POST https://api.example.com/v1/deploys \
  -H 'Content-Type: application/json' \
  -H "Authorization: Bearer $TOKEN" \
  -d '{"service": "web", "version": "1.4.2"}'
curl --retry 5 --retry-delay 2 --retry-all-errors -sf https://flaky.example.com
curl -u user:pass ftp://host/file                 # basic auth
curl -x http://proxy:3128 https://example.com     # via proxy

curl -s https://api.example.com/pods | jq .              # pretty-print
jq '.items[].metadata.name' pods.json                    # extract a field
jq -r '.token' resp.json                                 # -r: raw, no quotes
jq '.items | length' pods.json                           # count
jq '.[] | select(.status == "failed") | .id' jobs.json   # filter
jq '.[] | {name: .metadata.name, ip: .status.podIP}'     # reshape
jq -r '.[] | [.name, .cpu] | @tsv' nodes.json            # TSV for awk/column
jq -n --arg env "$ENV" '{environment: $env}'             # build JSON from shell
jq 'keys' obj.json                                       # what fields exist?

df -h                                  # filesystem usage
du -sh /var/* | sort -rh | head        # what's eating this disk
du -xh --max-depth=2 / | sort -rh | head -20   # -x: don't cross filesystems
ncdu /var                              # interactive, if installed

ps aux --sort=-%mem | head             # top memory hogs
ps aux --sort=-%cpu | head             # top CPU hogs
ps -ef --forest                        # process tree
top -o %MEM                            # top sorted by memory (htop if you can)
lsof -p 1234                           # files open by PID
lsof +D /var/log                       # who has files open under a dir
lsof -i :8080                          # what's listening on 8080
kill -TERM 1234 && sleep 5 && kill -0 1234 && kill -KILL 1234

ss -tlnp                               # listening TCP sockets + owning process
ss -s                                  # socket summary (state counts)
dig +short example.com                 # just the A record
dig example.com MX                     # specific record type
dig @1.1.1.1 example.com               # query a specific resolver
dig -x 93.184.216.34                   # reverse lookup
nc -zv host 5432                       # is that port open?
nc -l 9000                             # quick listener for testing
timeout 3 bash -c '</dev/tcp/host/443' && echo open   # no nc? pure bash
curl -sv telnet://host:6379 </dev/null # handshake check via curl
ip -br addr; ip route                  # interfaces and routing at a glance

ssh -J bastion.example.com user@10.0.2.15        # jump host
ssh -L 5432:db.internal:5432 bastion             # local port forward
ssh host 'sudo journalctl -u nginx -n 50'        # run remote command
ssh-copy-id user@host                            # install your key

scp file.tar.gz user@host:/tmp/                  # simple copy
scp -r user@host:/var/log/app ./logs/            # recursive pull

rsync -avz --progress ./site/ user@host:/var/www/site/   # sync (mind the slashes)
rsync -avz --delete src/ dst/                    # exact mirror; deletes extras
rsync -avzn --delete src/ dst/                   # -n: ALWAYS dry-run first
rsync -avz -e 'ssh -J bastion' data/ user@internal:/data/

mkdir -p /opt/app/releases/v2 && cd !$    # !$ expands to the new path
history | awk '{print $2}' | sort | uniq -c | sort -rn | head   # your top commands

long_build.sh &                # run in background
jobs -l                        # list jobs with PIDs
fg %1                          # bring job 1 to foreground
bg %1                          # resume a Ctrl-Z'd job in background
kill %2                        # kill by job number
Ctrl-Z                         # suspend current foreground job

nohup ./migrate.sh > migrate.log 2>&1 &   # survive hangup on logout
./worker.sh & disown           # background + detach from the shell
wait                           # block until all background jobs finish
wait -n                        # until any one finishes (bash 4.3+)