Linux Tips, Tricks and Tutorials on Linuxize

sudo Cheatsheet

hello@linuxize.com (Linuxize) — Sun, 20 Sep 2026 09:25:00 +0200

Basic Usage

Run commands with elevated privileges.

Command	Description
`sudo command`	Run a command as root
`sudo -u username command`	Run a command as another user
`sudo -g groupname command`	Run a command with another primary group
`sudo -u#1000 command`	Run as a user ID instead of a name
`sudo -i`	Open a root login shell that reads root’s profile
`sudo -s`	Open a root shell that keeps the current directory
`sudo -e /etc/hosts`	Edit a root-owned file with an editor running as your user
`sudo -b command`	Run the command in the background
`sudo -- command -l`	Stop option parsing so the flags reach the command
`sudo !!`	Re-run the previous command with `sudo` in Bash or Zsh

Password Caching

Control how often sudo asks for a password.

Command	Description
`sudo -v`	Refresh the cached credentials without running a command
`sudo -k`	Invalidate the cache for the current terminal
`sudo -K`	Remove the cached credentials for every terminal
`sudo -n command`	Fail with an error instead of prompting, for cron and scripts
`sudo -A command`	Read the password from the program named in `SUDO_ASKPASS`
`sudo -p "Password for %u: " command`	Set a custom prompt
`Defaults timestamp_timeout=10`	Cache the password for 10 minutes
`Defaults timestamp_timeout=0`	Prompt for every command
`Defaults timestamp_type=global`	Share one timestamp across all terminals

Debian and Ubuntu packages ship a 15 minute timeout, while Fedora and RHEL keep the upstream five minute default.

Listing Privileges

Check what a rule actually grants before you rely on it.

Command	Description
`sudo -l`	List the commands the current user may run
`sudo -ll`	List the same rules in long form
`sudo -l -U username`	List another user’s privileges as root or an authorized user
`sudo -l /usr/bin/systemctl`	Check whether one command is permitted
`sudo -V`	Print the version, and as root the full `Defaults` list
`id -nG`	List group membership, which `%group` rules match on
`getent group sudo`	Show the members of the `sudo` group

Environment Handling

sudo builds a new environment rather than passing yours through.

Command	Description
`sudo -E command`	Request preservation of the current environment
`sudo --preserve-env=http_proxy command`	Request preservation of only the named variables
`sudo -H command`	Set `HOME` to the target user’s home directory
`sudo env`	Print the environment `sudo` actually builds
`sudo env PATH="/opt/tool/bin:/usr/bin" command`	Run with an explicit trusted `PATH` instead of `secure_path`
`Defaults env_reset`	Strip the caller’s environment, the default on most distros
`Defaults env_keep += "http_proxy https_proxy"`	Let named variables through `env_reset`
`Defaults secure_path="/usr/sbin:/usr/bin:/sbin:/bin"`	Replace `PATH` for every `sudo` command
`Defaults always_set_home`	Set target `HOME` when `env_reset` does not already do so

sudo exports SUDO_USER, SUDO_UID, SUDO_GID, and SUDO_COMMAND into the command environment, so a privileged script can recover who called it.

Redirects and Pipes

The shell expands > and | before sudo runs, so redirects need their own root process.

Command	Description
`sudo echo text > /root/file`	Usually fails: the shell opens the file as your user
`sudo sh -c 'echo text > /root/file'`	Run the whole line, redirect included, as root
`echo text \| sudo tee /root/file`	Write the file as root
`echo text \| sudo tee -a /root/file`	Append to the file as root
`echo text \| sudo tee /root/file > /dev/null`	Write without echoing the content back
`sudo sh -c 'cmd1 && cmd2'`	Chain several commands under one `sudo` call
`sudo cat /root/file \| grep pattern`	Read as root, filter as your user

Editing the sudoers File

Never open /etc/sudoers in a plain editor. A syntax error there can disable sudo access.

Command	Description
`sudo visudo`	Edit `/etc/sudoers` with a syntax check on save
`sudo visudo -c`	Check every sudoers file without editing
`sudo visudo -f /etc/sudoers.d/webops`	Edit a drop-in file with the same check
`sudo visudo -s`	Treat undefined aliases and alias cycles as errors
`@includedir /etc/sudoers.d`	Parse eligible files in the drop-in directory
`sudo chown root:root /etc/sudoers.d/webops`	Set the required owner and group
`sudo chmod 0440 /etc/sudoers.d/webops`	Set the permissions a drop-in file requires
`sudo ls /etc/sudoers.d`	List the files in the drop-in directory

On sudo older than 1.9.1 the directive is written #includedir /etc/sudoers.d. Despite the leading #, that line is not a comment. Drop-in files whose names contain a dot or end in ~ are skipped.

visudo reads SUDO_EDITOR, VISUAL, and EDITOR when the policy lets those variables through. A command rule that matches ALL implies SETENV, while a rule granting only /usr/sbin/visudo must add SETENV or preserve the editor variables. To avoid depending on that policy, open a root shell with sudo -i, then run EDITOR=/usr/bin/vim visudo.

sudoers Rule Syntax

Each rule reads user host=(runas:rungroup) tagged commands.

Rule	Description
`username ALL=(ALL:ALL) ALL`	Full access for one user
`%sudo ALL=(ALL:ALL) ALL`	Full access for a group, Debian and Ubuntu
`%wheel ALL=(ALL) ALL`	Full access for a group, Fedora and RHEL
`username ALL=(ALL) NOPASSWD: ALL`	Skip the password prompt for every command
`username ALL=(ALL) NOPASSWD: /usr/bin/systemctl restart nginx`	Skip the prompt for one exact command
`username ALL=(www-data) /usr/bin/php`	Run one command as a service account
`username ALL=(ALL) NOEXEC: /usr/bin/less`	Block child commands where `NOEXEC` is supported
`username ALL=(ALL) PASSWD: /usr/bin/su`	Force a prompt for one command inside a `NOPASSWD` rule

Command paths generally must be absolute. A rule listing apt never matches; write /usr/bin/apt. Wildcards in command arguments can match whitespace, so exact arguments or anchored regular expressions are safer. Do not use an editor as a security boundary: /usr/bin/vim can start a shell even without a wildcard.

Aliases

Aliases keep long rule sets readable and reduce repetition.

Declaration	Description
`User_Alias ADMINS = alice, bob, %ops`	Name a set of users or groups
`Runas_Alias SUPERUSER = root`	Name a set of target users
`Host_Alias WEB = web01, web02, 10.0.5.0/24`	Name a set of hosts
`Cmnd_Alias NGINX = /usr/bin/systemctl restart nginx, /usr/bin/systemctl reload nginx`	Name a set of exact commands
`ADMINS WEB=(SUPERUSER) NGINX`	Combine aliases in a rule
`ADMINS ALL=(root) NOPASSWD: NGINX`	Apply a tag to a command alias

Alias names start with an uppercase letter and contain uppercase letters, digits, or underscores. The parser resolves aliases across the complete policy, so a definition may appear before or after a rule that uses it.

Defaults Directives

Policy settings that apply to every matching sudo call.

Directive	Description
`Defaults env_reset`	Run commands with a clean environment
`Defaults secure_path="/usr/sbin:/usr/bin:/sbin:/bin"`	Fixed `PATH` for `sudo` commands
`Defaults timestamp_timeout=15`	Minutes before the password is asked for again
`Defaults passwd_tries=3`	Password attempts before `sudo` gives up
`Defaults targetpw`	Ask for the target user’s password, not the caller’s
`Defaults lecture=never`	Skip the warning shown on first use
`Defaults mail_badpass`	Mail the administrator after a failed password
`Defaults:username timestamp_timeout=30`	Apply a setting to one user
`Defaults@web01 log_output`	Apply a setting on one host
`Defaults!/usr/sbin/visudo env_keep += "SUDO_EDITOR VISUAL EDITOR"`	Preserve editor variables for `visudo`

Logging and Auditing

By default, sudoers logs allowed and denied commands as well as errors.

Command	Description
`sudo journalctl _COMM=sudo`	Show `sudo` events from the systemd journal
`sudo journalctl -t sudo -S today`	Show today’s events by syslog tag
`sudo grep sudo /var/log/auth.log`	Read the log on Debian and Ubuntu
`sudo grep sudo /var/log/secure`	Read the log on Fedora, RHEL, and derivatives
`Defaults logfile="/var/log/sudo.log"`	Write a dedicated `sudo` log file
`Defaults log_input, log_output`	Record full sessions for replay
`sudo sudoreplay -l`	List the recorded sessions
`sudo sudoreplay ID`	Replay one recorded session

Troubleshooting

What the common failures mean and where to look.

Message	Check
`username is not in the sudoers file`	Add the user to `sudo` on Debian and Ubuntu or `wheel` on Fedora and RHEL, then log in again
`sudo: unable to resolve host name`	Map the current hostname in `/etc/hosts`, such as `127.0.1.1 name`
`sudo: command not found` or `sudo: name: command not found`	The shell cannot find `sudo`, or the target command is missing or outside `secure_path`
`sorry, you are not allowed to set the following environment variables`	Preserve the variable or grant `SETENV` narrowly
`sorry, you are not allowed to preserve the environment`	Grant `SETENV`; matching `ALL` implies it unless `NOSETENV` overrides it
`>>> /etc/sudoers: syntax error near line N <<<`	Press `e` to re-edit; `Q` force-saves the broken file
`sudo: no tty present and no askpass program specified`	Use `-n` to fail fast, configure `-A`, or grant `NOPASSWD` narrowly
`sudo: effective uid is not 0`	Check root ownership, setuid, `nosuid`, and NFS mounts; repair from root or recovery

Deeper reading on privilege escalation and user administration.

Guide	Description
sudo Command in Linux	Full `sudo` guide with examples, sudoedit, and credential caching
How to Add User to Sudoers in Ubuntu	Grant sudo access on Debian and Ubuntu
How to Add User to Sudoers in CentOS	Grant sudo access on RHEL and derivatives
How to Run sudo Command Without Password	Set up a `NOPASSWD` rule safely
su Command in Linux	Switch user accounts instead of running one command
su cheatsheet	Quick reference for `su`

nice and renice Commands in Linux: Set Process Priority

hello@linuxize.com (Linuxize) — Fri, 18 Sep 2026 18:00:00 +0200

When you run a CPU-heavy task on a shared server, a long compile job or a background backup can slow down everything else. Linux lets you give that process a lower priority, so it receives a smaller share of CPU time when it competes with other work. Use nice to adjust the priority when you start a command and renice to change the priority of a process that is already running.

This guide explains how nice values work in Linux and how to use nice and renice to start and adjust processes at different priority levels.

How Nice Values Work

For processes using normal time-sharing or batch scheduling, the kernel uses a nice value to decide how much CPU time they should receive relative to competing processes. The range goes from -20 (highest priority) to 19 (lowest priority). New processes inherit their parent’s nice value, which is usually 0.

A higher nice value means the process is “nicer” to other work and receives a smaller CPU share under contention. A lower nice value gives it a larger share. Without contention, even a process at nice 19 can use a full CPU core. Niceness does not set a CPU usage limit.

On most systems, regular users can only increase the nice value of their own processes (lower their priority). Decreasing the value normally requires root privileges, even when changing it from 10 back to 0. An administrator can allow exceptions through the RLIMIT_NICE resource limit.

You can check the current nice value of a process in the NI column of ps or top :

Terminal
ps -eo pid,ni,comm

For example, the output may look like this:

output

 PID NI COMMAND
1 0 systemd
842 0 sshd
1024 10 rsync

The rsync process in the example above is running with a nice value of 10, which is lower priority than the default.

nice Command Syntax

The nice command runs a command with an adjustment to the inherited nice value:

txt
nice [OPTION] [COMMAND [ARGS]...]

With no command, nice prints its current nice value, inherited from your shell:

Terminal
nice

In a shell with the usual nice value of 0, the output is:

output

This does not change the shell’s priority. When you pass a command, nice adds 10 to the inherited nice value unless you choose a different adjustment with -n.

The examples below assume a starting nice value of 0 and use GNU nice from coreutils and renice from util-linux, the implementations commonly found on Linux.

Running a Command With Lower Priority

To try the default adjustment without creating files or running a heavy workload, use nice to run another copy of itself:

Terminal
nice nice

The second nice prints the adjusted value:

output

The outer command adds 10 to the inherited value of 0. The inner command only prints that value and exits.

For a practical example, you can run an archive job at a lower CPU priority. Choose an unused archive filename and replace /var/www with a directory you can read:

Terminal
nice tar -czf backup.tar.gz /var/www

The tar process runs with a nice value of 10 instead of 0. This can help interactive programs stay responsive when they compete with the archive job for CPU time.

You can choose a different adjustment with the -n option. For example, to add 15 when running an existing build script:

Terminal
nice -n 15 ./build.sh

From a starting value of 0, the build script runs at nice 15. If your shell already has a nice value of 10, the result is 19, the maximum allowed value, rather than 15.

Running a Command With Higher Priority

To raise a command’s priority, use a negative adjustment. This normally requires root privileges. For example, a regular user without a suitable nice resource limit can try:

Terminal
nice -n -5 nice

From a starting value of 0, GNU nice reports the failed adjustment and the inner command prints the unchanged value:

output

nice: cannot set niceness: Permission denied
0

GNU nice still runs the command after this permission error, so the warning does not mean the workload was stopped.

With sudo , you can normally apply the adjustment:

Terminal
sudo nice -n -5 nice

When the starting value is 0, the inner command prints:

output

-5

This command runs as root. To raise the priority of a job you already started as your own user, use sudo renice as shown below. Changing its nice value does not change its owner.

Use negative values carefully. A CPU-heavy process at nice -20 can leave competing work with little CPU time.

renice Command Syntax

The renice command changes the nice value of a process that is already running:

txt
renice PRIORITY [-p|-g|-u] IDENTIFIER...

By default, renice interprets the identifier as a process ID. The -p option makes that explicit, -g targets a process group, and -u targets processes owned by a given user.

Unlike nice -n, the priority in this form is an absolute nice value. For example, renice 10 -p PID sets the value to 10; it does not add 10.

In util-linux, renice -n 10 also sets an absolute value by default, but it becomes a relative adjustment when the POSIXLY_CORRECT environment variable is set. We use the form without -n to keep the examples unambiguous. See the renice manual for details.

Changing the Priority of a Running Process

To lower the priority of a running process, find its PID with ps or pgrep , then pass it to renice. Replace 4821 with the PID of your process:

Terminal
renice 10 -p 4821

If the process starts at nice 0, the output is:

output

4821 (process ID) old priority 0, new priority 10

The output confirms the change from 0 to 10.

To try this on a harmless process, start sleep in the background, capture its PID, and change its nice value:

Terminal
sleep 60 &
job_pid=$!
renice 10 -p "$job_pid"
ps -p "$job_pid" -o pid,ni,comm

$! holds the PID of the last background job. The NI column from ps should show 10. The process exits on its own after 60 seconds, so run the following examples before it finishes.

To change the value again, pass the new absolute value:

Terminal
renice 15 -p "$job_pid"

This changes the nice value from 10 to 15, rather than adding 15 to it.

Restoring the value to 0 raises the process’s priority and normally requires sudo:

Terminal
sudo renice 0 -p "$job_pid"

On Linux, nice values are per thread. Renicing a PID does not automatically update every worker thread or an existing child process. Newly created children inherit the calling thread’s nice value.

Renicing All Processes for a User

To adjust the current processes owned by a user, pass the username with -u. For example, if your backup jobs run under an account named backup:

Terminal
sudo renice 15 -u backup

This sets the account’s current processes to nice 15. It does not configure a permanent default for the account or change jobs that will start independently later.

Renicing a Process Group

To target a process group, use -g with the process group ID (PGID). First, list process IDs and their groups:

Terminal
ps -eo pid,pgid,ni,comm

If the jobs you want to adjust belong to group 1820, set their nice value to 5:

Terminal
sudo renice 5 -g 1820

Replace 1820 with the PGID you found. A process group can contain several commands from the same job, such as the stages of a shell pipeline.

Quick Reference

Task	Command
Show the nice value inherited from your shell	`nice`
Add `10` when starting a command	`nice command`
Add `15` when starting a command	`nice -n 15 command`
Subtract `5` when starting a command as root	`sudo nice -n -5 command`
Set a running process to nice `10`	`renice 10 -p PID`
Restore a running process to nice `0`	`sudo renice 0 -p PID`
Set a user’s current processes to nice `15`	`sudo renice 15 -u USER`
Set processes in a group to nice `5`	`sudo renice 5 -g PGID`

Troubleshooting

nice: cannot set niceness: Permission denied
You tried to apply a negative adjustment without permission to raise priority. Use sudo when appropriate, or choose a nonnegative adjustment. GNU nice still runs the command at its inherited nice value after this warning.

renice reports permission denied or operation not permitted
You tried to change a process you do not own, or to decrease a nice value without the required privileges. On most systems, even restoring your own process from nice 10 to 0 requires sudo.

renice reports no such process
The process has exited or the PID is wrong. Find the current PID with ps or pgrep and try again. In the sleep example above, the process disappears after 60 seconds.

Nice value does not seem to affect performance
Nice values matter when processes compete for CPU time. On an idle system, a niced process can still use a full CPU core. Use htop to check whether the workload is CPU-bound.

Autogrouping and cgroup CPU scheduling also affect how CPU time is shared. With autogrouping enabled, changing niceness in one terminal session may have little effect on a job in another session. Process nice values apply within the same scheduling group; see the Linux scheduling documentation for the details.

A backup still slows down disk access
nice and renice adjust CPU scheduling, so they do not directly set disk I/O priority. Some I/O schedulers derive a default I/O priority from CPU niceness, but the behavior depends on the scheduler. Use ionice when you need to set I/O priority explicitly, and check whether your active I/O scheduler supports it.

Conclusion

For a long job that can wait, start with the default nice adjustment and check its NI value with ps. If you prefer to adjust priorities interactively, see how to change nice values in htop .

Nginx Cheatsheet

hello@linuxize.com (Linuxize) — Wed, 16 Sep 2026 17:45:00 +0200

Service and CLI Commands

Control the service and check the configuration before it goes live.

Command	Description
`sudo systemctl reload nginx`	Apply a new configuration without dropping connections
`sudo systemctl start nginx`	Start the service
`sudo systemctl stop nginx`	Stop the service immediately
`sudo systemctl restart nginx`	Stop and start the service
`sudo systemctl status nginx`	Show the service state and recent log lines
`sudo systemctl enable --now nginx`	Start now and at every boot
`sudo nginx -t`	Test the configuration for syntax errors
`sudo nginx -T`	Test and print the full merged configuration
`sudo nginx -s reload`	Reload through the master process signal
`sudo nginx -s quit`	Shut down gracefully after current requests finish
`sudo nginx -s reopen`	Reopen the log files after rotation
`nginx -V`	Print the version and the configure arguments

Always run nginx -t before a reload. A failed reload leaves the old configuration running, but a restart with a broken file leaves the service down.

Configuration Layout

Where the files live and how a site is switched on.

Path	Description
`/etc/nginx/nginx.conf`	Main configuration file
`/etc/nginx/conf.d/*.conf`	Common include pattern; verify it in `nginx.conf`
`/etc/nginx/sites-available/`	Site definitions on Ubuntu and Debian
`/etc/nginx/sites-enabled/`	Symlinks to the active sites
`/etc/nginx/snippets/`	Reusable fragments on Ubuntu and Debian
`/var/www/html`	Default document root on Ubuntu and Debian
`/usr/share/nginx/html`	Default document root on Fedora and RHEL
`/var/log/nginx/`	Access and error logs
`sudo ln -s /etc/nginx/sites-available/example.com /etc/nginx/sites-enabled/`	Enable a site on Ubuntu and Debian
`sudo unlink /etc/nginx/sites-enabled/default`	Disable the default site

Fedora and RHEL have no sites-available directory. Put each site in its own file under /etc/nginx/conf.d/ instead.

Server Blocks

Directives that decide which server block answers a request.

Directive	Description
`listen 80;`	Listen on IPv4 port 80
`listen [::]:80;`	Listen on IPv6 port 80
`listen 80 default_server;`	Serve requests matching no other server name
`server_name example.com www.example.com;`	Match these host names
`server_name *.example.com;`	Match any subdomain
`server_name _;`	Invalid name used as a catch-all placeholder
`root /var/www/example.com;`	Set the document root
`index index.html index.htm;`	File served when a directory is requested
`include /etc/nginx/snippets/ssl.conf;`	Pull in a shared fragment

Nginx matches the exact name first, then the longest wildcard starting with an asterisk, then the longest wildcard ending with one, and finally the first matching regular expression.

Location Matching

Modifiers that set both the match rule and its priority.

Directive	Description
`location = /health { ... }`	Exact match, checked first and wins immediately
`location ^~ /static/ { ... }`	Prefix match that suppresses the regex pass
`location ~ \.php$ { ... }`	Case-sensitive regular expression
`location ~* \.css$ { ... }`	Case-insensitive regular expression
`location /images/ { ... }`	Plain prefix match
`location / { ... }`	Fallback for every request
`location @fallback { ... }`	Named location, reachable only from `error_page` or `try_files`

Nginx checks the exact match first, then stores the longest matching prefix. If that prefix uses ^~, it is used right away. Otherwise the regular expressions are tried in file order and the first match wins. The stored prefix is used only when no regular expression matches.

Serving Files

Map a request to a file on disk and decide what happens when it is missing.

Directive	Description
`root /var/www/example.com;`	Append the current normalized URI path, without the query string
`alias /srv/media/;`	Replace the matched location prefix with this path
`try_files $uri $uri/ =404;`	Try the file, then the directory, then return 404
`try_files $uri $uri/ /index.html;`	Single-page application fallback
`try_files $uri $uri/ /index.php?$query_string;`	WordPress and PHP framework fallback
`autoindex on;`	Generate a directory listing
`error_page 404 /404.html;`	Serve a custom error page
`error_page 502 503 504 /5xx.html;`	One page for several statuses
`sendfile on;`	Copy files to the socket in the kernel

With root, nginx appends the current normalized URI path without the query string, so location /images/ with root /data serves /data/images/cat.png. With alias, the matched prefix is replaced instead, so the same location with alias /data/pictures/ serves /data/pictures/cat.png. Keep the trailing slash on both the location and the alias.

Reverse Proxy

Forward requests to an application and pass on the client details.

Directive	Description
`proxy_pass http://127.0.0.1:3000;`	Forward to a local application
`proxy_pass http://backend;`	Forward to a named upstream group
`proxy_set_header Host $host;`	Pass the original host name
`proxy_set_header X-Real-IP $remote_addr;`	Pass the client address
`proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;`	Append the client to the forwarding chain
`proxy_set_header X-Forwarded-Proto $scheme;`	Tell the application whether TLS was used
`proxy_http_version 1.1;`	Use HTTP/1.1 for upstream keepalive and WebSocket upgrades
`proxy_set_header Upgrade $http_upgrade;`	Pass the WebSocket upgrade request
`proxy_set_header Connection "upgrade";`	Complete the WebSocket handshake
`proxy_read_timeout 300s;`	Wait longer for a slow response
`proxy_buffering off;`	Stream the response as it arrives

The trailing slash changes the result. proxy_pass http://127.0.0.1:3000; forwards the full request URI, while proxy_pass http://127.0.0.1:3000/; replaces the matched location prefix with /.

Load Balancing

Spread traffic across a pool of backends. Define the pool in http and put the other directives inside upstream.

Directive	Description
`upstream backend { server 10.0.0.1:8080; server 10.0.0.2:8080; }`	Define a pool, round-robin by default
`least_conn;`	Send each request to the least busy server
`ip_hash;`	Pin a client address to one server
`hash $request_uri consistent;`	Distribute by key with minimal reshuffling
`server 10.0.0.1:8080 weight=3;`	Take three times the usual share
`server 10.0.0.2:8080 max_fails=3 fail_timeout=30s;`	After three qualifying failures within 30 seconds, mark unavailable for 30 seconds
`server 10.0.0.3:8080 backup;`	Use only when the others are down
`server 10.0.0.4:8080 down;`	Take a server out of rotation
`server unix:/run/app.sock;`	Proxy to a Unix socket
`keepalive 32;`	Cache up to 32 idle upstream connections per worker

Choose only one of least_conn, ip_hash, or hash; round-robin is the default. The backup parameter cannot be combined with hash or ip_hash. On nginx versions older than 1.29.7, set proxy_http_version 1.1; and proxy_set_header Connection ""; in the proxy location to use HTTP/1.1 upstream keepalive. Since 1.29.7, HTTP/1.1 and upstream keepalive are enabled by default, and the default proxy configuration no longer sends Connection: close.

HTTPS and TLS

Terminate TLS and keep the protocol settings current.

Directive	Description
`listen 443 ssl;`	Accept TLS connections
`http2 on;`	Enable HTTP/2 on nginx 1.25.1 and later
`listen 443 ssl http2;`	Enable HTTP/2 on older releases
`ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;`	Certificate and intermediate chain
`ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;`	Private key
`ssl_protocols TLSv1.2 TLSv1.3;`	Allow only modern protocol versions
`ssl_prefer_server_ciphers off;`	Let the client pick from the allowed ciphers
`ssl_session_cache shared:SSL:10m;`	Share the session cache between workers
`ssl_session_timeout 1d;`	Keep sessions resumable for a day
`add_header Strict-Transport-Security "max-age=63072000" always;`	Send HSTS on every response
`sudo certbot --nginx -d example.com -d www.example.com`	Issue and install a certificate

Keep the private key readable by root only. Never copy a key into a repository or a document root, and add *.pem to .gitignore when the configuration lives in version control.

Redirects and Rewrites

Move URLs without losing the original path.

Directive	Description
`return 301 https://$host$request_uri;`	Redirect every request to HTTPS
`return 301 https://www.example.com$request_uri;`	Redirect to the www host
`return 302 /maintenance.html;`	Temporary redirect
`return 444;`	Close the connection without a response
`rewrite ^/old/(.*)$ /new/$1 permanent;`	301 rewrite that keeps the path tail
`rewrite ^/old/(.*)$ /new/$1 redirect;`	The same rewrite as a 302
`rewrite ^/blog/(.*)$ /$1 last;`	Rewrite internally and restart location matching
`rewrite ^/api/(.*)$ /$1 break;`	Rewrite internally and stop processing rewrites

Prefer return over rewrite for plain redirects. It is faster, easier to read, and it skips the regular expression evaluation that rewrite performs on every request.

Access Control and Limits

Guard the upstream against oversized uploads and traffic spikes. Use htpasswd -c only for a new password file, because it overwrites an existing one.

Directive	Description
`client_max_body_size 64m;`	Raise the upload size limit
`allow 10.0.0.0/8;`	Permit a network
`deny all;`	Block everything else
`auth_basic "Restricted";`	Turn on HTTP basic authentication
`auth_basic_user_file /etc/nginx/.htpasswd;`	Point to the password file
`sudo htpasswd -c /etc/nginx/.htpasswd admin`	Create a new password file, first creation only
`sudo htpasswd /etc/nginx/.htpasswd editor`	Add or update a user in the existing file
`limit_req_zone $binary_remote_addr zone=req:10m rate=10r/s;`	Define a rate limit zone in `http`
`limit_req zone=req burst=20 nodelay;`	Apply the zone with a burst allowance
`limit_conn_zone $binary_remote_addr zone=conn:10m;`	Define a connection limit zone in `http`
`limit_conn conn 10;`	Limit active connections to ten per address
`server_tokens off;`	Hide the version number in responses and error pages

The .htpasswd file holds hashed credentials. Keep it outside the document root and out of version control. In HTTP/2 and HTTP/3, limit_conn counts each concurrent request as a separate connection.

Compression and Caching

Cut response size and avoid repeat trips to the backend.

Directive	Description
`gzip on;`	Compress responses
`gzip_types text/css application/javascript application/json;`	Compress these types beyond `text/html`
`gzip_min_length 256;`	Skip responses too small to benefit
`gzip_comp_level 5;`	Balance CPU time against size
`gzip_vary on;`	Add `Vary: Accept-Encoding`
`expires 30d;`	Set a far-future expiry inside a static location
`add_header Cache-Control "public, immutable";`	Mark fingerprinted assets as cacheable
`proxy_cache_path /var/cache/nginx keys_zone=cache:10m max_size=1g;`	Define a proxy cache in `http`
`proxy_cache cache;`	Turn the cache on for a location
`proxy_cache_valid 200 10m;`	Cache successful responses for ten minutes
`add_header X-Cache-Status $upstream_cache_status;`	Expose cache hits and misses while debugging

By default, a block with its own add_header directives does not inherit its parent’s add_header directives. Repeat the ones you still need, or use add_header_inherit merge; on nginx 1.29.3 and later.

Logging

Choose what gets recorded and where to watch it.

Directive	Description
`access_log /var/log/nginx/access.log combined;`	Write access logs in the default format
`access_log off;`	Disable access logging for a location
`error_log /var/log/nginx/error.log warn;`	Set the error log file and level
`log_format main '$remote_addr $status "$request" $request_time';`	Define a custom format in `http`
`access_log /var/log/nginx/api.log main;`	Use that custom format
`sudo tail -f /var/log/nginx/error.log`	Follow errors live
`sudo journalctl -u nginx -f`	Follow service-level messages
`sudo nginx -s reopen`	Reopen log files after rotation

Error log levels run debug, info, notice, warn, error, crit, alert, and emerg, from most to least verbose, and each level includes everything more severe. The debug level needs a build configured with --with-debug.

Common Variables

Values available in log formats, proxy headers, redirects, and conditions.

Variable	Description
`$host`	Host from the request line, then the Host header, then the matching server name
`$remote_addr`	Client IP address
`$request_uri`	Full original URI including the query string
`$uri`	Current URI after rewrites, without the query string
`$args`	Query string
`$scheme`	`http` or `https`
`$request_method`	GET, POST, and so on
`$status`	Response status code
`$body_bytes_sent`	Size of the response body
`$request_time`	Request duration in seconds
`$http_user_agent`	User-Agent header
`$proxy_add_x_forwarded_for`	Existing X-Forwarded-For plus the client address
`$upstream_addr`	Backend that served the request
`$upstream_response_time`	Backend response time
`$document_root`	Document root for the current request

Use these guides for the longer explanations behind these directives.

Guide	Description
`Nginx Commands You Should Know`	Service, testing, and reload commands in detail
`Nginx Location Blocks`	Match rules and the full priority order
`Nginx Reverse Proxy`	proxy_pass, headers, and WebSocket support
`Configuring the Nginx Error and Access Logs`	Log formats, levels, and rotation
`Redirect HTTP to HTTPS in Nginx`	Redirect patterns and the pitfalls to avoid
`How to Start, Stop, or Restart Nginx`	Reload versus restart and what each one does
`Nginx Server Blocks on Ubuntu`	Hosting several sites on one server
`How to Install Nginx on Ubuntu 26.04`	Installation, firewall rules, and first steps

Fix "No Space Left on Device" When df Shows Free Space

hello@linuxize.com (Linuxize) — Mon, 14 Sep 2026 18:10:00 +0200

A command can fail with No space left on device even when df -h reports gigabytes of free space:

output

touch: cannot touch '/var/lib/app/cache/item': No space left on device

The message does not always mean that the filesystem has run out of data blocks. Linux also needs a free inode for every new file, and the affected path may be on a different mount or a size-limited memory filesystem. Btrfs can run out of usable data or metadata space while df still reports free capacity, and the kernel returns the same error when a program exhausts its inotify watch limit.

This guide shows how to check each cause in a practical order, identify the exhausted resource, and free space safely.

Quick Reference

Check	Command
Space on the affected path	`df -h /affected/path`
Inodes on the affected path	`df -ih /affected/path`
Filesystem and source device	`findmnt -T /affected/path`
Inode-heavy directories	`sudo du --inodes -x -d 2 /path \| sort -n \| tail -20`
Deleted files still open	`sudo lsof +L1`
Btrfs allocation details	`sudo btrfs filesystem usage /affected/path`
inotify watch limit	`sysctl fs.inotify.max_user_watches`
Docker storage usage	`docker system df`
Journal size	`sudo journalctl --disk-usage`
APT cache size	`sudo du -sh /var/cache/apt/archives`

Check the Exact Path That Failed

Start by passing the affected path to df , not only the root directory:

Terminal
df -h /var/lib/app/cache

output

Filesystem Size Used Avail Use% Mounted on
/dev/nvme0n1p5 40G 17G 22G 44% /var

The Mounted on column shows which filesystem actually holds the path. Here the failing directory lives on a separate /var filesystem, not on the root filesystem that df -h / would have reported. A server may have separate filesystems for /, /var, /home, /tmp, container storage, or application data, and each one fills up independently.

Display the source device, filesystem type, and mount point with:

Terminal
findmnt -T /var/lib/app/cache

output

TARGET SOURCE FSTYPE OPTIONS
/var /dev/nvme0n1p5 ext4 rw,relatime

If Use% is 100%, the filesystem is genuinely out of data blocks. Use du or the guide on finding large files in Linux to locate the largest directories and files.

Check Inode Usage

When block usage looks normal, check inodes on the same path:

Terminal
df -ih /var/lib/app/cache

output

Filesystem Inodes IUsed IFree IUse% Mounted on
/dev/nvme0n1p5 2.6M 2.6M 0 100% /var

Each file and directory consumes an inode . A filesystem containing millions of tiny cache, session, queue, or temporary files can run out of inodes while still having substantial free capacity in bytes.

If IFree is 0 or IUse% is 100%, inode exhaustion is the cause.

Find Directories Using the Most Inodes

The GNU du command can count inodes instead of bytes. To inspect /var without crossing into other mounted filesystems:

Terminal
sudo du --inodes -x -d 2 /var 2>/dev/null |
 sort -n |
 tail -20

output

12540 /var/lib/systemd
48201 /var/lib/docker
73122 /var/cache
2310884 /var/lib/app/cache
2485119 /var/lib
2621402 /var

The largest counts appear at the bottom. In this example, /var/lib/app/cache alone accounts for almost every inode on the filesystem. Repeat the command on the highest directory with a greater depth:

Terminal
sudo du --inodes -x -d 3 /var/lib/app/cache 2>/dev/null |
 sort -n |
 tail -20

This narrows the search before you remove anything.

For a file-count view grouped by parent directory, use:

Terminal
sudo find /var -xdev -type f -printf '%h\n' 2>/dev/null |
 sort |
 uniq -c |
 sort -n |
 tail -20

This command may take time on a filesystem containing millions of files. It does not delete anything.

Remove Excess Small Files Safely

Once you identify the directory, determine which application owns it and whether the files are disposable. Common sources include:

Application caches that do not expire old entries.
PHP session directories.
Mail queues.
Container image layers and build caches.
Monitoring data and rotated logs.
Temporary files created by failed jobs.

Preview old temporary files before deleting them:

Terminal
sudo find /tmp -xdev -type f -mtime +7 -print

If the list contains only files that are safe to remove, rerun it with -delete:

Terminal
sudo find /tmp -xdev -type f -mtime +7 -delete

Do not run broad find ... -delete commands against application directories until you know their retention rules. Prefer the application’s own cleanup command when one exists.

On Ubuntu and Debian, clear downloaded package archives with:

Terminal
sudo apt clean

Check the system journal’s current size:

Terminal
sudo journalctl --disk-usage

To remove archived journal data older than seven days:

Terminal
sudo journalctl --vacuum-time=7d

After cleanup, confirm that inodes are available again:

Terminal
df -ih /var/lib/app/cache

Check for Deleted Files Still Held Open

This check covers a different version of the problem: df reports a full filesystem, but du cannot account for the usage. A process may still have a deleted file open. The directory entry is gone, but the kernel does not release its blocks until the process closes the file descriptor.

List deleted files that remain open:

Terminal
sudo lsof +L1

output

COMMAND PID USER FD TYPE DEVICE SIZE/OFF NLINK NODE NAME
java 4217 app 7w REG 259,3 8589934592 0 8123 /var/log/app.log (deleted)

The example shows an 8 GB deleted log still held by a Java process. Restart the owning service during an appropriate maintenance window:

Terminal
sudo systemctl restart app.service

Use the actual service name for your process. Confirm the file is gone from the lsof +L1 output and check space again with df -h.

For a detailed explanation of deleted open files, see the lsof command guide .

Check tmpfs and Container Filesystems

Paths such as /run, /dev/shm, and sometimes /tmp may use tmpfs, which is backed by memory and has its own size limit. Check the affected path directly:

Terminal
df -h /run /dev/shm /tmp

If a tmpfs mount is full, remove stale files owned by the relevant application or increase the mount limit after checking available memory.

Containers also write through overlay filesystems and mounted volumes. A host filesystem may have free space while a container-specific mount or storage pool is full. From the host, identify the path and mount with findmnt -T. Inside the container, run df -h and df -i to inspect its view.

For Docker, display the space used by images, containers, local volumes, and the build cache with:

Terminal
docker system df

This command reports Docker’s storage usage without removing anything. Review the detailed output before deciding which objects are safe to clean up.

Check Btrfs Data and Metadata Allocation

Btrfs manages data and metadata in separate block groups. Its copy-on-write allocation can return No space left on device even when the free-space total from df looks sufficient.

If findmnt reports btrfs for the affected path, inspect its allocation details with:

Terminal
sudo btrfs filesystem usage /affected/path

Review the Device unallocated, Free (estimated), Data, and Metadata values together. A filesystem may have free data space but too little unallocated capacity to create another metadata block group.

First, remove unneeded files or snapshots according to your retention policy. You can then reclaim completely unused data and metadata block groups with:

Terminal
sudo btrfs balance start -dusage=0 -musage=0 /mountpoint

Replace /mountpoint with the Btrfs mount point shown by findmnt. The usage=0 filters select only empty block groups and do not need extra workspace. Do not run an unfiltered balance as a general disk-full fix because it rewrites all selected block groups, can take a long time, and needs temporary free space.

Check the inotify Watch Limit

Editors, build tools, log shippers, and file sync daemons watch files through inotify. Every watched file or directory consumes one watch, and the kernel enforces a per-user limit. When a program exceeds that limit, inotify_add_watch() fails with the same No space left on device error even though the filesystem has free blocks and free inodes. Applications often report it in their own wording:

output

Error: ENOSPC: System limit for number of file watchers reached, watch '/srv/app/src'

Display the current limit:

Terminal
sysctl fs.inotify.max_user_watches

output

fs.inotify.max_user_watches = 65536

The value varies by distribution and kernel version. To find which process is consuming the watches, count them per file descriptor:

Terminal
sudo sh -c "grep -c '^inotify' /proc/*/fdinfo/* 2>/dev/null" |
 awk -F: '$2 > 0 {print $2, $1}' |
 sort -rn |
 head

output

62184 /proc/2811/fdinfo/23
1204 /proc/1533/fdinfo/9
118 /proc/994/fdinfo/12

The PID appears in the path, so ps -p 2811 -o comm= names the program holding the watches. If that program is watching a directory it does not need, such as a dependency or build output directory, exclude the directory in the program’s own configuration instead of raising the limit.

When the workload genuinely needs more watches, raise the limit for the running system:

Terminal
sudo sysctl fs.inotify.max_user_watches=524288

Make the change persistent across reboots:

Terminal
echo 'fs.inotify.max_user_watches=524288' | sudo tee /etc/sysctl.d/90-inotify.conf

Each watch consumes a small amount of kernel memory that cannot be swapped out, so set the limit to match the workload rather than to the largest value the system accepts.

Check Filesystem and Kernel Errors

If space and inodes are available but writes still fail, inspect recent kernel messages:

Terminal
sudo dmesg --level=err,warn | tail -50

Also check the system journal:

Terminal
sudo journalctl -k -p warning --since "1 hour ago"

Look for Btrfs allocation warnings, I/O errors, filesystem corruption, a read-only remount, or storage device failures. Errors such as Input/output error and Read-only file system need a different fix than No space left on device. A filesystem check may be required, but do not run fsck against a mounted filesystem. Schedule downtime, unmount the filesystem, and follow the appropriate recovery procedure.

Troubleshooting

df -h shows space but df -i shows 100 percent
The filesystem has exhausted its inode table. Find directories containing very large numbers of files, then remove or archive files according to the owning application’s retention policy.

df shows more usage than du
A process probably holds a deleted file open. Run sudo lsof +L1, identify the process, and restart the owning service to release the blocks.

The error occurs only in /tmp, /run, or /dev/shm
The path may be a size-limited tmpfs mount. Run df -h and df -i against that exact path rather than checking /.

Docker reports no space while the host has free capacity
Check Docker’s storage path and filesystem with docker info, docker system df, and findmnt -T /var/lib/docker. Review unused images, containers, build cache, and volumes before removing them.

Btrfs reports no space while df shows free capacity
Run sudo btrfs filesystem usage /affected/path and compare data, metadata, and unallocated space. After removing unneeded files or snapshots, a balance limited to -dusage=0 -musage=0 can reclaim empty block groups without starting a full balance.

An editor, build tool, or sync daemon reports no space while df and df -i look fine
The process reached the inotify watch limit. Check fs.inotify.max_user_watches, exclude directories the program does not need to watch, and raise the limit in /etc/sysctl.d/ when the workload requires it.

FAQ

What is an inode?
An inode stores filesystem metadata for a file or directory, such as its size, ownership, permissions, timestamps, and the location of its data blocks. Each filesystem has a finite inode supply, and each file normally consumes one inode regardless of its size.

Can I add more inodes to an existing ext4 filesystem?
The inode count is chosen when the filesystem is created and cannot be increased with an online setting change. The practical fixes are to remove excess files, move the workload to another filesystem, or recreate the filesystem with a smaller bytes-per-inode ratio suited to many small files.

Why does deleting a large file not free space immediately?
A running process may still have the deleted file open. Linux releases the blocks only when the last file descriptor closes, so df keeps reporting the space as used. Run sudo lsof +L1 to find the process and restart the owning service.

Why does the error appear on a system with terabytes of free space?
The failing write is limited by something other than total capacity, most often the inode count of the specific mount, a size-limited tmpfs, container storage, Btrfs allocation, or the inotify watch limit. Always check the exact path that failed rather than the root filesystem.

Conclusion

When df -h shows free space, check the affected path with df -ih and use findmnt to confirm its mount and filesystem type. Inode exhaustion, a full nested mount or tmpfs, container storage, Btrfs allocation, and the inotify watch limit each need a different fix, while lsof +L1 solves the separate case where df is full but du cannot explain the usage.

ffmpeg Cheatsheet

hello@linuxize.com (Linuxize) — Sun, 13 Sep 2026 10:30:00 +0200

Install ffmpeg

Get the ffmpeg binaries and confirm the build.

Command	Description
`sudo apt install ffmpeg`	Install on Ubuntu, Debian, and derivatives
`sudo dnf install ffmpeg`	Install the full build from RPM Fusion on Fedora or RHEL
`sudo dnf install ffmpeg-free`	Install the codec-limited build from Fedora or EPEL
`ffmpeg -version`	Print the version and build configuration
`ffmpeg -encoders`	List every available encoder
`ffmpeg -decoders`	List every available decoder
`ffmpeg -formats`	List supported container formats

Inspect Media Files

Read stream details before deciding how to re-encode.

Command	Description
`ffprobe -hide_banner in.mp4`	Show streams, codecs, and duration
`ffprobe -v error -show_format in.mp4`	Print container metadata only
`ffprobe -v error -show_streams in.mp4`	Print every stream property
`ffprobe -v error -print_format json -show_format -show_streams in.mp4`	Machine-readable output
`ffprobe -v error -select_streams v:0 -show_entries stream=width,height -of csv=p=0 in.mp4`	Print the video resolution
`ffprobe -v error -show_entries format=duration -of csv=p=0 in.mp4`	Print the duration in seconds

Common Options

Options that control inputs, outputs, and command behavior.

Option	Description
`-i input`	Set an input file (repeat for multiple inputs)
`-y`	Overwrite the output file without asking
`-n`	Never overwrite an existing output file
`-hide_banner`	Suppress the build and library banner
`-loglevel error`	Print errors only
`-stats`	Keep the progress line while quiet
`-threads:v 4`	Request four threads for the video encoder when supported
`-f format`	Force an input or output format

Convert Between Formats

Change the container, with or without re-encoding.

Command	Description
`ffmpeg -i in.mkv -c copy out.mp4`	Repackage compatible streams without re-encoding
`ffmpeg -i in.avi out.mp4`	Convert using the default encoders
`ffmpeg -i in.mov -c:v libx264 -c:a aac out.mp4`	Convert to H.264 and AAC
`ffmpeg -i in.mp4 -c:v libvpx-vp9 -c:a libopus out.webm`	Convert to WebM
`ffmpeg -i in.mp4 -c:v copy -c:a aac out.mp4`	Re-encode the audio, keep the video
`ffmpeg -i in.wav out.flac`	Convert between audio formats

Compress Video

Lower the bitrate with constant quality or a controlled bitrate.

Command	Description
`ffmpeg -i in.mp4 -c:v libx264 -crf 23 -preset slow -c:a aac -b:a 128k out.mp4`	Compress with H.264
`ffmpeg -i in.mp4 -c:v libx265 -crf 28 -c:a copy out.mp4`	Compress with H.265 at a similar quality
`ffmpeg -i in.mp4 -c:v libx264 -crf 18 out.mp4`	Keep near-source quality
`ffmpeg -i in.mp4 -c:v libx264 -b:v 2M -maxrate 2M -bufsize 4M -c:a copy out.mp4`	Target 2 Mb/s with a 2 Mb/s VBV ceiling
`ffmpeg -i in.mp4 -c:v h264_nvenc -cq 23 -c:a copy out.mp4`	Encode on an NVIDIA GPU
`ffmpeg -vaapi_device /dev/dri/renderD128 -i in.mp4 -vf 'format=nv12,hwupload' -c:v h264_vaapi -c:a copy out.mp4`	Encode with VA-API

CRF runs from 0 (lossless) to 51 (worst). Lower values mean larger files, and 18 to 28 covers most work. Slower presets such as slow or veryslow shrink the file further at the same CRF.

Audio

Extract, convert, and adjust audio tracks.

Command	Description
`ffmpeg -i in.mp4 -vn -c:a libmp3lame -q:a 2 out.mp3`	Extract audio as MP3
`ffmpeg -i in.mp4 -vn -c:a copy out.m4a`	Copy compatible audio without re-encoding
`ffmpeg -i in.mp4 -vn -c:a aac -b:a 192k out.aac`	Extract audio as AAC
`ffmpeg -i in.mp3 -ac 1 -ar 16000 out.wav`	Downmix to mono at 16 kHz
`ffmpeg -i in.mp4 -c:v copy -af 'volume=1.5' out.mp4`	Raise the volume by 50 percent
`ffmpeg -i in.mp4 -c:v copy -af 'loudnorm=I=-23' -ar 48000 out.mp4`	Apply one-pass EBU R128 normalization at -23 LUFS
`ffmpeg -i in.mp4 -an -c:v copy out.mp4`	Strip the audio track

The -q:a scale for libmp3lame runs from 0 (best) to 9 (worst), and 2 is a good default for speech and music alike.

Resize, Crop, and Rotate

Reshape the picture with video filters.

Command	Description
`ffmpeg -i in.mp4 -vf scale=1280:-2 -c:a copy out.mp4`	Scale to 1280 wide, keep the aspect ratio
`ffmpeg -i in.mp4 -vf scale=-2:720 -c:a copy out.mp4`	Scale to 720 high
`ffmpeg -i in.mp4 -vf scale=1920:1080 -c:a copy out.mp4`	Force an exact resolution
`ffmpeg -i in.mp4 -vf 'crop=640:480:100:50' -c:a copy out.mp4`	Crop 640x480 starting at x=100, y=50
`ffmpeg -i in.mp4 -vf 'transpose=1' -c:a copy out.mp4`	Rotate 90 degrees clockwise
`ffmpeg -i in.mp4 -vf 'hflip' -c:a copy out.mp4`	Mirror horizontally
`ffmpeg -i in.mp4 -vf 'pad=1920:1080:(ow-iw)/2:(oh-ih)/2' -c:a copy out.mp4`	Pad to 1080p with centered bars

Use -2 rather than -1 for the free dimension so the calculated size stays even, as required by common 4:2:0 output formats.

Trim and Concatenate

Cut clips and join files back together.

Command	Description
`ffmpeg -ss 00:01:00 -to 00:02:30 -i in.mp4 -c copy clip.mp4`	Fast cut at the nearest keyframe
`ffmpeg -ss 00:01:00 -to 00:02:30 -i in.mp4 -c:v libx264 -c:a aac clip.mp4`	Frame-accurate cut by re-encoding
`ffmpeg -ss 00:00:30 -t 15 -i in.mp4 -c copy clip.mp4`	Cut 15 seconds starting at 30 seconds
`ffmpeg -i in.mp4 -t 60 -c copy first-minute.mp4`	Keep the first minute
`ffmpeg -f concat -safe 0 -i list.txt -c copy out.mp4`	Join files listed in list.txt
`ffmpeg -i in.mp4 -c copy -f segment -segment_time 600 part%03d.mp4`	Split near ten-minute boundaries at keyframes

Each line of list.txt takes the form file '/path/to/clip.mp4'. The concat demuxer requires matching stream layouts and parameters, including codecs and time bases.

Images, Thumbnails, and GIFs

Move between video and still images.

Command	Description
`ffmpeg -ss 00:00:10 -i in.mp4 -frames:v 1 thumb.jpg`	Grab a single frame at ten seconds
`ffmpeg -i in.mp4 -vf fps=1 frame%04d.png`	Export one frame per second
`ffmpeg -i in.mp4 -vf 'fps=1/10' frame%04d.jpg`	Export one frame every ten seconds
`ffmpeg -framerate 30 -i frame%04d.png -c:v libx264 -pix_fmt yuv420p out.mp4`	Build a video from an image sequence
`ffmpeg -i in.mp4 -vf 'fps=10,scale=480:-1:flags=lanczos' out.gif`	Create a GIF
`ffmpeg -i in.mp4 -vf 'fps=10,scale=480:-1:flags=lanczos,palettegen' palette.png`	Build a GIF color palette
`ffmpeg -i in.mp4 -i palette.png -lavfi 'fps=10,scale=480:-1:flags=lanczos [x]; [x][1:v] paletteuse' out.gif`	Create a GIF with that palette

Subtitles

Attach, burn in, or pull out subtitle tracks.

Command	Description
`ffmpeg -i in.mp4 -i subs.srt -map 0 -map 1:0 -c copy -c:s mov_text out.mp4`	Add soft subtitles to MP4
`ffmpeg -i in.mkv -i subs.srt -map 0 -map 1:0 -c copy out.mkv`	Add soft subtitles to MKV
`ffmpeg -i in.mp4 -vf subtitles=subs.srt -c:a copy out.mp4`	Burn subtitles into the picture
`ffmpeg -i in.mkv -vf 'subtitles=in.mkv:si=0' -c:a copy out.mp4`	Burn in an embedded subtitle stream
`ffmpeg -i in.mkv -map 0:s:0 subs.srt`	Convert the first subtitle track to SRT when it is text based
`ffmpeg -i in.mkv -map 0 -sn -c copy out.mkv`	Remove every subtitle track and keep other streams

Stream Mapping and Metadata

Choose which streams reach the output.

Command	Description
`ffmpeg -i in.mkv -map 0:v:0 -map 0:a:1 -c copy out.mkv`	Keep the first video and second audio stream
`ffmpeg -i in.mkv -map 0 -c copy out.mkv`	Keep every stream from the input
`ffmpeg -i video.mp4 -i audio.mp3 -map 0:v -map 1:a -c:v copy -shortest out.mp4`	Combine separate video and audio files
`ffmpeg -i in.mp4 -map_metadata -1 -c copy out.mp4`	Strip global metadata
`ffmpeg -i in.mp3 -metadata title='Track name' -c copy out.mp3`	Set a metadata tag
`ffmpeg -i in.mp4 -c copy -movflags +faststart out.mp4`	Move the MP4 index to the front for streaming
`for f in *.mkv; do ffmpeg -i "$f" -c:v libx264 -crf 23 -c:a aac "${f%.mkv}.mp4"; done`	Batch convert a directory

Use these guides for the longer explanations behind these commands.

Guide	Description
`ffmpeg Command in Linux`	Full ffmpeg tutorial with worked examples
`Convert MP4 to MP3 with ffmpeg`	Audio extraction and quality settings in detail

pnpm Cheatsheet

hello@linuxize.com (Linuxize) — Fri, 11 Sep 2026 08:45:00 +0200

Install and Update pnpm

Set up the pnpm executable and keep it current.

Command	Description
`curl -fsSL https://get.pnpm.io/install.sh \| sh -`	Install with the standalone script
`wget -qO- https://get.pnpm.io/install.sh \| sh -`	Install without curl
`npx get-pnpm`	Install through npm
`pnpm self-update`	Update pnpm to the current release
`pnpm self-update 12.3.4`	Move to a specific pnpm version
`pnpm setup`	Create PNPM_HOME and update the shell profile
`pnpm --version`	Print the installed pnpm version

Node.js Runtimes

Install language runtimes with pnpm itself.

Command	Description
`pnpm runtime set node lts -g`	Install the Node.js LTS release
`pnpm runtime set node 22 -g`	Install a Node.js major version
`pnpm runtime set node latest -g`	Install the newest Node.js release
`pnpm runtime set node 22.23.2 -g`	Install an exact Node.js version
`pnpm runtime set deno 2 -g`	Install Deno
`pnpm runtime set bun latest -g`	Install Bun

Project Setup

Create and edit project metadata.

Command	Description
`pnpm init`	Create package.json
`pnpm init --init-package-manager`	Create package.json and pin pnpm
`pnpm init --bare`	Create package.json with required fields only
`pnpm import`	Build pnpm-lock.yaml from another lockfile
`pnpm pkg get name`	Print a package.json field
`pnpm pkg set scripts.start="node index.js"`	Add or update a field
`pnpm pkg delete scripts.old`	Remove a package.json field

Add Dependencies

Record packages in package.json and the lockfile.

Command	Description
`pnpm add express`	Add a runtime dependency
`pnpm add -D eslint`	Add a development dependency
`pnpm add -O sharp`	Add an optional dependency
`pnpm add -E express`	Add without a version range
`pnpm add express@5.1.0`	Add a specific version
`pnpm add -g http-server`	Add a global package
`pnpm add -w typescript`	Add to the workspace root

Install Dependencies

Reproduce a dependency tree from the lockfile.

Command	Description
`pnpm install`	Install everything package.json declares
`pnpm install --frozen-lockfile`	Install without changing the lockfile
`pnpm ci`	Clean install for CI pipelines
`pnpm install --prod`	Skip development dependencies
`pnpm install --offline`	Install from the store only
`pnpm install --ignore-scripts`	Install without lifecycle scripts
`pnpm fetch`	Fetch the lockfile contents into the store

Update and Inspect

Check versions and trace where packages come from.

Command	Description
`pnpm outdated`	Show packages with newer versions
`pnpm update`	Update within package.json ranges
`pnpm update express --latest`	Update one package and its range
`pnpm update -i`	Choose updates interactively
`pnpm list --depth 0`	List direct dependencies
`pnpm why express`	Explain why a package is installed
`pnpm licenses list`	List dependency licenses

Remove and Clean

Drop packages and reclaim project space.

Command	Description
`pnpm remove express`	Remove a dependency
`pnpm remove -g http-server`	Remove a global package
`pnpm prune`	Remove extraneous packages
`pnpm prune --prod`	Remove development dependencies
`pnpm dedupe`	Collapse duplicate versions in the lockfile
`pnpm dedupe --check`	Report duplicates without writing
`pnpm pm clean`	Remove node_modules from every workspace project

Scripts and Execution

Run package scripts and one-off tools.

Command	Description
`pnpm run build`	Run a named script
`pnpm start`	Run the start script
`pnpm test`	Run the test script
`pnpm run build -- --watch`	Pass arguments to a script
`pnpm exec eslint .`	Run a local package binary
`pnpm dlx create-vite@latest app`	Run a package without installing it
`pnpm pm <command>`	Force a built-in command over a same-named script

Workspaces and Filtering

Target one package or a slice of a monorepo.

Command	Description
`pnpm -r run build`	Run a script in every workspace package
`pnpm --filter web-app add zod`	Add a dependency to one package
`pnpm --filter web-app run test`	Run a script in one package
`pnpm --filter "@scope/*" test`	Select packages by pattern
`pnpm --filter web-app... build`	Select a package and its dependencies
`pnpm --filter ...web-app build`	Select a package and its dependents
`pnpm --filter "...[origin/main]" build`	Select packages changed since a branch

Store and Cache

Maintain the shared content-addressable store.

Command	Description
`pnpm store path`	Print the store location
`pnpm store status`	Check the store for modified packages
`pnpm store prune`	Remove orphaned packages from the store
`pnpm store add express@5.1.0`	Add a package to the store
`pnpm cache path`	Print the metadata cache directory
`pnpm root -g`	Print the global node_modules path
`pnpm bin -g`	Print the global binary directory

Security and Diagnostics

Audit dependencies and check the installation.

Command	Description
`pnpm audit`	Scan dependencies for advisories
`pnpm audit --prod`	Audit production dependencies only
`pnpm audit --fix`	Add overrides for non-vulnerable versions
`pnpm doctor`	Run diagnostics on the pnpm environment
`pnpm sbom --sbom-format spdx`	Generate a software bill of materials
`pnpm approve-builds`	Approve dependency build scripts
`pnpm ignored-builds`	List packages with blocked build scripts

Use these references for Node.js package workflows.

Guide	Description
`pnpm Command`	Full pnpm tutorial with examples
`npm Command`	The npm equivalents of these commands
`Install Node.js on Ubuntu 26.04`	Install Node.js and npm

How to Fix APT and dpkg Lock Errors on Ubuntu and Debian

hello@linuxize.com (Linuxize) — Wed, 09 Sep 2026 10:20:00 +0200

When you install or update packages on Ubuntu or Debian, you may see an error saying that APT or dpkg could not obtain a lock:

output

E: Could not get lock /var/lib/dpkg/lock-frontend. It is held by process 2481 (apt)
N: Be aware that removing the lock file is not a solution and may break your system.
E: Unable to acquire the dpkg frontend lock (/var/lib/dpkg/lock-frontend), is another process using it?

The lock prevents two package managers from changing the package database at the same time. In most cases, another update is still running and the correct fix is to let it finish. If the process is stuck, you need to identify and stop it before repairing the package state.

This guide explains how to resolve APT and dpkg lock errors without deleting lock files or damaging the package database.

Quick Reference

For a printable quick reference, see the apt cheatsheet .

Task	Command
Show the process from the error	`ps -p PID -o pid,etime,cmd`
Check APT lock holders	`sudo lsof /var/lib/dpkg/lock-frontend /var/lib/dpkg/lock /var/cache/apt/archives/lock /var/lib/apt/lists/lock`
Check with fuser	`sudo fuser -v /var/lib/dpkg/lock-frontend`
Check automatic update services	`systemctl status apt-daily.service apt-daily-upgrade.service unattended-upgrades.service`
Ask a stuck process to stop	`sudo kill PID`
Finish pending package configuration	`sudo dpkg --configure -a`
Repair broken dependencies	`sudo apt --fix-broken install`
Refresh the package index	`sudo apt update`

Why the Lock Error Occurs

APT and dpkg use lock files to coordinate access to package data. A lock error commonly appears when:

Another terminal is running apt, apt-get, dpkg, or a graphical software manager.
Ubuntu’s automatic update services are checking for or installing updates.
A package operation was interrupted and left a process running.
A package manager process stopped responding.

The error often includes the process ID that holds the lock. That PID is the safest place to start because it tells you which process currently owns package management.

Warning

Do not delete /var/lib/dpkg/lock, /var/lib/dpkg/lock-frontend, /var/cache/apt/archives/lock, or /var/lib/apt/lists/lock as a first response. Removing a lock file does not stop the process using the package database, and two concurrent writers can leave packages in an inconsistent state.

Step 1: Check the Process Holding the Lock

Replace 2481 with the PID shown in your error:

Terminal
ps -p 2481 -o pid,etime,cmd

output

 PID ELAPSED CMD
2481 01:42 apt upgrade

The ELAPSED column shows how long the process has been running. If it is an expected apt, dpkg, or update process and its runtime is reasonable, wait for it to finish.

When the error does not show a PID, check the common lock files with lsof:

Terminal
sudo lsof \
 /var/lib/dpkg/lock-frontend \
 /var/lib/dpkg/lock \
 /var/cache/apt/archives/lock \
 /var/lib/apt/lists/lock

output

COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
apt 2481 root 4uW REG 8,2 0 812 /var/lib/dpkg/lock-frontend

The COMMAND and PID columns identify the process. If lsof is unavailable, use fuser:

Terminal
sudo fuser -v /var/lib/dpkg/lock-frontend

output

 USER PID ACCESS COMMAND
/var/lib/dpkg/lock-frontend:
root 2481 F.... apt

Do not start another package command until the listed process has finished or been stopped safely.

Step 2: Check Automatic Updates

Ubuntu and Debian systems may run background package operations through systemd. Check the APT update services with:

Terminal
systemctl status apt-daily.service apt-daily-upgrade.service unattended-upgrades.service

If any of these services is active, wait several minutes and check again:

Terminal
systemctl is-active apt-daily.service apt-daily-upgrade.service unattended-upgrades.service

output

inactive
inactive
inactive

Once all three services are inactive, retry your original package command.

You can also inspect recent service messages:

Terminal
sudo journalctl -u apt-daily.service -u apt-daily-upgrade.service -u unattended-upgrades.service --since "30 minutes ago"

The journal shows whether the updater is downloading packages, installing them, or failing repeatedly.

Step 3: Stop a Stuck Package Process

Only stop the process when it has clearly stopped making progress. Check the terminal output or service journal first, then confirm its command, state, and elapsed time:

Terminal
ps -p 2481 -o pid,stat,etime,cmd

The STAT column shows the current process state, but it does not prove that a process is stuck. A sleeping package process may still be waiting for network or disk activity, so use the command output and logs as your main evidence.

First, ask the process to terminate normally:

Terminal
sudo kill 2481

Wait a few seconds, then check whether it still exists:

Terminal
ps -p 2481

If the command prints no process row, it has exited. Avoid sending SIGKILL unless a normal termination fails, because an immediate kill gives the package manager no opportunity to clean up.

If an automatic update service owns the process, stop the service instead of killing a child process:

Terminal
sudo systemctl stop apt-daily.service apt-daily-upgrade.service unattended-upgrades.service

Check the lock again before continuing:

Terminal
sudo fuser -v /var/lib/dpkg/lock-frontend

No output means no visible process is accessing that lock file.

Step 4: Repair Interrupted Package Configuration

Stopping a package process may leave unpacked packages waiting to be configured. Complete those pending operations with:

Terminal
sudo dpkg --configure -a

This command configures packages that were unpacked but not fully configured. Our dpkg command guide explains package states and other useful recovery options.

Next, repair missing or broken dependencies:

Terminal
sudo apt --fix-broken install

Review the proposed package changes before confirming. After the repair completes, refresh the package index:

Terminal
sudo apt update

You can then retry the original install or upgrade command.

Lock File Locations

The path in the error depends on which package-management layer is busy:

/var/lib/dpkg/lock-frontend - Frontend lock used by APT before it calls dpkg.
/var/lib/dpkg/lock - Lock for the dpkg package database.
/var/cache/apt/archives/lock - Lock for downloaded package archives.
/var/lib/apt/lists/lock - Lock for repository index files.

The diagnostic process is the same for each path: identify the process using the file, let it finish or stop it safely, and repair interrupted package configuration when necessary.

If No Process Holds the Lock

If lsof and fuser show no holder, do not remove the lock file. The dpkg tools keep these files in place, and the presence of a file does not mean that its lock is active.

First, confirm that no package manager is running:

Terminal
ps aux | grep -E '[a]pt|[d]pkg|unattended-upgrade'

Retry the original package command. If the lock error returns with a PID, another process acquired the lock between your checks. Inspect that new process before taking any other action.

Run the recovery commands only if an earlier package operation was interrupted:

Terminal
sudo dpkg --configure -a
sudo apt --fix-broken install

Troubleshooting

The lock is held by unattended-upgrade
Wait for the automatic update to finish and monitor it with systemctl status apt-daily-upgrade.service unattended-upgrades.service or sudo journalctl -u apt-daily-upgrade.service -u unattended-upgrades.service. Stop it only when it has clearly failed or remained stuck for an unreasonable time.

dpkg –configure -a reports dependency problems
Run sudo apt --fix-broken install to install missing dependencies and finish incomplete package operations. Then run sudo dpkg --configure -a again if the error requests it.

The lock returns immediately
Check the PID in the new error instead of assuming that the previous process restarted. An APT timer may have launched a new one-shot package operation between your checks. Inspect the services and their next scheduled runs with:

Terminal
systemctl status apt-daily.service apt-daily-upgrade.service
systemctl list-timers apt-daily.timer apt-daily-upgrade.timer

Do not repeatedly kill package processes. Wait for the active service to finish or stop that service only after confirming that it is stuck.

The lock error appears inside a script
Another package process may overlap with the script. For an apt-get install command, set a bounded dpkg lock timeout so the script waits instead of failing immediately:

sh
sudo apt-get -o DPkg::Lock::Timeout=60 install -y curl

This example waits up to 60 seconds for the dpkg lock. If the timeout expires, log the failure and stop the script. Do not add rm commands for APT or dpkg lock files.

A graphical software manager is open
Close applications such as App Center, Software Updater, Synaptic, or other package frontends. Wait for their background process to exit, then retry the terminal command.

FAQ

Is it safe to delete /var/lib/dpkg/lock?
Deleting the file is not the correct first fix. The lock is associated with a running process, so removing the path does not stop that process. Identify the holder with lsof, fuser, or the PID in the error and deal with the process instead.

How long should I wait for apt-daily?
Most background checks finish within a few minutes, but upgrades can take longer depending on package downloads and installation work. Check its status and journal rather than relying on a fixed timeout.

What does dpkg –configure -a do?
It configures all packages that were unpacked but not fully configured. This is the standard recovery step after a package operation is interrupted.

Why does the error mention lock-frontend instead of lock?
APT uses a frontend lock to ensure that only one high-level package manager controls dpkg at a time. The lower-level dpkg database has its own lock as well.

Can I prevent automatic updates from taking the lock?
You can change the system’s automatic update schedule or policy, but disabling security updates only to avoid occasional lock contention is usually a poor tradeoff. It is safer to schedule maintenance commands outside the automatic update window.

Conclusion

An APT or dpkg lock error usually means package management is already active, not that the lock file is broken. Identify the holder, wait or stop it safely, then use dpkg --configure -a and apt --fix-broken install to repair any interrupted work. For more package maintenance examples, see our APT command guide .

vmstat Command in Linux: Memory, CPU, and I/O Statistics

hello@linuxize.com (Linuxize) — Mon, 07 Sep 2026 17:10:00 +0200

When a server slows down, the first question is what it is waiting on. Is the CPU saturated? Is memory exhausted and the system is swapping? Is disk I/O holding up processes? The vmstat command puts clues about each resource in one compact table, making it a useful first check before you move to a more specialized monitoring tool.

vmstat stands for virtual memory statistics and is provided by procps-ng. Most full Linux installations include it through a package named procps or procps-ng.

This guide explains how to read vmstat output and use its most useful options.

Syntax

txt
vmstat [OPTIONS] [delay [count]]

delay - Seconds between reports. Without it, vmstat prints a single report and exits.
count - Number of reports to print. When you set a delay without a count, vmstat runs until you press Ctrl+C.

Reading the Default Output

Running vmstat without arguments prints one report:

Terminal
vmstat

output

procs -----------memory---------- ---swap-- -----io---- -system-- -------cpu-------
r b swpd free buff cache si so bi bo in cs us sy id wa st gu
1 0 0 362824 94368 1207160 0 0 12 5 48 112 1 0 99 0 0 0

The process and memory columns show values from the moment the command runs. In the first report, swap, I/O, system, and CPU activity is averaged since the last boot. The output has six sections.

procs

r - Runnable processes, including processes running or waiting for CPU time. Compare a sustained value with the logical CPU count from nproc; a busy run queue together with little idle CPU suggests CPU contention.
b - Processes blocked while waiting for I/O to complete.

memory (default KiB)

swpd - Swap space currently in use.
free - Idle memory that is not currently in use.
buff - Memory used as buffers.
cache - Memory used as cache. Linux uses otherwise idle RAM to cache data, so a large value is normal.

The free column alone does not show how much memory applications can readily use. Check the available value from the free command when you need that figure.

swap (KiB/s)

si - Memory swapped in from disk per second.
so - Memory swapped out to disk per second.

Occasional swap activity is not enough to diagnose a problem. Sustained si or so activity together with falling free and cache memory is a stronger sign of memory pressure.

io (KiB/s)

bi - Kibibytes received from block devices per second.
bo - Kibibytes sent to block devices per second.

system

in - Interrupts per second, including the clock interrupt.
cs - Context switches per second. Compare this value with the system’s normal workload rather than using a fixed threshold.

cpu (percentage of total CPU time)

us - Time spent running user-space code, including nice time.
sy - Time spent running kernel code.
id - Idle time.
wa - Time the CPU was idle while waiting for I/O. A sustained increase is a clue to investigate I/O, but it does not identify the device or prove that storage is the bottleneck.
st - Time taken from a virtual machine by the hypervisor.
gu - Time spent running KVM guest code, including guest nice time.

Older procps-ng versions may end the CPU columns at st. The meaning of the preceding columns is unchanged.

Continuous Monitoring

A single report gives limited information about a live problem. Pass a delay to watch activity over consecutive intervals:

Terminal
vmstat 2

This prints a new line every two seconds until you press Ctrl+C. The first line still contains activity averages since boot, while later lines cover each two-second interval. Add -y when you want to omit that first report:

Terminal
vmstat -y 2

To collect ten interval reports and then stop, add a count:

Terminal
vmstat -y 2 10

output

procs -----------memory---------- ---swap-- -----io---- -system-- -------cpu-------
r b swpd free buff cache si so bi bo in cs us sy id wa st gu
0 0 0 360988 94504 1208068 0 0 0 0 92 198 0 0 100 0 0 0
1 0 0 360744 94504 1208068 0 0 0 16 104 231 1 0 99 0 0 0
0 0 0 360720 94504 1208080 0 0 0 0 89 190 0 0 100 0 0 0

Only the first three rows are shown here. Because -y skips the immediate boot-average report, the command waits for and records ten two-second intervals, taking about 20 seconds.

Add timestamps and redirect the reports to a file when you want to review them later:

Terminal
vmstat -y -t 2 10 > vmstat.log

Active and Inactive Memory

The -a flag replaces the buff and cache columns with inact (inactive memory) and active (active memory):

Terminal
vmstat -a

output

procs -----------memory---------- ---swap-- -----io---- -system-- -------cpu-------
r b swpd free inact active si so bi bo in cs us sy id wa st gu
0 0 0 358900 921048 490836 0 0 12 5 48 112 1 0 99 0 0 0

Active memory contains pages used recently and likely to be referenced again. Inactive memory has not been accessed recently and contains candidates for reclaim when the system needs space. This view is useful when several workloads compete for memory.

Adding Timestamps

The -t flag appends a timestamp column to each line, which is useful when capturing output to a log file:

Terminal
vmstat -y -t 2 5

output

procs -----------memory---------- ---swap-- -----io---- -system-- -------cpu------- -----timestamp-----
r b swpd free buff cache si so bi bo in cs us sy id wa st gu EEST
0 0 0 362824 94368 1207160 0 0 0 0 88 195 0 0 100 0 0 0 2026-09-07 10:30:02
0 0 0 362700 94368 1207160 0 0 0 12 94 207 1 0 99 0 0 0 2026-09-07 10:30:04

The timestamp uses the system’s local time zone. The example shows only the first two of the five requested reports.

Wide Output Mode

On systems with many CPU cores or high counter values, the default column widths can cause numbers to truncate or columns to overlap. The -w flag switches to a wider format that avoids truncation:

Terminal
vmstat -w 2

Memory Event Counters

The -s flag prints current memory totals followed by CPU and event counters accumulated since boot:

Terminal
vmstat -s

output

 2023560 K total memory
417148 K used memory
493280 K active memory
921048 K inactive memory
362824 K free memory
94368 K buffer memory
1207160 K swap cache
2097148 K total swap
0 K used swap
2097148 K free swap
48712 non-nice user cpu ticks
952 nice user cpu ticks
12836 system cpu ticks
5181148 idle cpu ticks
5984 IO-wait cpu ticks
0 IRQ cpu ticks
3268 softirq cpu ticks
0 stolen cpu ticks
0 non-nice guest cpu ticks
0 nice guest cpu ticks
621264 K paged in
247908 K paged out
0 pages swapped in
0 pages swapped out
2518704 interrupts
5884112 CPU context switches
1788713671 boot time
52364 forks

The exact list varies with the kernel and procps-ng version. This view is useful for checking current swap totals and cumulative paging activity. The event counters and CPU ticks start again after a reboot.

Disk Statistics

The -d flag shows cumulative read and write statistics broken down by disk device:

Terminal
vmstat -d

output

disk- ------------reads------------ ------------writes----------- -----IO------
total merged sectors ms total merged sectors ms cur sec
sda 12486 983 956342 34208 18402 4682 920612 142104 0 42
sdb 142 0 9168 252 0 0 0 0 0 0

total - Total number of completed read or write operations.
merged - Adjacent requests grouped into a single I/O operation.
sectors - Total sectors read or written.
ms - Total milliseconds spent reading or writing.
cur - I/O operations currently in progress.
sec - Total seconds spent doing I/O.

To see statistics for a specific partition rather than the whole disk:

Terminal
vmstat -p /dev/sda1

output

sda1 reads read sectors writes requested writes
12384 948812 18320 910484

Changing Output Units

By default, memory and swap values use 1024-byte kibibytes. The -S flag changes their display unit:

Terminal
vmstat -S M 2

Accepted values are k (1000 bytes), K (1024 bytes), m (1,000,000 bytes), and M (1,048,576 bytes). This option does not change the swap (si, so) or I/O (bi, bo) fields, which stay in KiB/s.

Options Reference

-a - Show active and inactive memory instead of buffer and cache values.
-d - Display disk statistics per device.
-D - Display summary disk statistics.
-f - Show the number of forks since boot.
-m - Display slab memory information.
-n - Print the header only once.
-p device - Display partition-level disk statistics.
-s - Display memory statistics and event counters.
-S unit - Set the memory and swap output unit to k, K, m, or M.
-t - Append a timestamp to each line.
-w - Use wider columns to prevent unwanted column breaks.
-y - Omit the first report containing activity averages since boot.

Quick Reference

Task	Command
Single snapshot	`vmstat`
Update every 2 seconds	`vmstat 2`
Skip the boot-average report	`vmstat -y 2`
10 interval reports, 2 seconds apart	`vmstat -y 2 10`
Active/inactive memory view	`vmstat -a 2`
Timestamped output	`vmstat -t 2`
Wide output	`vmstat -w 2`
Memory event counters	`vmstat -s`
Disk statistics	`vmstat -d`
Partition statistics	`vmstat -p /dev/sda1`
Output in megabytes	`vmstat -S M 2`

Troubleshooting

All values look like averages, not live activity
The first line contains activity averages since boot, although its process and memory fields are current values. Run vmstat -y 2 to skip that line and show only two-second interval reports.

The shell reports vmstat: command not found
Install the procps package on Ubuntu and Debian with sudo apt install procps. Fedora and RHEL use sudo dnf install procps-ng, while Arch Linux uses sudo pacman -S procps-ng.

vmstat cannot read data under /proc
The command needs access to files under /proc. Containers and systems mounted with restrictive /proc options may hide some statistics. The vmstat -m view also requires access to /proc/slabinfo, which may be unavailable to a standard user.

Conclusion

Run vmstat -y 2 as a first check when a system slows down, then follow the signal: use top or htop for per-process CPU and memory usage, or iostat -xz 2 for device latency and queues.

btop Command in Linux: Monitor System Resources

hello@linuxize.com (Linuxize) — Sat, 05 Sep 2026 14:35:00 +0200

When a server feels slow, the first minutes are often spent juggling tools: top for processes, free for memory, and separate commands for network and disk activity. btop puts these metrics on one screen, with live graphs for CPU, memory, disks, and network traffic alongside a filterable process list. It is the C++ continuation of the bashtop and bpytop resource monitors.

This guide explains how to install btop, read its dashboard, manage processes from it, and adjust its configuration.

Installing btop

btop is available from the package repositories of current Ubuntu, Debian, Fedora, RHEL-based, and Arch Linux releases.

On Ubuntu, Debian, and Derivatives, install it with apt:

Terminal
sudo apt install btop

On Fedora, RHEL, and Derivatives, use dnf. Fedora provides the package directly:

Terminal
sudo dnf install btop

On RHEL, Rocky Linux, and AlmaLinux, enable the EPEL repository before installing btop:

Terminal
sudo dnf install epel-release
sudo dnf install btop

On Arch Linux, install the package with pacman:

Terminal
sudo pacman -S btop

Verify the installation with the version option:

Terminal
btop --version

btop Syntax

The btop command accepts the following general syntax:

txt
btop [OPTIONS]

Run it without options to open the interactive dashboard:

Terminal
btop

Use the built-in help to see the options supported by your installed version:

Terminal
btop --help

The options you will use most often are:

--low-color - Disable truecolor and convert to 256 colors.
-t - Force TTY mode with 16 colors and tty-friendly graph symbols.
-p <id> - Start with one of the saved presets, 0 through 9.
--version - Print the installed version.

Short option names changed in btop 1.4.2, so prefer the long forms above when you write scripts or aliases that must work across distributions.

Reading the Dashboard

The screen is divided into four boxes. The top box graphs per-core CPU usage along with frequency, temperature (when sensors are available), load average, and uptime. The left box covers memory and disks: used, available, and cached memory, plus usage and I/O activity for each mounted filesystem. The right box graphs network download and upload per interface. The bottom box is the process list.

Everything is live and mouse-aware: you can click a process to select it, click column headers to change sorting, and scroll the list with the wheel. The same navigation works from the keyboard. Press 1 to toggle the CPU box, 2 for memory and disks, 3 for network, and 4 for processes.

In the process list, memory usage is based on resident memory. By default, CPU usage is shown as a share of the machine’s total CPU capacity. Press c to switch to per-core scaling, where 100% represents one fully used core and a multithreaded process can exceed 100%. For more detail on the underlying numbers, see the free command for memory and the load discussion in our top command guide .

Working with the Process List

The process list supports keyboard and mouse navigation. These keys cover the most common tasks:

Up and Down arrows select a process; Enter opens a detail view with its own CPU and memory graphs for the selected process.
f or / starts a filter. Type part of a process name and press Enter to keep only matching rows. Press Delete after leaving the filter editor to clear the active filter; Esc cancels an edit and restores the previous filter.
e toggles tree view, showing parent-child relationships so you can see what started a process.
Left and Right arrows change the sort column (CPU, memory, PID, and so on), and r reverses the order.

Filtering plus the detail view covers the “what is eating this machine” workflow: filter to the suspect, Enter to watch its graphs, and you have a per-process monitor without leaving the dashboard.

Managing Processes

With a process selected, three keys open signal actions:

t opens a confirmation prompt for SIGTERM, the normal termination request.
k opens a confirmation prompt for SIGKILL, which stops the process immediately.
s opens a menu of all signals, for cases like SIGHUP or SIGSTOP.

Warning

Try SIGTERM first and wait for the process to exit. SIGKILL does not let the process save data or run cleanup handlers, so use it only when the process ignores SIGTERM.

You can signal processes owned by your user. Run sudo btop only when you need to manage a process owned by another account, and confirm the selected PID before sending a signal.

Options and Themes

Press F2 or o to open the options screen directly. You can change the update interval, visible boxes, temperature units, network interface, and color theme from this menu. Press Esc for the main menu or q to quit.

When $XDG_CONFIG_HOME is set, btop stores its settings in $XDG_CONFIG_HOME/btop/btop.conf. Otherwise, it uses ~/.config/btop/btop.conf. The file is plain text and can also be edited directly:

~/.config/btop/btop.conftxt
color_theme = "tokyo-night"
theme_background = False
update_ms = 2000
shown_boxes = "cpu mem net proc"

Setting theme_background = False makes btop use your terminal’s background. The 2000 ms update interval is the upstream default and provides steadier graph samples than a very short interval.

Distribution packages usually place system themes in /usr/share/btop/themes, while source installations may use /usr/local/share/btop/themes. Put additional themes in $XDG_CONFIG_HOME/btop/themes or ~/.config/btop/themes to make them available in the picker.

GPU panels appear only when the btop binary was built with GPU support and the required driver libraries are available. On Linux x86_64, upstream supports NVIDIA and AMD GPUs and Intel integrated GPUs, but the exact support depends on how your distribution packaged btop.

Quick Reference

Key or Command	Action
`btop`	Open the resource dashboard
`btop --help`	Show options supported by the installed version
`btop --version`	Show the installed version
`btop -p 1`	Start with preset 1
`btop -t`	Start in 16-color TTY mode
`btop --low-color`	Start in 256-color mode
`1` / `2` / `3` / `4`	Toggle the CPU, memory, network, or process box
Up / Down	Select a process
Enter	Open or close details for the selected process
Space	Expand or collapse the selected process in tree view
`f` or `/`	Edit the process filter
Delete	Clear the active process filter
Left / Right	Change the process sort column
`r`	Reverse the process sort order
`e`	Toggle process tree view
`c`	Toggle per-core process CPU percentages
`t` / `k` / `s`	Open SIGTERM, SIGKILL, or signal selection actions
`+` / `-`	Add or subtract 100 ms from the update timer
`F2` or `o`	Open options
`h`	Show the help window
Esc	Toggle the main menu
`q`	Quit `btop`

Troubleshooting

The interface renders as broken boxes or stray characters
btop needs a UTF-8 locale and a font with Braille, geometric shape, and box-drawing characters. Fix the locale or font first. The flag that bypasses locale detection was renamed in btop 1.4.2. Version 1.4.2 and newer accept btop --force-utf, while 1.4.1 and earlier, including the packages in Ubuntu 24.04 and Debian 13, accept btop --utf-force. Run btop --help to confirm which form your version accepts. TTY mode is another fallback for limited terminals:

Terminal
btop -t

No temperatures are shown
On Linux, btop reads sensor data through the kernel’s hwmon interface. Check whether the sensors command reports a CPU temperature, then select the correct sensor under Options > CPU if automatic detection chose the wrong one. If the kernel module for your hardware is missing, install lm-sensors and run sudo sensors-detect. Virtual machines usually do not expose hardware temperature sensors.

Colors look wrong or washed out
Try 256-color mode when the terminal does not render truecolor correctly:

Terminal
btop --low-color

For a basic console or a terminal with limited character support, use btop -t instead.

Sending a signal returns an insufficient permissions error
Your user can normally signal only its own processes. Exit and restart with sudo btop if you must manage a system process, then verify the process name and PID before confirming the signal.

Conclusion

btop combines CPU, memory, disk, network, and process monitoring in one interactive terminal view. Keep top as the widely available fallback, or use htop when you want a process-focused interface with fewer system-wide graphs.

How to Open a Port in the Firewall on Linux

hello@linuxize.com (Linuxize) — Wed, 02 Sep 2026 09:35:00 +0200

When a service works locally but cannot be reached from another machine, the host firewall is one of the first places to check. Opening the port tells the firewall to accept matching traffic, but it does not start the service or change the address on which it listens.

This guide shows how to open a port with ufw, firewalld, nftables, and legacy iptables rules, make the change persistent, and test the connection from another host.

Quick Reference

For a printable quick reference, see the ufw cheatsheet , firewalld cheatsheet , and iptables cheatsheet .

Task	Command
Check ufw	`sudo ufw status`
Check firewalld	`sudo firewall-cmd --state`
Find the active firewalld zone	`sudo firewall-cmd --get-active-zones`
Open TCP port 80 with ufw	`sudo ufw allow 80/tcp`
Open TCP port 80 with firewalld	`sudo firewall-cmd --zone=public --add-port=80/tcp`
Add a permanent firewalld rule	`sudo firewall-cmd --permanent --zone=public --add-port=80/tcp`
Inspect nftables rules	`sudo nft -a list ruleset`
Open TCP port 80 with iptables	`sudo iptables -I INPUT 1 -p tcp --dport 80 -j ACCEPT`
Check the local listener	`sudo ss -ltnp 'sport = :80'`
Test from another host	`nc -zv server.example.com 80`

The firewalld example uses the public zone. Replace it with the zone attached to your incoming network interface. Raw nftables rules use administrator-defined table and chain names, so inspect the ruleset before changing it.

Check Whether the Service Is Listening

Before changing the firewall, confirm that the service is listening on the expected TCP port. This example checks port 80:

Terminal
sudo ss -ltnp 'sport = :80'

If the command returns no output, nothing is listening on that port. Start or reconfigure the service before changing the firewall. If the local address is 127.0.0.1:80 or [::1]:80, the service accepts only local connections. Configure it to listen on the server’s network address, such as 0.0.0.0:80 or [::]:80, when remote access is required.

For a UDP service, replace -ltnp with -lunp. The ss command guide covers socket filters and listener output in more detail.

Identify the Active Firewall

Use the firewall manager that is already active on the system. Do not add raw nftables or iptables rules alongside ufw or firewalld, because the manager may replace or reorder them during a reload.

On Ubuntu and systems configured with ufw, check its status:

Terminal
sudo ufw status

Use the ufw section when the output begins with Status: active. An inactive ufw configuration is not enforcing its saved rules.

On Fedora, RHEL, and derivatives, check firewalld:

Terminal
sudo firewall-cmd --state

If the command prints running, use the firewalld section. When neither manager is active, check whether the system loads a raw nftables configuration:

Terminal
sudo systemctl is-active nftables

An active result means the nftables service is running. If all three checks are inactive or unavailable, the machine may not have an active host firewall. A cloud firewall, security group, or router can still block incoming traffic before it reaches the server.

Opening a Port with ufw

Ubuntu uses ufw as its default firewall configuration tool, and it is also available on Debian. To allow TCP traffic on port 80, run:

Terminal
sudo ufw allow 80/tcp

The rule takes effect immediately when ufw is active and remains in place after a reboot. Replace tcp with udp when the application uses UDP.

You can also use a service name from /etc/services. The following rule opens the standard HTTP port:

Terminal
sudo ufw allow http

Do not expose a database or an administration port to every source unless the service is meant to be public. To allow one address to reach PostgreSQL on port 5432, use:

Terminal
sudo ufw allow proto tcp from 203.0.113.10 to any port 5432

Replace 203.0.113.10 with the client address. You can also provide a CIDR range, such as 192.168.1.0/24, when a trusted network needs access.

For a TCP port range, separate the first and last ports with a colon:

Terminal
sudo ufw allow 6000:6007/tcp

List the rules with their numbers to confirm the change:

Terminal
sudo ufw status numbered

output

Status: active
To Action From
-- ------ ----
[ 1] 80/tcp ALLOW IN Anywhere
[ 2] 80/tcp (v6) ALLOW IN Anywhere (v6)

The two entries allow port 80 over IPv4 and IPv6. For more examples, including deleting a rule, see the ufw command guide .

Warning

If you are enabling ufw over SSH, allow the SSH service or its custom port first. Otherwise, sudo ufw enable can block the connection and leave you dependent on console access.

Opening a Port with firewalld

firewalld organizes rules into zones, and each network interface or source is assigned to a zone. Find the zone that receives the incoming connection before adding the rule:

Terminal
sudo firewall-cmd --get-active-zones

output

public
interfaces: enp1s0

This server uses the public zone for traffic arriving on enp1s0. Open TCP port 80 in the runtime configuration so the change takes effect immediately:

Terminal
sudo firewall-cmd --zone=public --add-port=80/tcp

Add the same rule to the permanent configuration so it survives a reload or reboot:

Terminal
sudo firewall-cmd --permanent --zone=public --add-port=80/tcp

Running both commands avoids reloading the entire firewall and does not disturb unrelated runtime-only rules. If your interface belongs to another zone, replace public in both commands.

For standard services, a named service is easier to read than a port number. These commands allow HTTP immediately and permanently:

Terminal
sudo firewall-cmd --zone=public --add-service=http
sudo firewall-cmd --permanent --zone=public --add-service=http

A port range works the same way, except that firewalld separates the two ports with a hyphen rather than the colon ufw expects. These commands open TCP ports 6000 through 6007:

Terminal
sudo firewall-cmd --zone=public --add-port=6000-6007/tcp
sudo firewall-cmd --permanent --zone=public --add-port=6000-6007/tcp

Query the active zone to confirm that the port rule is present:

Terminal
sudo firewall-cmd --zone=public --query-port=80/tcp

output

yes

When you add http as a named service, verify it with sudo firewall-cmd --zone=public --query-service=http instead.

Opening a Port with nftables

Use raw nft commands only when nftables itself manages the firewall. ufw and firewalld can also use nftables as a backend, but their rules should still be changed through ufw or firewall-cmd.

Unlike iptables, nftables does not create standard table and chain names. Display the current ruleset, including rule handles, before adding anything:

Terminal
sudo nft -a list ruleset

The following example assumes the ruleset contains an inet table named filter and an input chain named input. It inserts an allow rule at the beginning of that chain so an existing catch-all drop rule cannot match first:

Terminal
sudo nft insert rule inet filter input tcp dport 80 accept

Substitute the family, table, and chain names shown on your system. The command changes the running ruleset immediately, but it does not update the configuration loaded during boot.

On Debian, persistent nftables rules are normally stored in /etc/nftables.conf. Add the equivalent rule inside the existing input chain, before its final drop or reject rule:

/etc/nftables.conftxt
tcp dport 80 accept

Validate the complete file before loading it:

Terminal
sudo nft --check --file /etc/nftables.conf

If the check produces no error, apply the file and enable the service at boot:

Terminal
sudo nft --file /etc/nftables.conf
sudo systemctl enable nftables

Some systems split the rules across files included from /etc/nftables.conf. In that case, edit the file that defines the input chain rather than adding a second copy of the chain.

Opening a Port with iptables

iptables is the legacy interface and is often a compatibility front end for nftables on current distributions. Prefer ufw, firewalld, or native nftables for a new firewall, but use iptables syntax when maintaining an existing iptables ruleset.

Insert an IPv4 rule at the top of the INPUT chain to allow TCP port 80:

Terminal
sudo iptables -I INPUT 1 -p tcp --dport 80 -j ACCEPT

Using -I INPUT 1 places the rule before a later rule that drops unmatched traffic. List the chain with rule numbers to verify its position:

Terminal
sudo iptables -L INPUT -n --line-numbers

The running rule disappears after a reboot unless the system restores it. On Ubuntu and Debian, install the persistence package and save the current ruleset:

Terminal
sudo apt install iptables-persistent
sudo netfilter-persistent save

The iptables command affects IPv4 only. If the service also accepts IPv6 connections, add the equivalent rule with ip6tables and save again:

Terminal
sudo ip6tables -I INPUT 1 -p tcp --dport 80 -j ACCEPT
sudo netfilter-persistent save

See the iptables command guide when you need to inspect, remove, or reorder existing rules.

Verifying the Port Is Reachable

After applying the firewall rule, check the local listener again:

Terminal
sudo ss -ltnp 'sport = :80'

Then test from another machine that should be allowed through the firewall. Replace the hostname and port with your server details:

Terminal
nc -zv server.example.com 80

A successful connection confirms that the service is listening and the network path permits the traffic. A timeout usually points to a firewall, routing, or upstream network filter. Connection refused usually means the host is reachable but nothing accepts the connection on that address and port.

For additional remote tests with nmap, netcat, and Bash, see how to check open ports in Linux .

Troubleshooting

The firewall rule exists, but the port is still unreachable
Run sudo ss -ltnp 'sport = :80' and inspect the local address. A service bound only to 127.0.0.1 or ::1 cannot accept remote connections.

The ufw rule does not filter any traffic
Check sudo ufw status. Rules are saved while ufw is inactive, but they are not enforced until you enable the firewall.

The firewalld rule is in the wrong zone
Compare sudo firewall-cmd --get-active-zones with the zone used in the command. Add the rule to the zone attached to the incoming interface or source.

The rule uses the wrong protocol
TCP and UDP rules are separate. Check the application’s documentation or use ss -ltnp for TCP and ss -lunp for UDP before adding the rule.

A cloud server still blocks the port
Cloud security groups and provider firewalls operate outside the Linux host. Allow the same port and source in the provider control panel. A server behind a router may also need a port-forwarding rule before internet clients can reach it.

Conclusion

Open only the port, protocol, and source range the service needs. Check both the local listener and a remote connection after every change, and remove temporary rules when the service no longer requires them.

PHP Cheatsheet

hello@linuxize.com (Linuxize) — Tue, 01 Sep 2026 10:55:00 +0200

Basic Syntax

Every PHP file starts with an opening tag. Closing tags are omitted in pure PHP files to avoid stray output.

Syntax	Description
`<?php ... ?>`	Standard PHP tags
`<?= $name ?>`	Short echo tag (always available)
`declare(strict_types=1);`	Use strict scalar checks for calls and returns in this file
`// comment`, `# comment`	Single-line comment
`/* comment */`	Multi-line comment
`echo "text";`	Output one or more strings
`print_r($var)`	Human-readable dump of an array or object
`var_dump($var)`	Dump value with type and length
`require 'file.php'`	Include file, fatal error if missing
`include 'file.php'`	Include file, warning if missing
`require_once 'file.php'`	Include only once

Variables and Types

PHP variables start with $ and are dynamically typed. Type declarations are optional but recommended.

Syntax	Description
`$name = "Alice";`	Assign a value
`int`, `float`, `bool`, `string`	Scalar types
`array`, `object`, `callable`, `iterable`	Compound types
`null`	Absence of a value
`const MAX = 10;`	Compile-time constant
`define('MAX', 10);`	Runtime constant
`gettype($x)`	Return the type name
`is_int($x)`, `is_string($x)`, `is_array($x)`	Type checks
`(int) $x`, `(string) $x`, `(bool) $x`	Explicit casts
`intval($x)`, `floatval($x)`	Convert to int or float
`isset($x)`	`true` if set and not `null`
`empty($x)`	`true` when unset or equal to `""`, `"0"`, `0`, `0.0`, `[]`, `null`, or `false`
`unset($x)`	Destroy a variable
`?int $x`	Nullable type (int or null)
`int\|string $x`	Union type

Operators

Arithmetic, comparison, logical, and null-handling operators.

Operator	Description
`+`, `-`, `*`, `/`, `%`	Arithmetic and modulo
`**`	Exponentiation
`.`	String concatenation
`.=`, `+=`, `-=`, `*=`	Compound assignment
`==`, `!=`	Loose comparison (type juggling)
`===`, `!==`	Strict comparison (value and type)
`<`, `>`, `<=`, `>=`	Relational comparison
`<=>`	Spaceship, returns -1, 0, or 1
`&&`, `\|\|`, `!`	Logical AND, OR, NOT
`and`, `or`, `xor`	Low-precedence logical operators
`? :`	Ternary conditional
`?:`	Elvis, returns left side if truthy
`??`	Null coalescing, returns right side if left is null
`??=`	Null coalescing assignment
`?->`	Nullsafe method or property access
`\|>`	Pipe operator, PHP 8.5 and later

Strings

Double-quoted strings interpolate variables; single-quoted strings do not.

Function	Description
`strlen($s)`	String length in bytes
`mb_strlen($s)`	Character length (requires the mbstring extension)
`strtolower($s)` / `strtoupper($s)`	Change case
`ucfirst($s)` / `ucwords($s)`	Capitalize first letter / each word
`trim($s)`, `ltrim($s)`, `rtrim($s)`	Strip whitespace
`str_contains($s, "x")`	`true` if substring is present
`str_starts_with($s, "x")`	`true` if string starts with prefix
`str_ends_with($s, "x")`	`true` if string ends with suffix
`strpos($s, "x")`	First index of substring, `false` if absent
`substr($s, 0, 5)`	Extract part of a string
`str_replace("a", "b", $s)`	Replace all occurrences
`explode(",", $s)`	Split into an array
`implode(", ", $arr)`	Join array elements
`sprintf("%s has %d", $a, $b)`	Format into a string
`number_format(1234.5, 2)`	Format a number with separators
`str_pad($s, 10, "0", STR_PAD_LEFT)`	Pad to a fixed width
`str_repeat($s, 3)`	Repeat a string
`htmlspecialchars($s)`	Escape HTML before output
`nl2br($s)`	Convert newlines to `<br>`
`"Hello $name"` / `"Sum: {$a['b']}"`	Interpolation, braces for complex expressions
`<<<EOT ... EOT;`	Heredoc (interpolates) and nowdoc `<<<'EOT'` (does not)

Arrays

PHP arrays are ordered maps and cover both lists and dictionaries.

Syntax	Description
`$a = [1, 2, 3];`	Indexed array
`$a = ["k" => "v"];`	Associative array
`$a[] = 4;`	Append an element
`$a["k"]`	Access by key
`$a[0][1]`	Nested access
`count($a)`	Number of elements
`array_key_exists("k", $a)`	`true` if the key exists, even when null
`in_array(4, $a)`	`true` if the value exists
`array_search(4, $a)`	Return the key of a value
`[$x, $y] = $a;`	Destructuring assignment
`["k" => $v] = $a;`	Destructure by key
`[...$a, ...$b]`	Spread into a new array
`foreach ($a as $k => $v)`	Iterate keys and values

Array Functions

Transform, filter, and sort arrays without writing loops.

Function	Description
`array_push($a, $v)` / `array_pop($a)`	Add or remove at the end
`array_unshift($a, $v)` / `array_shift($a)`	Add or remove at the start
`array_merge($a, $b)`	Merge arrays, reindex numeric keys
`array_keys($a)` / `array_values($a)`	Extract keys or values
`array_slice($a, 1, 3)`	Extract a portion
`array_splice($a, 1, 2)`	Remove or replace a portion in place
`array_map(fn($x) => $x * 2, $a)`	Apply a callback to each element
`array_filter($a, fn($x) => $x > 2)`	Keep elements passing a test
`array_reduce($a, fn($c, $x) => $c + $x, 0)`	Reduce to a single value
`array_column($rows, "name", "id")`	Pull one column, optionally keyed
`array_unique($a)`	Remove duplicate values
`array_combine($keys, $vals)`	Build an array from two arrays
`array_flip($a)`	Swap keys and values
`array_sum($a)` / `array_product($a)`	Sum or product of values
`min($a)` / `max($a)`	Smallest or largest value
`range(1, 10)`	Build a sequence
`sort($a)` / `rsort($a)`	Sort values ascending / descending
`asort($a)` / `ksort($a)`	Sort by value / key, keep keys
`usort($a, fn($x, $y) => $x <=> $y)`	Sort with a custom comparator
`array_find($a, $fn)`, `array_any($a, $fn)`, `array_all($a, $fn)`	Search and test, PHP 8.4 and later
`array_first($a)` / `array_last($a)`	First or last value, PHP 8.5 and later

Control Flow

Conditionals and loops. The alternative syntax with endif and endforeach reads better inside HTML templates.

Syntax	Description
`if (...) { } elseif (...) { } else { }`	Standard branching
`if (...): ... endif;`	Alternative syntax for templates
`switch ($x) { case 1: ...; break; default: ...; }`	Multi-branch on loose comparison
`match($x) { 1 => "a", default => "b" }`	Strict comparison, returns a value
`for ($i = 0; $i < 10; $i++)`	Counter loop
`foreach ($arr as $value)`	Iterate values
`foreach ($arr as $key => $value)`	Iterate keys and values
`foreach ($arr as &$value)`	Iterate by reference (unset after)
`while (cond)` / `do { } while (cond);`	Conditional loops
`break;` / `break 2;`	Exit the loop, or two levels of loops
`continue;`	Skip to the next iteration
`return $x;`	Return from a function

Functions

Functions support default values, type declarations, named arguments, and variadics.

Syntax	Description
`function name($a, $b) { }`	Function declaration
`function name(int $a): string { }`	Typed parameters and return type
`function name($a = 10) { }`	Default parameter value
`function name(...$args) { }`	Variadic parameters
`name(b: 2, a: 1)`	Named arguments
`function name(&$a) { }`	Pass by reference
`function (): void { }`	No return value
`fn($x) => $x * 2`	Arrow function, captures scope automatically
`function ($x) use ($y) { }`	Closure with an explicit captured variable
`$fn = strlen(...);`	First-class callable syntax
`call_user_func($fn, $arg)`	Call a callable dynamically
`function gen() { yield $x; }`	Generator function
`static function () { }`	Closure without `$this` binding

Classes and Objects

PHP 8 adds constructor promotion, enums, readonly properties, and property hooks.

Syntax	Description
`class User { }`	Class declaration
`new User()`	Instantiate
`public`, `protected`, `private`	Visibility modifiers
`public function __construct(private string $name) { }`	Constructor property promotion
`public readonly int $id;`	Write once, then immutable
`private(set) string $name;`	Asymmetric visibility, PHP 8.4 and later
`public string $full { get => "$this->a $this->b"; }`	Property hook, PHP 8.4 and later
`$this->name`	Access a property on the instance
`self::CONST`, `static::method()`	Class and late static binding access
`parent::__construct()`	Call the parent constructor
`class Admin extends User { }`	Inheritance
`interface Jsonable { }` / `implements Jsonable`	Interfaces
`abstract class Base { }`	Abstract class
`trait Loggable { }` / `use Loggable;`	Trait reuse
`enum Status: string { case Active = 'active'; }`	Backed enum
`Status::from('active')`, `Status::tryFrom($x)`	Enum lookup, `tryFrom` returns null
`$obj instanceof User`	Type check
`User::class`	Fully qualified class name as a string
`__get`, `__set`, `__call`, `__toString`	Magic methods
`namespace App\Models;` / `use App\Models\User;`	Namespaces and imports

Superglobals and Request Data

Superglobals are available in every scope. Treat all of them as untrusted input.

Variable	Description
`$_GET`	Query string parameters
`$_POST`	Form body parameters
`$_REQUEST`	Merge of GET, POST, and cookies
`$_SERVER`	Request and server metadata
`$_SERVER['REQUEST_METHOD']`	HTTP method
`$_SERVER['REMOTE_ADDR']`	Client IP address
`$_FILES`	Uploaded file metadata
`$_COOKIE`	Cookies sent by the client
`$_SESSION`	Session data, after `session_start()`
`$_ENV`, `getenv('NAME')`	Environment variables
`filter_input(INPUT_GET, 'id', FILTER_VALIDATE_INT)`	Read and validate in one call
`filter_var($email, FILTER_VALIDATE_EMAIL)`	Validate a value
`htmlspecialchars($v, ENT_QUOTES)`	Escape before printing to HTML
`header('Location: /home'); exit;`	Redirect and stop further execution
`http_response_code(404)`	Set the response status
`password_hash($p, PASSWORD_DEFAULT)`	Hash a password
`password_verify($p, $hash)`	Verify a password against a hash

Files and JSON

File helpers for small payloads, plus JSON encoding and decoding.

Function	Description
`file_get_contents($path)`	Read a whole file into a string
`file_put_contents($path, $data)`	Write a string to a file
`file($path, FILE_IGNORE_NEW_LINES)`	Read a file into an array of lines
`fopen($path, 'r')`, `fgets($fh)`, `fclose($fh)`	Streamed reads for large files
`fwrite($fh, $data)`	Write to an open handle
`file_exists($p)`, `is_file($p)`, `is_dir($p)`	Existence and type checks
`is_readable($p)`, `is_writable($p)`	Permission checks
`unlink($p)`, `rename($a, $b)`, `copy($a, $b)`	Delete, move, copy
`mkdir($p, 0755, true)` / `rmdir($p)`	Create or remove directories
`scandir($p)` / `glob("*.log")`	List directory entries or match a pattern
`dirname($p)`, `basename($p)`, `pathinfo($p)`	Split a path
`__DIR__`, `__FILE__`	Directory and path of the current file
`realpath($p)`, `filesize($p)`, `filemtime($p)`	Resolve path, size, modification time
`json_encode($data, JSON_PRETTY_PRINT)`	Encode to JSON
`json_decode($s, true)`	Decode to an associative array
`json_encode($d, JSON_THROW_ON_ERROR)`	Throw `JsonException` on failure
`json_validate($s)`	Check validity without decoding, PHP 8.3 and later

Dates and Times

DateTimeImmutable is the safer default because arithmetic returns a new object instead of mutating the original.

Syntax	Description
`time()`	Current Unix timestamp
`date('Y-m-d H:i:s')`	Format the current time
`date('Y-m-d', $ts)`	Format a given timestamp
`strtotime('+1 day')`	Parse a relative or absolute string
`mktime($h, $m, $s, $mo, $d, $y)`	Build a timestamp from parts
`new DateTimeImmutable('2026-09-01')`	Create an immutable date object
`$d->format('D, d M Y')`	Format a date object
`$d->modify('+2 weeks')`	Return a shifted copy
`$d->add(new DateInterval('P1M'))`	Add an interval
`$a->diff($b)->days`	Difference in days
`new DateTimeZone('Europe/Berlin')`	Time zone object
`date_default_timezone_set('UTC')`	Set the script time zone
`checkdate($m, $d, $y)`	Validate a calendar date
`Y m d H i s`, `D M`, `N`, `U`	Common format characters

Errors and Exceptions

Error covers engine failures and Exception covers application failures; both implement Throwable.

Syntax	Description
`try { } catch (Exception $e) { } finally { }`	Handle and clean up
`catch (TypeError \| ValueError $e)`	Catch multiple types
`catch (Exception)`	Catch without capturing the object
`throw new RuntimeException("msg", 500);`	Throw an exception
`$e->getMessage()`, `$e->getCode()`	Read the message and code
`$e->getFile()`, `$e->getLine()`	Where the exception was thrown
`$e->getTraceAsString()`	Stack trace as text
`$e->getPrevious()`	Chained exception
`class MyException extends Exception { }`	Custom exception
`error_reporting(E_ALL)`	Report every error level
`ini_set('display_errors', '1')`	Show errors, development only
`ini_set('log_errors', '1')`	Write errors to the log
`set_error_handler($fn)`	Register a user-defined error handler
`set_exception_handler($fn)`	Catch uncaught exceptions
`trigger_error("msg", E_USER_WARNING)`	Raise a user-level error
`@$value`	Error suppression operator, avoid it

Regular Expressions

PHP uses PCRE. Patterns need delimiters, usually / or #.

Function	Description
`preg_match('/^a/', $s, $m)`	Match once, fill `$m` with captures
`preg_match_all('/\d+/', $s, $m)`	Match every occurrence
`preg_replace('/\s+/', ' ', $s)`	Replace matches
`preg_replace_callback('/\d/', $fn, $s)`	Replace using a callback
`preg_split('/[\s,]+/', $s)`	Split on a pattern
`preg_quote($s, '/')`	Escape user input used in a pattern
`preg_grep('/^a/', $arr)`	Filter array entries by pattern
`/pattern/i`	Case-insensitive
`/pattern/m`	Multiline, `^` and `$` match each line
`/pattern/s`	Dot matches newlines
`/pattern/u`	Treat pattern and subject as UTF-8
`(?<name>...)`	Named capture group, read as `$m['name']`

PHP CLI

The php binary runs scripts, checks syntax, and starts a development server without a web server in front of it.

Command	Description
`php script.php`	Run a script
`php -v`	Show the PHP version
`php -m`	List compiled and loaded modules
`php -i`	Print the full `phpinfo()` output
`php --ini`	Show which `php.ini` files are loaded
`php -l script.php`	Syntax check without executing
`php -r 'echo PHP_VERSION;'`	Run inline code
`php -a`	Interactive shell
`php -S localhost:8000`	Built-in development server
`php -S localhost:8000 -t public`	Serve a specific document root
`php -d memory_limit=512M script.php`	Override an `ini` setting for one run
`php -c /path/to/php.ini script.php`	Use a specific config file
`php --rf str_replace`	Reflect on a function signature
`php --rc DateTimeImmutable`	Reflect on a class
`php --re json`	Reflect on an extension
`php -n script.php`	Run without loading any `php.ini`

Configuration and Extensions

Configuration paths depend on the SAPI and distribution. Use php --ini for the CLI or phpinfo() through the web server to confirm which files are active.

Path or command	Description
`php --ini`	Locate the CLI configuration files
`/etc/php/<version>/cli/php.ini`	CLI config on Debian and Ubuntu
`/etc/php/<version>/fpm/php.ini`	PHP-FPM config on Debian and Ubuntu
`/etc/php/<version>/apache2/php.ini`	Apache module config on Debian and Ubuntu
`/etc/php.ini`, `/etc/php.d/`	Main config and snippets on Fedora and RHEL
`/etc/php/<version>/mods-available/`	Extension snippets on Debian and Ubuntu
`memory_limit`, `max_execution_time`	Per-script resource limits
`upload_max_filesize`, `post_max_size`	Upload limits, raise both together
`display_errors`, `error_log`	Error output and log destination
`date.timezone`	Default time zone
`opcache.enable`, `opcache.memory_consumption`	Bytecode cache settings
`sudo apt install php-gd php-curl php-mbstring`	Install default-version extensions on Ubuntu or Debian
`sudo dnf install php-gd php-curl php-mbstring`	Install extensions on Fedora or RHEL
`php -m \| grep -E 'curl\|gd\|mbstring'`	Confirm extensions are loaded
`sudo phpenmod curl` / `sudo phpdismod curl`	Enable or disable an extension on Debian or Ubuntu
`sudo update-alternatives --config php`	Select an installed CLI version on Debian or Ubuntu

PHP-FPM

PHP-FPM is the process manager that Nginx and Apache hand PHP requests to. The versioned examples below use PHP 8.5 on Ubuntu 26.04; Debian 13 uses 8.4, while Fedora and RHEL use unversioned php-fpm names. Reload or restart FPM after config or extension changes.

Command or directive	Description
`sudo systemctl status php8.5-fpm`	Check the Ubuntu 26.04 service state
`sudo systemctl status php-fpm`	Check the Fedora or RHEL service state
`sudo systemctl restart php8.5-fpm`	Restart the versioned service
`sudo systemctl reload php8.5-fpm`	Gracefully reload FPM workers
`sudo php-fpm8.5 -t`	Test Ubuntu 26.04 configuration before reloading
`/etc/php/8.5/fpm/pool.d/www.conf`	Ubuntu 26.04 default pool configuration
`listen = /run/php/php8.5-fpm.sock`	Unix socket the web server connects to
`user` / `group`	System account the workers run as
`pm = dynamic`	Process manager mode: `static`, `dynamic`, or `ondemand`
`pm.max_children`	Hard cap on worker processes
`pm.start_servers`, `pm.min_spare_servers`	Warm pool sizing for `dynamic`
`pm.max_requests`	Recycle a worker after N requests
`php_admin_value[memory_limit] = 256M`	Override an `ini` value per pool
`slowlog`, `request_slowlog_timeout`	Log requests that run too long
`sudo journalctl -u php8.5-fpm -f`	Follow the versioned service log

Composer

Composer manages dependencies and the autoloader for almost every modern PHP project.

Command	Description
`composer init`	Create a `composer.json` interactively
`composer require vendor/package`	Add a dependency
`composer require --dev phpunit/phpunit`	Add a development dependency
`composer install`	Install from `composer.lock`
`composer update`	Update dependencies and the lock file
`composer update vendor/package`	Update a single package
`composer remove vendor/package`	Remove a dependency
`composer install --no-dev --optimize-autoloader`	Production install
`composer dump-autoload -o`	Regenerate an optimized autoloader
`composer show` / `composer show -t`	List packages, or show the dependency tree
`composer outdated`	List packages with newer versions
`composer why vendor/package`	Explain why a package is installed
`composer audit`	Check dependencies for known vulnerabilities
`composer create-project vendor/skeleton app`	Start a project from a skeleton
`require 'vendor/autoload.php';`	Load the autoloader in your entry script

Use these guides to install PHP, check the running version, and debug errors on a server.

Guide	Description
How to Install PHP on Ubuntu 26.04	Install PHP 8.5 with Apache or Nginx and PHP-FPM
How to Check the PHP Version	Find the CLI and web server PHP versions
PHP Error Reporting	Show, log, and control PHP errors
How to Install a LAMP Stack on Ubuntu 26.04	Apache, MySQL, and PHP on one server
MySQL and MariaDB Cheatsheet	Database commands for the data layer behind PHP

What Is .bashrc? When It Runs and What to Put in It

hello@linuxize.com (Linuxize) — Mon, 31 Aug 2026 14:35:00 +0200

You define an alias in your terminal, use it happily for an hour, then open a new tab and it is gone. Shell settings typed at the prompt live only as long as that shell does. To make them permanent, they have to go in a file that Bash reads every time it starts a new session. On most Linux systems that file is ~/.bashrc.

This guide covers where .bashrc lives, when Bash reads it, what belongs inside it, and how to apply your changes without opening a new terminal.

What .bashrc Does

.bashrc is a per-user Bash startup script, not a generic Linux configuration file. When Bash loads it, each command runs in the current shell. That is why aliases, functions, prompt settings, and shell options become part of the session without a separate import step. Other shells use their own files, such as ~/.zshrc for zsh.

The rc suffix comes from RUNCOM, an early CTSS program that executed commands stored in a file. The name survives in Unix configuration files such as .vimrc, .screenrc, and .inputrc.

Where the .bashrc File Is Located

.bashrc sits in your home directory. The leading dot makes it a hidden file, so a plain ls will not show it:

Terminal
ls -la ~/.bashrc

output

-rw-r--r-- 1 dejan dejan 3771 Aug 14 09:12 /home/dejan/.bashrc

Every user account has its own copy, and editing yours has no effect on anyone else on the system. The file is plain text, so any editor works:

Terminal
nano ~/.bashrc

If the file does not exist, nothing is broken. Bash simply skips it. Most distributions ship a template in /etc/skel/ that is copied into each new home directory, so you can restore the default version with:

Terminal
cp /etc/skel/.bashrc ~/.bashrc

You can also create the file from scratch and start with an empty one.

When Bash Reads .bashrc

Bash reads ~/.bashrc when it starts an interactive shell that is not a login shell. In everyday terms, that means opening a new terminal window or tab in your desktop environment, or typing bash inside a shell you already have open.

Two common cases do not fit that description. Logging in over SSH or at a console starts a login shell. Bash reads /etc/profile, then the first readable file it finds from ~/.bash_profile, ~/.bash_login, and ~/.profile. Running a local script starts a non-interactive shell, which normally reads none of those files. If BASH_ENV is set, Bash reads the file named by that variable before running the script.

Because most people want the same interactive settings in both login and non-login shells, the usual arrangement is to keep those settings in ~/.bashrc and have the login file source it. For the full startup order and the reasoning behind that setup, see .bashrc vs .bash_profile .

The Guard at the Top of the File

Open the default ~/.bashrc on Debian or Ubuntu and the first real line is this:

~/.bashrcsh
# If not running interactively, don't do anything
case $- in
 *i*) ;;
 *) return;;
esac

The $- variable holds the current shell option flags, and it contains i only in an interactive shell. If the i flag is missing, return stops reading the file right there.

That guard exists because of one specific Bash behavior: when Bash detects that its standard input is connected to a network connection, as happens with ssh user@host 'command', it reads ~/.bashrc even though the shell is not interactive. Without the guard, everything below it could run during remote commands and file transfers that start Bash on the server.

Keep the guard where it is, and add interactive settings below it. A setting required by a non-interactive remote command is an exception, but anything placed above the guard must stay silent.

What to Put in .bashrc

Anything that shapes how an interactive shell behaves belongs here. The most common additions follow.

Aliases

Aliases are short names for longer commands:

~/.bashrcsh
alias ll='ls -alF'
alias gs='git status'
alias ..='cd ..'

Functions

When a shortcut needs arguments or more than one command, use a function instead of an alias:

~/.bashrcsh
mkcd () {
 mkdir -p "$1" && cd "$1"
}

Running mkcd projects/api now creates the directory and moves into it.

Interactive PATH Additions

To make Bash find executables in a directory of your own at the interactive prompt, add it to $PATH :

~/.bashrcsh
export PATH="$HOME/.local/bin:$PATH"

Putting $PATH at the end preserves the existing directories. Placing your directory first means your version of a command wins over a system one with the same name.

This change applies to shells that read .bashrc. If the path must also reach GUI programs or other shells, set it in ~/.profile or ~/.bash_profile instead.

Environment Variables

Environment variables needed by programs you start from interactive Bash can go here. Export them so child processes inherit their values:

~/.bashrcsh
export EDITOR=nano
export LESS='-R'

For variables that must exist across the entire login session, including applications not launched from a terminal, use a login or desktop environment file instead.

Do not put API keys, tokens, or passwords in .bashrc. The file often ends up in a dotfiles repository. Keep secrets in a separate file that is excluded from version control and protected with chmod 600, or use a dedicated secret manager.

The Shell Prompt

PS1 defines the prompt string. The following example shows the username, host, and current directory in color:

~/.bashrcsh
PS1='\[\e[32m\]\u@\h\[\e[0m\]:\[\e[34m\]\w\[\e[0m\]\$ '

The \[ and \] markers tell Bash that the enclosed escape sequences take up no screen width. Leaving them out makes long command lines wrap incorrectly.

Shell Options

shopt toggles Bash behaviors that are off by default:

~/.bashrcsh
shopt -s autocd # type a directory name to cd into it
shopt -s cdspell # fix minor typos in cd arguments
shopt -s globstar # ** matches files across subdirectories
shopt -s histappend # append to the history file instead of overwriting

History settings such as HISTSIZE and HISTCONTROL also live in this file. See the history command guide for working with the entries themselves.

Apply Changes Without Restarting the Terminal

Bash reads ~/.bashrc at startup, so an edit has no effect on shells that are already running. Before loading an edited file, check its syntax:

Terminal
bash -n ~/.bashrc

No output means Bash found no syntax errors. You can then source the file instead of closing the terminal:

Terminal
source ~/.bashrc

The dot command is the POSIX spelling of source and does the same thing in Bash:

Terminal
. ~/.bashrc

Either command runs the file in your current shell, so aliases, functions, and variables become available immediately. Sourcing does not undo anything: if you deleted an alias from the file, it stays defined in the current session until you run unalias or open a new terminal.

Split .bashrc Into Separate Files

A .bashrc that has grown past a couple of hundred lines is easier to manage in pieces. Debian and Ubuntu already use this pattern for aliases, and their default file includes:

~/.bashrcsh
if [ -f ~/.bash_aliases ]; then
 . ~/.bash_aliases
fi

For a more general split, create a directory for the extra files:

Terminal
mkdir -p ~/.bashrc.d

Then add a loop to ~/.bashrc that sources every readable shell file in the directory:

~/.bashrcsh
if [ -d ~/.bashrc.d ]; then
 for rc in ~/.bashrc.d/*.sh; do
 [ -r "$rc" ] && . "$rc"
 done
 unset rc
fi

Files are sourced in alphabetical order, so a 10-path.sh runs before a 20-aliases.sh. This keeps work-specific settings in one file that you can drop in or remove without editing .bashrc itself. A bash -n ~/.bashrc check does not read the sourced files, so check each of them separately after an edit.

Fedora and RHEL already source files from ~/.bashrc.d/ in their default configuration, so check your existing file before adding another loop.

What Not to Put in .bashrc

Commands that print output are the main thing to avoid. A neofetch call or an echo "Welcome back" line placed above the interactivity guard looks harmless in a terminal, but it also runs during scp, rsync, and ssh host 'command' sessions. The extra text can corrupt the protocol stream and make those tools fail. Keep printed output below the guard, or move a login banner to the login profile.

Long-running commands are worth avoiding too. Everything in .bashrc runs before you get a prompt, so a network call or a version-manager initialization that takes half a second adds that delay to every terminal you open.

Quick Reference

For a printable quick reference, see the Bash cheatsheet .

Setting	Example	Purpose
Alias	`alias ll='ls -alF'`	Short name for a longer command
Function	`mkcd () { mkdir -p "$1" && cd "$1"; }`	Shortcut that takes arguments
Interactive PATH	`export PATH="$HOME/.local/bin:$PATH"`	Add an executable directory to interactive Bash
Environment variable	`export EDITOR=nano`	Setting inherited by programs launched from Bash
Prompt	`PS1='\u@\h:\w\$ '`	Format of the shell prompt
Shell option	`shopt -s autocd`	Toggle a Bash behavior
Source a file	`. ~/.bash_aliases`	Load settings from another file
Syntax check	`bash -n ~/.bashrc`	Check the file without running it
Reload	`source ~/.bashrc`	Apply edits to the current shell

Troubleshooting

Changes do not take effect
Bash reads ~/.bashrc only when a shell starts. Run bash -n ~/.bashrc, then source ~/.bashrc in the current terminal, or open a new one.

Settings work in a new terminal but not over SSH
ssh user@host opens a login shell, which reads the first available file from ~/.bash_profile, ~/.bash_login, and ~/.profile rather than ~/.bashrc. Debian and Ubuntu ship a ~/.profile that sources ~/.bashrc already, so the default setup works. On other systems, or after replacing the login file, add . ~/.bashrc to it so both shell types load the same interactive configuration.

scp or rsync fails after editing .bashrc
Something in the file may be printing output during the remote session. Move any echo, neofetch, or banner command below the interactivity guard, then test with ssh user@host 'true', which should print nothing at all.

A syntax error appears in every new terminal
Bash reports the offending line number. Open a shell that skips the file with bash --norc, fix the line, then run bash -n ~/.bashrc before reloading. A missing fi or an unclosed quote is the usual cause.

The file was deleted or emptied
Copy the distribution default back with cp /etc/skel/.bashrc ~/.bashrc and reload it.

A command is found in one terminal but not another
The two shells may read different startup files, or the $PATH addition may be below an early return or inside a conditional that does not match. Run echo "$PATH" in both shells to compare.

FAQ

Does .bashrc run when I execute a script?
Normally, no. A local script runs in a non-interactive shell, which does not read ~/.bashrc unless the script sources it or BASH_ENV points to it. Bash may also read .bashrc when a remote shell daemon starts a non-interactive command, but the interactivity guard usually stops the file immediately.

I use zsh. Where do these settings go?
Use ~/.zshrc, which serves the same role for zsh. Aliases, functions, and PATH changes carry over unchanged, but prompt escapes and some shopt options do not.

Should I put .bashrc in version control?
Yes, as long as it holds no secrets. A dotfiles repository makes it easy to set up a new machine. Keep tokens and passwords in a separate file that is listed in .gitignore and sourced from .bashrc.

Why is my .bashrc not read on macOS?
Terminal and iTerm2 normally open a login shell. If you configured them to use Bash, Bash reads the first available login file instead of ~/.bashrc. Current macOS releases use zsh by default, and its interactive configuration belongs in ~/.zshrc.

Conclusion

Treat ~/.bashrc as code that runs every time you open an interactive Bash shell. Keep it fast, keep secrets out of it, and check each edit with bash -n ~/.bashrc before loading the change.

Regex Cheatsheet

hello@linuxize.com (Linuxize) — Fri, 28 Aug 2026 17:40:00 +0200

Metacharacters

Characters that mean something other than themselves.

Pattern	Description
`.`	Any single character except a newline
`*`	Zero or more of the item before it
`[...]`	Any one character from the set
`[^...]`	Any one character not in the set
`^`	Start of the line
`$`	End of the line
`\`	Escape a character or begin a special sequence, depending on the regex flavor

Most other characters match themselves. Line-based tools such as grep, sed, and awk read one line at a time, so . never matches the line ending.

Anchors and Word Boundaries

Tie a pattern to a position instead of a character.

Pattern	Description
`^error`	Line starts with `error`
`done$`	Line ends with `done`
`^exact$`	Match the whole line
`^$`	Match an empty line
`\<word`	Start of a word (GNU tools and Vim)
`word\>`	End of a word
`\bword\b`	Word boundary on both sides (GNU and PCRE)
`\B`	Any position that is not a word boundary

Anchors match a position of zero width, so they never consume a character. In awk, \b means a backspace rather than a word boundary; gawk provides \y instead.

Bracket Expressions

Match one character out of a set you define.

Pattern	Description
`[abc]`	One `a`, `b`, or `c`
`[^abc]`	Any character except `a`, `b`, or `c`
`[a-z]`	One lowercase letter
`[0-9a-fA-F]`	One hexadecimal digit
`[]abc]`	Include a literal `]` by putting it first
`[abc-]`	Include a literal `-` by putting it last
`[a^]`	`^` is literal when it is not first

Most metacharacters lose their meaning inside brackets, so [.*] matches a dot or an asterisk. Ranges follow the current locale, so use LC_ALL=C or a POSIX class when you need predictable results.

POSIX Character Classes

Portable, locale-aware sets that go inside a bracket expression.

Class	Matches
`[[:digit:]]`	Digits
`[[:alpha:]]`	Letters
`[[:alnum:]]`	Letters and digits
`[[:lower:]]` `[[:upper:]]`	Lowercase and uppercase letters
`[[:space:]]`	Whitespace, including tabs and newlines
`[[:blank:]]`	Spaces and tabs only
`[[:punct:]]`	Punctuation characters
`[[:xdigit:]]`	Hexadecimal digits
`[[:print:]]` `[[:graph:]]`	Printable, and printable except space
`[[:cntrl:]]`	Control characters

The double brackets are not a typo. The class itself is [:digit:], and the outer brackets are the bracket expression that holds it, so [[:digit:]_] matches a digit or an underscore.

Quantifiers

Say how many times the preceding item repeats.

Pattern	Description
`a*`	Zero or more `a`
`a\+` / `a+`	One or more, BRE and ERE forms
`a\?` / `a?`	Zero or one
`a\{3\}` / `a{3}`	Exactly three
`a{3,}`	Three or more
`a{,3}`	Up to three (GNU extension for `{0,3}`)
`a{2,4}`	Between two and four
`.*`	Any run of characters, including none

Quantifiers are greedy and take the longest match available. In a basic regular expression, a * at the very start of the pattern is a literal asterisk because there is nothing for it to repeat.

Groups, Alternation, and Backreferences

Treat several characters as one unit and reuse what they matched.

Pattern	Description
`(ab)+`	ERE group repeated one or more times
`$ab$\+`	The same group in BRE
`cat\|dog`	ERE alternation, either side matches
`cat\\|dog`	The same alternation in GNU BRE
`^(a\|b)c$`	Alternation limited to the group
`\1`	Whatever group 1 matched
`$.$\1`	Any character repeated twice

Groups are numbered from left to right by their opening parenthesis. Backreferences are part of POSIX BRE, and GNU grep and GNU sed also accept them in extended patterns. POSIX ERE and awk do not support backreferences. In a sed replacement, \1 inserts group 1 and & inserts the whole match.

Escaping Special Characters

Match a metacharacter as an ordinary character.

Pattern	Description
`\.`	A literal dot
`\\`	A literal backslash
`\*` `\[` `\^` `\$`	The literal symbol
`[.]`	A dot, escaped by a bracket expression instead
`grep -F 'a.b'`	Treat the whole pattern as a fixed string
`\Q...\E`	Quote a run of characters in PCRE

Quote patterns with single quotes so the shell passes the backslashes through untouched. Inside double quotes, the shell expands $ and consumes some backslashes before the tool ever sees the pattern.

Shorthand Classes

Short names for common sets, provided as extensions rather than by POSIX.

Pattern	Matches and Availability
`\w` `\W`	Word and non-word characters in GNU grep, GNU sed, gawk, PCRE, and Vim; the exact character set varies by engine and locale
`\s` `\S`	Whitespace and non-whitespace in GNU grep, GNU sed, gawk, PCRE, and Vim
`\d` `\D`	Digits and non-digits in PCRE and Vim; not defined by POSIX BRE or ERE
`\h` `\v`	Horizontal and vertical whitespace in PCRE; Vim assigns different meanings to both sequences

Do not use \d with grep’s basic or extended syntax. GNU grep documents an escaped ordinary character such as \d as unspecified, and other grep implementations may interpret it differently. Use [[:digit:]], [0-9], or grep -P instead.

PCRE Extras

Available with grep -P and other Perl-compatible engines.

Pattern	Description
`.*?` `+?` `??`	Lazy quantifiers that take the shortest match
`(?:...)`	Group without capturing it
`(?<name>...)`	Named capture group
`(?=...)`	Lookahead, text must follow
`(?!...)`	Negative lookahead
`(?<=...)`	Lookbehind, text must precede
`(?<!...)`	Negative lookbehind
`(?i)`	Case-insensitive from this point on
`\K`	Drop everything matched so far from the result

Lookarounds check their surroundings without adding them to the match, which pairs well with grep -oP. None of this works in sed or awk, and grep -P needs a build with PCRE support.

BRE, ERE, and PCRE

The same idea written three ways.

Feature	Syntax by Flavor
Grouping	BRE `$ab$`; ERE and PCRE `(ab)`
Alternation	GNU BRE `a\\|b`; ERE and PCRE `a\|b`
One or more	GNU BRE `a\+`; ERE and PCRE `a+`
Optional	GNU BRE `a\?`; ERE and PCRE `a?`
Interval	BRE `a\{2,4\}`; ERE and PCRE `a{2,4}`
Backreference	BRE and PCRE `\1`; GNU grep and GNU sed also accept `\1` in ERE, but POSIX ERE and awk do not
`\d` and lookaround	PCRE supports both; BRE and ERE do not
Default in	BRE: `grep`, `sed`; ERE: `grep -E`, `sed -E`, awk; PCRE: `grep -P`

In GNU grep, BRE and ERE provide the same pattern-matching functionality with different notation. The characters ?, +, (), {}, and | are special without backslashes in ERE and with backslashes in GNU BRE. This equivalence does not extend to POSIX ERE backreferences or PCRE-only features.

Regex in grep

Pick the flavor with a flag.

Command	Description
`grep 'pattern' file`	Basic regular expression, the default
`grep -E 'pattern' file`	Extended regular expression
`grep -P 'pattern' file`	Perl-compatible regular expression
`grep -F 'pattern' file`	No regex at all, fixed string
`grep -o 'pattern' file`	Print only the matched text
`grep -w 'pattern' file`	Require word boundaries around the match
`grep -i 'pattern' file`	Ignore case
`grep -v 'pattern' file`	Print the lines that do not match

Use -o while building a pattern to see exactly what it captures. GNU grep 3.8 and later print a warning for egrep and fgrep, so write grep -E and grep -F instead.

Regex in sed

Patterns select lines, and the same syntax drives substitutions.

Command	Description
`sed 's/old/new/' file`	Substitute using a basic regular expression
`sed -E 's/[0-9]+/N/g' file`	Extended syntax, with `-r` as a synonym
`sed -n '/error/p' file`	Print only matching lines
`sed '/^$/d' file`	Delete every empty line
`sed 's/$a$$b$/\2\1/' file`	Swap two captured groups
`sed 's/word/[&]/' file`	Wrap the whole match in brackets
`sed 's/error/ERROR/gI' file`	Replace every match, ignoring case
`sed -E 's/(\w+)/\U\1/' file`	Uppercase group 1 with a GNU escape

The delimiter does not have to be a slash. Writing sed 's|/usr/bin|/usr/local/bin|' avoids escaping every slash in a path.

Regex in awk

Patterns are extended regular expressions and sit between slashes.

Command	Description
`awk '/error/' file`	Print lines matching the pattern
`awk '$1 ~ /^web/' file`	Match a single field
`awk '$3 !~ /ok/' file`	Match fields that fail the pattern
`awk '/start/,/stop/' file`	Print an inclusive range of lines
`awk '{ gsub(/[0-9]+/, "N"); print }' file`	Replace every match on the line
`awk '{ sub(/^ +/, ""); print }' file`	Replace the first match only
`awk 'match($0, /[0-9]+/) { print substr($0, RSTART, RLENGTH) }' file`	Locate a match and extract it
`gawk '{ gsub(/\yroot\y/, "USER"); print }' file`	Word boundaries in gawk

Awk always uses extended syntax, so +, ?, and {n,m} work without a backslash. When the pattern is a string rather than a /.../ literal, every backslash needs doubling, so gsub(/\./, "-") becomes gsub("\\.", "-").

Regex in Vim

Vim uses its own flavor, close to ERE once you turn on very magic mode.

Pattern	Description
`/pattern`	Search forward in the file
`:%s/old/new/g`	Replace every match in the file
`a\+`	One or more, since `+` needs a backslash by default
`\v`	Very magic mode, so `+`, `?`, `(`, and `\|` work unescaped
`\v\d+`	Digits in very magic mode
`\<word\>`	Whole word match
`price: \zs\d\+`	Start the match after `\zs`, end it at `\ze`
`\cerror`	Ignore case for this pattern

Very magic mode is the shortcut worth remembering. Writing :%s/\v(\w+), (\w+)/\2 \1/g to swap two fields keeps a pattern readable instead of filling it with backslashes.

Regex in Bash

The =~ operator inside [[ ]] takes an extended regular expression.

Snippet	Description
`[[ $ip =~ ^[0-9.]+$ ]]`	Test a string against a pattern
`[[ ! $name =~ ^[a-z] ]]`	Negate the test
`re='^v([0-9]+)\.([0-9]+)$'`	Keep the pattern in a variable
`[[ $tag =~ $re ]]`	Use the variable unquoted so it stays a regex
`${BASH_REMATCH[0]}`	The whole match
`${BASH_REMATCH[1]}`	The first capture group
`case $file in *.txt) ;; esac`	A reminder that `case` uses globs, not regex

Quoting the right-hand side turns the pattern into a literal string, so [[ abc =~ "a.c" ]] fails while [[ abc =~ a.c ]] succeeds. Store the pattern in a variable when it contains spaces or quotes.

Common Patterns

Working starting points to copy and adjust.

Pattern	Matches
`grep -E '\b([0-9]{1,3}\.){3}[0-9]{1,3}\b'`	Anything shaped like an IPv4 address
`grep -P '\b((25[0-5]\|2[0-4][0-9]\|1[0-9]{2}\|[1-9]?[0-9])\.){3}(25[0-5]\|2[0-4][0-9]\|1[0-9]{2}\|[1-9]?[0-9])\b'`	An IPv4 candidate with each octet under 256
`grep -E '[[:alnum:]._%+-]+@[[:alnum:].-]+\.[[:alpha:]]{2,}'`	An email-shaped address
`grep -E '[0-9]{4}-[0-9]{2}-[0-9]{2}'`	An ISO date such as `2026-08-28`
`grep -E '#[0-9a-fA-F]{6}\b'`	A six-digit hex color
`grep -nE '[[:space:]]+$'`	Trailing whitespace, with line numbers
`grep -cE '^[[:space:]]*$'`	Count blank lines
`grep -E '^[[:space:]]*#'`	Commented-out configuration lines
`grep -vE '^[[:space:]]*(#\|$)'`	Everything except comments and blank lines
`grep -E '\b([[:alpha:]]+) \1\b'`	A word accidentally repeated twice
`grep -oE '"[^"]*"'`	A double-quoted string, quotes included
`grep -oP 'user=\K\S+'`	The value after a `user=` key, key excluded

The address patterns describe a shape rather than validate it. Use them to pull candidates out of logs, and check the results with a real parser when correctness matters.

Troubleshooting

Common regex problems and what to check first.

Problem	Check
`\d` fails or behaves unexpectedly	BRE and ERE do not define `\d`; use `[[:digit:]]`, `[0-9]`, or `grep -P`
`+` or `?` matched literally	The pattern is basic syntax; escape them as `\+` and `\?`, or switch to `grep -E`
Alternation found nothing	ERE takes a bare pipe, BRE takes an escaped one; `grep -E` is the simpler fix
The shell changed the pattern	Wrap the pattern in single quotes so backslashes and `$` survive
`[a-z]` also matched uppercase	Range order follows the locale; use `LC_ALL=C` or `[[:lower:]]`
Lookahead or lookbehind rejected	BRE and ERE do not support them; use `grep -P`, or the engine’s own syntax such as Vim’s `\@=`
`grep -P` is not supported	The build lacks PCRE; use `pcre2grep`, `perl -ne`, or rewrite the pattern
`\b` did nothing in awk	Awk reads `\b` as a backspace; use `\y` in gawk or `\<` and `\>`
The match ran too far	Quantifiers are greedy; use a negated class such as `[^"]`, or a lazy `.?` with `-P`
Intervals matched literally in Vim	Vim needs `\{2,4}` in magic mode, or `\v` first

Longer walkthroughs and per-tool references.

Guide	Description
Regular Expressions Basics	Learn the building blocks from the ground up
Regular Expressions in Grep	Every grep flavor with worked examples
grep Cheatsheet	Search options, recursion, and context output
sed Cheatsheet	Substitution, addresses, and in-place editing
awk Cheatsheet	Fields, patterns, actions, and built-in variables
Vim Cheatsheet	Motions, editing, search, and replace

parted Cheatsheet

hello@linuxize.com (Linuxize) — Tue, 25 Aug 2026 18:50:00 +0200

Basic Usage

Core command forms and help options.

Command	Description
`parted [OPTIONS] DEVICE [COMMAND [ARGUMENTS]]`	General syntax
`sudo parted /dev/sdX`	Open a disk in interactive mode
`sudo parted /dev/sdX -- print`	Print one disk’s partition table
`sudo parted --list`	List partition tables on all detected disks
`parted --help`	Show command-line options
`parted --version`	Show the installed version

Always pass the whole-disk path explicitly. Most parted changes take effect immediately, even in interactive mode.

Identify the Target Disk

Confirm the device name, size, model, and current use before changing it.

Command	Description
`lsblk -d -o NAME,SIZE,MODEL,TRAN`	List whole disks with identifying details
`lsblk -o NAME,SIZE,TYPE,FSTYPE,MOUNTPOINTS,MODEL`	Show disks, partitions, filesystems, and mounts
`lsblk -f`	Show filesystem labels and UUIDs
`findmnt -S /dev/sdX1`	Check whether a partition is mounted
`sudo parted /dev/sdX -- print`	Review the current partition table
`sudo parted /dev/sdX -- unit MiB print free`	Show partitions and unallocated space

Use /dev/sdX for the whole disk and /dev/sdX1 for its first partition. NVMe and eMMC disks insert p before the number, so partition 1 of /dev/nvme0n1 is /dev/nvme0n1p1. The MOUNTPOINTS column needs util-linux 2.37 or later; use MOUNTPOINT on older releases. Replace every placeholder with a verified device path.

Command-Line Options

Options must appear before the device and session command.

Option	Description
`-l`, `--list`	List partition layouts on all block devices
`-s`, `--script`	Never prompt for input
`-m`, `--machine`	Print colon-separated, machine-readable output
`-j`, `--json`	Print JSON output on supported versions
`-f`, `--fix`	Automatically choose `fix` for repairable exceptions in script mode
`-a optimal`, `--align optimal`	Use optimal alignment for new partitions
`--`	End option parsing before session commands and negative positions

Script mode is not a dry run. Inspect the disk separately before using --script or --fix.

Interactive Commands

Enter these commands at the (parted) prompt.

Command	Description
`help`	List available session commands
`help mkpart`	Show help for one command
`print`	Print the current partition table
`print free`	Include unallocated space
`unit MiB`	Set the default display and input unit
`select /dev/sdY`	Switch to another disk
`quit`	Exit Parted

The quit command does not undo earlier changes because Parted writes most changes as each command runs.

Create a Partition Table

Create a disk label on a new or intentionally cleared disk.

Command	Description
`sudo parted --script /dev/sdX -- mklabel gpt`	Create a GPT partition table
`sudo parted --script /dev/sdX -- mklabel msdos`	Create an MBR partition table
`sudo parted /dev/sdX -- print`	Confirm the new table type

mklabel replaces the existing partition table and makes its partitions inaccessible. Use GPT for current systems; use MBR only when legacy compatibility requires it.

Create GPT Partitions

Give each GPT partition a name, filesystem type hint, start, and end.

Command	Description
`sudo parted --script /dev/sdX -- mkpart data ext4 1MiB 100%`	Create one partition using the available disk
`sudo parted --script /dev/sdX -- mkpart data ext4 1MiB 50GiB`	Create a partition ending at 50 GiB
`sudo parted --script /dev/sdX -- mkpart backup ext4 50GiB 100%`	Use the remaining space for a second partition
`sudo parted /dev/sdX -- print`	Review the finished layout
`sudo parted /dev/sdX -- align-check optimal 1`	Check partition 1 alignment

The filesystem type is a partition-table hint. mkpart does not create a filesystem.

Create MBR Partitions

An MBR table takes a partition type where GPT takes a name.

Command	Description
`sudo parted --script /dev/sdX -- mkpart primary ext4 1MiB 100%`	Create one primary partition using the available disk
`sudo parted --script /dev/sdX -- mkpart primary ext4 1MiB 50GiB`	Create a primary partition ending at 50 GiB
`sudo parted --script /dev/sdX -- mkpart primary ext4 50GiB 100%`	Add a second primary partition
`sudo parted --script /dev/sdX -- mkpart extended 50GiB 100%`	Create an extended partition to hold logical partitions
`sudo parted --script /dev/sdX -- mkpart logical ext4 51GiB 100%`	Create a logical partition inside the extended partition
`sudo parted /dev/sdX -- print`	Review the finished layout

An MBR table holds four primary partitions, or three primary partitions plus one extended partition that contains the logical ones. Start the first logical partition after the extended partition’s start so Parted can write the extended boot record. The name command does not work on MBR partitions.

Units and Positions

Suffix boundary values so Parted does not have to infer the unit.

Value	Description
`s`	Sectors, used for exact sector positions
`MiB`, `GiB`, `TiB`	Exact IEC binary positions
`MB`, `GB`, `TB`	Decimal positions that may allow a nearby boundary
`1MiB`	Common aligned start for a new partition
`100%`	End at the last usable part of the disk
`-1s`	Last sector of the disk; put `--` before the command
`sudo parted /dev/sdX -- unit s print`	Display all boundaries in sectors

Use MiB or GiB for repeatable commands and unit MiB print free when comparing boundaries.

Partition Names and Flags

Names and available flags depend on the partition table type.

Command	Description
`sudo parted --script /dev/sdX -- name 1 data`	Rename GPT partition 1
`sudo parted --script /dev/sdX -- set 1 esp on`	Mark an EFI System Partition
`sudo parted --script /dev/sdX -- set 1 bios_grub on`	Mark a BIOS GRUB partition on GPT
`sudo parted --script /dev/sdX -- set 1 swap on`	Mark a swap partition
`sudo parted --script /dev/sdX -- set 1 lvm on`	Mark an LVM physical volume where supported
`sudo parted --script /dev/sdX -- set 1 raid on`	Mark a software RAID member where supported
`sudo parted --script /dev/sdX -- set 1 FLAG off`	Disable a flag

Run help set interactively to see the flags supported by the current table. Flags record a partition’s purpose but do not create an EFI filesystem, swap area, LVM volume, or RAID array.

Resize a Partition Boundary

Confirm that free space is adjacent to the partition before extending it.

Command	Description
`sudo parted /dev/sdX -- unit MiB print free`	Check the partition and adjacent free space
`sudo parted --script /dev/sdX -- resizepart 1 100%`	Move partition 1’s end to the end of the disk
`sudo partprobe /dev/sdX`	Ask the kernel to reread the partition table
`sudo resize2fs /dev/sdX1`	Grow an ext2, ext3, or ext4 filesystem afterward
`sudo xfs_growfs /mount/point`	Grow a mounted XFS filesystem afterward
`lsblk -f`	Check the resulting partition and filesystem size

resizepart changes only the partition boundary. When shrinking, shrink the filesystem first and use a filesystem-specific procedure.

Remove or Rescue a Partition

Keep inspection and removal as separate commands.

Command	Description
`sudo parted /dev/sdX -- print`	Note the target partition number and boundaries
`sudo parted --script /dev/sdX -- rm 2`	Remove partition 2 immediately
`sudo parted /dev/sdX`	Open interactive mode for recovery
`rescue START END`	Search near the old boundaries for a lost partition
`sudo partprobe /dev/sdX`	Ask the kernel to reread the changed table

After an accidental removal, stop writing to the disk and try rescue before creating another partition. Recovery is not guaranteed.

Format and Mount

Create a filesystem only after checking the new partition path.

Command	Description
`lsblk -f /dev/sdX`	Confirm the new partition and existing filesystems
`sudo mkfs.ext4 -L data /dev/sdX1`	Create an ext4 filesystem with label `data`
`sudo mkfs.xfs -L data /dev/sdX1`	Create an XFS filesystem with label `data`
`sudo mkswap -L swap /dev/sdX2`	Create swap space on partition 2
`sudo mkdir -p /mnt/data`	Create a mount point
`sudo mount /dev/sdX1 /mnt/data`	Mount the new filesystem
`lsblk -f`	Confirm filesystem and mount details

Formatting destroys data on the selected partition. A partition name and a filesystem label are separate values.

Troubleshooting

Common Parted problems and the next check to run.

Problem	Check
Partition is not aligned	Run `align-check optimal NUMBER`; recreate an empty partition with a suitable start
Kernel still shows the old table	Unmount filesystems, disable swap, then run `sudo partprobe /dev/sdX` or reboot
Device or resource is busy	Check `lsblk`, `findmnt`, swap, LVM, RAID, and encrypted mappings
New partition does not appear	Run `sudo partprobe /dev/sdX`, then check `lsblk`; reboot if the disk remains busy
`unrecognised disk label`	The disk has no supported table; verify it is the correct empty disk before using `mklabel`
`mkpart` rejects the partition name	The disk uses an MBR table; pass `primary`, `extended`, or `logical` instead of a name
Filesystem size did not change	Run the correct filesystem grow command after `resizepart`

Use these guides and cheatsheets for the complete storage workflow.

Guide	Description
parted Command in Linux	Full walkthrough for inspecting and changing partitions
Linux Block Devices, Partitions, Filesystems, and Mount Points	Understand where partitioning fits in the storage stack
fdisk Cheatsheet	Menu-driven partitioning command reference
mount Cheatsheet	Mount options, UUIDs, labels, and `/etc/fstab` entries

parted Command in Linux: Manage Disk Partitions

hello@linuxize.com (Linuxize) — Mon, 24 Aug 2026 20:40:00 +0200

When a new disk appears in lsblk, it is visible to Linux but still has nowhere to store files. The disk needs a partition table and at least one partition before you create a filesystem and mount it. The parted command manages those boundaries from the terminal, works with both GPT and MBR tables, and can run interactively or from a script.

Unlike fdisk, which stages changes until you write the table, parted applies most commands immediately. This guide explains how to inspect a disk, create a GPT partition table, add aligned partitions, resize a partition boundary, and remove a partition without losing track of which storage layer you are changing.

Warning

Partitioning the wrong disk can make its data inaccessible. Before every write operation, confirm the device with lsblk , use the whole-disk name such as /dev/sdb rather than a partition such as /dev/sdb1, and keep a current backup of any disk that holds data.

parted Command Syntax

The general form of the command is:

txt
parted [OPTIONS] [DEVICE [COMMAND [ARGUMENTS]]]

Always pass the device explicitly. If you omit it, parted tries to choose a device, which is not a risk worth taking on a machine with several disks.

The options you will use most often are:

-l, --list - List partition layouts on all detected block devices.
-s, --script - Never prompt for input. Use this only after validating the device and command.
-m, --machine - Produce colon-separated output for scripts.
-j, --json - Produce JSON output on versions that support it.
-a, --align - Choose the alignment type for newly created partitions. The default is optimal.

The examples place options before the device and put -- before the parted command. The separator matters when an argument begins with a dash, such as the -1s end position that means the last sector of the disk. Without it, parted reads -1s as an invalid option instead of a position.

Installing parted

Most distributions include parted. If the command is missing, install it with your distribution package manager.

On Ubuntu, Debian, and Derivatives:

Terminal
sudo apt update
sudo apt install parted

On Fedora, RHEL, and Derivatives:

Terminal
sudo dnf install parted

Confirm the installed version before continuing:

Terminal
parted --version

Listing Disks and Free Space

Start with lsblk so you can match each device name to its size, model, filesystem, and mount points:

Terminal
lsblk -o NAME,SIZE,TYPE,FSTYPE,MOUNTPOINTS,MODEL

A row with TYPE set to disk is a whole device, while rows marked part are partitions. Confirm the size and model instead of relying on a name such as /dev/sdb, since device names can change between boots.

Next, list the partition table on every detected disk:

Terminal
sudo parted --list

output

Model: ATA Samsung SSD 870 (scsi)
Disk /dev/sda: 500GB
Sector size (logical/physical): 512B/512B
Partition Table: gpt
Disk Flags:
Number Start End Size File system Name Flags
1 1049kB 538MB 537MB fat32 EFI System Partition boot, esp
2 538MB 500GB 500GB ext4

The Partition Table line identifies the layout as gpt or msdos (MBR). The partition rows show the boundaries, detected filesystem, GPT name, and any flags.

To inspect one disk in MiB and include its unallocated regions, use unit MiB followed by print free:

Terminal
sudo parted /dev/sdb -- unit MiB print free

output

Model: QEMU QEMU HARDDISK (scsi)
Disk /dev/sdb: 102400MiB
Sector size (logical/physical): 512B/512B
Partition Table: gpt
Disk Flags:
Number Start End Size File system Name Flags
0.02MiB 1.00MiB 0.98MiB Free Space
1 1.00MiB 51200MiB 51199MiB ext4 data
51200MiB 102400MiB 51200MiB Free Space

Rows without a number are unallocated regions. The small gap at the start of the disk holds the GPT header, while the 51200MiB region after partition 1 is space available for a new partition. This read-only command is the one to run before creating or extending a partition, since it shows whether free space exists and on which side of the existing partitions it sits.

On parted 3.4 and later, --json returns the same layout as structured data for scripts:

Terminal
sudo parted --json /dev/sdb -- unit MiB print

output

{
"disk": {
"path": "/dev/sdb",
"size": "102400MiB",
"model": "QEMU QEMU HARDDISK (scsi)",
"transport": "scsi",
"logical-sector-size": 512,
"physical-sector-size": 512,
"label": "gpt",
"max-partitions": 128,
"partitions": [
{
"number": 1,
"start": "1.00MiB",
"end": "51200MiB",
"size": "51199MiB",
"name": "data",
"filesystem": "ext4"
}
]
}
}

Pipe that into jq when a script needs a single value, such as jq -r '.disk.partitions[].size'.

You can also open an interactive session by passing only the device:

Terminal
sudo parted /dev/sdb

output

GNU Parted 3.7
Using /dev/sdb
Welcome to GNU Parted! Type 'help' to view a list of commands.
(parted)

At the (parted) prompt, enter commands such as print, mkpart, and quit. The remaining examples use command-line mode so each operation and its target are visible in one copy-pasteable command.

Creating a GPT Partition Table

A new disk needs a partition table before it can hold partitions. GPT is the standard choice for current systems and is required when an MBR table with 512-byte sectors would exceed its 2 TiB addressing limit.

Run the inspection command again immediately before creating the table:

Terminal
lsblk -o NAME,SIZE,TYPE,FSTYPE,MOUNTPOINTS,MODEL /dev/sdb

Once /dev/sdb is confirmed as the intended disk, create the GPT label:

Terminal
sudo parted --script /dev/sdb -- mklabel gpt

This replaces the existing partition table and makes its old partitions inaccessible. The --script option suppresses prompts; it is not a dry run and does not make the operation safer. Use mklabel msdos only when you specifically need an MBR table for legacy compatibility.

Creating an Aligned Partition

The mkpart command takes a GPT partition name, a filesystem type hint, and the start and end positions. To create one data partition that fills the usable disk space, run:

Terminal
sudo parted --script /dev/sdb -- mkpart data ext4 1MiB 100%

The name is data, and ext4 sets the intended partition type. It does not create an ext4 filesystem. Starting at 1MiB leaves room for the GPT metadata and gives the partition a common aligned starting point; 100% extends it to the last usable part of the disk.

For two partitions, give each one its own range. This example creates a 50 GiB data partition and uses the remaining space for backups:

Terminal
sudo parted --script /dev/sdb -- mkpart data ext4 1MiB 50GiB
sudo parted --script /dev/sdb -- mkpart backup ext4 50GiB 100%

IEC units such as MiB and GiB identify exact positions. Decimal units such as MB and GB allow parted to choose a nearby position, so explicit IEC units are easier to reason about in repeatable commands.

Print the finished layout:

Terminal
sudo parted /dev/sdb -- unit MiB print free

Then check the alignment of partition 1:

Terminal
sudo parted /dev/sdb -- align-check optimal 1

output

1 aligned

The alignment check confirms that the partition starts on a boundary suited to the device. If it reports not aligned, recreate an empty partition with a suitable start position before writing data to it.

The new partition still has no filesystem. After verifying that /dev/sdb1 is the new empty partition, format it separately:

Terminal
sudo mkfs.ext4 -L data /dev/sdb1

The -L data option assigns a filesystem label, which is separate from the GPT partition name. Follow the mount and unmount guide when you are ready to attach the filesystem to the directory tree.

Renaming a GPT Partition

GPT stores a human-readable name for each partition. To rename partition 1 without changing its filesystem label, use the name command:

Terminal
sudo parted --script /dev/sdb -- name 1 archive

Run print afterward to confirm the new value in the Name column. Partition names are available with GPT and several other table formats, but not with an MBR table.

Setting Partition Flags

Flags mark what a partition is for so that firmware and other tools treat it correctly. The set command takes the partition number, the flag name, and on or off:

Terminal
sudo parted --script /dev/sdb -- set 1 esp on

The flags you will use most often on a GPT disk are:

esp - Mark the partition as an EFI System Partition. On GPT, boot and esp are the same flag.
bios_grub - Mark the small unformatted partition that GRUB needs to boot a GPT disk on BIOS firmware.
lvm - Mark the partition as an LVM physical volume.
raid - Mark the partition as a software RAID member.
msftdata - Mark the partition as Microsoft basic data, which is the type Windows expects.

Turn a flag off by passing off instead:

Terminal
sudo parted --script /dev/sdb -- set 1 lvm off

Flags record intent and set the GPT partition type, but they create nothing. Setting lvm does not run pvcreate, and setting esp does not put a FAT32 filesystem on the partition. To see which flags the current table supports, open an interactive session and run help set.

Resizing a Partition

Before extending a partition, use print free to confirm that unallocated space begins directly after it:

Terminal
sudo parted /dev/sdb -- unit MiB print free

If partition 1 is followed by free space, move its end boundary to the end of the disk:

Terminal
sudo parted --script /dev/sdb -- resizepart 1 100%

The resizepart command changes only the partition boundary. It does not resize the filesystem inside. For an ext4 filesystem, grow the filesystem afterward:

Terminal
sudo resize2fs /dev/sdb1

Use df to confirm the filesystem now sees the extra capacity. Other filesystems need their own resizing tools; XFS, for example, grows with xfs_growfs and cannot be shrunk.

Shrinking is a different workflow. You must unmount and shrink a shrinkable filesystem first, check it for errors, and only then move the partition boundary. Do not use resizepart alone to shrink a partition, since it can cut off live filesystem data.

Removing a Partition

List the table one final time and note the number of the partition you intend to remove:

Terminal
sudo parted /dev/sdb -- print

When the number is confirmed, remove partition 2:

Terminal
sudo parted --script /dev/sdb -- rm 2

The partition disappears from the table immediately, and its former space becomes unallocated. Script mode provides no confirmation, so keep the inspection and removal as separate commands rather than chaining them.

Quick Reference

For a printable quick reference, see the parted cheatsheet .

Task	Command
List all partition tables	`sudo parted --list`
Show one disk and its free space	`sudo parted /dev/sdb -- unit MiB print free`
Print the layout as JSON	`sudo parted --json /dev/sdb -- unit MiB print`
Open interactive mode	`sudo parted /dev/sdb`
Create a GPT table	`sudo parted --script /dev/sdb -- mklabel gpt`
Create an ext4 data partition	`sudo parted --script /dev/sdb -- mkpart data ext4 1MiB 100%`
Check optimal alignment	`sudo parted /dev/sdb -- align-check optimal 1`
Rename GPT partition 1	`sudo parted --script /dev/sdb -- name 1 archive`
Set the EFI system partition flag	`sudo parted --script /dev/sdb -- set 1 esp on`
Extend partition 1	`sudo parted --script /dev/sdb -- resizepart 1 100%`
Remove partition 2	`sudo parted --script /dev/sdb -- rm 2`

Troubleshooting

The kernel still uses the old partition table
Unmount filesystems on the disk, disable any swap partition it contains, and run sudo partprobe /dev/sdb to ask the kernel to reread the table. If the device is still busy, schedule a reboot instead of forcing another partition change.

parted reports that a partition is not properly aligned
Use sudo parted /dev/sdb -- align-check optimal NUMBER to verify the start boundary. If the partition is empty, recreate it with a 1MiB start or another boundary that satisfies the device’s reported alignment requirements.

A partition was removed by mistake
Stop writing to the disk. Open sudo parted /dev/sdb, run rescue START END with the approximate old boundaries, and confirm the discovered partition only when its location and filesystem match. Recovery is not guaranteed, especially after new data has been written.

parted says a partition is in use
Check lsblk and findmnt, then unmount the filesystem before changing its boundaries. A disk can also remain busy because it contains active swap, an LVM physical volume, software RAID, or an encrypted mapping.

FAQ

Should I use parted or fdisk?
Both tools support GPT and MBR tables. fdisk provides an interactive workflow that stages changes until you write them, while parted is convenient for one-line commands, scripts, alignment checks, and changing a partition’s end boundary.

Does parted format partitions?
No. parted creates the partition entry and can record an intended filesystem type, but it does not create the filesystem. Run the appropriate mkfs command on the new partition after checking the device name.

Does resizepart resize the filesystem too?
No. resizepart only moves the partition’s end boundary. Grow or shrink the filesystem separately with the tool designed for that filesystem, and always shrink the filesystem before shrinking its partition.

Should I use GPT or MBR?
Use GPT for current Linux systems, UEFI boot disks, and disks larger than 2 TiB. Use MBR only when an older operating system or firmware requires it.

Conclusion

parted is most useful when you need precise, repeatable control over partition boundaries, especially on GPT disks. Keep inspection and write commands separate, use explicit units, and stop after unexpected output instead of pushing through with --script.

DNS Record Types Explained: A, AAAA, CNAME, MX, TXT, and More

hello@linuxize.com (Linuxize) — Fri, 21 Aug 2026 16:00:00 +0200

A website can load normally while mail delivery, domain verification, or certificate issuance fails. Each service asks DNS a different question, and the answer comes from a specific record type.

A and AAAA records provide server addresses, MX records route email, TXT records publish verification and policy data, and several other types handle aliases, delegation, service discovery, and security. This guide explains the DNS record types you will encounter most often, shows their zone-file syntax, and demonstrates how to inspect them with dig.

What a DNS Record Contains

DNS is a distributed database that associates names with typed data. A resource record contains a name, time to live (TTL), class, type, and value. The class is almost always IN, which means Internet.

Here are three records in zone-file notation:

txt
example.com. 3600 IN A 203.0.113.10
www.example.com. 3600 IN CNAME example.com.
example.com. 3600 IN MX 10 mail.example.com.

The final dot marks each name as fully qualified. DNS control panels often hide this detail and let you enter @ for the zone apex or only the subdomain label, such as www.

The TTL in this example is 3600 seconds, so a resolver may reuse a cached answer for up to one hour. A shorter TTL lets resolvers fetch a changed record sooner, but it does not shorten the lifetime of copies already cached with the old value. Before a planned migration, lower the TTL at least one old-TTL interval in advance, wait for existing caches to expire, and then make the change.

A Records: IPv4 Addresses

An A record maps a hostname to an IPv4 address:

txt
example.com. 3600 IN A 203.0.113.10

This is the usual record for pointing a website or another network service at an IPv4 server. The value must be an IPv4 address, not a URL, port number, or hostname.

A name can have several A records. Resolvers usually return the complete set, and clients may try the addresses in different orders. This provides basic round-robin traffic distribution, but DNS does not check whether each server is healthy. An unavailable address can remain in the answer until you remove it and its cached TTL expires.

AAAA Records: IPv6 Addresses

An AAAA record maps a hostname to an IPv6 address:

txt
example.com. 3600 IN AAAA 2001:db8::10

A dual-stack service commonly publishes both A and AAAA records. Current clients usually request both types and use a connection strategy such as Happy Eyeballs to try IPv6 and IPv4 without waiting through a long failure.

Publish an AAAA record only when the service is reachable at that IPv6 address. IPv4-only clients will continue using the A record, but an incorrect AAAA record can delay or break connections for visitors whose systems prefer IPv6.

CNAME Records: Aliases

A CNAME record makes one name an alias of another name:

txt
www.example.com. 3600 IN CNAME example.com.

When a resolver receives this answer, it continues the lookup at example.com. CNAME records are useful when a subdomain must follow a hostname managed by a CDN, application host, or other provider whose IP addresses may change.

The owner of a CNAME cannot also hold ordinary A, AAAA, MX, or TXT data. The zone apex (example.com) must hold SOA and NS records, so it cannot be a CNAME. Providers implement apex aliasing through non-standard features named ALIAS, ANAME, or CNAME flattening, which resolve the target and publish A or AAAA answers on your behalf.

MX Records: Mail Routing

MX records identify the servers that accept email for a domain. Each value starts with a preference number, and lower numbers are preferred:

txt
example.com. 3600 IN MX 10 mail1.example.com.
example.com. 3600 IN MX 20 mail2.example.com.

A sending server tries mail1.example.com first and falls back to mail2.example.com if the preferred server is unavailable. Records with equal preference can share delivery attempts.

An MX target must be a hostname that resolves directly through A or AAAA records. It cannot be an IP address or a CNAME alias. The trailing dot is also important in a zone file because omitting it may cause the DNS server to append the zone name.

TXT Records: Verification and Policy Data

TXT records store text associated with a name. Providers use them for domain-ownership challenges, while email systems use them for SPF, DKIM, and DMARC:

txt
example.com. 3600 IN TXT "v=spf1 mx -all"
_dmarc.example.com. 3600 IN TXT "v=DMARC1; p=quarantine"

The SPF value lists which systems may send mail for the domain. A domain must not publish multiple TXT records beginning with v=spf1 at the same name. DMARC lives at _dmarc, while DKIM keys use a selector name such as default._domainkey.example.com.

Long TXT data can appear as several quoted strings because each individual character-string has a size limit. DNS clients concatenate those strings into one record value. Our guide to SPF, DKIM, and DMARC explains how the three email checks work together.

NS Records: Zone Delegation

NS records name the authoritative servers for a DNS zone:

txt
example.com. 86400 IN NS ns1.dns-provider.net.
example.com. 86400 IN NS ns2.dns-provider.net.

The parent zone publishes a delegation that directs resolvers to these servers, and the delegated zone publishes its own NS set at the apex. Changing name servers at a registrar updates the parent delegation. The parent and authoritative-zone sets should agree, or different resolution paths may produce inconsistent results.

DNS zones should have at least two authoritative servers for availability, and most registries require it. Managed providers normally create the apex NS records automatically, although you still select or confirm the delegation through the registrar.

SOA Records: Zone Metadata

Every zone contains one SOA (start of authority) record. It identifies the primary server, encodes the administrator contact, and stores a serial number and timers used by secondary servers:

txt
example.com. 86400 IN SOA ns1.dns-provider.net. admin.example.com. (
 2026082101 ; serial
 7200 ; refresh
 3600 ; retry
 1209600 ; expire
 3600 ) ; minimum

In this example, admin.example.com. represents the email address admin@example.com. Secondary servers compare the serial number with their copy and transfer the zone when the serial increases.

The final MINIMUM field participates in negative caching. A resolver may cache a response stating that a name or record does not exist for the lower of this value and the SOA record’s own TTL. Managed DNS services maintain the SOA fields for you, but the serial and timers remain useful when diagnosing stale or inconsistent authoritative servers.

PTR Records: Reverse DNS

A PTR record maps an IP address to a hostname. IPv4 records live below in-addr.arpa, with the address octets reversed, while IPv6 uses ip6.arpa:

txt
10.113.0.203.in-addr.arpa. 3600 IN PTR mail.example.com.

The organization that controls the IP block also controls its reverse zone. For a server address, this is usually your hosting provider or ISP, so you configure PTR data through its control panel rather than your domain’s normal DNS zone.

Forward and reverse records are independent. Mail systems often check that the PTR hostname resolves forward to the sending address, so a mail server should have matching PTR and A or AAAA data.

SRV Records: Service Discovery

An SRV record advertises the hostname and port for a service. Its owner name begins with underscore-prefixed service and protocol labels:

txt
_sip._tcp.example.com. 3600 IN SRV 10 60 5060 sipserver.example.com.

The four values are priority, weight, port, and target. Clients prefer lower priorities. When several records share a priority, weight helps distribute requests among their targets.

SRV records are common with SIP, XMPP, LDAP, Active Directory, and some game servers. Web browsers did not adopt SRV for ordinary HTTP and HTTPS navigation, so websites still depend on address, alias, and newer HTTPS records.

CAA Records: Certificate Issuance

A CAA record authorizes a certificate authority to issue TLS certificates for a domain:

txt
example.com. 3600 IN CAA 0 issue "letsencrypt.org"

A public certificate authority checks the relevant CAA set before issuance. If a name has no CAA record, the search continues up its DNS name hierarchy, so a policy at example.com also applies to subdomains that do not publish their own CAA set.

The issue property covers standard certificates, issuewild can set a separate wildcard policy, and iodef supplies a contact for policy reports. Check the issuer identifier required by your certificate authority before adding CAA records. An incorrect policy can block both initial issuance and automated renewal.

Other DNS Record Types

DNSSEC uses DNSKEY, DS, RRSIG, NSEC, and NSEC3 records so validating resolvers can authenticate DNS answers. The DNS provider creates signatures and DNSKEY records in the zone, while a DS record in the parent zone completes the chain of trust. Enabling DNSSEC only at the provider without publishing the required DS record does not establish that chain.

SVCB and HTTPS records publish connection parameters and alternative service endpoints. HTTPS records can advertise supported application protocols, including HTTP/3, and provide address hints before a client opens its connection. DNS providers and content delivery networks may create these records automatically.

You may also encounter TLSA for DANE certificate association, SSHFP for SSH host-key fingerprints, and NAPTR for rule-based service discovery. These specialized types are not needed for most domain setups.

Querying DNS Records with dig

The general short-answer form of a dig query is:

txt
dig +short NAME TYPE

For a stable public example, query the A records for Cloudflare’s resolver hostname:

Terminal
dig +short one.one.one.one A

output

1.0.0.1
1.1.1.1

The order may vary because both addresses belong to the same A record set. Remove +short when you need the response status, authoritative flag, TTL, and server details.

To inspect a domain’s mail routing, request its MX records:

Terminal
dig +short gmail.com MX

output

5 gmail-smtp-in.l.google.com.
10 alt1.gmail-smtp-in.l.google.com.
20 alt2.gmail-smtp-in.l.google.com.
30 alt3.gmail-smtp-in.l.google.com.
40 alt4.gmail-smtp-in.l.google.com.

Each answer starts with its preference number, followed by the mail-server hostname. A sending server tries gmail-smtp-in.l.google.com first because its preference of 5 is the lowest. The returned servers and their order can change as the domain operator updates its mail infrastructure.

TXT, CAA, NS, and other records use the same pattern:

Terminal
dig +short example.com TXT
dig +short example.com CAA
dig +short example.com NS

For reverse DNS, pass an address to -x instead of building the reverse-zone name manually:

Terminal
dig +short -x 1.1.1.1

output

one.one.one.one.

The dig command guide covers server selection, trace queries, and DNSSEC checks. The host and nslookup commands provide simpler alternatives. After changing a record, remember that your resolver or operating system may keep the previous answer until its TTL expires, although you can clear the local DNS cache during testing.

Quick Reference

Task	Record type	Value
Point a name to an IPv4 address	A	`203.0.113.10`
Point a name to an IPv6 address	AAAA	`2001:db8::10`
Make a name follow another hostname	CNAME	`example.com.`
Route incoming email	MX	`10 mail.example.com.`
Publish verification or policy text	TXT	`"v=spf1 mx -all"`
Delegate a zone to authoritative servers	NS	`ns1.dns-provider.net.`
Store zone authority and transfer data	SOA	Primary server, serial, and timers
Map an IP address back to a hostname	PTR	`mail.example.com.`
Advertise a service hostname and port	SRV	`10 60 5060 sip.example.com.`
Restrict certificate authorities	CAA	`0 issue "letsencrypt.org"`

Conclusion

Before saving a DNS change, confirm the record owner, value format, and whether the target must be an address or a hostname. Lower the TTL ahead of planned migrations, keep the old service available while caches expire, and use dig to verify the answers that resolvers actually receive.

Block Devices, Partitions, and Filesystems in Linux Explained

hello@linuxize.com (Linuxize) — Sat, 15 Aug 2026 10:35:00 +0200

You attach a new disk to a server, run lsblk , and the drive is there. Then you try to copy a file onto it and nothing works, because there is no path to copy to. The disk is visible to the kernel, but it has no partition, no filesystem, and no place in the directory tree.

Linux storage is built from four layers stacked on top of each other, and most confusion comes from treating them as one thing. This guide explains what a block device, a partition, a filesystem, and a mount point each are, how they connect, and which command shows you the state of each layer.

What a Block Device Is

A block device is how the kernel represents a piece of storage that can be read and written in fixed-size chunks called blocks, rather than one byte at a time. Hard drives, SSDs, USB sticks, SD cards, and the virtual disks of a cloud instance are all block devices.

Every block device gets a file under /dev. The name depends on the driver that claims the hardware:

/dev/sda, /dev/sdb - SATA, SAS, and USB storage
/dev/nvme0n1 - the first namespace of the first NVMe drive
/dev/vda - a virtual disk on a KVM or cloud guest
/dev/mmcblk0 - an SD card or eMMC device

These files are not ordinary files. Running ls -l on one shows what they really are:

Terminal
ls -l /dev/sda /dev/null

output

brw-rw---- 1 root disk 8, 0 Aug 14 09:12 /dev/sda
crw-rw-rw- 1 root root 1, 3 Aug 14 09:12 /dev/null

The first character of the permission string is the giveaway. b marks a block device and c marks a character device such as /dev/null. The pair of numbers where a file size would normally appear, 8, 0, is the major and minor number that identifies the driver and the specific device it handles.

The kernel also publishes every block device under /sys/block, which is where tools such as lsblk read their information from. A block device at this stage is just an addressable range of storage. Nothing on it means anything yet.

Partitions Divide a Disk

A partition is a labeled region of a block device. The disk keeps a small table near its start that records where each region begins and ends, and the kernel exposes each region as its own block device: /dev/sda1, /dev/sda2, and so on. NVMe and SD devices insert a p before the number, so the first partition of /dev/nvme0n1 is /dev/nvme0n1p1.

Two partition table formats are in common use:

MBR (also called msdos) is the older format. It supports four primary partitions, works around that limit with extended partitions, and cannot address a disk larger than 2 TiB with standard 512-byte sectors.
GPT is the modern format. It commonly provides 128 partition entries, supports disks far larger than MBR, and stores a backup copy of the table at the end of the disk. UEFI firmware supports both GPT and legacy MBR, though GPT is the standard choice for current UEFI installations.

To see which format a disk uses, run fdisk with the -l flag:

Terminal
sudo fdisk -l /dev/sda

The output starts with the disk size and model, then prints a Disklabel type line that reads either gpt or dos, followed by the partition list.

Partitioning is a convention rather than a hard requirement. You can create a filesystem directly on a whole disk, and some storage appliances do exactly that. On a system that boots from the disk, though, partitions are what separate the EFI system partition, the boot files, and the root filesystem from each other.

A partition still holds no structure. It marks out space and stops there.

Filesystems Give a Partition Structure

A filesystem is the format written inside a partition that turns raw space into directories, filenames, permissions, and timestamps. Creating one is called formatting, and the mkfs family of commands does it:

Warning

Creating a filesystem destroys any existing filesystem and data on the target. Before running mkfs, confirm the device name with lsblk -f, verify that it is the intended empty partition, and make sure it is not mounted.

Terminal
sudo mkfs.ext4 /dev/sdb1

This writes ext4 metadata across /dev/sdb1, including the superblock, the inode tables, and the free-space maps. From that moment the partition can hold files, and each file gets an inode that stores its metadata.

Linux supports many filesystem types, and the choice matters:

ext4 - the default on most Debian and Ubuntu installations, stable and well understood
xfs - the default on RHEL and derivatives, strong with large files and parallel writes
btrfs - supports snapshots, checksums, and built-in volume management
vfat - used for EFI System Partitions and broadly compatible removable drives
exfat - suited to large removable drives shared with Windows and macOS
swap - not a filesystem for files at all, but a formatted area the kernel uses as swap space

Formatting also assigns the filesystem a UUID, and optionally a label. Both identify the filesystem itself rather than the device it happens to sit on. This distinction matters more than it first appears: device names are assigned in detection order, so a disk that is /dev/sdb today can come up as /dev/sdc after you add another drive or reboot a cloud instance. The UUID does not move. That is why configuration files should reference UUID= instead of /dev/sdb1.

Mount Points Attach a Filesystem to the Tree

Linux has no drive letters. Every filesystem on the machine appears somewhere inside a single tree that starts at /. A mount point is the directory where a filesystem is attached, and mounting is the act of attaching it. Create the mount point, then attach the filesystem:

Terminal
sudo mkdir -p /srv/data
sudo mount /dev/sdb1 /srv/data

The first command creates the directory if it does not already exist. After the second command, everything written under /srv/data lands on /dev/sdb1, while the rest of the tree stays on whatever filesystem holds /. The reader cannot tell from the path alone which disk a file lives on, which is the point of the design.

A mount point is an ordinary directory. There is no special flag that makes /srv/data mountable, and any empty directory works.

Info

If the directory already contains files when you mount over it, those files are hidden rather than deleted. They are still on the underlying filesystem and reappear once you unmount.

A manual mount command lasts until reboot. To make it persistent, the filesystem needs an entry in /etc/fstab , which the system reads at boot and mounts automatically.

Walking Through One Real Layout

Putting the four layers side by side makes the stack easier to read. The -o flag selects the columns, and adding TYPE shows what each row actually is:

Terminal
lsblk -o NAME,TYPE,FSTYPE,LABEL,MOUNTPOINTS

output

NAME TYPE FSTYPE LABEL MOUNTPOINTS
nvme0n1 disk
├─nvme0n1p1 part vfat /boot/efi
├─nvme0n1p2 part ext4 boot /boot
└─nvme0n1p3 part LVM2_member
├─vg0-root lvm ext4 root /
└─vg0-swap lvm swap [SWAP]
sdb disk
└─sdb1 part xfs data /srv/data

Read it from the outside in. nvme0n1 and sdb have TYPE of disk and no filesystem of their own, because they are the block devices. The indented rows marked part are partitions. The FSTYPE column tells you which of those partitions were formatted, and with what. The MOUNTPOINTS column tells you where each formatted filesystem was attached.

nvme0n1p3 shows all four layers coming apart cleanly. It is a partition, it has a format, but that format is LVM2_member rather than a filesystem you can browse, and it has no mount point. Its two children are the layer that carries the actual filesystems.

The sdb disk is the simple case: one disk, one partition, one XFS filesystem labeled data, mounted at /srv/data.

Where LVM, RAID, and Encryption Fit

The four layers describe the common path, but Linux lets you insert extra layers between the partition and the filesystem. Each one consumes a block device and produces a new one.

LVM groups one or more physical volumes into a volume group, then carves logical volumes out of it. The logical volume is a block device at /dev/mapper/vg0-root, and you format that instead of the partition. Logical volumes can be resized and moved between disks without repartitioning, which is why servers so often use them.

Software RAID combines several devices into one /dev/md0 device with mirroring or striping across the members. The filesystem sits on /dev/md0 and never sees the individual disks.

LUKS encryption wraps a device in an encrypted container. Unlocking it produces a decrypted block device under /dev/mapper, and the filesystem goes there. lsblk shows the container with TYPE of crypt.

These stack in any sensible order, and a common server layout runs all of them at once: partition, then LUKS, then LVM, then ext4. Each layer only needs to know about the block device directly beneath it.

Quick Reference

Layer	What it is	Typical name	Inspect with
Block device	Raw addressable storage exposed by the kernel	`/dev/sda`, `/dev/nvme0n1`	`lsblk -d`, `ls -l /dev/sd*`
Partition	A labeled region of a block device	`/dev/sda1`, `/dev/nvme0n1p1`	`sudo fdisk -l`, `lsblk`
Filesystem	The format written inside a partition	ext4, xfs, btrfs, vfat	`lsblk -f`, `blkid`
Mount point	The directory where a filesystem is attached	`/`, `/boot`, `/srv/data`	`findmnt`, `df -h`

FAQ

What is the difference between a partition and a filesystem?
A partition reserves a region of a disk and records its boundaries in the partition table. A filesystem is the structure written inside that region so it can store files. A freshly created partition has no filesystem, which is why mkfs is a separate step after fdisk or parted.

Is /dev/sda a file or a device?
Both, in a sense. /dev/sda is a special file that acts as the interface to the device, so tools can open, read, and write it with ordinary file operations. The leading b in ls -l output marks it as a block device rather than a regular file.

Why does my disk name change between reboots?
Kernel device names are assigned in detection order, not fixed to the hardware. Adding a drive or rebooting a virtual machine can shift /dev/sdb to /dev/sdc. Refer to filesystems by UUID= or LABEL= in /etc/fstab and scripts so the reference survives reordering.

How do I tell which disk a directory lives on?
Pass the path to findmnt --target, for example findmnt --target /srv/data, and it prints the source device, filesystem type, and mount options for the filesystem containing that path. Running df -h /srv/data shows the source device, capacity, usage, and mount point instead.

Can I create a filesystem without partitioning first?
Yes. Running mkfs.ext4 /dev/sdb creates an ext4 filesystem directly on the whole disk with no partition table. Filesystem-aware tools such as lsblk -f and blkid still detect it, while partitioning tools report that no partition table is present. This is destructive and should only be done intentionally on a verified empty data disk. Use partitions for boot disks and workflows that expect a partition table.

Conclusion

Once you can name which layer a problem sits on, the next check becomes clearer: a missing device is a kernel or cabling question, an unknown partition or filesystem needs inspection before you change it, and a known unmounted filesystem calls for mount. Start with lsblk -f on any unfamiliar machine, since it shows three of the four layers in a single screen.

nmap Cheatsheet

hello@linuxize.com (Linuxize) — Fri, 14 Aug 2026 15:15:00 +0200

Basic Syntax

Core nmap command forms.

Command	Description
`nmap 192.168.1.10`	Scan the 1000 most common TCP ports on one host
`sudo nmap 192.168.1.10`	Same scan as root, which enables the faster SYN scan
`nmap -v 192.168.1.10`	Increase verbosity, repeat as `-vv` for more detail
`nmap --reason 192.168.1.10`	Show why each port is in its reported state
`nmap --open 192.168.1.10`	Report only ports that are open

Target Specification

Point a scan at one host, a range, a subnet, or a list.

Command	Description
`nmap 192.168.1.10 10.0.0.5`	Scan several hosts in one run
`nmap 192.168.1.0/24`	Scan a whole subnet in CIDR notation
`nmap 192.168.1.1-50`	Scan an address range
`nmap -iL targets.txt`	Read targets from a file, one per line
`nmap --exclude 192.168.1.1 192.168.1.0/24`	Skip specific hosts in a larger scan
`nmap -6 2001:db8::1`	Scan an IPv6 target

Host Discovery

Find which hosts are up before spending time on port scans.

Command	Description
`sudo nmap -sn 192.168.1.0/24`	Ping scan: list live hosts without scanning ports
`nmap -Pn 192.168.1.10`	Skip discovery and treat the host as online
`nmap -PS22,80,443 192.168.1.0/24`	Discover hosts with TCP SYN probes to those ports
`nmap -PA80 192.168.1.0/24`	Discover hosts with TCP ACK probes
`sudo nmap -PE 192.168.1.0/24`	Discover hosts with ICMP echo requests
`nmap -n 192.168.1.0/24`	Skip reverse DNS lookups to speed up the scan

Port Selection

Control which ports the scan covers.

Command	Description
`nmap -p 22 192.168.1.10`	Scan a single port
`nmap -p 22,80,443 192.168.1.10`	Scan a list of ports
`nmap -p 1-1024 192.168.1.10`	Scan a port range
`nmap -p- 192.168.1.10`	Scan all 65535 TCP ports
`nmap -F 192.168.1.10`	Fast scan of the top 100 ports
`nmap --top-ports 20 192.168.1.10`	Scan the 20 most common ports
`sudo nmap -sU -sS -p U:53,T:80,443 192.168.1.10`	Mix UDP and TCP ports, which needs both scan types

Scan Types

Pick how nmap probes each port. The raw-packet scans need root.

Command	Description
`sudo nmap -sS 192.168.1.10`	TCP SYN scan: fast, the default when running as root
`nmap -sT 192.168.1.10`	TCP connect scan: the fallback for an unprivileged user
`sudo nmap -sU 192.168.1.10`	UDP scan: slow, so pair it with `--top-ports`
`sudo nmap -sA 192.168.1.10`	ACK scan: map which ports a firewall filters
`sudo nmap -sn 192.168.1.0/24`	No port scan at all, discovery only
`nmap -sL 192.168.1.0/24`	List scan: show the targets without sending probes

Service and OS Detection

Identify what is listening and what the host is running.

Command	Description
`nmap -sV 192.168.1.10`	Detect service names and version numbers
`nmap -sV --version-intensity 9 192.168.1.10`	Probe harder for versions, from 0 (light) to 9
`sudo nmap -O 192.168.1.10`	Guess the operating system from TCP/IP fingerprints
`sudo nmap -A 192.168.1.10`	Aggressive scan: `-sV`, `-O`, default scripts, and traceroute
`sudo nmap --traceroute 192.168.1.10`	Trace the route to each target

Timing and Performance

Trade speed against accuracy and network load.

Command	Description
`nmap -T4 192.168.1.10`	Faster timing, a good default on a local network
`nmap -T2 192.168.1.10`	Slower and gentler on fragile or busy networks
`nmap --min-rate 1000 192.168.1.0/24`	Send at least 1000 packets per second
`nmap --max-retries 1 192.168.1.0/24`	Give up sooner on unanswered probes
`nmap --host-timeout 5m 192.168.1.0/24`	Abandon any host still scanning after 5 minutes

Output Formats

Save results for review, diffing, or scripting.

Command	Description
`nmap -oN scan.txt 192.168.1.10`	Write human readable output to a file
`nmap -oX scan.xml 192.168.1.10`	Write XML for other tools to parse
`nmap -oG scan.gnmap 192.168.1.10`	Write grepable output for `grep` and `awk`
`nmap -oA scan 192.168.1.10`	Write all three formats using one base name
`nmap --append-output -oN scan.txt 192.168.1.11`	Append to an existing output file

NSE Scripts

Run the Nmap Scripting Engine for deeper checks.

Command	Description
`nmap -sC 192.168.1.10`	Run the default script set
`nmap --script http-title 192.168.1.10`	Run one named script
`nmap --script "http-*" 192.168.1.10`	Run every script matching a pattern
`nmap --script vuln 192.168.1.10`	Run the vulnerability script category
`nmap --script ssl-enum-ciphers -p 443 example.com`	List the TLS ciphers a server accepts
`nmap --script-help ssh-auth-methods`	Read what a script does before running it

Common Use Cases

Practical scans for day-to-day network work.

Command	Description
`sudo nmap -sn 192.168.1.0/24`	Inventory the hosts on a local network
`sudo nmap -p- -T4 192.168.1.10`	Find every open TCP port on one server
`nmap -sV --open 192.168.1.10`	List running services and their versions
`nmap -p 80,443 --open 192.168.1.0/24`	Locate the web servers on a subnet
`sudo nmap -sU --top-ports 20 192.168.1.10`	Check the most common UDP services
`sudo nmap -A -oA audit 192.168.1.10`	Full audit of one host, saved in every format

Troubleshooting

Quick checks for common nmap problems.

Issue	Check
`You requested a scan type which requires root privileges`	Run the command with `sudo`, or use `-sT` instead of `-sS`
`Note: Host seems down`	Add `-Pn` when ICMP is blocked but the host is reachable
Scan takes far too long	Add `-T4`, narrow the ports with `-F` or `--top-ports`, and add `-n`
Every UDP port shows `open\|filtered`	UDP has no handshake, so add `-sV` or scan fewer ports for a clearer answer
Results differ from a local port check	The firewall may filter the port; compare with `ss -tulpn` on the host itself

Use these guides for broader port and network troubleshooting.

Guide	Description
nmap Command in Linux	Full `nmap` guide with detailed examples
How to Check Open Ports in Linux	Scan a host for open ports with nmap, netcat, or telnet
ss Command in Linux	Inspect sockets and listening services
netcat cheatsheet	Test single ports and move data between hosts
tcpdump cheatsheet	Capture the packets behind a scan result

lsblk Command in Linux: List Block Devices

hello@linuxize.com (Linuxize) — Thu, 13 Aug 2026 11:20:00 +0200

When you plug in a new drive, set up a fresh partition, or try to remember which disk is mounted where, you need a quick way to see every block device attached to the system. The lsblk command reads information from sysfs and the udev database and prints a tidy tree of disks, partitions, loop devices, and LVM volumes, together with their sizes and mount points.

This guide explains how to use lsblk to inspect block devices, pick the columns you need, and format the output for scripts.

lsblk Syntax

The general form of the command is:

txt
lsblk [OPTIONS] [DEVICE...]

With no arguments, lsblk lists every block device except RAM disks and empty devices. You can pass one or more device paths to limit the output, for example lsblk /dev/sda.

Unlike fdisk , lsblk does not need root privileges for most queries, which makes it safer for quick checks.

Basic Usage

Run lsblk with no options to see a tree of all devices on the system:

Terminal
lsblk

output

NAME MAJ:MIN RM SIZE RO TYPE MOUNTPOINTS
sda 8:0 0 465.8G 0 disk
├─sda1 8:1 0 512M 0 part /boot/efi
├─sda2 8:2 0 16G 0 part [SWAP]
└─sda3 8:3 0 449.3G 0 part /
sdb 8:16 1 14.3G 0 disk
└─sdb1 8:17 1 14.3G 0 part /media/john/usb
sr0 11:0 1 1024M 0 rom

Each row describes one device. The tree characters on the left show which partitions belong to which disk. The TYPE column tells you whether the entry is a whole disk, a partition, an optical rom, an LVM lvm volume, a crypt container, and so on. The MOUNTPOINTS column is empty when the partition is not mounted.

The RM column is 1 when the kernel marks a device as removable, and RO is 1 for read-only devices. Some USB drives report RM as 0, so use the TRAN column when you specifically need to identify USB storage.

Hide Partitions and Child Devices

When you only care about top-level devices, pass the -d (or --nodeps) flag to hide their partitions, holders, and slaves:

Terminal
lsblk -d

output

NAME MAJ:MIN RM SIZE RO TYPE MOUNTPOINTS
sda 8:0 0 465.8G 0 disk
sdb 8:16 1 14.3G 0 disk
sr0 11:0 1 1024M 0 rom

This is handy when you do not want partition noise. It does not filter by device type, so entries such as the sr0 optical drive can still appear.

Snap packages mount as loop devices, so on an Ubuntu desktop the list can fill with loop0 through loop20 before you reach the real disks. Exclude them by major number with -e (or --exclude):

Terminal
lsblk -e 7

Major number 7 is the loop driver. You can pass several numbers as a comma-separated list, for example lsblk -e 7,11 to drop optical drives as well.

Show Filesystem Information

Passing -f (or --fs) replaces the default columns with filesystem details such as the type, label, UUID, and how full each mounted filesystem is:

Terminal
lsblk -f

output

NAME FSTYPE FSVER LABEL UUID FSAVAIL FSUSE% MOUNTPOINTS
sda
├─sda1 vfat FAT32 4F3A-91BC 470.1M 8% /boot/efi
├─sda2 swap 1 9f4b5a44-6d1e-44a8-a0ae-2c3d3e4f1234 [SWAP]
└─sda3 ext4 1.0 root be2e1f8e-7a0b-4ab1-9f1d-5c6d7e8f9012 312.5G 25% /
sdb
└─sdb1 vfat FAT32 USB 1A2B-3C4D 12.8G 10% /media/john/usb

This is usually the fastest way to find a UUID for /etc/fstab or to confirm which filesystem type sits on a given partition.

Pick Specific Columns

The default columns cover the common cases, but you can choose exactly what to show with the -o (or --output) option. Pass a comma-separated list of column names:

Terminal
lsblk -o NAME,SIZE,TYPE,MOUNTPOINTS

output

NAME SIZE TYPE MOUNTPOINTS
sda 465.8G disk
├─sda1 512M part /boot/efi
├─sda2 16G part [SWAP]
└─sda3 449.3G part /
sdb 14.3G disk
└─sdb1 14.3G part /media/john/usb
sr0 1024M rom

To see the full list of columns lsblk understands, run:

Terminal
lsblk --list-columns

On util-linux versions older than 2.41, that option does not exist yet, and lsblk --help prints the column list instead.

Useful columns include UUID, LABEL, MODEL, SERIAL, VENDOR, FSTYPE, PARTTYPE, HOTPLUG, and TRAN (transport, for example sata, nvme, or usb).

To add columns to the default set rather than replace it, prefix the list with +. For example, this command adds the model and serial number:

Terminal
lsblk -o +MODEL,SERIAL

The -O (or --output-all) flag has a different purpose: it displays every available column.

Show Device Paths

By default, lsblk prints short names such as sda1. If you want the full /dev path in the NAME column, add -p (or --paths):

Terminal
lsblk -p

output

NAME MAJ:MIN RM SIZE RO TYPE MOUNTPOINTS
/dev/sda 8:0 0 465.8G 0 disk
├─/dev/sda1 8:1 0 512M 0 part /boot/efi
├─/dev/sda2 8:2 0 16G 0 part [SWAP]
└─/dev/sda3 8:3 0 449.3G 0 part /

Full paths are easier to copy into a script or a mount command.

List a Single Device

You can pass a device path to inspect only that device and its partitions:

Terminal
lsblk /dev/sda

This narrows the output to one disk, which is useful on servers with many drives.

Flat and ASCII Output

The tree layout is readable in a terminal but awkward to parse in scripts. Use -l (or --list) to print one device per line with no tree characters:

Terminal
lsblk -l

output

NAME MAJ:MIN RM SIZE RO TYPE MOUNTPOINTS
sda 8:0 0 465.8G 0 disk
sda1 8:1 0 512M 0 part /boot/efi
sda2 8:2 0 16G 0 part [SWAP]
sda3 8:3 0 449.3G 0 part /

If your terminal does not render Unicode box-drawing characters correctly, swap them for plain ASCII with -i (or --ascii).

Machine-Readable Output

For scripts, the -J (or --json) flag prints the same information as structured JSON that is easy to parse with tools such as jq:

Terminal
lsblk -J -o NAME,SIZE,FSTYPE /dev/sda

output

{
"blockdevices": [
{
"name": "sda",
"size": "465.8G",
"fstype": null,
"children": [
{
"name": "sda1",
"size": "512M",
"fstype": "vfat"
},
{
"name": "sda2",
"size": "16G",
"fstype": "swap"
},
{
"name": "sda3",
"size": "449.3G",
"fstype": "ext4"
}
]
}
]
}

Each disk becomes an object, and its partitions appear in the children array, so the tree relationship survives the conversion. Fields that do not apply are null rather than empty strings, which keeps the types stable for jq.

You can also use -P (pairs) for line-oriented KEY="value" output, or -r (raw) for space-separated fields with no padding.

The default columns can change between util-linux releases. In scripts, always select the columns you expect with -o, then choose a predictable format such as -J, -P, or -l.

For example, to list only mounted ext4 partitions in a script:

Terminal
lsblk -lnp -o NAME,FSTYPE,MOUNTPOINTS | awk '$2 == "ext4" && $3 != "" {print $1, $3}'

The -n (or --noheadings) flag drops the header row so that the output is pure data.

Show Sizes in Bytes

Sizes are printed in human-readable units by default, for example 465.8G. For exact values, use -b (or --bytes):

Terminal
lsblk -b -o NAME,SIZE

This is the form you want when comparing sizes in a script, since 465.8G is not directly comparable with 449.3G as a string.

Quick Reference

Common lsblk flags and what they do:

-a - Include empty devices and RAM disks that are normally hidden.
-b - Print sizes in bytes instead of human-readable units.
-d - Hide partitions, holders, and slaves.
-e LIST - Exclude devices by major number (7 is loop).
-f - Show filesystem information (type, label, UUID, usage).
-i - Use plain ASCII characters for the tree instead of Unicode.
-J - Output as JSON.
-l - Use a flat list instead of the tree layout.
-n - Omit the header row.
-o LIST - Choose which columns to display.
-o +LIST - Add columns to the default output.
-O - Display every available column.
-p - Print full device paths such as /dev/sda1.
-P - Output as KEY="value" pairs for shell scripts.
-r - Raw output with no padding.
-S - Show information about SCSI devices only.
-t - Print topology information (alignment, I/O sizes).

FAQ

How is lsblk different from fdisk -l?
lsblk reads from sysfs and udev and shows a tree of devices with mount points and filesystem details, all without root privileges for the common cases. fdisk -l reads the partition table directly from the device and focuses on partition layout, sector offsets, and disk identifiers. Use lsblk for a quick overview and fdisk when you care about the raw partition table.

Why is a device missing from lsblk output?
Run lsblk -a to include empty devices and RAM disks that are normally hidden. If you just connected or changed a device, run udevadm settle before trying lsblk again so udev can finish processing the event. A drive that the kernel never detected cannot appear in the list; check the cable or port and inspect recent messages with sudo dmesg | tail -n 30.

How can I get only the UUID of a partition?
Combine -n to drop the header, -o UUID to pick the column, and the device path:
lsblk -no UUID /dev/sda3.

Does lsblk show LVM and encrypted volumes?
Yes. LVM logical volumes appear as children of their physical volume with type lvm, and LUKS-encrypted containers show as crypt. The tree layout makes the stacking relationship easy to follow.

Can lsblk show disk model or serial number?
Yes. Add them to the output list: lsblk -o NAME,MODEL,SERIAL,SIZE. Some virtual devices do not expose these fields, so they may be empty.

Conclusion

lsblk is the fastest way to answer the “what disks and partitions does this machine have?” question, and its JSON and column-selection options make it equally useful inside scripts. Pair it with df for usage stats and with mount when you are ready to attach a new device.

How to Tail and Filter Logs in Real Time on Linux

hello@linuxize.com (Linuxize) — Tue, 11 Aug 2026 09:30:00 +0200

When you reproduce a bug or restart a service, the most useful view is often the log scrolling live as it happens. You want to see each new line when it is written, but you may also need to hide routine entries so the warning or error that matters does not disappear in the noise.

Linux provides several ways to follow logs. Use tail -F for a plain log file, less +F when you need to pause and search, and journalctl -f for output stored in the systemd journal. This guide shows how to use each tool and filter the live stream.

Quick Reference

For printable quick references, see the tail , grep , less , and journalctl cheatsheets.

Task	Command
Follow a file	`tail -f /var/log/app.log`
Follow and survive rotation	`tail -F /var/log/app.log`
Follow only newly appended lines	`tail -n 0 -F /var/log/app.log`
Show last N lines, then follow	`tail -n 100 -f /var/log/app.log`
Follow several files at once	`tail -F /var/log/a.log /var/log/b.log`
Follow, scroll, search, and filter	`less +F /var/log/app.log`
Follow a systemd unit	`journalctl -f -u nginx`
Follow errors and more severe entries	`journalctl -f -p err`
Filter file logs by text	`tail -F app.log \| grep -i error`
Filter journal messages by text	`journalctl -f -u nginx -g 'timeout\|failed'`

Follow a File with tail -f

The tail command prints the end of a file, and the -f (--follow) option keeps reading as new data is appended. This is the quickest way to watch a plain-text log:

Terminal
tail -f /var/log/nginx/access.log

The terminal shows the last 10 lines and then waits, adding each new request as it arrives. Press Ctrl+C to stop. To start with more context, specify the number of existing lines to show:

Terminal
tail -n 100 -f /var/log/nginx/access.log

If you want to ignore existing entries and display only lines appended after the command starts, set the initial line count to zero:

Terminal
tail -n 0 -f /var/log/nginx/access.log

One catch is log rotation. Plain -f follows the open file descriptor, so it can keep watching the old file after that file is renamed. On GNU tail, -F is equivalent to --follow=name --retry: it watches the path and keeps trying to reopen the file when it is replaced or temporarily unavailable.

Terminal
tail -F /var/log/nginx/access.log

You can also watch more than one file in the same session. Pass several paths, and tail prints a ==> path <== header each time the output switches to a different file:

Terminal
tail -F /var/log/nginx/access.log /var/log/nginx/error.log

Those headers tell you which file produced the lines that follow, which matters when two logs use a similar format.

Use -F for a long-running session on a rotating log. The tail command guide covers line counts, byte offsets, and other follow options.

Filter a Live Stream with grep

Pipe the followed output into grep to keep only matching lines. The following command ignores case, so it matches error, ERROR, and other capitalization variants:

Terminal
tail -F /var/log/app.log | grep -i error

In this two-command pipeline, grep writes directly to the terminal and normally displays each match immediately. If you send its output into another command, GNU grep switches to full buffering. Add --line-buffered before the next pipeline stage so matches continue moving one line at a time:

Terminal
tail -F /var/log/app.log | grep --line-buffered -i error | awk '{ print $1, $2, $NF }'

Here, grep flushes each match to awk, which prints the first two and last whitespace-separated fields. A later command can still have its own buffering rules, so check each stage if output remains delayed.

Use extended regular expressions to match several severity words in one pass:

Terminal
tail -F /var/log/app.log | grep -Ei 'error|warning|critical'

To hide a noisy health-check endpoint while keeping all other requests, invert the match with -v:

Terminal
tail -F /var/log/nginx/access.log | grep -v '/health'

The grep command guide covers fixed strings, regular expressions, and inverted matches in more detail.

Scroll and Search with less +F

tail -f shows new lines but does not let you inspect earlier entries without stopping the command. The less pager has its own follow mode and lets you switch between live output and normal navigation:

Terminal
less +F /var/log/app.log

Press Ctrl+C to pause following. You can then scroll with the arrow keys or search forward by typing /pattern and pressing Enter.

To hide nonmatching lines, type &pattern and press Enter. Enter & followed by Enter to clear the filter. Press uppercase F to return to follow mode; any active filter remains in effect while new lines arrive. The less command guide covers navigation, searches, and display options.

Follow a Service with journalctl -f

On a systemd system, service output captured by systemd-journald is read with journalctl. Use -f to follow new journal entries and -u to limit them to one unit:

Terminal
journalctl -f -u nginx

This follows entries associated with the nginx unit, including service lifecycle messages and output sent to the journal. Applications can also write dedicated files. If Nginx access requests are stored in /var/log/nginx/access.log, follow that file with tail -F instead.

Because journal entries contain structured fields, you can filter by priority. A single priority includes that level and all more severe levels, so err shows err, crit, alert, and emerg entries:

Terminal
journalctl -f -u nginx -p err

Use -g (--grep) to match a regular expression against the MESSAGE field while following:

Terminal
journalctl -f -u nginx -g 'timeout|failed'

To follow warnings and more severe entries from the current boot across all accessible units, combine -f, -p, and -b:

Terminal
journalctl -f -b -p warning

The journalctl command guide covers time ranges, boot selection, unit filters, and journal fields.

Which Tool to Use

The log destination determines the first choice. Use tail -F for a rotating plain-text file, then pipe it through grep when you need text filtering. Use less +F when you expect to pause, scroll backward, search, or interactively hide nonmatching lines. Use journalctl -f when the messages are stored in the systemd journal and you want to filter by unit, priority, boot, or message text.

Troubleshooting

Permission denied when opening a log
Check the file permissions with ls -l /path/to/log. Run sudo tail -F /path/to/log only if your account is authorized to read that log. For the system journal, administrators can use sudo journalctl, while many distributions also grant journal access through groups such as adm or systemd-journal.

No new lines appear
Confirm that the application is still appending to the path you opened. If the file was rotated or recreated, restart with tail -F. Also remember that tail follows appended data; it does not report text rewritten in place earlier in the file.

journalctl -p err misses a message containing ERROR
The -p option checks the structured PRIORITY field, not words inside the message. If an application logs the word ERROR without assigning an error priority, use a text filter such as journalctl -f -u SERVICE -g 'error'.

Conclusion

Start with the unfiltered stream to confirm that you have the correct source, then add one filter at a time so you do not hide the event you are trying to diagnose. When a filter proves useful more than once, save it as a shell alias or a short script so the next incident starts from a view you already trust.

Regular Expressions Explained: How Regex Patterns Work

hello@linuxize.com (Linuxize) — Mon, 03 Aug 2026 10:10:00 +0200

Sooner or later every command line session runs into a matching problem that plain text search cannot solve: find lines that start with a number, pull every email address out of a log, or replace dates in one format with another. Regular expressions (regex) are the pattern language that solves these problems, and the same core syntax works in grep, sed, awk, text editors, and most programming languages.

This guide explains the building blocks of regular expressions, anchors, character classes, quantifiers, grouping, and alternation, and shows how the same pattern carries from grep to sed and awk.

What a Regular Expression Is

A regular expression is a pattern that describes a set of strings. Instead of matching one literal word, a pattern like ^error [0-9]+ matches any line that starts with “error” followed by a space and one or more digits.

The examples in this guide use GNU grep -E (extended regular expressions), so every pattern works as written. You can test any of them by piping text into grep :

Terminal
echo "error 404" | grep -E '^error [0-9]+'

output

error 404

The line prints because it matches the pattern. When there is no match, grep prints nothing and returns a non-zero exit status. Always single-quote the pattern so the shell does not interpret characters like $ and * before grep sees them.

Literal Characters and Metacharacters

Most characters in a regex match themselves: the pattern cat matches the string “cat” anywhere in a line, including inside “concatenate”. A handful of characters have special meanings instead of matching literally:

txt
. ^ $ * + ? ( ) [ ] { } | \

These are the metacharacters, and the rest of this guide is about what they do. To match one of them literally, escape it with a backslash: \. matches a real dot, \$ a real dollar sign.

Anchors and Word Boundaries

Anchors and word boundaries do not match characters; they match positions in the line.

^ - Matches the start of the line.
$ - Matches the end of the line.
\b - Matches a word boundary, the position between a word character and a non-word character.

The \b boundary is a GNU grep extension rather than part of POSIX extended regular expression syntax.

The difference is easiest to see on real input. The following input contains three similar lines, but the pattern prints only the line that consists of exactly the word “root”:

Terminal
printf 'root\nroot:x:0:0\nchroot\n' | grep -E '^root$'

output

root

Without anchors, the pattern root would also match “chroot” or a line where “root” appears in the middle. Word boundaries solve the substring problem without pinning the match to the whole line:

Terminal
echo "the cat scattered" | grep -E -o '\bcat\b'

output

cat

The -o flag prints only the matched text. Notice that “scattered” did not produce a match, because “cat” inside it is not surrounded by word boundaries.

Character Classes: Matching Sets

Square brackets match one character from a set:

[abc] - One character: a, b, or c.
[a-z] - One lowercase letter; ranges also work for [0-9] and [A-Z].
[^abc] - Negation: one character that is NOT a, b, or c.

For example, to match “gray” and “grey” with one pattern:

Terminal
printf 'gray\ngrey\ngroy\n' | grep -E 'gr[ae]y'

output

gray
grey

The third line does not match because “o” is not in the set. Inside brackets, most metacharacters lose their special meaning; [.] matches a literal dot.

POSIX character classes are named shortcuts that work inside brackets: [[:digit:]] is equivalent to [0-9], [[:alpha:]] matches letters, [[:space:]] matches whitespace. Many tools also support the Perl-style shorthands \d wherever PCRE is available (grep -P), but the bracket forms are the portable choice for shell work.

The Dot and Quantifiers: Matching Repetition

The dot . matches any single character except a newline. Quantifiers apply to the preceding item and control how many times it may repeat:

* - Zero or more times.
+ - One or more times.
? - Zero or one time (optional).
{n} - Exactly n times.
{n,m} - Between n and m times.

Combining the dot with a quantifier gives .*, which matches anything, including nothing. A more precise example matches an IPv4-looking address by requiring one to three digits in each group:

Terminal
echo "server at 192.168.1.10 is up" | grep -E -o '[0-9]{1,3}(\.[0-9]{1,3}){3}'

output

192.168.1.10

Reading it piece by piece: [0-9]{1,3} matches the first number group, \. matches a literal dot, and the parentheses with {3} repeat the dot-plus-number sequence three times.

A common beginner mistake is reaching for * when + is meant. The pattern [0-9]* happily matches an empty string, so it succeeds on every line; [0-9]+ actually requires a digit.

Grouping and Alternation

Parentheses group parts of a pattern, and the pipe | provides alternation (OR):

Terminal
printf 'error: disk full\nwarning: low memory\ninfo: started\n' | grep -E '^(error|warning):'

output

error: disk full
warning: low memory

The group limits the alternation to the two words before the colon; without parentheses, ^error|warning: would mean “starts with error, OR contains warning: anywhere”, which is rarely what you want.

Groups also capture what they match, and the captured text can be reused. In sed , \1 refers to the first group, which makes reordering text possible:

Terminal
echo "2026-01-15" | sed -E 's/([0-9]{4})-([0-9]{2})-([0-9]{2})/\3.\2.\1/'

output

15.01.2026

The three groups capture the year, month, and day, and the replacement writes them back in reverse order.

Basic vs Extended Regular Expressions

POSIX defines two regex dialects, and the difference trips up almost everyone at some point. In basic regular expressions (BRE), which plain grep and sed use, the characters +, ?, |, {}, and () match literally, and you must escape them (\+, $ … $) to get the special behavior. In extended regular expressions (ERE), they are special by default.

Construct	ERE (`grep -E`, `sed -E`, `awk`)	BRE (plain `grep`, `sed`)
One or more	`+`	`\+`
Optional	`?`	`\?`
Repetition	`{n,m}`	`\{n,m\}`
Grouping	`(...)`	`$...$`
Alternation	`a\|b`	`a\\|b`, GNU extension only

That last row is the one to watch. Alternation is not part of POSIX BRE at all, so \| works in GNU grep and GNU sed but fails silently on the BSD sed that ships with macOS.

In practice, the simplest rule is: pass -E to grep and sed and write in the extended dialect, as every example in this guide does. awk uses extended syntax natively:

Terminal
printf 'alice 92\nbob 47\ncarol 78\n' | awk '/^[ab]/ {print $1}'

output

alice
bob

The awk pattern selects lines starting with “a” or “b” and prints the first field. grep -P enables a third dialect, Perl-compatible regular expressions (PCRE), which adds features like \d and lookarounds; reach for it when the POSIX dialects run out.

One Pattern, Three Tools

The syntax is shared, but each tool wraps it differently, which is the part that usually causes confusion when moving a working pattern from one command to another. Create a small log file to follow along:

Terminal
printf 'error: disk full\nwarning: low memory\ninfo: started\n' > app.log

Because grep is a filter, the pattern is the whole job and needs nothing around it:

Terminal
grep -E '^(error|warning):' app.log

sed prints every input line unless you suppress that with -n, so selecting lines takes an address followed by an explicit p command:

Terminal
sed -E -n '/^(error|warning):/p' app.log

awk reads a bare pattern with no action block as “print the matching line”:

Terminal
awk '/^(error|warning):/' app.log

output

error: disk full
warning: low memory

All three print the same two lines and skip the “info” line. Where the tools part company is what happens after the match. grep reports lines and stops there, sed can rewrite the matched text, and awk splits each matching line into fields you can work with:

Terminal
awk -F': ' '/^(error|warning):/ {print $2}' app.log

output

disk full
low memory

Setting the field separator to ': ' makes $2 the message text, so the pattern selects the lines and the action block pulls out the part you actually wanted. This is why it pays to learn regex once as its own subject: the pattern you write today for grep is the same pattern you will paste into sed, awk, a text editor, or a Python script tomorrow.

Quick Reference

For a printable quick reference, see the Regex cheatsheet .

Pattern	Matches
`.`	Any single character
`^` / `$`	Start / end of line
`\b`	Word boundary in GNU grep
`[abc]` / `[^abc]`	One of the set / one not in the set
`[0-9]`, `[[:digit:]]`	One digit
`*` / `+` / `?`	Zero or more / one or more / optional
`{n,m}`	Between n and m repetitions
`(foo\|bar)`	foo or bar
`\1`	Text captured by the first group
`\.`	Literal dot (escaped metacharacter)

Conclusion

Anchors, character classes, quantifiers, and groups combine into patterns that handle most day-to-day matching on Linux, and the same vocabulary carries over to editors and programming languages. To put the syntax to work in specific tools, see our guides to regular expressions in grep and find and replace with sed .

git worktree: Work on Multiple Branches at Once

hello@linuxize.com (Linuxize) — Sun, 02 Aug 2026 09:20:00 +0200

A common frustration when working with Git is needing to switch branches while your current working tree has uncommitted changes. You can stash the changes , switch branches, make the fix, switch back, and restore the stash, but that flow interrupts your work and can create conflicts. git worktree lets you check out another branch in a separate directory, so both workspaces remain available at the same time.

This guide explains how to create, list, lock, prune, and remove linked worktrees, with a hotfix workflow you can copy.

How git worktree Works

A Git repository normally has one working tree: the directory where you edit files. With git worktree, you can attach additional working trees to the same repository. Each linked worktree has its own working directory, index, and HEAD, while all worktrees share the same object store and repository history. You do not create another clone; you create another workspace for the same repository.

git worktree Syntax

The most-used forms of the command are:

txt
git worktree add [OPTIONS] <path> [<commit-ish>]
git worktree list [OPTIONS]
git worktree remove [--force] <worktree>
git worktree prune [OPTIONS]
git worktree lock [--reason <string>] <worktree>
git worktree unlock <worktree>

Add a Worktree for an Existing Branch

Suppose you are working on a feature branch and want a separate checkout of main. Add it in a sibling directory without leaving your current branch:

Terminal
git worktree add ../project-main main

output

Preparing worktree (checking out 'main')
HEAD is now at a1b2c3d Fix typo in README

The new directory ../project-main contains main, while your original working tree stays on the feature branch. Git refuses this command if main is already checked out in another worktree.

Add a Worktree with a New Branch

For a hotfix, create a new branch from main and check it out in one step:

Terminal
git worktree add -b hotfix/payment-null ../project-hotfix main

output

Preparing worktree (new branch 'hotfix/payment-null')
HEAD is now at a1b2c3d Fix typo in README

The -b flag creates hotfix/payment-null from main and checks it out in the new directory. After making the fix and running your tests, commit and push from that worktree:

Terminal
cd ../project-hotfix
# Edit the files and run your tests
git add .
git commit -m "Fix payment handler"
git push -u origin hotfix/payment-null

Your original directory remains on the feature branch throughout this workflow.

List All Worktrees

To display the main worktree and every linked worktree, run:

Terminal
git worktree list

output

/home/user/project abc1234 [feature/new-dashboard]
/home/user/project-hotfix def5678 [hotfix/payment-null]
/home/user/project-main a1b2c3d [main]

The first entry is always the main worktree. Each linked worktree shows its path, current commit, and checked-out branch.

Run Tests Across Branches in Parallel

Worktrees are useful for running a test suite against two commits at the same time. For a temporary test directory that does not need its own branch, create a detached worktree:

Terminal
git worktree add --detach ../project-test main
(cd ../project-test && npm ci && npm test) &
npm test &
wait

The first background job installs dependencies and runs the tests against main in ../project-test, while the second runs in your current worktree. Both worktrees share the Git object store but keep their working files and installed dependencies separate.

Remove a Worktree

When you are done with a linked worktree, remove it:

Terminal
git worktree remove ../project-hotfix

This deletes the linked directory and unregisters it from the repository. It does not delete the hotfix/payment-null branch.

Git refuses to remove a worktree with modified or untracked files. Check its status before deciding whether to force removal:

Terminal
git -C ../project-hotfix status

Warning

The --force option deletes the linked directory even when it contains modified or untracked files. Commit or copy anything you need before running it.

If you are certain that the remaining files are disposable, force the removal with:

Terminal
git worktree remove --force ../project-hotfix

Prune Stale Worktree References

If you delete a worktree directory manually, Git retains its administrative entry. Preview the stale entries that qualify for removal with:

Terminal
git worktree prune --dry-run --verbose

After reviewing the output, remove those entries with:

Terminal
git worktree prune --verbose

This command removes stale metadata, not active worktree directories. git gc also prunes missing entries older than the configured gc.worktreePruneExpire period, which defaults to three months.

Lock a Worktree

If a worktree lives on a removable drive or a network path that may be temporarily unavailable, lock it so prune does not remove it:

Terminal
git worktree lock --reason "on external drive" ../project-hotfix

Unlock it when the path is available again:

Terminal
git worktree unlock ../project-hotfix

A lock also protects the worktree from git worktree remove, and a single --force is not enough to override it:

output

fatal: cannot remove a locked working tree, lock reason: on external drive
use 'remove -f -f' to override or unlock first

Unlock the worktree first, or pass the force option twice:

Terminal
git worktree remove --force --force ../project-hotfix

Quick Reference

For a printable quick reference, see the Git cheatsheet .

Command	Description
`git worktree add ../path branch`	Check out an existing branch in a linked worktree
`git worktree add -b new-branch ../path main`	Create a new branch from `main` in a linked worktree
`git worktree add --detach ../path main`	Create a detached worktree for testing
`git worktree list`	List the main and linked worktrees
`git worktree lock --reason "text" ../path`	Protect a temporarily unavailable worktree from pruning
`git worktree remove ../path`	Delete and unregister a clean linked worktree
`git worktree prune --dry-run --verbose`	Preview stale administrative entries
`git worktree repair /new/path`	Repair the link to a manually moved worktree

Troubleshooting

Git reports that a branch is already checked out
A branch can normally be checked out in only one worktree. Create a new branch from it instead:

Terminal
git worktree add -b new-branch ../project-new main

If you only need the files for testing and do not plan to commit, use a detached worktree:

Terminal
git worktree add --detach ../project-test main

Git cannot find a manually moved worktree
If you moved a linked directory without git worktree move, repair its administrative link from another worktree:

Terminal
git worktree repair /new/path

Use the new location as the argument. Git reconnects the linked directory without checking it out again.

Conclusion

git worktree keeps parallel tasks isolated without creating another clone or disturbing your current files. Create a dedicated branch for changes, use detached worktrees for temporary tests, and see the git branch guide when you need to rename, inspect, or delete the branches afterward.

killall Command in Linux: Kill Processes by Name

hello@linuxize.com (Linuxize) — Sat, 01 Aug 2026 08:40:00 +0200

When a program misbehaves, it may leave several processes running. Modern browsers start separate worker processes, and a stuck script may have been launched several times in different terminals. Killing each one with the kill command means looking up every PID first. The killall command skips that step: you give it a process name, and it signals every process running under that name.

This guide explains how to use killall to terminate processes by name, choose the signal to send, and narrow matches by user, age, or pattern.

Installing killall

killall is part of the psmisc package, which is preinstalled on most desktop and server distributions. If the command is missing, install it from the standard repositories.

On Ubuntu, Debian, and Derivatives:

Terminal
sudo apt install psmisc

On Fedora, RHEL, and Derivatives:

Terminal
sudo dnf install psmisc

Warning

On Linux, the psmisc version of killall affects only processes matching the given name. On some other Unix systems, such as Solaris and AIX, killall signals nearly every process on the machine, which is how those systems tear things down at shutdown. Confirm which implementation is installed before running killall on a remote system, especially as root.

killall Syntax

The general syntax of the killall command is as follows:

txt
killall [OPTIONS] NAME...

NAME is the process name to match. You can pass more than one name, and killall signals every process that matches any of them. Unlike pkill, which matches partial names, killall requires the name to match exactly.

killall exits with status zero when it successfully signals at least one process for every name you supplied. If a name does not match, it prints a message and returns a non-zero status:

Terminal
killall firefox

output

firefox: no process found

Killing a Process by Name

To terminate a process, pass its exact name:

Terminal
killall firefox

By default, killall sends the SIGTERM signal, which asks each matching process to shut down cleanly. The command produces no output when it succeeds. Add -v to confirm what was signalled:

Terminal
killall -v vlc

output

Killed vlc(8143) with signal 15

The output shows the process name, its PID, and the signal number. Signal 15 is SIGTERM.

Before sending a signal, use pgrep to preview exact matches and their full command lines:

Terminal
pgrep -a -x firefox

If this command prints nothing, check ps -e -o pid,comm to find the process name that Linux reports.

Sending a Specific Signal

When a process ignores SIGTERM, you can send a stronger signal. The -s option accepts a signal name or number:

Terminal
killall -s KILL myscript

SIGKILL cannot be caught or ignored, so the process is terminated immediately without a chance to clean up. The same signal can be written in two shorter forms:

Terminal
killall -9 myscript
killall -SIGKILL myscript

Use SIGKILL only after a plain killall has failed. A process killed this way cannot flush buffers or remove its temporary files, which is why trying SIGTERM first is the safer habit. For a longer discussion of signals and when to use each, see our guide on how to kill a process in Linux .

Signals are also useful for more than termination. For example, BIND reloads its configuration when the named process receives SIGHUP:

Terminal
sudo killall -s HUP named

To list all signal names that killall understands, use -l:

Terminal
killall -l

output

HUP INT QUIT ILL TRAP ABRT BUS FPE KILL USR1 SEGV USR2 PIPE ALRM TERM STKFLT
CHLD CONT STOP TSTP TTIN TTOU URG XCPU XFSZ VTALRM PROF WINCH POLL PWR SYS

Matching Names Case-Insensitively

Process name matching is case-sensitive by default. If you are not sure about the capitalization, add -I:

Terminal
killall -I "teamviewer"

This matches TeamViewer, teamviewer, and any other case variant of the name.

Matching with Regular Expressions

The -r option interprets the name as an extended regular expression, so you can signal several related processes at once:

Terminal
killall -r '^chrom.*'

The ^ anchor limits the match to names that begin with chrom, such as chrome and chromium. Quote the pattern so the shell does not interpret special characters before killall sees them.

Killing Processes Owned by a User

The -u option restricts matches to processes owned by a specific user:

Terminal
killall -u sarah node

This terminates only the node processes running under the sarah account, leaving other users’ node processes alone.

If you pass -u without a process name, killall signals every process the user owns:

Terminal
sudo killall -u sarah

Be careful with this form. It terminates the user’s entire session, including their shell and any editors with unsaved work. Combine it with -i when you want to review each process first.

Confirming Each Kill Interactively

The -i option asks for confirmation before signalling each matching process:

Terminal
killall -i node

output

Kill node(2211) ? (y/N)
Kill node(2384) ? (y/N)

Answer y to signal a process or press Enter to skip it. Interactive mode is a good safety net when a name is common enough to match processes you did not have in mind.

Filtering by Process Age

The -o (older) and -y (younger) options filter matches by how long a process has been running. The time is a whole number followed by a unit: s for seconds, m for minutes, h for hours, d for days, w for weeks, M for months, and y for years.

To kill myscript processes that have been running for more than an hour:

Terminal
killall -o 1h myscript

To kill only instances started within the last ten minutes:

Terminal
killall -y 10m myscript

The age filters are handy for cleaning up stuck workers or runaway cron jobs while leaving fresh, healthy instances running.

Waiting for Processes to Die

By default, killall sends the signal and returns immediately. The -w option makes it wait until all signalled processes have actually terminated:

Terminal
killall -w myscript && echo "all stopped"

This is useful in scripts that must not continue until a service is fully down. The wait can continue forever if the signal is ignored, has no effect, or leaves the process in a zombie state.

To put a ten-second limit on the wait, run killall through the timeout command :

Terminal
timeout 10s killall -w myscript

If the limit expires, timeout stops the killall command, but the target process may still be running. Inspect it with pgrep before deciding whether to send SIGKILL. A process that remains in a zombie state can also cause killall -w to keep waiting.

killall vs kill vs pkill

All three commands send signals; they differ in how you select the target processes:

kill targets a specific PID. It is the most precise option, but you have to look the PID up first.
killall targets an exact process name and signals every instance of it.
pkill targets a name pattern, so pkill fire matches firefox. It can also match against the full command line with -f.

The exact-name behavior of killall makes it more predictable than pkill for everyday use: killall node cannot accidentally match node_exporter. Linux limits the process name stored in /proc/PID/stat to 15 characters. For longer names, killall may have to fall back to those first 15 characters when the full name is unavailable. Add -e to skip a long-name match that cannot be verified exactly.

Common Options

-s SIGNAL - Send the given signal instead of SIGTERM. Also accepts the -SIGNAL and numeric forms.
-l - List known signal names.
-v - Report each signal that was successfully sent.
-q - Do not complain when no process matched.
-I - Match process names case-insensitively.
-r - Interpret the name as an extended regular expression.
-e - Require an exact match for names longer than 15 characters.
-u USER - Match only processes owned by the given user.
-i - Ask for confirmation before signalling each process.
-o TIME - Match only processes older than the given age.
-y TIME - Match only processes younger than the given age.
-w - Wait until all signalled processes have died.

Quick Reference

For a printable quick reference, see the kill cheatsheet .

Task	Command
Terminate all processes with a name	`killall firefox`
Force kill after a failed terminate	`killall -9 firefox`
Reload BIND’s configuration	`sudo killall -s HUP named`
Ignore name capitalization	`killall -I teamviewer`
Match names by regex	`killall -r '^chrom.*'`
Kill a user’s instances of a program	`killall -u sarah node`
Kill all of a user’s processes	`sudo killall -u sarah`
Confirm each kill	`killall -i node`
Kill instances older than one hour	`killall -o 1h myscript`
Wait until processes exit	`killall -w myscript`
List signal names	`killall -l`

Troubleshooting

killall: no process found
killall requires the process name to match exactly unless you use -r or -I. Run pgrep -a pattern or ps -e -o pid,comm to check the reported name, capitalization, and command line before trying again.

Operation not permitted
You can signal your own processes, but another user’s process normally requires root privileges. Verify the exact target first, then rerun the command with sudo only when needed.

killall -w does not return
The process may have ignored the signal, stayed in a zombie state, or been replaced by a new process with the same PID while killall was checking it. Stop waiting with Ctrl+C, inspect the target with pgrep -a -x NAME, and use SIGKILL only if the process is still running and cannot shut down cleanly.

Conclusion

killall terminates every instance of a program in one command, with filters for user, age, and case when the name alone is too broad. When you need pattern matching instead of exact names, reach for pkill , and when you need to inspect processes before killing them, start with pgrep .

AWS CLI Cheatsheet

hello@linuxize.com (Linuxize) — Fri, 31 Jul 2026 13:35:00 +0200

Installation and Setup

Install AWS CLI version 2 and set the basic configuration. Full walkthrough in installing and configuring the AWS CLI on Linux .

Command	Description
`curl https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip -o awscliv2.zip`	Download the x86_64 installer
`curl https://awscli.amazonaws.com/awscli-exe-linux-aarch64.zip -o awscliv2.zip`	Download the ARM64 installer
`unzip awscliv2.zip`	Extract the installer
`sudo ./aws/install`	Install AWS CLI version 2
`sudo ./aws/install --update`	Update from a freshly extracted installer
`aws --version`	Show the installed version
`aws configure`	Interactive credential and region setup
`aws configure list`	Show active settings and where they come from
`aws configure get region`	Read a single config value
`aws configure set region eu-central-1`	Write a single config value
`complete -C aws_completer aws`	Enable Bash command completion
`aws ec2 help`	Open the reference for a service

Profiles and Authentication

Static access keys configured with aws configure live in ~/.aws/credentials, while other settings live in ~/.aws/config. Prefer temporary credentials from aws login or IAM Identity Center.

Command	Description
`aws login`	Sign in with AWS console credentials
`aws login --profile dev`	Sign in to a named profile
`aws login --remote`	Sign in from a host without a browser
`aws logout --profile dev`	Clear cached login credentials for a profile
`aws configure --profile dev`	Configure a profile with an access key
`aws s3 ls --profile dev`	Run one command as a profile
`export AWS_PROFILE=dev`	Use a profile for the whole shell
`aws configure list-profiles`	List configured profiles
`aws configure sso`	Set up an IAM Identity Center profile
`aws sso login --profile dev`	Start or refresh an SSO session
`aws sso logout`	Clear cached SSO credentials
`aws sts get-caller-identity`	Show the account and identity in use
`aws sts assume-role --role-arn arn --role-session-name cli`	Get temporary role credentials
`export AWS_REGION=eu-west-1`	Override the region for the shell

Common Options

Frequently used options. Availability depends on the service and operation.

Option	Description
`--region eu-west-1`	Target a specific region
`--profile dev`	Use a named profile
`--output json`	Set the response format
`--no-cli-pager`	Print output instead of opening a pager
`--dry-run`	Check permissions without acting on supported EC2 operations
`--cli-auto-prompt`	Prompt for parameters interactively
`--no-paginate`	Return only the first page from a paginated operation
`--page-size 100`	Set the API page size for a paginated operation
`--max-items 20`	Limit output from a paginated operation
`--cli-input-json file://params.json`	Read parameters for a modeled API operation
`--generate-cli-skeleton`	Print a parameter template for a modeled API operation
`--debug`	Print the full request and response trace

Output Formatting and Queries

The --query option uses JMESPath and runs client side. Service-specific options such as --filters run server side, which can reduce response size and improve response time for large data sets. Pipe --output json into jq when a query gets hard to read.

Command	Description
`aws s3api list-buckets --output table`	Human-readable table
`aws s3api list-buckets --output text`	Tab-delimited text
`aws s3api list-buckets --output yaml`	YAML response
`aws s3api list-buckets --query "Buckets[].Name"`	Return one field
`aws ec2 describe-instances --query "Reservations[].Instances[].[InstanceId,State.Name]" --output text`	Return several fields as columns
`aws ec2 describe-instances --query "Reservations[].Instances[?State.Name=='running'].InstanceId"`	Filter results client side
`aws ec2 describe-instances --filters Name=instance-state-name,Values=running`	Filter results server side
`aws ec2 describe-volumes --query "Volumes[0:5]"`	Slice the result list
`aws ec2 wait instance-running --instance-ids i-0abc123`	Block until a state is reached

S3 Buckets and Objects

Everyday transfers with the high-level aws s3 commands. More examples in aws s3 commands .

Command	Description
`aws s3 ls`	List all buckets
`aws s3 ls s3://bucket --recursive --summarize`	List objects with a size total
`aws s3 cp file.txt s3://bucket/`	Upload a file
`aws s3 cp s3://bucket/file.txt .`	Download a file
`aws s3 cp ./dir s3://bucket/dir --recursive`	Upload a directory
`aws s3 sync ./dir s3://bucket/dir`	Copy only new and changed files
`aws s3 sync ./dir s3://bucket/dir --delete --dryrun`	Preview a mirror that removes stale files
`aws s3 rm s3://bucket/dir/ --recursive --dryrun`	Preview a recursive delete
`aws s3 mb s3://bucket`	Create a bucket
`aws s3 rb s3://bucket`	Remove an empty bucket
`aws s3 presign s3://bucket/file.txt --expires-in 3600`	Generate a temporary download link

EC2 Instances

Launch, inspect, and control instances.

Command	Description
`aws ec2 describe-instances`	List instances and their details
`aws ec2 describe-instances --instance-ids i-0abc123`	Details for one instance
`aws ec2 describe-instance-status`	Health and scheduled events
`aws ec2 run-instances --image-id ami-0abc --instance-type t3.micro --key-name mykey`	Launch an instance
`aws ec2 start-instances --instance-ids i-0abc123`	Start a stopped instance
`aws ec2 stop-instances --instance-ids i-0abc123`	Stop an instance
`aws ec2 reboot-instances --instance-ids i-0abc123`	Reboot an instance
`aws ec2 terminate-instances --instance-ids i-0abc123`	Permanently terminate an instance
`aws ec2 create-tags --resources i-0abc123 --tags Key=Name,Value=web`	Tag a resource
`aws ec2 describe-images --owners 099720109477 --filters "Name=name,Values=ubuntu/images/hvm-ssd-gp3/ubuntu-noble-24.04-amd64-server-*"`	Find official Ubuntu 24.04 AMIs
`aws ec2 get-console-output --instance-id i-0abc123`	Read the instance console log

Security Groups and Key Pairs

Network access and SSH keys for EC2. Private key files are unencrypted, so keep them readable only by your user.

Command	Description
`aws ec2 describe-security-groups`	List security groups
`aws ec2 create-security-group --group-name web --description "Web tier"`	Create a security group
`aws ec2 authorize-security-group-ingress --group-id sg-0abc --protocol tcp --port 22 --cidr 203.0.113.10/32`	Allow inbound traffic
`aws ec2 revoke-security-group-ingress --group-id sg-0abc --protocol tcp --port 22 --cidr 203.0.113.10/32`	Remove an inbound rule
`aws ec2 delete-security-group --group-id sg-0abc`	Delete a security group
`aws ec2 create-key-pair --key-name mykey --query KeyMaterial --output text > mykey.pem`	Create a key pair and save the private key
`chmod 400 mykey.pem`	Restrict private key permissions
`aws ec2 describe-key-pairs`	List key pairs
`aws ec2 delete-key-pair --key-name mykey`	Delete a key pair
`aws ec2 describe-vpcs`	List VPCs
`aws ec2 describe-subnets --filters Name=vpc-id,Values=vpc-0abc`	List subnets in a VPC
`aws ec2 allocate-address`	Reserve an elastic IP
`aws ec2 associate-address --instance-id i-0abc123 --allocation-id eipalloc-0abc`	Attach an elastic IP

EBS Volumes and Snapshots

Block storage and backups.

Command	Description
`aws ec2 describe-volumes`	List volumes
`aws ec2 create-volume --size 20 --availability-zone eu-central-1a`	Create a volume
`aws ec2 attach-volume --volume-id vol-0abc --instance-id i-0abc123 --device /dev/sdf`	Attach a volume
`aws ec2 detach-volume --volume-id vol-0abc`	Detach a volume
`aws ec2 delete-volume --volume-id vol-0abc`	Permanently delete a volume
`aws ec2 create-snapshot --volume-id vol-0abc --description "nightly"`	Snapshot a volume
`aws ec2 describe-snapshots --owner-ids self`	List your snapshots
`aws ec2 copy-snapshot --region eu-west-1 --source-region eu-central-1 --source-snapshot-id snap-0abc`	Copy a snapshot from eu-central-1 to eu-west-1
`aws ec2 delete-snapshot --snapshot-id snap-0abc`	Permanently delete a snapshot

IAM Users and Roles

Identities, policies, and access keys. Creating an access key prints its secret once, so store it securely and never commit it to version control.

Command	Description
`aws iam list-users`	List IAM users
`aws iam create-user --user-name dev`	Create a user
`aws iam delete-user --user-name dev`	Permanently delete a user after removing dependencies
`aws iam list-roles`	List roles
`aws iam get-role --role-name deploy`	Show a role and its trust policy
`aws iam attach-user-policy --user-name dev --policy-arn arn:aws:iam::aws:policy/ReadOnlyAccess`	Attach a managed policy
`aws iam list-attached-user-policies --user-name dev`	List policies attached to a user
`aws iam create-access-key --user-name dev`	Create an access key
`aws iam list-access-keys --user-name dev`	List access keys and creation dates
`aws iam update-access-key --user-name dev --access-key-id AKIA123 --status Inactive`	Disable a key before deleting it
`aws iam delete-access-key --user-name dev --access-key-id AKIA123`	Permanently delete an access key
`aws iam get-account-summary`	Account-wide IAM counts and limits

Systems Manager and Secrets

Shell access without SSH, plus configuration and secret storage. The start-session command needs the Session Manager plugin installed locally. Pass secret values from protected files so they do not enter shell history, and keep decrypted output out of shared logs.

Command	Description
`aws ssm start-session --target i-0abc123`	Open a shell on an instance
`aws ssm describe-instance-information`	List instances managed by SSM
`aws ssm send-command --instance-ids i-0abc123 --document-name AWS-RunShellScript --parameters commands="uptime"`	Run a command on an instance
`aws ssm get-command-invocation --command-id 1a2b --instance-id i-0abc123`	Read the output of a sent command
`aws ssm put-parameter --name /app/db_url --value file://db-url.txt --type SecureString`	Store an encrypted parameter from a file
`aws ssm get-parameter --name /app/db_url --with-decryption`	Read and decrypt a parameter
`aws ssm get-parameters-by-path --path /app --recursive`	List parameters under a path
`aws secretsmanager list-secrets`	List secrets
`aws secretsmanager get-secret-value --secret-id prod/db --query SecretString --output text`	Print a decrypted secret value
`aws secretsmanager create-secret --name prod/db --secret-string file://secret.json`	Create a secret from a file

CloudWatch Logs and Alarms

Read application and service logs from the terminal.

Command	Description
`aws logs describe-log-groups`	List log groups
`aws logs describe-log-streams --log-group-name /aws/lambda/fn`	List streams in a group
`aws logs tail /aws/lambda/fn --follow`	Stream new log events live
`aws logs tail /aws/lambda/fn --since 1h --format short`	Show the last hour of logs
`aws logs filter-log-events --log-group-name /aws/lambda/fn --filter-pattern ERROR`	Search log events
`aws logs create-log-group --log-group-name /app/web`	Create a log group
`aws logs put-retention-policy --log-group-name /app/web --retention-in-days 30`	Set log retention
`aws logs delete-log-group --log-group-name /app/web`	Permanently delete a log group and its logs
`aws cloudwatch describe-alarms`	List alarms and their state
`aws cloudwatch describe-alarms --state-value ALARM`	Show only firing alarms

Lambda Functions

Deploy and invoke functions. AWS CLI version 2 expects base64 input for blob parameters by default, so literal JSON passed to --payload needs --cli-binary-format raw-in-base64-out.

Command	Description
`aws lambda list-functions`	List functions
`aws lambda get-function --function-name fn`	Show configuration and code location
`aws lambda invoke --function-name fn out.json`	Invoke a function
`aws lambda invoke --function-name fn --cli-binary-format raw-in-base64-out --payload '{"key":"value"}' out.json`	Invoke with a JSON payload
`aws lambda update-function-code --function-name fn --zip-file fileb://fn.zip`	Deploy new code
`aws lambda update-function-configuration --function-name fn --timeout 30`	Change a setting
`aws lambda publish-version --function-name fn`	Publish an immutable version
`aws lambda list-versions-by-function --function-name fn`	List published versions
`aws lambda delete-function --function-name fn`	Permanently delete a function

ECR Container Images

Authenticate Docker against a registry with aws ecr get-login-password --region eu-central-1 piped into docker login --username AWS --password-stdin 123456789012.dkr.ecr.eu-central-1.amazonaws.com. Container commands are in the Docker cheatsheet .

Command	Description
`aws ecr get-login-password --region eu-central-1`	Print a registry password for Docker
`aws ecr describe-repositories`	List repositories
`aws ecr create-repository --repository-name app`	Create a repository
`aws ecr list-images --repository-name app`	List image tags and digests
`aws ecr describe-images --repository-name app`	Show image size and push date
`aws ecr batch-delete-image --repository-name app --image-ids imageTag=old`	Delete an image
`aws ecr delete-repository --repository-name app --force`	Permanently delete a repository and its images

aws s3 Commands: cp, sync, ls, and rm Examples

hello@linuxize.com (Linuxize) — Fri, 31 Jul 2026 10:10:00 +0200

Uploading a file to Amazon S3 through the web console works fine once. The tenth time, or the first time you need to move a whole directory tree, you want it in your shell history instead. The aws s3 command group gives you familiar Unix-style operations for S3: ls to list, cp to copy, sync to mirror directories, and rm to delete.

This guide shows practical examples of the most used aws s3 commands, including recursive copies, include and exclude filters, and safe deletion with --dryrun.

Prerequisites

The examples require AWS CLI version 2 and an identity with permission to access the S3 resources you use. If the CLI is not ready yet, follow our guide on installing and configuring the AWS CLI on Linux .

Confirm that the CLI can authenticate to your account with:

Terminal
aws sts get-caller-identity

If the command prints your account ID and IAM identity, authentication is working. Individual S3 commands can still return AccessDenied when that identity lacks the required bucket or object permissions.

The AWS CLI has two command groups for S3. The aws s3 group used in this guide provides high-level file operations. The aws s3api group exposes the raw API, one call per operation, and is only needed for tasks such as managing bucket policies or object versions.

S3 paths use the form s3://bucket-name/key. The general command structure is:

txt
aws s3 <subcommand> [ARGUMENTS] [OPTIONS]

Commands such as cp, mv, and sync take source and destination arguments. The remaining commands operate on one S3 path, except aws s3 ls, which can omit the path to list every bucket.

Listing Buckets and Objects

Run aws s3 ls with no arguments to list all buckets in the account:

Terminal
aws s3 ls

output

2025-11-04 09:12:33 my-bucket
2026-01-15 17:40:21 my-site-backups

To list the contents of a bucket, pass the bucket path:

Terminal
aws s3 ls s3://my-bucket

output

 PRE logs/
2026-02-10 08:30:12 1048576 backup.tar.gz
2026-02-11 09:02:44 4523 notes.txt

Entries marked PRE are prefixes, the S3 equivalent of directories. To look inside one, append it to the path with a trailing slash, for example aws s3 ls s3://my-bucket/logs/.

Add --recursive to walk the whole bucket, and combine it with --human-readable and --summarize to get readable sizes and totals:

Terminal
aws s3 ls s3://my-bucket --recursive --human-readable --summarize

output

2026-02-10 08:30:12 1.0 MiB backup.tar.gz
2026-02-11 09:02:44 4.4 KiB notes.txt
2026-02-12 06:15:09 12.7 MiB logs/app.log
Total Objects: 3
Total Size: 13.7 MiB

The summary at the bottom shows the count and combined size of the current objects listed under the bucket or prefix. It does not include noncurrent versions in a versioned bucket.

Uploading and Downloading Files with cp

The cp subcommand copies files between your machine and S3, in either direction. To upload a file to a bucket:

Terminal
aws s3 cp backup.tar.gz s3://my-bucket/

output

upload: ./backup.tar.gz to s3://my-bucket/backup.tar.gz

The object keeps its original name. To store it under a different key, spell out the full target path:

Terminal
aws s3 cp backup.tar.gz s3://my-bucket/backups/backup-2026-02-10.tar.gz

Downloading works the same way with the arguments reversed. The . target saves the file into the current directory:

Terminal
aws s3 cp s3://my-bucket/backup.tar.gz .

You can also copy directly between two buckets. The transfer happens inside AWS, so the data does not pass through your machine:

Terminal
aws s3 cp s3://my-bucket/backup.tar.gz s3://my-site-backups/backup.tar.gz

Copying Directories

To copy a directory and everything under it, add --recursive:

Terminal
aws s3 cp ./logs s3://my-bucket/logs --recursive

When you only want some of the files, combine --exclude and --include. The filters are evaluated in the order given, and the later filter wins, so the usual pattern is to exclude everything and then include what you want:

Terminal
aws s3 cp ./logs s3://my-bucket/logs --recursive --exclude "*" --include "*.log"

This uploads only the .log files and skips everything else in the directory.

The most useful cp options:

--recursive - Copy all files under a directory or prefix.
--exclude / --include - Filter files by pattern; later filters override earlier ones.
--storage-class - Choose the destination storage class, for example STANDARD_IA for backups accessed infrequently.
--dryrun - Print what would be copied without transferring anything.

Streaming to and from S3

The cp command accepts - as a stand-in for standard input or output, which lets you pipe data straight to a bucket without a temporary file:

Terminal
pg_dump mydb | gzip | aws s3 cp - s3://my-bucket/backups/mydb.sql.gz

Reading works the same way in reverse. This prints an object to standard output where you can pipe it further:

Terminal
aws s3 cp s3://my-bucket/backups/mydb.sql.gz - | gunzip | head

Moving and Renaming Objects with mv

Amazon S3 does not rename an object in place. The mv command copies the source to the new key and then deletes the source, so preview the operation before running it:

Terminal
aws s3 mv s3://my-bucket/report-draft.pdf s3://my-bucket/report-final.pdf --dryrun

Check both paths carefully, then run the command again without --dryrun. The same command can move files between your machine and S3 or between two buckets.

Synchronizing Directories with sync

Where cp --recursive copies everything every time, sync transfers files that are missing, differ in size, or have a newer source modification time. To mirror a local directory to a bucket:

Terminal
aws s3 sync ./website s3://my-bucket/website

Run it again immediately and nothing is transferred, because both sides already match. This makes sync the right tool for repeated jobs such as publishing a static site or shipping nightly backups.

The reverse direction downloads new and changed objects from the bucket:

Terminal
aws s3 sync s3://my-bucket/website ./website

Syncing between two buckets also works: aws s3 sync s3://my-bucket s3://my-site-backups.

By default, sync never deletes anything. Files removed from the source remain on the target. To make the target an exact mirror, add --delete, but preview the result first because deleted objects are gone for good:

Terminal
aws s3 sync ./website s3://my-bucket/website --delete --dryrun

output

(dryrun) upload: website/index.html to s3://my-bucket/website/index.html
(dryrun) delete: s3://my-bucket/website/old-page.html

Every line is prefixed with (dryrun), so nothing has happened yet. Review the delete: lines, and when the plan looks right, run the same command without --dryrun.

The same --exclude and --include filters from cp apply here. A common one keeps repository metadata out of the bucket:

Terminal
aws s3 sync ./website s3://my-bucket/website --exclude ".git/*"

Because sync is idempotent, it pairs well with a scheduled job. See our guide on scheduling cron jobs with crontab if you want to run a sync every night.

Deleting Objects with rm

To delete a single object, pass its full path:

Terminal
aws s3 rm s3://my-bucket/old-backup.tar.gz

output

delete: s3://my-bucket/old-backup.tar.gz

Warning

There is no trash bin in S3. Unless the bucket has versioning enabled, a deleted object cannot be recovered. Always test recursive deletions with --dryrun first.

To delete everything under a prefix, add --recursive and preview the damage before committing:

Terminal
aws s3 rm s3://my-bucket/logs/ --recursive --dryrun

If the listed objects are the ones you expect, run the command again without --dryrun to perform the deletion.

On buckets with versioning enabled, rm only inserts a delete marker; previous versions remain and continue to incur storage costs. Removing versions permanently requires the aws s3api delete-object call with a version ID.

Creating and Removing Buckets

The mb (make bucket) subcommand creates a new bucket. General purpose bucket names must be unique across AWS accounts and Regions within an AWS partition, so pick something difficult to collide with:

Terminal
aws s3 mb s3://my-unique-bucket-name --region eu-central-1

The rb (remove bucket) subcommand deletes a bucket, but only when it is empty:

Terminal
aws s3 rb s3://my-unique-bucket-name

Adding --force deletes the current objects in an unversioned bucket and then removes the bucket. It does not permanently delete object versions or delete markers, so removal fails when a versioned bucket still contains them. Treat --force with the same caution as rm --recursive.

Generating Temporary Download Links

Sometimes you need to hand a file to someone without making the bucket public. The presign subcommand generates a URL that grants temporary access to a single object:

Terminal
aws s3 presign s3://my-bucket/report.pdf --expires-in 3600

The command prints a long URL that anyone can use to download the object for the next hour (3600 seconds). The default lifetime is one hour, and the maximum is seven days. A URL signed with temporary credentials expires when those credentials expire, even when --expires-in requests a later time.

Quick Reference

For a printable quick reference, see the AWS CLI cheatsheet .

Task	Command
List all buckets	`aws s3 ls`
List bucket contents	`aws s3 ls s3://bucket`
List recursively with totals	`aws s3 ls s3://bucket --recursive --summarize`
Upload a file	`aws s3 cp file.txt s3://bucket/`
Download a file	`aws s3 cp s3://bucket/file.txt .`
Upload a directory	`aws s3 cp ./dir s3://bucket/dir --recursive`
Preview renaming an object	`aws s3 mv s3://bucket/old.txt s3://bucket/new.txt --dryrun`
Mirror a directory	`aws s3 sync ./dir s3://bucket/dir`
Preview removing stale files during a mirror	`aws s3 sync ./dir s3://bucket/dir --delete --dryrun`
Delete an object	`aws s3 rm s3://bucket/file.txt`
Preview deleting a prefix	`aws s3 rm s3://bucket/dir/ --recursive --dryrun`
Create a bucket	`aws s3 mb s3://bucket`
Remove an empty bucket	`aws s3 rb s3://bucket`
Temporary download link	`aws s3 presign s3://bucket/file.txt`

FAQ

What is the difference between cp –recursive and sync?
cp --recursive copies every file on every run. sync compares both sides and transfers only new or changed files, which is faster and cheaper for repeated jobs.

Can I use shell wildcards in S3 paths?
No. The AWS CLI does not interpret Unix-style wildcards in an S3 path such as s3://bucket/*.log. Use --recursive together with --exclude and --include filters instead.

How do I delete all files in a bucket?
For an unversioned bucket, preview aws s3 rm s3://bucket --recursive --dryrun, then remove --dryrun to empty it. The aws s3 rb s3://bucket --force command can empty and remove an unversioned bucket in one step, but it fails when object versions or delete markers remain.

Conclusion

Make --dryrun a habit before mv, recursive rm, or sync --delete, then reuse the reviewed commands in your scripts and scheduled jobs.

How to Install and Configure the AWS CLI on Linux

hello@linuxize.com (Linuxize) — Thu, 30 Jul 2026 09:20:00 +0200

Clicking through the AWS console works for a one-off task, but the moment you manage instances, buckets, or DNS records regularly, you want those actions in your shell history and your scripts. The AWS CLI puts every AWS API behind a single aws command, so listing instances, syncing a bucket, or rotating a key becomes a one-liner you can repeat and automate.

This guide explains how to install AWS CLI version 2 on Linux, authenticate with short-term credentials, manage named profiles, and verify that your setup can access your AWS account.

Installing AWS CLI Version 2

AWS maintains an install script that downloads, verifies, and installs the current AWS CLI release. It detects whether your Linux system uses an x86_64 or ARM processor, so the same command works on both architectures:

Terminal
curl -fsSL https://awscli.amazonaws.com/v2/install.sh | bash

The script installs the program for your user under ~/.local/share/aws-cli and creates ~/.local/bin/aws. This avoids requiring root access. Open a new terminal after installation, then verify the version:

Terminal
aws --version

The first part of the output should begin with aws-cli/2.. The remaining version and system details depend on the current release and your Linux distribution.

To install the CLI for every user instead, run the installer in system mode:

Terminal
curl -fsSL https://awscli.amazonaws.com/v2/install.sh | sudo bash -s -- --system

System mode installs the files under /usr/local/aws-cli and creates the command links in /usr/local/bin.

When a newer release is available, update a per-user installation with:

Terminal
aws update

Use sudo aws update if you installed the CLI in system mode.

Configuring AWS CLI Authentication

AWS recommends short-term credentials for people and workloads. The best configuration method depends on how your AWS account manages identities:

Use aws login when you already sign in to the AWS Management Console with an IAM or federated identity.
Use aws configure sso when your organization uses AWS IAM Identity Center.
Use aws configure with an IAM access key only when neither short-term method is available.

Do not configure the CLI with root-user access keys. Use a non-root identity with only the permissions required for your work.

Signing In with AWS Console Credentials

AWS CLI version 2.32.0 and later supports aws login , which exchanges an existing console session for temporary credentials. Your AWS administrator must allow local developer sign-in for the identity. Start the browser-based flow with:

Terminal
aws login

The CLI asks for a default Region if one is not already configured, then opens your browser. Select the console session and identity you want to use. AWS stores the temporary session under ~/.aws/login/cache and refreshes its credentials while the session remains valid.

To create or sign in to a named profile, add --profile:

Terminal
aws login --profile work

On a remote Linux server without a browser, use the cross-device flow:

Terminal
aws login --remote

When the session reaches its maximum duration, run aws login again. You can end it earlier with aws logout.

Configuring IAM Identity Center

If your organization provides an AWS access portal, follow the IAM Identity Center configuration instead of using aws login. Run the setup wizard with a descriptive profile name:

Terminal
aws configure sso --profile work

The wizard asks for the SSO session name, start or issuer URL, SSO Region, account, permission set, default Region, and output format. It opens a browser so you can authorize the session.

Terminal
aws sso login --profile work

IAM Identity Center stores the profile settings in ~/.aws/config and caches its tokens under ~/.aws/sso/cache.

Configuring an IAM Access Key

Some legacy tools and workloads still require a long-term access key. If you cannot use temporary credentials, create the key for a dedicated IAM user with least-privilege permissions, then configure a named profile:

Terminal
aws configure --profile legacy

output

AWS Access Key ID [None]: <your-access-key-id>
AWS Secret Access Key [None]: <your-secret-access-key>
Default region name [None]: eu-central-1
Default output format [None]: json

Choose the Region where most of your resources run. JSON is a practical default output format for scripts, while table is easier to scan interactively.

The CLI writes access keys to ~/.aws/credentials and other settings to ~/.aws/config.

Warning

Never commit access keys, paste them into scripts, or bake them into images. If a key enters Git history or another public location, deactivate it immediately and create a replacement. Prefer temporary credentials whenever the application supports them.

Verifying the Configuration

Ask AWS Security Token Service which identity the CLI resolved:

Terminal
aws sts get-caller-identity

output

{
"UserId": "AROAXAMPLE:dejan",
"Account": "123456789012",
"Arn": "arn:aws:sts::123456789012:assumed-role/Developer/dejan"
}

The response identifies the account, IAM user, or assumed role behind the current credentials. To test a named profile, add it to the command:

Terminal
aws sts get-caller-identity --profile work

If the call succeeds, authentication works. Individual service commands can still fail when the identity lacks permission for that action.

Working with Named Profiles

Profiles keep settings and credentials for separate accounts or roles from interfering with each other. List the profiles currently available:

Terminal
aws configure list-profiles

Select a profile for one command with --profile:

Terminal
aws s3 ls --profile work

To use the same profile for the rest of the shell session, set AWS_PROFILE:

Terminal
export AWS_PROFILE=work

The default profile is used when neither --profile nor AWS_PROFILE is set. A command-line --profile option overrides the environment variable.

On EC2 instances, ECS tasks, and other AWS compute services, attach an IAM role to the workload instead of storing access keys. For CI systems, use the platform’s OpenID Connect integration to assume an IAM role when available.

Running Your First Commands

The CLI follows a aws <service> <operation> pattern. List your S3 buckets:

Terminal
aws s3 ls

output

2025-11-02 14:11:20 backups-prod
2026-01-01 09:48:03 static-assets

List EC2 instances, trimmed down to the fields you care about with --query:

Terminal
aws ec2 describe-instances \
 --query 'Reservations[].Instances[].{ID:InstanceId,Type:InstanceType,State:State.Name}' \
 --output table

output

-------------------------------------------------
| DescribeInstances |
+----------------------+-----------+------------+
| ID | Type | State |
+----------------------+-----------+------------+
| i-0abcd1234ef567890 | t3.small | running |
| i-0fe9876543ba21001 | t3.micro | stopped |
+----------------------+-----------+------------+

The --query option takes a JMESPath expression and works on every command, which saves you from piping JSON into other tools for simple filtering. The --output option switches between json, yaml, text, and table per invocation.

Every service has built-in help, so aws s3 help and aws ec2 describe-instances help open the relevant manual pages without leaving the terminal.

Enabling Command Completion

The installer includes aws_completer, which suggests services, operations, and options when you press Tab. Confirm that your shell can find it:

Terminal
command -v aws_completer

The path is usually ~/.local/bin/aws_completer for a per-user installation or /usr/local/bin/aws_completer for a system installation.

For Bash, add this line to ~/.bashrc:

~/.bashrcsh
complete -C "$(command -v aws_completer)" aws

Reload the file:

Terminal
source ~/.bashrc

For Zsh, add these lines to ~/.zshrc:

~/.zshrcsh
autoload bashcompinit && bashcompinit
complete -C "$(command -v aws_completer)" aws

Then reload the Zsh configuration:

Terminal
source ~/.zshrc

Troubleshooting

aws: command not found
For a per-user installation, ~/.local/bin may be missing from PATH. Add export PATH="$HOME/.local/bin:$PATH" to ~/.bashrc or ~/.zshrc, reload the file, and run aws --version again. For a system installation, check that /usr/local/bin is in PATH.

Unable to locate credentials
No authentication method is configured, or AWS_PROFILE points to a profile that does not exist. Run aws configure list to see where the CLI is looking and what it found.

ExpiredToken after aws login
An older access key in ~/.aws/credentials can take precedence over login credentials for the same profile. Run aws configure list, remove the stale key entries for that profile, and sign in again.

An error occurred (InvalidClientTokenId)
For an access-key profile, the key is inactive, deleted, or mistyped. Replace it in IAM and run aws configure --profile <profile-name> again.

An error occurred (UnauthorizedOperation) or AccessDenied
The credentials are valid, but the current identity lacks permission for that action. Ask your AWS administrator to grant the required permission through the relevant role, permission set, or IAM policy.

Could not connect to the endpoint URL
Check the configured Region with aws configure get region. A value such as eu-central1 is invalid; the correct format is eu-central-1.

Conclusion

With AWS CLI version 2 installed and aws sts get-caller-identity returning the expected account, you can start using service commands without storing long-lived credentials. For day-to-day bucket work, see our guide on the aws s3 commands , and if you want those syncs on a schedule, our guide on using cron to schedule jobs .

How to Install Kubernetes with kubeadm on Ubuntu 26.04

hello@linuxize.com (Linuxize) — Wed, 29 Jul 2026 09:40:00 +0200

When you outgrow a single Docker host and need to run containers across several machines with rolling updates, self-healing, and service discovery built in, Kubernetes is the standard answer. The kubeadm tool provides a minimal upstream method for bootstrapping a self-managed cluster on plain Linux servers.

This guide explains how to set up Kubernetes 1.36 on Ubuntu 26.04 using kubeadm, kubelet, and kubectl from the Kubernetes apt repository, with containerd as the container runtime. By the end you will have a control-plane node, one or more worker nodes, and a test workload running across the cluster.

Quick Reference

Task	Command
Disable swap	`sudo swapoff -a`
Install containerd	`sudo apt install -y containerd`
Add Kubernetes apt key	`curl -fsSL https://pkgs.k8s.io/core:/stable:/v1.36/deb/Release.key \| sudo gpg --dearmor -o /etc/apt/keyrings/kubernetes-apt-keyring.gpg`
Install kube tools	`sudo apt install -y kubelet kubeadm kubectl`
Hold kube versions	`sudo apt-mark hold kubelet kubeadm kubectl`
Init control plane	`sudo kubeadm init --pod-network-cidr=10.244.0.0/16`
Configure kubectl	`mkdir -p ~/.kube && sudo cp /etc/kubernetes/admin.conf ~/.kube/config && sudo chown $(id -u):$(id -g) ~/.kube/config`
Get nodes	`kubectl get nodes`
Get pods (all namespaces)	`kubectl get pods -A`
Generate join command	`sudo kubeadm token create --print-join-command`

Prerequisites

Before starting, make sure you have:

Two or more servers running Ubuntu 26.04 with at least 2 GB of RAM each. The control-plane node needs at least 2 CPUs.
A user with sudo privileges on each server.
Full network connectivity between the nodes and Internet access for downloading packages and container images.
A stable IP address plus a unique hostname, MAC address, and product UUID on every node.

The same instructions apply to control-plane and worker nodes up to the cluster bootstrap step. Run every command on every node unless the section says otherwise.

If a host or cloud firewall filters traffic between the nodes, allow the required traffic between these sources and destination ports:

Destination	Source	Ports
Control plane API	Cluster nodes and administrators	TCP `6443`
etcd on the control plane	Control-plane nodes only	TCP `2379-2380`
Control-plane kubelet	Control-plane components	TCP `10250`
Scheduler and controller manager	Control-plane node itself	TCP `10257` and `10259`
Worker kubelet	Control-plane nodes	TCP `10250`
kube-proxy health endpoint	Node itself and load balancers that use it	TCP `10256`
NodePort services	Clients that need access	TCP and UDP `30000-32767`
Flannel VXLAN	Other cluster nodes	UDP `8472`

Restrict these rules to trusted cluster and administration networks. Do not expose the etcd or kubelet ports directly to the Internet.

Step 1: Prepare the System

The kubelet refuses to start when swap is active unless you configure it to tolerate swap. This guide uses the default behavior, so turn swap off for the current session and comment out swap entries in /etc/fstab:

Terminal
sudo swapoff -a
sudo sed -i '/[[:space:]]swap[[:space:]]/ s/^[^#]/#&/' /etc/fstab

Check that no active swap devices remain:

Terminal
swapon --show

The command should return no output.

Load the kernel modules required by the container runtime and Kubernetes networking:

Terminal
sudo tee /etc/modules-load.d/k8s.conf <<EOF
overlay
br_netfilter
EOF

sudo modprobe overlay
sudo modprobe br_netfilter

Confirm that both modules are loaded:

Terminal
lsmod | grep -E 'br_netfilter|overlay'

Enable the sysctl settings that allow iptables to see bridged traffic and let IP forwarding work:

Terminal
sudo tee /etc/sysctl.d/k8s.conf <<EOF
net.bridge.bridge-nf-call-iptables = 1
net.bridge.bridge-nf-call-ip6tables = 1
net.ipv4.ip_forward = 1
EOF

sudo sysctl --system

Verify the two main networking settings:

Terminal
sysctl net.ipv4.ip_forward net.bridge.bridge-nf-call-iptables

Both values should be 1.

Step 2: Install containerd

Kubernetes uses the Container Runtime Interface (CRI) to communicate with a container runtime. Ubuntu 26.04 provides containerd 2.x in its repositories:

Terminal
sudo apt update
sudo apt install -y containerd

If Docker is already installed from the official Docker repository, the containerd.io package provides the same runtime and conflicts with the containerd package. Skip the install above and continue with the configuration below.

Generate a complete containerd configuration, then enable the systemd cgroup driver so it matches the kubelet configuration created by kubeadm:

Terminal
sudo mkdir -p /etc/containerd
containerd config default | sudo tee /etc/containerd/config.toml > /dev/null
sudo sed -i 's/SystemdCgroup = false/SystemdCgroup = true/' /etc/containerd/config.toml
sudo systemctl restart containerd
sudo systemctl enable containerd

Confirm that the service is running and the setting is present:

Terminal
systemctl is-active containerd
sudo grep 'SystemdCgroup = true' /etc/containerd/config.toml

The first command should print active, and the second should show the enabled cgroup setting.

Step 3: Add the Kubernetes apt Repository

Kubernetes publishes a separate package repository for every minor release. This guide follows the supported v1.36 series, and apt installs the newest patch release available in that repository.

Install the prerequisites and download the signing key:

Terminal
sudo apt install -y apt-transport-https ca-certificates curl gpg
sudo mkdir -p -m 755 /etc/apt/keyrings
curl -fsSL https://pkgs.k8s.io/core:/stable:/v1.36/deb/Release.key | sudo gpg --dearmor -o /etc/apt/keyrings/kubernetes-apt-keyring.gpg

Add the repository:

Terminal
echo "deb [signed-by=/etc/apt/keyrings/kubernetes-apt-keyring.gpg] https://pkgs.k8s.io/core:/stable:/v1.36/deb/ /" | sudo tee /etc/apt/sources.list.d/kubernetes.list

Refresh the package index:

Terminal
sudo apt update

Step 4: Install kubelet, kubeadm, and kubectl

Install the three Kubernetes tools and pin their versions so an apt upgrade does not change them by accident:

Terminal
sudo apt install -y kubelet kubeadm kubectl
sudo apt-mark hold kubelet kubeadm kubectl

Confirm the install:

Terminal
kubeadm version
kubelet --version
kubectl version --client

The apt-mark hold flag is important because Kubernetes upgrades follow a specific procedure (kubeadm upgrade), and a casual apt upgrade could break the cluster.

The kubelet may restart repeatedly at this point because it does not have a cluster configuration yet. This is expected and stops after kubeadm init or kubeadm join configures the node.

Step 5: Initialize the Control Plane

Run the next two steps only on the control-plane node.

Warning

This procedure creates one control-plane node, so the cluster is not highly available. For production workloads that must survive a control-plane failure, design a multi-control-plane cluster with a load balancer and a shared --control-plane-endpoint before initialization.

Pick a CIDR for the pod network that does not overlap with your host network. The example uses 10.244.0.0/16, which is the default for Flannel. Bootstrap the cluster:

Terminal
sudo kubeadm init --pod-network-cidr=10.244.0.0/16

The command pulls the control-plane container images, generates certificates, writes the kubeconfig files under /etc/kubernetes/, and starts the static pods for the API server, controller manager, scheduler, and etcd. When it finishes you will see a block similar to this:

output

Your Kubernetes control-plane has initialized successfully!
To start using your cluster, you need to run the following as a regular user:
mkdir -p $HOME/.kube
sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config
sudo chown $(id -u):$(id -g) $HOME/.kube/config
Then you can join any number of worker nodes by running the following on each as root:
kubeadm join 192.168.1.10:6443 --token abcdef.0123456789abcdef \
--discovery-token-ca-cert-hash sha256:1234...

Copy the join command somewhere safe. The bootstrap token is a credential that allows a node to authenticate while joining the cluster, so do not publish or share it with untrusted users.

Set up the kubeconfig for your sudo user so kubectl works without root:

Terminal
mkdir -p $HOME/.kube
sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config
sudo chown $(id -u):$(id -g) $HOME/.kube/config

The copied admin.conf grants cluster administrator access. Keep ~/.kube/config private and do not distribute it as a general user credential.

Verify that the API server is reachable:

Terminal
kubectl get nodes

The output lists the control-plane node with a status of NotReady. The status changes to Ready after you install a pod network in the next step.

Step 6: Install a Pod Network

Pods cannot communicate until the cluster has a network plugin. Flannel is one of the simplest options that works with the default 10.244.0.0/16 CIDR:

Terminal
kubectl apply -f https://github.com/flannel-io/flannel/releases/latest/download/kube-flannel.yml

Watch the system pods come up:

Terminal
kubectl get pods -n kube-flannel
kubectl get pods -n kube-system
kubectl get nodes

After a minute or so, the Flannel and core system pods should report Running, and the control-plane node should show Ready.

If you prefer Calico, Cilium, or another CNI plugin, install it now instead of Flannel and pass the matching --pod-network-cidr value to kubeadm init.

Step 7: Join Worker Nodes

Run this step on each worker node.

Use the kubeadm join command that was printed at the end of kubeadm init. If you lost it or the token has expired (tokens are valid for 24 hours by default), generate a new one on the control-plane node:

Terminal
sudo kubeadm token create --print-join-command

Then run the printed command on the worker:

Terminal
sudo kubeadm join 192.168.1.10:6443 --token <token> \
 --discovery-token-ca-cert-hash sha256:<hash>

Back on the control-plane node, verify that the new node has joined:

Terminal
kubectl get nodes

The output now lists the worker. It moves from NotReady to Ready once the kubelet finishes its registration and the network plugin reports healthy.

Step 8: Test the Cluster

Deploy a small workload to confirm the cluster schedules pods and that networking is working:

Terminal
kubectl create deployment nginx-test --image=nginx
kubectl expose deployment nginx-test --port=80 --type=NodePort
kubectl rollout status deployment/nginx-test
kubectl get pods,svc

The output shows the nginx-test pod in the Running state and a NodePort service with a port in the 30000-32767 range:

output

NAME READY STATUS RESTARTS AGE
pod/nginx-test-7b7bf6d9b8-8pxnf 1/1 Running 0 25s
NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE
service/nginx-test NodePort 10.105.10.123 <none> 80:31234/TCP 12s

Open http://<node_ip>:<nodeport> in a browser and you should see the Nginx welcome page. Tear the demo down once you confirm it works:

Terminal
kubectl delete service nginx-test
kubectl delete deployment nginx-test

Troubleshooting

kubeadm init fails with “container runtime is not running”
containerd is not running, or its CRI plugin is disabled. Inspect the service with sudo systemctl status containerd --no-pager and check /etc/containerd/config.toml for a disabled_plugins entry containing cri. Remove cri from that list, confirm that SystemdCgroup = true, and restart the service with sudo systemctl restart containerd.

Nodes stay NotReady after init
The pod network is not installed or the CNI pods are crashing. Run kubectl get pods -n kube-flannel and kubectl logs -n kube-flannel daemonset/kube-flannel-ds --tail=50 to inspect Flannel. Confirm that the --pod-network-cidr passed to kubeadm init matches the CIDR expected by the CNI plugin.

Cgroup driver mismatch warning in kubelet logs
The kubelet uses systemd and the runtime uses cgroupfs, or vice versa. Edit /etc/containerd/config.toml, set SystemdCgroup = true, and restart containerd. Restart the kubelet with sudo systemctl restart kubelet.

The connection to the server localhost:8080 was refused
kubectl is reading the wrong kubeconfig. Run kubectl config view to confirm the current context, and make sure ~/.kube/config exists for the user running the command. On the control-plane node, copy /etc/kubernetes/admin.conf to ~/.kube/config and fix ownership.

Worker join times out
The control-plane host is not reachable from the worker on TCP port 6443, or the token has expired. Confirm the route and firewall rules, then run sudo kubeadm token create --print-join-command on the control plane to generate a fresh join command.

The Nginx NodePort does not respond
The workload can be healthy while a host or cloud firewall blocks the assigned NodePort. Read the port from kubectl get service nginx-test, then allow that TCP port only from the client network that needs access.

FAQ

Do I still need Docker?
No. Kubernetes communicates with container runtimes through the CRI, and containerd is enough for this cluster. Kubernetes 1.24 removed the built-in Docker integration known as dockershim. If you also want to build images on the same host, install Docker as a separate tool. See How to Install Docker on Ubuntu 26.04 for the build environment.

Why is swap disabled?
The kubelet refuses to start by default when it detects active swap. Kubernetes can use swap with an explicit kubelet configuration, but disabling it keeps this installation aligned with the default behavior.

Can I run a single-node cluster on the control plane?
Yes. Remove the control-plane taint with kubectl taint nodes --all node-role.kubernetes.io/control-plane-. After that, the scheduler places workload pods on the control-plane node.

How do I upgrade Kubernetes later?
Follow the kubeadm node upgrade procedure and move through one minor version at a time. The process includes upgrading kubeadm, running kubeadm upgrade plan and kubeadm upgrade apply, then upgrading the kubelet and kubectl. The package holds prevent these components from changing during a routine apt upgrade.

Next Steps

You now have a working Kubernetes cluster on Ubuntu 26.04. From here you can deploy applications with manifests or Helm charts, set up an ingress controller, and add storage classes that match your environment. For a single-node lab on the same host, an alternative is to start with k3s or minikube and migrate to a kubeadm cluster as your needs grow.

update-alternatives Command on Ubuntu and Debian

hello@linuxize.com (Linuxize) — Mon, 27 Jul 2026 09:10:00 +0200

When several installed programs provide the same command, you need a reliable way to choose which one runs by default. Hard-coding paths in scripts or rebuilding symbolic links by hand makes that choice difficult to maintain.

On Ubuntu, Debian, and their derivatives, the update-alternatives command manages these selections through symbolic links in /etc/alternatives. This guide explains how to inspect alternative groups, switch programs interactively or from a script, register new choices, and return a group to automatic mode.

How It Works

update-alternatives maintains link groups. Each group has a generic command name and one or more registered program paths. For example, the java group controls which installed Java runtime /usr/bin/java starts.

The generic command is not linked directly to the selected program. Instead, /usr/bin/java points to /etc/alternatives/java, which points to the active Java binary. You can read our symbolic links guide for more about this two-step link structure.

Each group operates in one of two modes:

Automatic mode selects the registered alternative with the highest priority.
Manual mode keeps the administrator’s selection until it is changed explicitly or becomes invalid.

The command stores its administrative state under /var/lib/dpkg/alternatives.

Syntax

The general command syntax is:

txt
update-alternatives [OPTIONS] COMMAND

Commands that change an alternative group require sudo. Listing and displaying alternatives does not.

List Alternative Groups

To see every master alternative group registered on the system, run:

Terminal
update-alternatives --get-selections

output

awk auto /usr/bin/mawk
editor auto /bin/nano
pager auto /bin/more
vi auto /usr/bin/vim.basic

The second column shows whether the group is in auto or manual mode. The final column contains the selected program path. Your groups and paths will differ according to the packages installed on your system.

To list only the registered paths for one group, pass its name to --list:

Terminal
update-alternatives --list java

output

/usr/lib/jvm/java-17-openjdk-amd64/bin/java
/usr/lib/jvm/java-21-openjdk-amd64/bin/java

This example has Java 17 and Java 21 registered. If the named group does not exist, the command reports that no alternatives are registered for it.

Display an Alternative

To see all registered options for a specific alternative and which one is currently active:

Terminal
update-alternatives --display java

output

java - auto mode
link best version is /usr/lib/jvm/java-21-openjdk-amd64/bin/java
link currently points to /usr/lib/jvm/java-21-openjdk-amd64/bin/java
link java is /usr/bin/java
slave java.1.gz is /usr/share/man/man1/java.1.gz
/usr/lib/jvm/java-17-openjdk-amd64/bin/java - priority 1711
slave java.1.gz: /usr/lib/jvm/java-17-openjdk-amd64/man/man1/java.1.gz
/usr/lib/jvm/java-21-openjdk-amd64/bin/java - priority 2111
slave java.1.gz: /usr/lib/jvm/java-21-openjdk-amd64/man/man1/java.1.gz

The output lists each registered path with its priority. In auto mode, the highest priority wins. The slave lines show related files that follow the same selection, in this case the java manual page.

Switch Between Alternatives

To choose interactively from the registered options, run:

Terminal
sudo update-alternatives --config java

output

There are 2 choices for the alternative java (providing /usr/bin/java).
Selection Path Priority Status
------------------------------------------------------------
* 0 /usr/lib/jvm/java-21-openjdk-amd64/bin/java 2111 auto mode
1 /usr/lib/jvm/java-17-openjdk-amd64/bin/java 1711 manual mode
2 /usr/lib/jvm/java-21-openjdk-amd64/bin/java 2111 manual mode
Press <enter> to keep the current choice[*], or type selection number: 1

Type the number of a manual choice and press Enter to pin that version. Selecting 0 keeps or restores automatic mode, while pressing Enter without a number keeps the current choice.

When a group is in manual mode, a package installation can register another choice but will not replace your valid selection.

Set an Alternative Noninteractively

The --set command changes an alternative without displaying a menu, which makes it useful in provisioning scripts. Use --list as shown above to copy the exact path, then pass it to --set:

Terminal
sudo update-alternatives --set java /usr/lib/jvm/java-17-openjdk-amd64/bin/java

The selected group enters manual mode. The path must already be registered in that group.

Alternative groups are independent unless their provider registered related files as slave links. For example, switching the java group does not necessarily switch javac. Use --display to check which links belong to a group.

Register a New Alternative

When you install a program outside the package manager, you can register it with --install. Assume two releases of a program are installed at /opt/acme-tool-1.0/bin/acme-tool and /opt/acme-tool-2.0/bin/acme-tool. Confirm that both executable paths exist before registering them:

Terminal
ls -l /opt/acme-tool-1.0/bin/acme-tool /opt/acme-tool-2.0/bin/acme-tool

Terminal
sudo update-alternatives --install /usr/local/bin/acme-tool acme-tool /opt/acme-tool-1.0/bin/acme-tool 100
sudo update-alternatives --install /usr/local/bin/acme-tool acme-tool /opt/acme-tool-2.0/bin/acme-tool 200

The arguments are:

txt
--install LINK NAME PATH PRIORITY

LINK is the path where the generic command link will be created (/usr/local/bin/acme-tool).
NAME is the alternative group name (acme-tool).
PATH is the actual binary (/opt/acme-tool-1.0/bin/acme-tool).
PRIORITY is the numeric weight used in auto mode (higher wins).

In this example, automatic mode selects version 2.0 because it has the higher priority.

Warning

Do not use update-alternatives to replace /usr/bin/python3 on Ubuntu or Debian. System tools depend on the distribution’s default Python interpreter. Use versioned commands, virtual environments, pyenv, or a separate command under /usr/local/bin instead.

Remove an Alternative

Before removing a registered path, display the group and confirm the exact path:

Terminal
update-alternatives --display acme-tool

Then deregister the path:

Terminal
sudo update-alternatives --remove acme-tool /opt/acme-tool-1.0/bin/acme-tool

The command removes the path from the alternatives database but does not delete the program itself. If you remove the active path, the group returns to automatic mode and selects the best remaining alternative.

Reset to Auto Mode

If you manually pinned an alternative and want to go back to automatic selection by priority:

Terminal
sudo update-alternatives --auto java

The system returns to the highest-priority option.

Switch the Editor Alternative

The editor alternative provides the system-wide /usr/bin/editor command. Programs that invoke this path follow the selected alternative, while tools such as sensible-editor may honor user-specific settings and environment variables first. To switch the system editor choice:

Terminal
sudo update-alternatives --config editor

Select an installed editor such as vim.basic from the list. Applications with their own editor setting do not necessarily follow this choice. Git, for example, checks GIT_EDITOR, core.editor, VISUAL, and EDITOR before using its compiled default.

Quick Reference

Task	Command
List all alternative groups	`update-alternatives --get-selections`
List paths in one group	`update-alternatives --list NAME`
Display group details	`update-alternatives --display NAME`
Choose interactively	`sudo update-alternatives --config NAME`
Select a path noninteractively	`sudo update-alternatives --set NAME PATH`
Return to automatic mode	`sudo update-alternatives --auto NAME`
Register a path	`sudo update-alternatives --install LINK NAME PATH PRIORITY`
Deregister a path	`sudo update-alternatives --remove NAME PATH`

Troubleshooting

no alternatives for NAME The group is not registered. Check the available names with update-alternatives --get-selections. Install a package that provides the group or register an existing executable with --install.

alternative path ... does not exist The path passed to --install must already exist. Check it with ls -l PATH, then correct the path or install the program before trying again.

A regular file blocks the alternatives link Do not immediately add --force. Check which package owns the path with dpkg -S /path/to/command, and back up locally installed files before replacing them with an alternatives-managed link.

Conclusion

Use --config for interactive changes, --set for scripts, and --auto when you want priority-based selection again. For a practical example with multiple JDKs, see How to Check Java Version .

How to Convert MP4 to MP3 with ffmpeg

hello@linuxize.com (Linuxize) — Sun, 26 Jul 2026 08:20:00 +0200

A recorded lecture, a podcast published as video, a concert clip you only ever listen to: sometimes all you want from an MP4 is its audio track. ffmpeg does this in one command, with full control over the output quality.

This guide shows how to convert MP4 to MP3 with ffmpeg, pick sensible quality settings, extract audio without any quality loss, and convert files in bulk.

Prerequisites

You need ffmpeg installed. On Ubuntu, Debian, and derivatives:

Terminal
sudo apt update
sudo apt install ffmpeg

These commands install both ffmpeg and ffprobe. For version-specific instructions, see our guides on installing ffmpeg on Ubuntu and Debian .

Converting MP4 to MP3

The simplest form gives ffmpeg an input, selects the LAME MP3 encoder, and names the output file:

Terminal
ffmpeg -i video.mp4 -c:a libmp3lame audio.mp3

This decodes the audio track from video.mp4, encodes it as MP3 with default settings, and writes audio.mp3. The video stream is dropped automatically, since an MP3 file cannot contain one.

For better control, the recommended form adds two options:

Terminal
ffmpeg -i video.mp4 -vn -c:a libmp3lame -q:a 2 audio.mp3

The -vn flag explicitly discards the video stream, -c:a libmp3lame selects the LAME MP3 encoder, and -q:a 2 selects variable bitrate (VBR) quality level 2. This level typically averages around 190 kb/s, although the actual bitrate depends on the audio.

Choosing the Quality

The MP3 encoder accepts a VBR quality scale from 0 (best) to 9 (smallest). These approximate bitrates vary with the source:

-q:a 0 - Around 245 kb/s; highest quality VBR, for music you care about.
-q:a 2 - Around 190 kb/s; the common sweet spot.
-q:a 5 - Around 130 kb/s; fine for speech and podcasts.
-q:a 7 - Around 100 kb/s; small files, audible compression on music.

If you need a constant bitrate instead, for example for a device that struggles with VBR, use -b:a:

Terminal
ffmpeg -i video.mp4 -vn -c:a libmp3lame -b:a 192k audio.mp3

Keep in mind that encoding cannot add quality back: if the source audio is a 96 kb/s stream, encoding it at 320 kb/s only produces a larger file, not a better-sounding one.

Extracting Audio Without Quality Loss

Converting to MP3 always re-encodes, which costs a small amount of quality. If you only need the original audio track, check its codec before deciding whether to convert it:

Terminal
ffprobe -v error -select_streams a:0 -show_entries stream=codec_name -of default=noprint_wrappers=1:nokey=1 video.mp4

output

aac

AAC audio is common in MP4 files and can be copied into an .m4a container without re-encoding:

Terminal
ffmpeg -i video.mp4 -map 0:a:0 -c:a copy audio.m4a

The -map 0:a:0 option selects the first audio stream, and -c:a copy moves the compressed audio without decoding or encoding it. The audio data remains unchanged, and the operation usually finishes much faster than an MP3 conversion. If ffprobe reports another codec, use a compatible container or convert the audio instead.

Converting Part of a File

To convert only a section, combine the conversion with a start time and a duration:

Terminal
ffmpeg -ss 00:05:30 -i video.mp4 -t 00:06:30 -vn -c:a libmp3lame -q:a 2 clip.mp3

The -ss option starts at 5:30, and -t 00:06:30 converts the next six minutes and thirty seconds, ending at 12:00. This is handy for pulling one song out of a concert recording or one answer out of a long interview.

Batch Converting Multiple Files

ffmpeg takes one input at a time, so converting a directory of MP4 files uses a small bash for loop :

Terminal
shopt -s nullglob
for f in *.mp4; do
 ffmpeg -n -i "$f" -vn -c:a libmp3lame -q:a 2 "${f%.mp4}.mp3"
done

The nullglob setting skips the loop when the directory contains no MP4 files. The ${f%.mp4} expansion strips the .mp4 extension so each MP3 keeps the original filename, while -n prevents existing files from being overwritten. The quotes around the variables keep filenames with spaces intact.

Troubleshooting

Unknown encoder ’libmp3lame’
Your ffmpeg build lacks the LAME MP3 encoder, which happens with some minimal or codec-restricted packages. Check for it with ffmpeg -hide_banner -encoders | grep -w libmp3lame, then install an FFmpeg package that includes the encoder.

Output file has no sound
The source may carry multiple audio tracks and the wrong one was picked. Inspect the file with ffprobe -hide_banner video.mp4, then select the track explicitly with -map, for example -map 0:a:1 for the second audio stream.

Could not write the M4A output header
The source audio codec is not compatible with the M4A container. Use a container that supports the original codec, or replace -c:a copy with -c:a aac -b:a 192k to create a compatible M4A file.

The output file already exists
FFmpeg asks before replacing an existing file. Use a different output name, add -n to keep the existing file, or add -y only when you intend to overwrite it.

Conclusion

One command covers the everyday case: ffmpeg -i video.mp4 -vn -c:a libmp3lame -q:a 2 audio.mp3, with -q:a trading size against quality. For more conversion, compression, and inspection examples, see our ffmpeg command guide .

How to Find Which Process Is Using a Port in Linux

hello@linuxize.com (Linuxize) — Sat, 25 Jul 2026 07:30:00 +0200

You start a service, and it refuses to launch with an error like “bind: address already in use”. Something is already holding the port, but the message does not tell you what. Before you can fix it, you need to map the port back to a process, find its PID, and decide whether to stop it. Linux gives you several tools for this, and each one answers the question in a slightly different way.

This guide shows how to find the process using a port with ss, lsof, fuser, and netstat, and how to stop it once you have the PID.

If you need an inventory of every service accepting connections instead of one specific port, see the guide on checking listening ports in Linux . Note that 127.0.0.1:8080 and 0.0.0.0:8080 collide, because binding to all interfaces includes the loopback address .

Quick Reference

For printable quick references, see the ss cheatsheet , lsof cheatsheet , and netstat cheatsheet .

Task	Command
Find a TCP listener with ss	`sudo ss -ltnp 'sport = :80'`
Find a UDP socket with ss	`sudo ss -lunp 'sport = :53'`
Find a TCP listener with lsof	`sudo lsof -nP -iTCP:80 -sTCP:LISTEN`
Find processes with fuser	`sudo fuser -v 80/tcp`
Find a TCP listener with netstat	`sudo netstat -ltnp \| grep ':80 '`
Inspect a process	`ps -fp PID`
Stop an unmanaged process	`sudo kill PID`
Send SIGTERM with fuser	`sudo fuser -k -TERM 80/tcp`

Finding the Process with ss

The ss command is the standard choice on current Linux distributions. It comes from the iproute2 package and supports filters that match an exact port without piping the output through another command.

Terminal
sudo ss -ltnp 'sport = :80'

output

State Recv-Q Send-Q Local Address:Port Peer Address:Port Process
LISTEN 0 511 0.0.0.0:80 0.0.0.0:* users:(("nginx",pid=1433,fd=6),("nginx",pid=1432,fd=6))
LISTEN 0 511 [::]:80 [::]:* users:(("nginx",pid=1433,fd=6),("nginx",pid=1432,fd=6))

Run the command with sudo so ss can show process details for sockets owned by other users. The options provide the following information:

-l - Show only listening sockets.
-t - Show TCP sockets.
-n - Print numeric port numbers instead of resolving service names.
-p - Show the process that owns each socket.

The sport = :80 expression matches local port 80 exactly, so it does not also return ports such as 8080. In the output above, nginx holds the port. The Process column lists two process IDs because the master process, 1432, opened the socket and passed it to its worker, 1433. Either PID leads you back to the same service. The two rows show that nginx listens on both IPv4 and IPv6.

UDP sockets do not use the TCP LISTEN state. To check a UDP port, replace -t with -u. For example, the following command identifies the process bound to UDP port 53:

Terminal
sudo ss -lunp 'sport = :53'

output

State Recv-Q Send-Q Local Address:Port Peer Address:Port Process
UNCONN 0 0 0.0.0.0:53 0.0.0.0:* users:(("dnsmasq",pid=902,fd=4))

The UNCONN state is normal for a UDP server because UDP does not establish connections before exchanging data.

Finding the Process with lsof

The lsof command lists open files, including network sockets. Use numeric output and restrict the result to TCP listeners on the port:

Terminal
sudo lsof -nP -iTCP:80 -sTCP:LISTEN

output

COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
nginx 1432 root 6u IPv4 28319 0t0 TCP *:80 (LISTEN)
nginx 1433 www-data 6u IPv4 28319 0t0 TCP *:80 (LISTEN)

The -nP options prevent hostname and service-name lookups, while -iTCP:80 selects TCP port 80 and -sTCP:LISTEN excludes established connections. The output reports the command, PID, user, and file descriptor. Here lsof gives you the same two nginx processes that ss reported, but it also shows the user each one runs as, which is useful when a master process drops privileges for its workers.

For UDP port 53, use this form:

Terminal
sudo lsof -nP -iUDP:53

The pattern is the same, except that -iUDP:53 selects the UDP port and there is no state filter, because UDP sockets never enter the LISTEN state.

Finding the Process with fuser

When you want a PID without the full socket table, fuser provides a short command. Pass the port number followed by the protocol:

Terminal
sudo fuser 80/tcp

output

80/tcp: 1432 1433

You get the PID list and nothing else, which makes the plain form easy to pass to another command. To include the user, access type, and command name, add the -v option:

Terminal
sudo fuser -v 80/tcp

output

 USER PID ACCESS COMMAND
80/tcp: root 1432 F.... nginx
www-data 1433 F.... nginx

The port appears once on the first row, and every process below it belongs to that same port. The ACCESS column describes how each process uses the socket, where F marks it as open for writing.

You must specify tcp or udp because the same numeric port can be used by both protocols.

Finding the Process with netstat

On older systems you may still find netstat , part of the net-tools package. Use it as a fallback when ss is not available:

Terminal
sudo netstat -ltnp | grep ':80 '

output

tcp 0 0 0.0.0.0:80 0.0.0.0:* LISTEN 1432/nginx: master

The last column ties PID 1432 to the nginx master process, and netstat truncates that name if it grows too long. Unlike ss and lsof, it reports a single process per socket rather than the whole group. The space after :80 in the filter prevents it from matching a longer port number such as 8080. For a UDP port, use -lunp instead of -ltnp.

Inspecting and Stopping the Process

Once you have the PID, confirm what started the process before stopping it. The following ps command shows the full command and its parent PID:

Terminal
ps -fp 1432

output

UID PID PPID C STIME TTY TIME CMD
root 1432 1 0 07:10 ? 00:00:00 nginx: master process /usr/sbin/nginx

A service manager or container runtime may own the process. In that case, stop it through its manager so it does not immediately start again. For example, stop an Nginx systemd service with:

Terminal
sudo systemctl stop nginx

Warning

Make sure you understand what the process does before stopping it. Terminating a database or another production service to free a port can interrupt active work or cause data loss.

For an unmanaged process, send SIGTERM with kill:

Terminal
sudo kill 1432

SIGTERM asks the process to shut down cleanly. If the process ignores it, you can use sudo kill -KILL 1432 as a last resort, but SIGKILL gives it no opportunity to save state or remove temporary files. For more detail about signals, see the guide on how to kill a process in Linux .

After inspecting the verbose fuser output, you can send SIGTERM to every process using the TCP port:

Terminal
sudo fuser -k -TERM 80/tcp

The explicit -TERM matters because fuser -k sends SIGKILL by default.

Confirming the Port Is Free

Run the same ss query after stopping the process:

Terminal
sudo ss -ltnp 'sport = :80'

If no socket row appears below the header, nothing is listening on TCP port 80 in the current network namespace. If you changed a service configuration instead of stopping it, start the service again and check the new port with the same command.

Troubleshooting

The port appears but the process name is missing
Run the command with sudo. Without root privileges, these tools may not be able to read details for sockets owned by another user.

ss returns nothing but the application still reports a conflict
Check that you are using the correct protocol. Use -lunp for UDP instead of -ltnp for TCP. The listener may also be inside another network namespace or container, so run the check in the same environment as the application.

The process starts again after you stop it
A service manager or container runtime is restarting it. Stop or reconfigure the systemd service, Docker container, or other supervisor instead of repeatedly killing its PID.

Several PIDs appear for the same port
Some servers use a master process with several workers that share one socket. Other applications can use the SO_REUSEPORT option. Identify the parent service and manage the group instead of stopping one worker at a time.

netstat: command not found
The net-tools package is not installed on many current distributions. Use ss instead.

Conclusion

Use ss first when you need the process behind a specific port, then turn to lsof or fuser when you need a different view. Inspect the PID and its manager before stopping anything, especially on a production system.

CIDR Notation and Subnetting Explained

hello@linuxize.com (Linuxize) — Fri, 24 Jul 2026 10:50:00 +0200

When you assign a static address, configure a firewall rule, or divide a private network, you will encounter values such as 192.168.10.0/24. The address identifies the network, while the number after the slash tells you how much of the address is fixed and how much remains available for hosts.

This guide explains how CIDR prefixes map to subnet masks, how to find network and broadcast addresses, and how to divide an IPv4 block into smaller subnets.

For instant calculations and a visual binary split, use the subnet calculator .

What CIDR Notation Means

CIDR stands for Classless Inter-Domain Routing. It replaced the older class-based system with variable-length prefixes, allowing networks to be sized and routed more precisely.

An IPv4 CIDR block contains an address followed by a slash and a prefix length:

txt
192.168.10.0/24

An IPv4 address contains 32 bits. The /24 prefix means the first 24 bits identify the network, leaving 8 bits for addresses inside that network. A longer prefix fixes more network bits and creates a smaller block. A shorter prefix leaves more host bits and creates a larger block.

The prefix can range from /0, which covers the entire IPv4 address space, to /32, which identifies one address. CIDR notation is used for both network allocation and routing, so the same format can describe a LAN subnet, a firewall source range, or a single host route.

Network Bits and Host Bits

To see the /24 boundary, write the address and mask in binary:

txt
Address: 11000000.10101000.00001010.00000000
Mask: 11111111.11111111.11111111.00000000
 <------ network ------><-- host -->

Every 1 in the mask belongs to the network prefix. Every 0 leaves a bit that can vary within the block. Because /24 leaves 8 host bits, the block contains 2^8, or 256, addresses.

The network portion stays constant for every address in the block. Only the last 8 bits change, producing the range 192.168.10.0 through 192.168.10.255.

Convert a CIDR Prefix to a Subnet Mask

A subnet mask expresses the same boundary as a CIDR prefix, but in dotted-decimal form. A /24 has 24 one bits followed by 8 zero bits:

txt
11111111.11111111.11111111.00000000
255.255.255.0

Prefixes that end on an octet boundary are easy to recognize: /8 is 255.0.0.0, /16 is 255.255.0.0, and /24 is 255.255.255.0.

For a prefix such as /26, the first two bits of the final octet also belong to the network:

txt
11111111.11111111.11111111.11000000
255.255.255.192

The binary value 11000000 equals 192, so /26 maps to 255.255.255.192. The remaining six host bits provide 2^6, or 64, total addresses per subnet.

Calculate the Number of Addresses and Hosts

For a normal IPv4 subnet, calculate the total number of addresses with this formula:

txt
Total addresses = 2^(32 - prefix length)

A /27 leaves five host bits, so it contains 2^5 = 32 addresses. The first address is normally reserved as the network address, and the last is the broadcast address, leaving 30 addresses for host interfaces.

Two prefixes need separate treatment:

A /31 contains two addresses. On a point-to-point link, RFC 3021 treats both as host addresses because that link has no need for a separate network or broadcast address.
A /32 contains one address and represents a host route, not a conventional multi-host subnet.

The familiar total minus 2 rule therefore applies to conventional IPv4 subnets from /0 through /30, not blindly to every prefix.

Find the Network and Broadcast Addresses

Consider the address 192.168.10.34/27. A /27 mask is 255.255.255.224, which creates blocks of 32 addresses in the final octet:

txt
0-31, 32-63, 64-95, 96-127, 128-159, 160-191, 192-223, 224-255

The address .34 falls in the 32-63 block. That gives us:

Network address: 192.168.10.32
First usable address: 192.168.10.33
Last usable address: 192.168.10.62
Broadcast address: 192.168.10.63

You can find the block size by subtracting the changing mask octet from 256. For /27, 256 - 224 = 32. Starting at zero, count in increments of 32 until you find the range that contains the address.

On Linux, the ip command displays each interface address together with its CIDR prefix:

Terminal
ip -brief address

output

lo UNKNOWN 127.0.0.1/8 ::1/128
eth0 UP 192.168.10.34/27

The output shows that eth0 uses the /27 network calculated above.

Subnet a /24 Network into /26 Blocks

Suppose you have 192.168.10.0/24 and need four equal networks. Moving from /24 to /26 borrows two host bits for subnetting. Two borrowed bits produce 2^2 = 4 subnets.

Each /26 contains 64 total addresses and 62 conventional host addresses:

Subnet	Usable host range	Broadcast
`192.168.10.0/26`	`192.168.10.1` to `192.168.10.62`	`192.168.10.63`
`192.168.10.64/26`	`192.168.10.65` to `192.168.10.126`	`192.168.10.127`
`192.168.10.128/26`	`192.168.10.129` to `192.168.10.190`	`192.168.10.191`
`192.168.10.192/26`	`192.168.10.193` to `192.168.10.254`	`192.168.10.255`

The subnet boundaries increase by 64 because /26 leaves six host bits and 2^6 = 64. A network address must start on one of these boundaries. For example, 192.168.10.64/26 is valid, but 192.168.10.70/26 is an address inside that network rather than the network identifier.

Combine Networks with Route Aggregation

CIDR also lets routers summarize adjacent networks into one larger route. For example, these four /24 networks are contiguous:

txt
168.0.0/24
168.1.0/24
168.2.0/24
168.3.0/24

They can be advertised as the single route 192.168.0.0/22. A /22 contains 1024 addresses, exactly the same total as four /24 blocks.

Aggregation works only when the networks are contiguous and aligned on the larger prefix boundary. The four networks from 192.168.1.0/24 through 192.168.4.0/24 cannot form one /22, even though their total size is the same, because the range does not start on a /22 boundary.

CIDR Notation in IPv6

IPv6 uses CIDR prefixes over a 128-bit address. For example:

txt
2001:db8:1234:5600::/64

The /64 prefix fixes the first 64 bits and leaves the remaining 64 bits for the interface identifier. A /64 is the common size for an IPv6 LAN, especially when Stateless Address Autoconfiguration (SLAAC) is used, although routing prefixes can have other lengths.

IPv6 has no broadcast address. Multicast replaces broadcast behavior, and all-zero or all-one values are legal within address fields unless a specific rule says otherwise. See the IPv4 vs IPv6 comparison for the broader differences between the protocols.

Quick Reference

Prefix	Subnet mask	Total addresses	Conventional usable hosts
`/8`	`255.0.0.0`	16,777,216	16,777,214
`/16`	`255.255.0.0`	65,536	65,534
`/20`	`255.255.240.0`	4,096	4,094
`/22`	`255.255.252.0`	1,024	1,022
`/24`	`255.255.255.0`	256	254
`/25`	`255.255.255.128`	128	126
`/26`	`255.255.255.192`	64	62
`/27`	`255.255.255.224`	32	30
`/28`	`255.255.255.240`	16	14
`/29`	`255.255.255.248`	8	6
`/30`	`255.255.255.252`	4	2
`/31`	`255.255.255.254`	2	2 on point-to-point links
`/32`	`255.255.255.255`	1	1 host route

Conclusion

The CIDR prefix tells you exactly where the network bits end and the host bits begin. Once you can convert that boundary to a mask and block size, you can calculate ranges, divide networks, and check firewall rules without relying on the old address classes.

mount Cheatsheet

hello@linuxize.com (Linuxize) — Fri, 24 Jul 2026 07:45:00 +0200

Basic Syntax

Core mount and umount command forms.

Command	Description
`mount DEVICE DIR`	Attach a device to a mount point
`mount -t TYPE DEVICE DIR`	Mount with an explicit filesystem type
`mount -o OPTIONS DEVICE DIR`	Mount with a comma-separated option list
`mount DIR`	Mount an entry already defined in `/etc/fstab`
`mount -a`	Mount `/etc/fstab` filesystems except `noauto` entries
`umount DIR`	Detach the filesystem mounted at `DIR`

Most mount operations require root privileges, so prefix them with sudo.

List Mounted Filesystems

Inspect what is currently mounted and where.

Command	Description
`mount`	List all mounts using the legacy display; prefer `findmnt`
`findmnt`	Show mounts as a readable tree
`findmnt /dev/sdb1`	Show where a specific device is mounted
`findmnt -t ext4,xfs`	List only the given filesystem types
`findmnt --fstab --verify`	Check `/etc/fstab` for errors before rebooting
`cat /proc/mounts`	Read active mounts in the current mount namespace
`lsblk -f`	List block devices with type, label, and UUID
`df -hT`	Show mounted filesystems with type and free space

Common Mount Options

Values passed to -o or listed in the fourth /etc/fstab field.

Option	Description
`defaults`	Common defaults are `rw,suid,dev,exec,auto,nouser,async`; exact defaults vary
`ro` / `rw`	Mount read-only or read-write
`noexec`	Block execution of binaries on the filesystem
`nosuid`	Ignore setuid and setgid bits
`nodev`	Ignore device files on the filesystem
`noatime`	Skip access-time updates, which reduces disk writes
`sync` / `async`	Write synchronously or let the kernel buffer writes
`noauto`	Skip this entry during `mount -a` and at boot
`user`	Allow a non-root user to mount; implies `noexec,nosuid,nodev` unless overridden
`nofail`	Continue booting when the device is missing
`uid=1000,gid=1000`	Set owner and group on filesystems without Unix permissions
`remount`	Change options on an already mounted filesystem

Example: sudo mount -o remount,rw / remounts the root filesystem read-write.

Mount by UUID or Label

Device names such as /dev/sdb1 can change between boots, so identify the filesystem instead.

Command	Description
`lsblk -f`	Show the UUID and label of every filesystem
`sudo blkid`	Print device type, label, and UUID
`sudo blkid /dev/sdb1`	Print the attributes of one device
`sudo mount UUID=1a2b3c4d-... /mnt/data`	Mount by filesystem UUID
`sudo mount LABEL=backup /mnt/backup`	Mount by filesystem label
`sudo mount -U 1a2b3c4d-... /mnt/data`	Short form of the UUID lookup
`sudo mount -L backup /mnt/backup`	Short form of the label lookup
`sudo e2label /dev/sdb1 backup`	Set a label on an ext2, ext3, or ext4 filesystem

Prefer UUID= or LABEL= for persistent local mounts in /etc/fstab because device names can change.

Filesystem Types

Values for -t and for the third /etc/fstab field.

Type	Description
`ext4`	Widely used general-purpose Linux filesystem
`xfs`	High-performance journaling filesystem, default on RHEL
`btrfs`	Copy-on-write filesystem with snapshots and subvolumes
`vfat`	FAT32, used by USB drives and EFI system partitions
`exfat`	Large-file FAT variant for USB drives and SD cards
`ntfs3`	In-kernel NTFS driver available on supported kernels
`iso9660`	Optical disc and ISO image filesystem
`tmpfs`	In-memory filesystem backed by RAM and swap
`nfs`	Network File System share
`cifs`	SMB or Windows network share
`auto`	Let `mount` detect the type

Network and Special Mounts

Mount forms beyond a plain local partition.

Command	Description
`sudo mount -t nfs server:/srv/data /mnt/data`	Mount an NFS export
`sudo mount -t cifs //server/share /mnt/share -o username=user`	Mount a Windows or Samba share
`sudo mount -t cifs //server/share /mnt/share -o credentials=/etc/smb-credentials`	Mount CIFS with a credentials file
`sshfs user@host:/remote/dir /mnt/remote`	Mount a remote directory over SSH
`sudo mount -o loop image.iso /mnt/iso`	Mount an ISO image through a loop device
`sudo mount --bind /src /dst`	Expose an existing directory at a second path
`sudo mount --rbind /src /dst`	Bind a directory together with its submounts
`sudo mount -t tmpfs -o size=512M tmpfs /mnt/ram`	Create a 512 MB RAM-backed filesystem

Keep CIFS credentials outside project directories and version control. Protect the file with sudo chmod 600 /etc/smb-credentials.

Unmounting

Detach a filesystem and deal with a busy mount point.

Command	Description
`sudo umount /mnt/data`	Unmount by mount point
`sudo umount /dev/sdb1`	Unmount by device (obsolete; use the mount point)
`sudo umount -R /mnt/data`	Unmount a mount point and everything below it
`sudo umount -l /mnt/data`	Lazy unmount: detach now, release when no longer in use
`sudo umount -f /mnt/share`	Force an unmount, mainly for unreachable network shares
`sudo umount -a -t nfs`	Unmount every NFS filesystem
`lsof +f -- /mnt/data`	List open files under the mount point
`fuser -mv /mnt/data`	Show processes and users holding the mount point
`sudo fuser -km /mnt/data`	Kill every process using the mount point; destructive

Review fuser -mv output before using fuser -km. Use lazy or forced unmounts only when a normal unmount cannot work: -f can lose unwritten data, while -l hides the path before all references are released.

Persistent Mounts in /etc/fstab

Each line has six space-separated fields.

Field	Description
1. Device	`UUID=`, `LABEL=`, a device path, or a remote share
2. Mount point	Existing directory, or `none` for swap
3. Type	Filesystem type, such as `ext4`, `nfs`, or `cifs`
4. Options	Comma-separated mount options, or `defaults`
5. Dump	`0` in nearly all cases; `1` marks the filesystem for `dump`
6. Pass	Order of `fsck` at boot: `1` for root, `2` for others, `0` to skip

Example: UUID=1a2b3c4d-... /mnt/data ext4 defaults,nofail 0 2

Command	Description
`sudo findmnt --fstab --verify`	Validate the file before rebooting
`sudo mount -a`	Apply mountable entries after validating `/etc/fstab`
`sudo systemctl daemon-reload`	Regenerate the systemd mount units after an edit
`sudo mount /mnt/data`	Mount one entry using only its mount point

Use nofail only for optional mounts. Add _netdev when a network-backed filesystem is not recognized as network-dependent from its type.

Troubleshooting

Common mount errors and what to check.

Error	Check
`target is busy`	Find the holder with `fuser -mv DIR` or `lsof +f -- DIR`, then close it
`unknown filesystem type`	Install the required helper or driver, such as `ntfs-3g`, `nfs-common` or `nfs-utils`, or `cifs-utils`; confirm kernel support for exFAT
`wrong fs type, bad option, bad superblock`	Confirm the type with `lsblk -f` and check `dmesg`. If repair is needed, unmount it and use the correct filesystem checker
`mount point does not exist`	Create the directory first with `sudo mkdir -p DIR`
`permission denied` on CIFS	Verify credentials and server share permissions; `uid=` and `gid=` only control local ownership
`special device does not exist`	Recheck the UUID with `blkid`; the device name may have changed
Files are hidden after mounting	The mounted filesystem covers existing directory contents; unmount it and inspect the underlying path
Boot drops to emergency mode	Remount root with `mount -o remount,rw /`, fix the bad `/etc/fstab` line, and validate it; add `nofail` only if the mount is optional

Use these guides and cheatsheets for complete storage workflows.

Guide	Description
How to Mount and Unmount File Systems in Linux	Full guide to `mount` and `umount` with practical examples
Understanding the /etc/fstab File in Linux	Field-by-field breakdown of persistent mount entries
How to Mount an NFS Share in Linux	Install the client, mount a share, and troubleshoot errors
How to Mount a Windows Share on Linux Using CIFS	Credentials files, ownership, and permissions for SMB shares
How to Mount ISO File on Linux	Loop devices and the graphical mounting method
How to Use SSHFS to Mount Remote Directories over SSH	Mount a remote directory and browse it like a local one
df Cheatsheet	Check free space on mounted filesystems
fdisk Cheatsheet	Partition a disk before creating a filesystem

SSH Connection Refused: Causes and Fixes

hello@linuxize.com (Linuxize) — Thu, 23 Jul 2026 14:20:00 +0200

You try to log in and SSH stops immediately with connect to host example.com port 22: Connection refused. The failure happens before SSH checks your key or password, so changing authentication settings will not fix it.

An immediate refusal means the target address has no process listening on that port, or a firewall or network device actively rejected the request. The usual causes are a stopped SSH server, the wrong host or port, a listener bound to another address, a firewall reject rule, or port forwarding to the wrong machine. A connection that hangs and then times out is different because no response came back.

This guide starts with checks you can run from the client, then moves to the SSH service, listening port, firewall, and network path on the server.

Quick Reference

For a printable quick reference, see the SSH cheatsheet .

Check	Command
Confirm the destination address	`getent ahosts example.com`
Show SSH connection details	`ssh -vvv user@example.com`
Test the default SSH port	`nc -vz example.com 22`
Check for a listener on port 22	`sudo ss -ltnp 'sport = :22'`
Show the effective SSH port and addresses	`sudo sshd -T \| grep -E '^(port\|listenaddress) '`
Check SSH on Ubuntu or Debian	`sudo systemctl status ssh.service ssh.socket`
Check SSH on Fedora or RHEL	`sudo systemctl status sshd`
Check UFW rules	`sudo ufw status numbered`
Check firewalld services	`sudo firewall-cmd --list-services`

Confirm the Host and Port from the Client

Before changing the server, confirm that the hostname resolves to the address you expect:

Terminal
getent ahosts example.com

If the result points to an old server or the wrong public address, correct the DNS record or connect to the intended IP address directly. Reaching the wrong host can produce a refusal even when SSH is working on the real server.

Next, run SSH with verbose output:

Terminal
ssh -vvv user@example.com

The relevant lines look like this:

output

debug1: Connecting to example.com [203.0.113.10] port 22.
ssh: connect to host example.com port 22: Connection refused

The client resolved example.com to 203.0.113.10 and received an immediate refusal from port 22. You can test the TCP port without starting an SSH login:

Terminal
nc -vz example.com 22

If the server uses a custom port, test and connect to that port instead:

Terminal
nc -vz example.com 2222
ssh -p 2222 user@example.com

A hostname can also have separate IPv4 and IPv6 addresses. Test each address family when one DNS record may point to the wrong server:

Terminal
ssh -4 user@example.com
ssh -6 user@example.com

The remaining checks require access to the server through a cloud console, virtual machine console, physical terminal, or another management channel.

Check Whether SSH Is Listening

The listening socket is the quickest way to tell whether the server can accept SSH connections on port 22. Run this command on the server:

Terminal
sudo ss -ltnp 'sport = :22'

A working listener appears as either sshd or systemd, depending on whether the distribution runs the daemon continuously or uses socket activation. If the command returns nothing, no process is accepting connections on port 22.

To see the port and addresses from the effective OpenSSH configuration, run:

Terminal
sudo sshd -T | grep -E '^(port|listenaddress) '

Typical output looks like this:

output

port 22
listenaddress [::]:22
listenaddress 0.0.0.0:22

The output shows that SSH is configured for port 22 on all IPv6 and IPv4 addresses. If it reports another port, connect with the -p option and verify that the firewall allows that port. See our guide on changing the SSH port if you need to correct the configuration.

Check the SSH Service or Socket

Linux distributions use different systemd unit names for OpenSSH. Ubuntu and Debian use ssh.service, while Fedora, RHEL, and their derivatives use sshd.service.

On Ubuntu and Debian, check the service:

Terminal
sudo systemctl status ssh.service

Ubuntu 22.10 and later use ssh.socket by default, so check that unit as well:

Terminal
sudo systemctl status ssh.socket

When ssh.socket is active and owns port 22, ssh.service may remain inactive until a client connects. In that setup, an inactive service alone does not indicate a problem. If the socket is disabled or stopped, enable it and start it:

Terminal
sudo systemctl enable --now ssh.socket

On systems without ssh.socket, enable and start the service instead:

Terminal
sudo systemctl enable --now ssh

On Fedora, RHEL, and derivatives, check and start sshd:

Terminal
sudo systemctl status sshd
sudo systemctl enable --now sshd

If the unit reports failed, validate the SSH server configuration:

Terminal
sudo sshd -t

No output means the configuration passed the test. If OpenSSH prints an error, correct the reported line before restarting the unit. You can also inspect the current boot logs on Ubuntu and Debian:

Terminal
sudo journalctl -u ssh.service -u ssh.socket -b

For Fedora and RHEL, use the sshd unit name:

Terminal
sudo journalctl -u sshd -b

Install the OpenSSH Server

Some minimal installations include the SSH client but not the server. If systemctl reports that the SSH unit does not exist, install the openssh-server package.

Ubuntu, Debian, and Derivatives

Update the package index and install the server package:

Terminal
sudo apt update
sudo apt install openssh-server

The package normally starts the appropriate SSH service or socket during installation. Check port 22 again with ss instead of assuming that the listener started successfully.

Fedora, RHEL, and Derivatives

Install the server package, then enable and start sshd:

Terminal
sudo dnf install openssh-server
sudo systemctl enable --now sshd

Check the Listening Address

SSH can run normally but listen only on the loopback interface or one private address. In that case, a local connection works while connections to other server addresses are refused.

Review the listenaddress lines from sshd -T. A value such as 127.0.0.1:22 accepts only local IPv4 connections. OpenSSH reads its main configuration from /etc/ssh/sshd_config and may also read files under /etc/ssh/sshd_config.d/. A listener on a loopback address is reachable from the server itself and from nowhere else.

Before changing Port or ListenAddress, keep console access open and validate the new configuration with sudo sshd -t. On Ubuntu systems using socket activation, the socket must also reload the generated listening configuration. The port-change guide linked above covers the service and socket steps in order.

Check the Firewall

A firewall is less likely to cause an immediate refusal than a missing listener. Rules that silently drop traffic usually end with Connection timed out, while an explicit REJECT rule can return Connection refused. Check the firewall after confirming the service and port.

If the server uses UFW, list its rules with numbers:

Terminal
sudo ufw status numbered

Allow the standard OpenSSH profile when SSH uses port 22:

Terminal
sudo ufw allow OpenSSH

For a custom port, allow the exact TCP port instead:

Terminal
sudo ufw allow 2222/tcp

On a server using firewalld, first check the services allowed in the active zone:

Terminal
sudo firewall-cmd --list-services

Add SSH to both the runtime and permanent configurations if it is missing:

Terminal
sudo firewall-cmd --add-service=ssh
sudo firewall-cmd --permanent --add-service=ssh

For a custom port, use --add-port=2222/tcp in both commands. Our UFW firewall guide explains how to review and manage rules in more detail.

Check Port Forwarding and External Firewalls

If SSH works from the same machine or local network but fails from the internet, the OpenSSH listener may already be correct. Check that the router or virtualization platform forwards the external port to the server’s current private address and SSH port.

The same issue can occur with a virtual machine, container, load balancer, or cloud firewall. Confirm that public DNS points to the expected system and that each forwarding rule uses the same port you pass to ssh. Cloud firewall rules often drop traffic and cause a timeout, but an edge device that rejects the request or forwards it to the wrong host can produce a refusal.

Troubleshooting

Connection refused started after an SSH configuration change
Run sudo sshd -t and correct every reported error. On Ubuntu with socket activation, reload systemd and restart ssh.socket after a valid Port or ListenAddress change, then verify the listener with ss before closing console access.

SSH works with localhost but not the server address
Check the effective ListenAddress values and the firewall rules for the external interface. A listener restricted to 127.0.0.1 or ::1 cannot accept remote connections.

IPv4 works but IPv6 is refused
The server may have an AAAA record without an IPv6 listener. Compare ssh -4 and ssh -6, then correct the DNS record or configure SSH to listen on the intended IPv6 address.

Only one client address is refused
A source-specific firewall rule or a tool such as Fail2ban may be rejecting that address. Review the firewall rules and, if Fail2ban is installed, check the SSH jail with sudo fail2ban-client status sshd.

SSH reaches the server but reports Permission denied
The network path and listener are working, and the failure has moved to authentication. Follow the SSH Permission denied (publickey) guide instead.

Conclusion

Once the port test succeeds, SSH should move on to host-key verification or authentication. Before exposing the restored service to the internet, review our SSH hardening best practices and restrict firewall access where possible.

Dockerfile COPY vs ADD: Which to Use

hello@linuxize.com (Linuxize) — Wed, 22 Jul 2026 10:25:00 +0200

When a Docker image needs application code, configuration, or a release archive, both COPY and ADD can place files in the image. For an ordinary local file, COPY app.py /app/ and ADD app.py /app/ produce the same result, but the instructions differ once archives, remote sources, or build stages are involved.

Use COPY for local files and artifacts from other build stages. Use ADD when you want automatic tar extraction or need BuildKit to fetch a remote HTTP or Git source. This guide compares both instructions and explains which one fits each case.

What COPY Does

COPY takes files or directories from the build context and places them at a destination inside the image:

dockerfile
COPY requirements.txt /app/
COPY src/ /app/src/

An archive copied this way stays an archive, and a source path cannot point outside the build context. Two options cover common permission needs by setting ownership and mode as the files are copied:

dockerfile
COPY --chown=appuser:appgroup --chmod=644 config.yml /app/

COPY can also read from a named context, another image, or an earlier stage in a multi-stage build. The --from option is commonly used to move compiled artifacts into a smaller production image:

dockerfile
COPY --from=builder /app/target/server /usr/local/bin/server

What ADD Does

For local files and directories, ADD behaves much like COPY. It also understands local tar archives, remote URLs, and Git repository sources.

When the source is a local tar archive, either uncompressed or compressed with gzip, bzip2, or xz, ADD extracts it into the destination instead of copying the archive file:

dockerfile
ADD rootfs.tar.gz /

Docker detects an archive from its contents, not its filename. A file named rootfs.tar.gz that does not contain a recognized tar archive is copied without an extraction error. When you need the archive itself inside the image, use COPY, or use ADD --unpack=false with Dockerfile syntax 1.17 or later.

For remote sources, ADD can download an HTTP or HTTPS URL. BuildKit supports --checksum so the build fails if the downloaded content does not match the expected SHA-256 digest. Here is a checksum-verified download:

dockerfile
# syntax=docker/dockerfile:1
ADD --checksum=sha256:24454f830cdb571e2c4ad15481119c43b3cafd48dd869a9b2945d1036d1dc68d \
 https://mirrors.edge.kernel.org/pub/linux/kernel/Historic/linux-0.01.tar.gz \
 /tmp/linux-0.01.tar.gz

Remote tar archives are downloaded without extraction by default. Dockerfile syntax 1.17 added --unpack=true for builds that should download and extract a remote tar archive in one instruction.

ADD can also clone a Git repository from an HTTPS or SSH address. A branch, tag, commit, or subdirectory can be selected in the URL, and --checksum can pin a Git source to a commit. These behaviors are covered in the official Dockerfile ADD reference .

Key Differences

Source or behavior	COPY	ADD
Local files and directories	Copies them	Copies them
Local tar archive	Keeps the archive	Extracts it by default
Remote HTTP or HTTPS URL	Not supported	Downloads it
Remote Git repository	Not supported	Clones it
Checksum for a remote source	Not applicable	`--checksum`
Remote tar extraction	Not supported	`--unpack=true`
Build stage, named context, or image	`--from`	Not supported

Choosing Between COPY and ADD

Use COPY for application source code, configuration, static assets, and other ordinary files from the build context. It states the intent directly and ensures that an archive remains intact. COPY --from is also the correct choice for moving artifacts between build stages or importing files from another image.

Use ADD when its source-aware behavior is part of the task. Local tar extraction is useful for assembling a root filesystem or installing a vendored release archive without storing the compressed archive in its own image layer.

For example, this instruction extracts a local application archive directly into /opt/app/:

dockerfile
ADD app-1.4.2-dist.tar.gz /opt/app/

For remote artifacts, current Docker build best practices favor ADD with --checksum because BuildKit can cache the remote source precisely and verify its contents. A RUN instruction with curl or wget is still appropriate when you need custom request handling or additional processing. Keep verification, extraction, and cleanup in the same RUN instruction so temporary files do not remain in a separate layer.

Conclusion

Choose COPY for local content and multi-stage artifacts. Choose ADD when you need automatic tar extraction or a checksum-verified remote source. For the complete image-building workflow, see our guide on building Docker images with a Dockerfile , and keep the Docker cheatsheet nearby for the rest of the instruction set.

head Cheatsheet

hello@linuxize.com (Linuxize) — Tue, 21 Jul 2026 13:20:00 +0200

Basic Syntax

Core head command forms.

Command	Description
`head FILE`	Show the first 10 lines of a file
`head -n 20 FILE`	Show the first 20 lines
`head -c 100 FILE`	Show the first 100 bytes
`command \| head -n 10`	Limit piped output to 10 lines
`head -- -notes.txt`	Read a file whose name starts with `-`

Select Lines

Control how many lines are printed.

Command	Description
`head -n 5 /etc/passwd`	Show the first 5 lines
`head -n 1 data.csv`	Print the header row of a CSV file
`head -n 100 app.log`	Preview the first 100 log entries
`head -n -5 FILE`	Show all lines except the last 5 (GNU)
`head -n 2 FILE1 FILE2`	Show the first 2 lines of each file

Select Bytes

Read a fixed number of bytes instead of lines.

Command	Description
`head -c 100 FILE`	Show the first 100 bytes
`head -c 2K FILE`	Show the first 2048 bytes
`head -c 1MB FILE`	Show the first 1,000,000 bytes
`head -c -512 FILE`	Show all bytes except the last 512 (GNU)
`head -c 512 disk.img > header.bin`	Save the first 512 bytes to a file

Multiple Files and Headers

Control the file-name headers shown with multiple inputs.

Command	Description
`head FILE1 FILE2`	Show 10 lines from each file with headers
`head -n 5 *.log`	Show the first 5 lines of every matched log
`head -q FILE1 FILE2`	Suppress file-name headers
`head -v FILE`	Always print a file-name header
`head -n 5 FILE1 - FILE2`	Read files and standard input in sequence

Pipelines

Combine head with other text-processing commands.

Command	Description
`ls -t \| head -n 5`	Show the 5 most recently modified entries
`sort -nr scores.txt \| head -n 10`	Show the 10 highest numeric values
`grep 'ERROR' app.log \| head -n 20`	Show the first 20 matching errors
`tail -n +20 FILE \| head -n 11`	Extract lines 20 through 30
`head -n 20 FILE \| wc -w`	Count words in the first 20 lines

Useful Options

Common GNU head flags and long forms.

Option	Description
`-n NUM`, `--lines=NUM`	Print the first `NUM` lines
`-c NUM`, `--bytes=NUM`	Print the first `NUM` bytes
`-q`, `--quiet`	Never print file-name headers
`-v`, `--verbose`	Always print file-name headers
`-z`, `--zero-terminated`	Read and write NUL-delimited items (GNU)
`--help`	Show command help
`--version`	Show the installed version

Use head -n 5 instead of the obsolete head -5 syntax in scripts.

NUL-Delimited Input

Handle file names containing spaces, newlines, or other special characters.

Command	Description
`find . -type f -print0 \| head -z -n 5`	Select the first 5 NUL-delimited paths
`find . -type f -print0 \| head -z -n 5 \| xargs -0 -r ls -l`	Pass the first 5 paths safely to `ls`
`printf 'one\0two\0' \| head -z -n 1`	Print the first NUL-delimited item

The -z option is specific to GNU head.

Troubleshooting

Quick checks for common head issues.

Issue	Check
Only 10 lines are shown	This is the default; set the count with `-n NUM`
File-name headers appear	Multiple files trigger headers; add `-q` to suppress them
Binary output looks garbled	Redirect byte output to a file or inspect it with `hexdump`
`head -n -5` fails	Negative counts are a GNU feature and are not portable
Upstream command reports a broken pipe	`head` exits after collecting enough input; some producers report the closed pipe

Use these guides and cheatsheets for complete text-processing workflows.

Guide	Description
head Command in Linux	Full guide to lines, bytes, files, and pipelines
tail Cheatsheet	Read the end of files and follow logs
cat Cheatsheet	Display and combine file contents
sort Cheatsheet	Order lines before selecting top results
wc Cheatsheet	Count lines, words, and bytes

lsusb, lspci, and lshw: List Hardware in Linux

hello@linuxize.com (Linuxize) — Tue, 21 Jul 2026 09:40:00 +0200

Sooner or later you need to know exactly what is inside a machine: which Wi-Fi chip refuses to work, whether the system sees a plugged-in USB device at all, or what to put in a purchase order for more RAM. Three commands answer these questions from the terminal, each covering a different part of the hardware inventory: lsusb for USB devices, lspci for PCI devices such as network cards and GPUs, and lshw for a complete inventory of everything.

This guide explains how to use all three, and which one to reach for depending on the question you are asking.

Installing the Tools

The three commands live in three small packages, most of which are preinstalled on desktop distributions.

On Ubuntu, Debian, and Derivatives:

Terminal
sudo apt install usbutils pciutils lshw

On Fedora, RHEL, and Derivatives:

Terminal
sudo dnf install usbutils pciutils lshw

Listing USB Devices with lsusb

Run lsusb without arguments to list every device on the USB buses:

Terminal
lsusb

output

Bus 002 Device 001: ID 1d6b:0003 Linux Foundation 3.0 root hub
Bus 001 Device 004: ID 046d:c52b Logitech, Inc. Unifying Receiver
Bus 001 Device 003: ID 13d3:56a6 IMC Networks Integrated Camera
Bus 001 Device 002: ID 8087:0aaa Intel Corp. Bluetooth 9460/9560
Bus 001 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub

Each line shows the bus and device number, then the ID in vendor:product form, then a human-readable name looked up from the USB ID database. The 1d6b root hubs are the controllers themselves, not devices you plugged in.

The classic use is answering “does the system see this thing at all”: run lsusb, plug the device in, run it again, and compare. If a new line appears, the system has enumerated the device, so drivers, firmware, and application support are the next places to check. Enumeration does not prove that the device or cable is fully healthy, but it confirms that the USB host received a response. If nothing appears, try another port or cable before blaming the OS. Recent kernel messages from dmesg show the same plug events with more detail.

The tree view adds the piece the flat list lacks, which drivers claimed each device and at what speed it connected:

Terminal
lsusb -t

output

/: Bus 02.Port 1: Dev 1, Class=root_hub, Driver=xhci_hcd/6p, 10000M
/: Bus 01.Port 1: Dev 1, Class=root_hub, Driver=xhci_hcd/12p, 480M
|__ Port 4: Dev 2, If 0, Class=Wireless, Driver=btusb, 12M
|__ Port 5: Dev 3, If 0, Class=Video, Driver=uvcvideo, 480M
|__ Port 9: Dev 4, If 2, Class=Human Interface Device, Driver=usbhid, 12M

A device present in lsusb but showing no Driver= entry here has been enumerated but has no kernel driver bound to that interface. That can indicate a missing kernel module or firmware package, although some devices are intentionally controlled by a userspace driver such as libusb. A USB 3 drive showing 480M instead of 5000M is connected through a USB 2 port or cable, a common reason external disks underperform.

For full descriptors of a single device, filter by its ID and add -v:

Terminal
sudo lsusb -v -d 046d:c52b

The verbose output is long; without root, parts of it are hidden.

Listing PCI Devices with lspci

PCI is where the built-in hardware lives: network controllers, graphics cards, storage controllers, and sound chips. The bare command lists them all:

Terminal
lspci

output

00:00.0 Host bridge: Intel Corporation Device a706
00:02.0 VGA compatible controller: Intel Corporation Raptor Lake-P [Iris Xe Graphics]
00:14.3 Network controller: Intel Corporation Raptor Lake PCH CNVi WiFi
00:1f.3 Audio device: Intel Corporation Raptor Lake-P/U/H cAVS
01:00.0 Non-Volatile memory controller: Samsung Electronics Co Ltd NVMe SSD Controller PM9A1

The leading 00:14.3 style address identifies the device’s slot and function, and the text after the class name identifies the chip. This is the fastest way to find out exactly which Wi-Fi or Ethernet chip a machine has, which is the first thing any driver search needs.

The single most useful option is -k, which shows the kernel driver bound to each device:

Terminal
lspci -k

output

00:14.3 Network controller: Intel Corporation Raptor Lake PCH CNVi WiFi
Subsystem: Intel Corporation Device 0094
Kernel driver in use: iwlwifi
Kernel modules: iwlwifi

Kernel modules lists what could drive the device, and Kernel driver in use shows what actually is. For a device that normally needs a kernel driver, modules listed but no driver in use can indicate missing firmware, a blacklisted module, or a binding problem. Some PCI functions do not need their own driver, so confirm the expected behavior before treating the missing line as an error. On systems with two GPUs, lspci -k is also the quick way to see which one is bound to which driver.

Two more options come up regularly. -nn appends the numeric [vendor:device] IDs, which are what you paste into a search engine or a driver compatibility list when the text name is ambiguous:

Terminal
lspci -nn | grep -i network

output

00:14.3 Network controller [0280]: Intel Corporation Raptor Lake PCH CNVi WiFi [8086:51f1]

And -s narrows the output to one slot, combined with -v or -vv for details like memory ranges, capabilities, and the current link speed of the slot:

Terminal
sudo lspci -vv -s 01:00.0

Getting a Full Inventory with lshw

Where lsusb and lspci each cover one bus, lshw walks everything the kernel knows: CPU, memory, firmware, disks, controllers, and the buses in between. Run it as root or the output will be incomplete. The full report is pages long, so start with the summary table:

Terminal
sudo lshw -short

output

H/W path Device Class Description
===========================================================
system ThinkPad T14 Gen 4
/0/0 memory 64KiB BIOS
/0/4 processor 13th Gen Intel Core i7-1355U
/0/13 memory 32GiB System Memory
/0/13/0 memory 16GiB SODIMM DDR5 5600 MHz
/0/13/1 memory 16GiB SODIMM DDR5 5600 MHz
/0/100/2 display Raptor Lake-P [Iris Xe Graphics]
/0/100/14.3 wlp0s20f3 network Raptor Lake PCH CNVi WiFi
/0/100/1d/0 /dev/nvme0 storage SAMSUNG MZVL21T0HCLR-00B00

This one screen answers most inventory questions: what model the machine is, which memory modules lshw detected, and what storage and network hardware is present. The two 16 GiB entries show how the detected memory is populated, but they do not confirm whether the machine has another empty slot. Check the vendor’s service manual before planning an upgrade.

To dig into one category, filter by class:

Terminal
sudo lshw -C memory
sudo lshw -C network

The class view for memory may include per-slot details such as speed and part numbers when the system firmware exposes them. For reports, lshw exports machine-readable and browsable formats:

Terminal
sudo lshw -json > hardware.json
sudo lshw -sanitize -html > hardware.html

The JSON output preserves detailed fields for local inventory tooling. Use the sanitized HTML file when sharing a report because -sanitize removes potentially sensitive values such as serial numbers and IP addresses.

For completeness: CPU details have their own dedicated tools, covered in our guide on getting CPU information on Linux , and sudo dmidecode reads the firmware’s DMI tables directly when you need BIOS versions or serial numbers that lshw summarizes.

Quick Reference

Task	Command
List USB devices	`lsusb`
USB tree with drivers and speeds	`lsusb -t`
Full descriptors for one USB device	`sudo lsusb -v -d 046d:c52b`
List PCI devices	`lspci`
PCI devices with kernel drivers	`lspci -k`
PCI devices with numeric IDs	`lspci -nn`
Details for one PCI slot	`sudo lspci -vv -s 01:00.0`
Hardware summary table	`sudo lshw -short`
One hardware class in detail	`sudo lshw -C network`
Machine-readable inventory	`sudo lshw -json`
Sanitized HTML report	`sudo lshw -sanitize -html`

Conclusion

lsusb confirms detection, lspci -k connects chips to drivers, and lshw turns a closed case into a readable inventory; between the three, “what hardware is this and is it working” stops requiring a screwdriver. When a device shows up in these listings but misbehaves, the kernel log usually explains why, so dmesg is the natural next stop.

How to Comment Out Multiple Lines in Vim

hello@linuxize.com (Linuxize) — Mon, 20 Jul 2026 11:20:00 +0200

Commenting out a block of lines is one of those edits you make constantly: disabling a section of a config file, switching off a function while debugging, or keeping an old approach around while testing a new one. In most editors that is select plus a single shortcut. Classic Vim has no comment shortcut out of the box, but it has three techniques that are just as fast once you know them, and recent versions ship a toggle plugin as well.

This guide shows how to comment out multiple lines in Vim with visual block mode, the substitute command, and the built-in comment plugin, and how to remove the comments again with each method.

Commenting with Visual Block Mode

The classic answer uses visual block mode to insert a comment character at the start of every selected line:

Move the cursor to the first column of the first line you want to comment.
Press Ctrl+V to enter visual block mode.
Press j (or the down arrow) until every target line is selected.
Press Shift+I to insert at the left edge of the block.
Type the comment character, # for shell scripts and config files.
Press Esc.

On Windows, Ctrl+V may be mapped to paste. If it does not start visual block mode, use Ctrl+Q instead.

The # appears on the first line while you type, which looks like the operation failed. It did not: the moment you press Esc, Vim repeats the insert on every line of the block.

For languages with two-character comments, type the whole prefix in step 5, for example // for C, JavaScript, and Go, or -- for SQL and Lua. The entire string is inserted on each line.

Because this selection starts in the first column, I prefixes every selected line, including empty lines. If you start the block farther to the right, Vim skips lines that end before the block’s left edge. Use the substitute method below when you want to prefix a line range regardless of line length.

Uncommenting with Visual Block Mode

The reverse uses the same block selection to delete a column of characters:

Place the cursor on the first comment character of the first line.
Press Ctrl+V, then j down to the last commented line.
If the comment prefix is longer than one character, press l once for each additional character to widen the block over the whole prefix.
Press x or d to delete the selected block on every line.

The highlighted column disappears from all lines at once. If you also inserted a space after the comment character, include it in the block before deleting.

Commenting with the Substitute Command

The substitute command edits a range of lines in one pass, which makes it the better tool when you already know the line numbers or when the block is large. To comment lines 10 through 20:

:10,20s/^/#/

The range 10,20 limits the substitution to those lines, ^ matches the empty start of each line, and the replacement inserts # there. Unlike block insert, this prefixes every line in the range, including blank ones.

You can also select the lines first with V and a movement, then press :. Vim inserts the '<,'> range for you, and you complete the command:

:'<,'>s/^/#/

Other ranges work the same way: % for the whole file and .,+4 for the current line and the four below it. If you use these often, turning on line numbers makes ranges much quicker to read off the screen; see How to Show Line Numbers in Vim .

To uncomment, delete the leading character instead of inserting it:

:10,20s/^#//

This removes the first # of each line in the range and leaves lines without one untouched. For a two-character prefix such as //, escaping the slashes gets noisy, so switch the delimiter to another punctuation character:

:'<,'>s#^//##

The substitute command accepts almost any punctuation as its separator, and using # here keeps the // readable. The full syntax, including flags and confirmation mode, is covered in Vim Find and Replace .

Keeping Indentation with :normal

Both methods above put the comment character in column one. To insert it in front of the first non-blank character instead, preserving the code’s indentation profile, run a normal mode command over the range:

:'<,'>norm I#

The :norm command replays its argument as keystrokes on every line in the range, and I in normal mode enters insert mode at the first non-blank character, so each line gets # right before its content rather than at the margin. Undo treats the whole operation as a single change, so u reverts every line at once.

Toggling Comments with gc

Modern Vim and Neovim can toggle comments with a mapping that knows each filetype’s comment syntax. Neovim 0.10 and later has it built in with no setup: select lines with V and press gc, or use gcc for the current line and gc followed by a motion, such as gcip for a paragraph. Pressing gc on commented lines uncomments them.

Vim 9.1.0375 and later bundles a similar optional comment package. Enable it for the current session with :packadd comment, or add this line to your vimrc to load it on startup:

~/.vimrcvim
packadd comment

After loading the package, the gc mappings work as described above and pick the right comment string automatically: # in a shell script, // in C, and " in a vimrc. On older Vim versions, the widely used commentary.vim plugin provides the same familiar mappings.

If you comment code many times a day, this is the method worth adopting, since toggling with gc replaces both the comment and uncomment workflows in one mapping.

Quick Reference

For a printable quick reference, see the Vim cheatsheet .

Action	Keys or command
Comment a block	`Ctrl+V`, select lines, `Shift+I`, type `#`, `Esc`
Uncomment a block	`Ctrl+V`, select the comment column, `x`
Comment lines 10-20	`:10,20s/^/#/`
Comment a visual selection	`:'<,'>s/^/#/`
Uncomment lines 10-20	`:10,20s/^#//`
Comment after indentation	`:'<,'>norm I#`
Toggle comments (Neovim 0.10+, Vim 9.1.0375+)	select with `V`, press `gc`
Toggle the current line	`gcc`
Undo the whole operation	`u`

Conclusion

For an occasional block, Ctrl+V, Shift+I, Esc is the fastest habit to build, and :s/^/#/ handles precise ranges and blank lines. If commenting is part of your daily editing, enable the gc mappings and get toggling in both directions. For selecting larger regions to operate on, see How to Select All in Vim .

What Is an Inode in Linux

hello@linuxize.com (Linuxize) — Sun, 19 Jul 2026 09:35:00 +0200

Running out of disk space normally means that a filesystem has no free bytes left. Sometimes, however, a command fails with “No space left on device” while df -h still shows available space. One possible cause is inode exhaustion: the filesystem can store more data, but it has no free metadata records for new files. Our guide on fixing “No space left on device” when df shows free space walks through that check and the other causes of the same error.

To understand why this happens, and why filenames and file contents are stored separately, you need to know what an inode is. This guide explains what an inode stores, how it relates to filenames and hard links, and how to check inode usage.

What an Inode Is

An inode (short for “index node”) is a data structure that a Unix-style filesystem uses to store metadata about a file or directory. Each file has an inode number that identifies it within that filesystem. The same number can appear on another filesystem, so an inode number is not unique across the entire system.

The inode holds almost everything the system needs to know about the file, except for its name and, in the usual case, the data itself. It records:

The file type, such as a regular file, directory, or symbolic link
The permissions and owner and group IDs
The file size and allocated blocks
The access, data modification, and status change timestamps
The hard-link count, which is the number of directory entries pointing to the file
The block map or extents that locate the file’s data

The exact on-disk format depends on the filesystem, but these fields are the ones you see through tools such as ls and stat.

Filenames Are Separate from Inodes

The detail that surprises many users is that the filename is not stored in the inode. A directory contains entries that map names to inode numbers. When you open report.txt, the system looks up that name in the directory, finds the inode number, reads the inode, and locates the file’s data.

This separation is what makes hard links possible. A hard link is another directory entry that points to the same inode. Both names are equal, and removing one name only decreases the inode’s link count. The filesystem releases the file’s storage after the last link is removed and no process still has the file open.

For a practical comparison of the two link types, see hard links vs symbolic links .

Viewing Inode Numbers

To see the inode number of a file, use the -i option with ls:

Terminal
ls -i report.txt

output

1310720 report.txt

The first column, 1310720, is the inode number. To list inode numbers for everything in a directory, run ls -li, which adds the inode number as the leftmost column of the long listing.

To display the metadata associated with the inode, use the stat command:

Terminal
stat report.txt

output

 File: report.txt
Size: 482 Blocks: 8 IO Block: 4096 regular file
Device: 8,1 Inode: 1310720 Links: 1
Access: (0644/-rw-r--r--) Uid: ( 1000/ linuxize) Gid: ( 1000/ linuxize)
Access: 2026-01-01 14:02:11.000000000 +0100
Modify: 2026-01-01 13:55:40.000000000 +0100
Change: 2026-01-01 13:55:40.000000000 +0100
Birth: 2026-01-01 13:55:40.000000000 +0100

The Inode field shows the inode number, and Links shows the hard-link count. Change is the status change time, commonly called ctime. It changes when inode metadata such as permissions, ownership, or the link count changes. It is not the file creation time. The separate Birth field shows creation time when the filesystem supports it.

The filename appears at the top because you passed it to stat; it is not part of the inode.

How Filesystems Allocate Inodes

Inode allocation depends on the filesystem. Ext2, ext3, and ext4 create inode tables when the filesystem is formatted. This gives the filesystem a fixed inode density, so a workload that creates millions of small files can use every inode before it uses every data block.

You cannot change the inode density of an existing ext4 filesystem in place. Growing the filesystem can add block groups and more inodes, but if the filesystem cannot be expanded, the practical options are to remove unneeded files, move the workload, or recreate the filesystem with a higher inode count.

XFS and Btrfs allocate inodes dynamically from available filesystem space instead of creating one fixed inode table at format time. They can still reject new files when the filesystem runs out of usable data or metadata space, but they do not have the same fixed inode-count limit as ext4.

Checking Inode Usage

To see how many inodes the filesystem containing /var has and how many are free, pass the path to df with the -i option:

Terminal
df -i /var

output

Filesystem Inodes IUsed IFree IUse% Mounted on
/dev/sdb1 655360 655360 0 100% /var

The IUse% column is the one to watch. Here, inode usage on /var is at 100 percent even though the byte-based df -h /var might still report free space. The filesystem cannot create another file until an inode becomes available.

A large cache, session directory, mail queue, or temporary directory is a common source of inode exhaustion. GNU du can count inodes instead of bytes. The following command stays on the /var filesystem, checks two directory levels, and displays the largest totals at the bottom:

Terminal
sudo du --inodes -x -d 2 /var 2>/dev/null |
 sort -n |
 tail -20

Repeat the command on the directory with the highest count and increase the depth if needed. For other counting methods, see the guide on counting files in a directory .

Warning

Do not remove files only because a directory has a high inode count. First identify which application owns the files and use its cleanup or retention policy when one is available.

After cleanup, run df -i /var again to confirm that free inodes are available.

Conclusion

An inode connects a file’s metadata to its stored data while the directory keeps the filename separately. When a filesystem reports “No space left on device” despite having free bytes, check the affected path with df -i before deciding what to remove.

How to Select All in Vim: Copy, Delete, or Yank Every Line

hello@linuxize.com (Linuxize) — Sat, 18 Jul 2026 09:15:00 +0200

Sooner or later you will need to grab the entire contents of a file open in Vim, whether to paste a config file into a support ticket, move a script into another editor, or wipe everything and start over. In most editors that is Ctrl+A followed by Ctrl+C. Vim does not work that way, and pressing Ctrl+A increments the next number at or after the cursor instead of selecting text.

The quickest way to select all text in Vim is the ggVG command sequence in normal mode. This guide explains how it works and how to copy, delete, or run other commands on every line in the file, including copying the whole file to the system clipboard.

Selecting All Text with ggVG

To select all text in Vim, make sure you are in normal mode (press Esc if you are not), then type ggVG. The sequence is three separate commands executed one after another:

gg - Move the cursor to the first line of the file
V - Start line-wise visual mode
G - Jump to the last line, extending the selection over the whole file

Every line in the file is now highlighted. From here, Vim waits for an operator: press y to yank (copy) the selection, d to delete it, or any other visual mode command. To cancel the selection without doing anything, press Esc.

Copying (Yanking) All Lines

With the whole file selected, press y to yank it into Vim’s default register. The full sequence is ggVGy. You can then paste the text elsewhere in the same Vim session with p.

Visual mode is not required, though. If you already know you want to copy everything, the ex command :%y does the same thing without touching the selection:

:%y

The % range means “all lines”, so :%y yanks the entire file into the default register in one step. The normal mode equivalent is ggyG, which yanks from the first line to the last without entering visual mode.

To duplicate the whole file below itself, run :%y followed by G and p: yank all lines, jump to the end, and paste.

Copying All Lines to the System Clipboard

Yanked text normally stays inside Vim. To paste the file into a browser, email, or another application, copy it to the system clipboard using the "+ register:

ggVG"+y - Select all, then yank the selection to the system clipboard
gg"+yG - Yank all lines to the system clipboard without visual mode
:%y+ - Yank all lines to the system clipboard with an ex command

After any of these, paste into the other application with the regular paste shortcut for your desktop environment.

Info

The "+ register requires Vim compiled with the +clipboard feature. Check with vim --version | grep clipboard. If the output shows -clipboard, install a build with clipboard support, such as vim-gtk3 on Debian and Ubuntu systems.

If installing another Vim build is not an option, you can pipe the buffer to a clipboard utility instead. On X11 systems with xclip installed:

:%w !xclip -selection clipboard

This writes the whole buffer to the xclip command, which places it on the clipboard. On Wayland, use wl-copy from the wl-clipboard package the same way:

:%w !wl-copy

For more on registers and clipboard integration, see How to Copy, Cut and Paste in Vim .

Deleting All Lines

To select everything and delete it, use ggVGd, or skip visual mode with ggdG (move to the first line, then delete to the last line). The fastest option is again the ex command with the % range:

:%d

All lines are removed and the file is left with a single empty line. The deleted text lands in the default register, so an accidental :%d is easy to reverse: press u to undo , or paste the text back with p.

To delete every line without replacing the current contents of the unnamed register, send the deleted text to the black hole register:

:%d _

This preserves whatever was already available for pasting with p.

For ranges, patterns, and more deletion commands, see How to Delete Lines in Vim .

Running Other Commands on the Whole File

Selecting all text is not limited to copy and delete. With ggVG active, any visual mode operator applies to the entire file:

ggVG= - Re-indent every line (same as gg=G)
ggVGu - Convert the whole file to lowercase
ggVGU - Convert the whole file to uppercase
ggVG> - Shift every line one indent level to the right

For find and replace across the whole file, you do not need a selection at all: the substitute command takes the same % range, as in :%s/old/new/g. See Vim Find and Replace for the full syntax.

Quick Reference

For a printable quick reference, see the Vim cheatsheet .

Command	Description
`ggVG`	Select all lines
`ggVGy`	Select all and yank (copy)
`ggVGd`	Select all and delete
`ggVG"+y`	Select all and copy to the system clipboard
`ggyG`	Yank all lines without visual mode
`ggdG`	Delete all lines without visual mode
`:%y`	Yank all lines (ex command)
`:%y+`	Yank all lines to the system clipboard
`:%d`	Delete all lines
`:%d _`	Delete all lines without replacing the unnamed register
`gg=G`	Re-indent the whole file
`:%s/old/new/g`	Replace across the whole file
`u`	Undo the last change

Conclusion

Use ggVG when you want to see the whole-file selection before choosing an operator. When the action is already clear, the % range is shorter, as in :%y, :%d, or :%s/old/new/g. For selecting a smaller block to comment out, see How to Comment Out Multiple Lines in Vim .

Email Authentication Explained: SPF, DKIM, and DMARC

hello@linuxize.com (Linuxize) — Fri, 17 Jul 2026 18:20:00 +0200

When mail from your domain lands in spam or is rejected, authentication is one of the first things to check. Google and Yahoo require all senders to use at least SPF or DKIM, while bulk senders must use SPF, DKIM, and DMARC. These mechanisms associate mail with your domain, but they do not guarantee inbox placement on their own.

This guide explains what each mechanism does, how the three work together, what the records look like, and how to verify your setup from the command line.

Why Email Needs Authentication

SMTP, the protocol that moves mail between servers, was designed without sender verification. Any server can connect to any other server and claim to send mail from example.com; nothing in the protocol stops it. That is why spammers and phishers can forge the From address of any domain.

Authentication closes this gap with DNS and message signing. SPF tells a receiver whether the connecting server is authorized for the envelope sender domain. DKIM associates a cryptographic signature with a signing domain. DMARC checks whether a passing SPF or DKIM identity aligns with the domain in the visible From address, then publishes the domain owner’s handling preference for failures.

How the Three Work Together

Each mechanism covers a different part of the delivery:

SPF publishes which servers may send mail for your domain. Receivers check the connecting server’s IP against the list.
DKIM adds a cryptographic signature to each message. Receivers verify it against a public key in DNS to confirm that the holder of the private key signed the message and that the signed content has not changed.
DMARC ties the result to the visible From address, publishes a handling preference for failures, and can request reports from participating receivers.

Using all three gives you better spoofing protection and diagnostic data even when your sending volume is below provider bulk-sender thresholds.

SPF: Authorizing Sending Servers

SPF (Sender Policy Framework) is a TXT record on the domain itself listing authorized senders:

txt
example.com. 3600 IN TXT "v=spf1 mx ip4:203.0.113.10 include:_spf.google.com -all"

Reading the record left to right: v=spf1 identifies it as SPF, mx authorizes the servers named in the domain’s MX records, ip4:203.0.113.10 authorizes a specific address, and include:_spf.google.com pulls in another domain’s SPF list, which is how you authorize a provider such as Google Workspace to send for you.

The final mechanism sets the SPF result for everything not listed:

-all - Returns fail, a clear statement that unlisted servers are not authorized.
~all - Returns softfail, a weaker statement that the server is probably not authorized.
+all - Returns pass for every server, which defeats the purpose of SPF.

The receiving system decides how each result affects delivery. SPF itself does not require a specific action for fail or softfail.

Two rules prevent many common SPF errors. A domain must have exactly one SPF record because multiple records produce permerror. Evaluation can use at most 10 DNS-querying terms, including include, mx, and a; chained provider records can consume that limit quickly.

SPF also has a blind spot: it checks the envelope sender used during the SMTP transaction, not the From header the user sees. Ordinary forwarding often causes SPF to fail because the forwarder’s IP is not in the original sender’s record, unless the forwarder rewrites the envelope sender with Sender Rewriting Scheme (SRS). That is where DKIM helps.

DKIM: Signing Messages

DKIM (DomainKeys Identified Mail) uses public-key cryptography. Your mail server signs each outgoing message with a private key, adding a DKIM-Signature header. Receivers fetch the matching public key from DNS and verify the signature. A valid result shows that the holder of the private key signed the message and that the signed headers and body have not changed. It does not show that the message content is trustworthy.

The public key lives in a TXT record under a selector name, which allows multiple keys per domain:

txt
default._domainkey.example.com. 3600 IN TXT "v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A..."

Here default is the selector; the signing server puts the selector name in each signature header so receivers know which key to fetch. The p= value is the base64-encoded public key, typically 2048-bit RSA.

Unlike SPF, DKIM requires software on the mail server to do the signing. On a self-hosted Postfix setup this is usually handled by a milter such as OpenDKIM or by Rspamd , which generates the key pair and signs outgoing mail. Hosted providers generate the keys for you and tell you which records to publish.

DKIM generally survives simple forwarding because the signature travels with the message. A forwarding service, mailing list, or security gateway that changes a signed header or the message body can invalidate it.

DMARC: Policy and Reporting

SPF and DKIM authenticate domains that are not necessarily the one shown in the From address. DMARC (Domain-Based Message Authentication, Reporting, and Conformance) adds that connection and publishes a handling preference in a TXT record at _dmarc:

txt
_dmarc.example.com. 3600 IN TXT "v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com"

The p= tag describes how the domain owner views mail that fails DMARC:

p=none - Expresses no DMARC-based handling preference and is the normal starting point for monitoring.
p=quarantine - Says the domain owner considers failing mail suspicious. A receiver may place it in spam or apply other scrutiny.
p=reject - Says the domain owner considers the failed use of the domain invalid.

These values are preferences, not commands. A receiving system can use other signals when deciding whether to accept, quarantine, or reject a message. The current DMARC standard specifically says that receivers must not reject mail solely because the sender publishes p=reject.

A message passes DMARC when at least one of SPF or DKIM passes and aligns. With the default relaxed alignment, the authenticated domain and the From domain must share the same organizational domain, so bounce.example.com can align with example.com. Strict alignment, enabled with aspf=s or adkim=s, requires identical domains.

Alignment is the part that blocks a common spoofing technique. An attacker can pass SPF for a domain they control while displaying your domain in the From header, but the result does not align and DMARC fails.

The rua= tag requests aggregate XML reports from participating receivers, commonly sent daily. Reports show which systems use your domain and how their messages authenticate. Start with p=none, identify legitimate services such as CRMs and monitoring tools, and fix their SPF or DKIM before considering enforcement. A report-processing service or self-hosted analyzer is easier to use than reading the raw XML. Do not treat p=reject as an automatic endpoint, especially for domains whose users send through mailing lists or forwarding services.

Checking Your Records with dig

All three mechanisms use DNS TXT records, although DKIM also requires a working signer. You can verify what the world sees with dig. Check SPF on the domain itself:

Terminal
dig +short example.com TXT

output

"v=spf1 mx ip4:203.0.113.10 include:_spf.google.com -all"

The answer may include unrelated TXT records. Confirm that exactly one returned string begins with v=spf1.

DKIM requires knowing the selector; check the record your signer uses:

Terminal
dig +short default._domainkey.example.com TXT

output

"v=DKIM1; k=rsa; " "p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A..."

DNS can split a long public key into adjacent quoted strings. They form one TXT record when concatenated.

And DMARC always lives at the _dmarc subdomain:

Terminal
dig +short _dmarc.example.com TXT

output

"v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com"

If a record is missing from the output, receivers cannot see it either. For more query options, see our dig command guide . For an end-to-end test, send a message to a Gmail address and use “Show original”, which displays PASS or FAIL for SPF, DKIM, and DMARC on the received message.

Troubleshooting

A new TXT record does not appear
Check that you used the correct DNS host name: @ or the bare domain for SPF, <selector>._domainkey for DKIM, and _dmarc for DMARC. DNS caches may continue returning the previous answer until the record’s TTL expires.

SPF returns permerror
Look for multiple TXT records beginning with v=spf1 and merge them into one. If there is only one record, count its DNS-querying terms and the terms inside every include; exceeding the 10-lookup limit also causes permerror.

SPF or DKIM passes but DMARC fails
The passing identity is probably not aligned with the visible From domain. Inspect the Authentication-Results header for the SPF envelope domain and the DKIM d= signing domain. Configure a custom return path or DKIM signing domain under your own organizational domain.

DKIM reports a body hash mismatch
Something changed the body after it was signed, often a mailing list footer, security gateway, or forwarding service. Compare a directly delivered message with the modified path, and make sure the published selector and key match the active signer.

Quick Reference

Mechanism	What the receiver checks	DNS record location	Example value
SPF	Connecting IP against the envelope sender policy	TXT at `example.com`	`v=spf1 mx -all`
DKIM	Signature against the selector’s public key	TXT at `<selector>._domainkey.example.com`	`v=DKIM1; k=rsa; p=<key>`
DMARC	SPF or DKIM alignment with the visible From domain	TXT at `_dmarc.example.com`	`v=DMARC1; p=none; rua=mailto:...`

Conclusion

SPF authorizes sending infrastructure, DKIM associates a valid signature with a domain, and DMARC checks alignment with the visible From address. If you run your own stack, our guides on setting up Postfix and Dovecot and integrating Rspamd cover the server-side configuration, including DKIM signing. For the other record types you will meet in a DNS panel, see our DNS record types guide .

sha256sum Cheatsheet

hello@linuxize.com (Linuxize) — Thu, 16 Jul 2026 08:40:00 +0200

Generate Checksums

Print a digest for one or more files.

Command	Description
`sha256sum file.iso`	Print the SHA-256 digest of a file
`sha256sum file1 file2`	One digest line per file
`sha256sum *.tar.gz > SHA256SUMS`	Save digests to a checksum file
`printf '%s' "text" \| sha256sum`	Hash a string from stdin
`find dir/ -type f -exec sha256sum {} +`	Hash every file in a directory tree

Verify Checksums

Check files against a checksum list with -c.

Command	Description
`sha256sum -c SHA256SUMS`	Verify every file in the list
`sha256sum -c --ignore-missing SHA256SUMS`	Verify only the files that are present
`grep file.iso SHA256SUMS \| sha256sum -c -`	Verify a single file from a larger list
`echo "DIGEST file.iso" \| sha256sum -c -`	Compare against a pasted digest (two spaces)
`sha256sum -c --quiet SHA256SUMS`	Print failures only, skip `OK` lines

Useful Options

Flags shared by sha256sum, md5sum, and the other GNU hash tools.

Option	Description
`-c`, `--check`	Read digests from a file and verify them
`--quiet`	Do not print `OK` for verified files
`--status`	Print nothing; report via exit status only
`--warn`	Warn about improperly formatted lines
`--strict`	Exit non-zero when a line is badly formatted
`--ignore-missing`	Skip listed files that do not exist
`--tag`	BSD-style output, `SHA256 (file) = digest`
`-b`, `--binary`	Mark files with `*` in the output
`-z`, `--zero`	End output lines with NUL instead of newline

Scripting and Exit Codes

Automate checks in scripts and CI jobs.

Command	Description
`sha256sum -c --status SHA256SUMS && echo ok`	Branch on the verification result
`sha256sum -c SHA256SUMS \|\| exit 1`	Abort a script on any mismatch
`[ "$(sha256sum < f)" = "$(sha256sum < g)" ]`	Compare two files by digest
`sha256sum file \| cut -d' ' -f1`	Extract the bare digest value

Other Hash Commands

Same interface, different algorithms.

Command	Description
`md5sum file`	128-bit MD5; corruption checks only, not security
`sha1sum file`	160-bit SHA-1; legacy, avoid for new uses
`sha512sum file`	512-bit SHA-2 digest
`b2sum file`	BLAKE2; fast modern alternative
`cksum -a sha256 file`	Unified hash tool in newer coreutils

Troubleshooting

Quick checks for common verification problems.

Issue	Check
Digest mismatch on a download	Re-download, ideally from a different mirror
`no properly formatted checksum lines found`	Fix CRLF endings with `dos2unix`, check the file format
`No such file or directory` with `-c`	Run from the directory that holds the listed files
Every other release fails as missing	Add `--ignore-missing` to scope the check
Digest source is untrusted	Verify the GPG signature on the checksum file itself

Full walkthroughs for checksums and signing.

Guide	Description
Verify a Checksum in Linux	Full `sha256sum` and `md5sum` tutorial
Encrypt and Decrypt Files with GPG	Work with GPG keys and signatures
wget Command Examples	Download files and checksum lists

What Is stdin, stdout, and stderr in Linux

hello@linuxize.com (Linuxize) — Thu, 16 Jul 2026 08:30:00 +0200

When a Linux command reads text you type, sends results to the terminal, or prints an error beside them, it is using a set of connections prepared before the program starts. These connections are standard input, standard output, and standard error, usually shortened to stdin, stdout, and stderr.

The shell can connect these streams to a terminal, file, pipe, or another destination without changing the program itself. This guide explains what the three standard streams do, why they use file descriptors 0, 1, and 2, and how shell redirection changes their destinations.

The Three Standard Streams

A process normally starts with three open file descriptors inherited from its parent. When you launch a command from an interactive shell, the shell usually connects all three to your current terminal:

Stream	File descriptor	Purpose	Interactive default
stdin	`0`	Input read by the program	Terminal input
stdout	`1`	Normal program output	Terminal display
stderr	`2`	Errors and diagnostic messages	Terminal display

Describing stdin as the keyboard is a useful shortcut, but the program actually reads from a terminal device. The terminal handles keyboard input and passes it to the program. In a script or pipeline, stdin may instead come from a file or another command.

The numbers matter because shell redirection syntax uses them. stdout and stderr both appear on the terminal by default, so they can look like one stream even though they remain separate. A script can save normal results in one file while sending errors somewhere else.

Seeing stdout and stderr Separately

The following commands print one normal message and one warning:

Terminal
printf '%s\n' "backup complete"
printf '%s\n' "warning: archive not found" >&2

output

backup complete
warning: archive not found

Both lines appear in the same terminal, but they traveled through different streams. The first printf writes to stdout. The >&2 redirection sends the second command’s output to stderr, which lets a script report a diagnostic without mixing it into data that another command may need to process.

Changing Stream Destinations

The shell sets up redirections before it starts the command. The program continues reading and writing the same file descriptors without needing to know whether they point to a terminal, file, or pipe.

The > operator sends stdout to a file, creating the file or replacing its contents:

Terminal
ls /etc > files.txt

Nothing appears on the terminal because the directory listing went to files.txt. Since > uses stdout when no descriptor is specified, > files.txt and 1> files.txt have the same effect.

stderr remains connected to the terminal unless you redirect descriptor 2. This command requests one existing path and one missing path:

Terminal
ls /etc /nonexistent > files.txt

output

ls: cannot access '/nonexistent': No such file or directory

The successful listing went into files.txt, while the error stayed visible because it traveled through stderr. Redirect descriptor 2 to capture it separately:

Terminal
ls /etc /nonexistent > files.txt 2> errors.txt

Now normal results are in files.txt and the diagnostic is in errors.txt.

To save both streams in one file using portable shell syntax, redirect stdout first and then duplicate its destination for stderr:

Terminal
command > output.log 2>&1

The 2>&1 expression makes file descriptor 2 point to the current destination of file descriptor 1. Redirections are processed from left to right, so reversing their order produces a different result. See how to redirect stderr to stdout in Bash for combining, appending, piping, and discarding output.

Input redirection works in the other direction. The < operator connects a file to stdin:

Terminal
sort < names.txt

Here sort reads from names.txt instead of the terminal. Many commands also accept a filename as an argument, but input redirection works for any command designed to read from stdin.

How Pipes Use the Streams

A pipe (|) connects the stdout of one command to the stdin of the next, so data can move between programs without a temporary file:

Terminal
ls /etc | grep conf

The stdout of ls becomes the stdin of grep. A regular pipe carries stdout, not stderr, so an error from ls still appears on the terminal instead of passing to grep. The Linux pipes guide covers longer pipelines, error handling, and pipefail. To show output on the terminal while also saving it, use the tee command .

Quick Reference

For a printable quick reference, see the Bash cheatsheet .

Descriptor or syntax	Effect
`0`	stdin
`1`	stdout
`2`	stderr
`command < file`	Read stdin from `file`
`command > file`	Write stdout to `file`, replacing its contents
`command >> file`	Append stdout to `file`
`command 2> file`	Write stderr to `file`
`command > file 2>&1`	Write stdout and stderr to the same file
`command 2>/dev/null`	Discard stderr
`cmd1 \| cmd2`	Connect stdout from `cmd1` to stdin for `cmd2`

Conclusion

When a command sends data somewhere unexpected, identify whether it is using file descriptor 0, 1, or 2, then read its redirections from left to right. That habit makes shell pipelines and logging commands much easier to follow.

How to Configure Networking with Netplan on Ubuntu

hello@linuxize.com (Linuxize) — Wed, 15 Jul 2026 10:30:00 +0200

Since Ubuntu 17.10, networking is configured with Netplan rather than the old /etc/network/interfaces file. You write a short YAML description of how each interface should behave, and Netplan translates it into configuration for the back end that actually manages the network. This keeps the configuration in one place and makes it easy to read, but the YAML syntax trips up people who are used to the older format.

This guide explains how Netplan works and how to configure DHCP, static addresses, DNS, Wi-Fi, and bridges, then how to apply the changes without locking yourself out of a remote server.

Quick Reference

Task	Command
List Netplan files	`ls /etc/netplan/`
Show interface names	`ip link`
Show the merged configuration	`sudo netplan get`
Check configuration for errors	`sudo netplan generate`
Apply changes with rollback	`sudo netplan try`
Apply changes directly	`sudo netplan apply`
Show current network state	`sudo netplan status`

How Netplan Works

Administrators store Netplan YAML files in /etc/netplan. Netplan reads those files and generates configuration for one of two back ends, called renderers:

systemd-networkd - The usual renderer on Ubuntu Server. It runs without a graphical environment and suits headless machines.
NetworkManager - The usual renderer on Ubuntu Desktop. It handles Wi-Fi, VPNs, and interface switching, and integrates with the GNOME settings panel.

When you run netplan apply, Netplan parses the YAML, writes back-end configuration, and tells the renderer to reload it. Syntax errors stop this process, but a valid configuration with the wrong address or route can still interrupt the connection.

List the files Netplan currently reads:

Terminal
ls /etc/netplan/

output

50-cloud-init.yaml

The exact name depends on how the system was installed. Common names include 00-installer-config.yaml, 01-netcfg.yaml, and 50-cloud-init.yaml. Files are read in alphanumeric order, and later files override earlier ones, so a 90-custom.yaml takes precedence over 50-cloud-init.yaml.

The examples below use /etc/netplan/99-custom.yaml, which loads after the common installer and cloud-init filenames. Create the file with a text editor, or edit an existing file instead if you already manage it directly:

Terminal
sudo nano /etc/netplan/99-custom.yaml

Netplan configuration files should be readable and writable only by root. After saving the file, set the required permissions before applying changes:

Terminal
sudo chmod 600 /etc/netplan/*.yaml

The Structure of a Netplan File

Every Netplan file starts with a top-level network key. Under it, you can set the configuration version, choose a renderer, and list interfaces by type, such as ethernets, wifis, bridges, or vlans. Netplan defaults to version 2 and the networkd renderer when these keys are omitted, but keeping them explicit makes the file easier to understand:

/etc/netplan/99-custom.yamlyaml
network:
 version: 2
 renderer: networkd
 ethernets:
 ens3:
 dhcp4: true

Version 2 is the only supported Netplan YAML format. The renderer chooses the back end, and the interface name (ens3 here) must match a real interface on the system. Find the interface names with the ip link command:

Terminal
ip link

YAML is sensitive to indentation, so use spaces, never tabs, and keep nested keys aligned. A single misaligned line is the most common reason a configuration does not apply.

Configuring DHCP

The example above already enables DHCP for IPv4 with dhcp4: true. To also enable DHCP for IPv6, add dhcp6:

/etc/netplan/99-custom.yamlyaml
network:
 version: 2
 renderer: networkd
 ethernets:
 ens3:
 dhcp4: true
 dhcp6: true

This is the default configuration on most fresh installs, where the router assigns the address automatically.

Configuring a Static IP Address

To assign a fixed address, disable DHCP and set the address, gateway, and nameservers manually:

/etc/netplan/99-custom.yamlyaml
network:
 version: 2
 renderer: networkd
 ethernets:
 ens3:
 dhcp4: false
 addresses:
 - 192.168.1.50/24
 routes:
 - to: default
 via: 192.168.1.1
 nameservers:
 addresses:
 - 8.8.8.8
 - 1.1.1.1

The address uses CIDR notation, so /24 is the equivalent of the 255.255.255.0 netmask. The routes block replaces the deprecated gateway4 key that older guides still use. You can assign more than one address to an interface by adding extra lines under addresses. For a focused walkthrough of static addressing on both Server and Desktop, see the dedicated guide on setting a static IP address on Ubuntu .

Configuring Wi-Fi

On a desktop or laptop, Netplan can connect to a wireless network through the wifis section. Ubuntu Desktop usually uses the NetworkManager renderer:

/etc/netplan/99-custom.yamlyaml
network:
 version: 2
 renderer: NetworkManager
 wifis:
 wlp2s0:
 dhcp4: true
 access-points:
 "MyNetwork":
 password: "your-wifi-password"

Replace wlp2s0 with your wireless interface name, MyNetwork with the network SSID, and the password with your own.

Warning

The Wi-Fi password is stored in plain text inside the Netplan file. Keep the file permissions set to 600, and never commit Netplan files containing credentials to version control.

Creating a Network Bridge

A bridge joins several interfaces into one logical network, which is useful when you run virtual machines or containers that need direct access to the physical network. The example below creates a bridge named br0 that takes its address from DHCP and includes the physical interface ens3:

/etc/netplan/99-custom.yamlyaml
network:
 version: 2
 renderer: networkd
 ethernets:
 ens3:
 dhcp4: false
 bridges:
 br0:
 interfaces:
 - ens3
 dhcp4: true

Notice that the physical interface has DHCP disabled, because the bridge now owns the address rather than the interface itself.

Applying the Configuration

After editing a file, you can check it for syntax errors before doing anything to the live network. The generate command builds the back-end configuration and reports any problems:

Terminal
sudo netplan generate

When you connect over SSH, never run netplan apply blindly, because a broken configuration can drop your connection. Use netplan try instead, which applies the configuration temporarily and rolls back automatically if you do not confirm it within the timeout:

Terminal
sudo netplan try

If the connection holds and the configuration is correct, confirm it at the prompt. Confirmation makes the tested configuration permanent, so you do not need to run netplan apply afterward.

When you are working from a local console and want to apply the configuration directly, run:

Terminal
sudo netplan apply

On recent Ubuntu releases you can review the resulting state, including addresses, routes, and DNS, with the status command:

Terminal
sudo netplan status

Verify the assigned address directly with ip addr :

Terminal
ip addr show dev ens3

Troubleshooting

Changes do not take effect after netplan apply
Run sudo netplan generate and fix any YAML error it reports. If the file is valid, confirm that the interface name matches ip link, then run sudo netplan get to check whether a later file overrides your settings.

The configuration warns that gateway4 is deprecated
Replace the gateway4 line with a routes block that uses to: default and via: gateway_ip.

Wi-Fi does not connect
Make sure the renderer is set to NetworkManager, the SSID is quoted exactly, and the interface name matches the output of ip link.

The static address reverts after a reboot on a cloud instance
Cloud images often regenerate Netplan files with cloud-init. Disable that by creating /etc/cloud/cloud.cfg.d/99-disable-network-config.cfg with the content network: {config: disabled}, then reboot.

Conclusion

Netplan centralizes Ubuntu networking in a few readable YAML files, with systemd-networkd driving servers and NetworkManager driving desktops. When you edit these files over SSH, reach for sudo netplan try first so a mistake rolls back on its own instead of cutting off your access.

Docker Compose Cheatsheet

hello@linuxize.com (Linuxize) — Wed, 15 Jul 2026 09:40:00 +0200

Start & Stop

Bring services up and take them down.

Command	Description
`docker compose up`	Create and start all services
`docker compose up -d`	Start in background (detached)
`docker compose up -d --build`	Rebuild images before starting
`docker compose up -d service`	Start one service and its dependencies
`docker compose up --wait`	Detach and wait until services are running or healthy
`docker compose stop`	Stop services without removing them
`docker compose start`	Start stopped services
`docker compose restart`	Restart all services
`docker compose down`	Stop and remove containers and networks
`docker compose down -v`	Also remove project-owned named and anonymous volumes

Inspect & Logs

Check service status and output.

Command	Description
`docker compose ps`	List running project containers
`docker compose ps -a`	List all project containers, including stopped
`docker compose logs`	Show logs for all services
`docker compose logs -f service`	Follow logs for one service
`docker compose logs --tail 100 service`	Show last 100 log lines
`docker compose top`	Running processes per service
`docker compose events`	Stream container events
`docker compose port service 80`	Host port mapped to container port 80
`docker compose ls`	List running Compose projects

Exec & Run

Run commands inside service containers.

Command	Description
`docker compose exec service sh`	Open shell in a running service
`docker compose exec service command`	Run command in a running service
`docker compose exec -u root service sh`	Shell as a specific user
`docker compose run --rm service command`	Run a one-off container
`docker compose run --rm --no-deps service sh`	One-off without starting dependencies
`docker compose cp service:/path ./local`	Copy from a service container
`docker compose cp ./local service:/path`	Copy into a service container
`docker compose attach service`	Attach to a service’s output

Build & Images

Build, pull, and push service images.

Command	Description
`docker compose build`	Build all service images
`docker compose build service`	Build one service image
`docker compose build --no-cache`	Build without layer cache
`docker compose pull`	Pull service images
`docker compose push`	Push service images to a registry
`docker compose images`	List images used by services
`docker compose create`	Create containers without starting them
`docker compose watch`	Sync files and rebuild on changes

Compose File Basics

Core service directives in docker-compose.yml .

Directive	Description
`services:`	Top-level map of containers to run
`image: postgres:16`	Run an existing image
`build: .`	Build from a Dockerfile in a path
`command: ["npm", "run", "dev"]`	Override the image default command
`entrypoint: ["/entrypoint.sh"]`	Override the image entrypoint
`ports: ["8080:80"]`	Publish host port 8080 to container port 80
`volumes: ["db_data:/var/lib/postgresql/data"]`	Mount a named volume
`environment: ["DEBUG=1"]`	Set environment variables
`env_file: .env.local`	Load variables from a file
`container_name: myapp`	Fixed container name (prevents scaling)

Health & Startup Order

Control dependency order and restart behavior.

Directive	Description
`depends_on: [db]`	Start db before this service
`depends_on: {db: {condition: service_healthy}}`	Wait until db passes its health check
`healthcheck: {test: ["CMD", "pg_isready"]}`	Define a health probe
`interval`, `timeout`, `retries`, `start_period`	Health check timing fields
`restart: "no"`	Never restart (default)
`restart: always`	Always restart
`restart: on-failure`	Restart on non-zero exit
`restart: unless-stopped`	Restart unless manually stopped

Environment Variables

Pass configuration into services. Keep .env files out of version control; use Compose secrets for sensitive data.

Syntax	Description
`environment: ["API_KEY=${API_KEY}"]`	Interpolate from the shell or `.env`
`${VAR:-default}`	Use default when VAR is unset or empty
`${VAR:?message}`	Fail with message when VAR is unset or empty
`env_file: .env.local`	Load variables from a specific file
`.env`	Loaded automatically from the project directory
`docker compose --env-file .env.prod up -d`	Use an alternate env file
`docker compose config`	Render final config with variables resolved

Projects & Files

Compose looks for compose.yaml first; docker-compose.yml is still supported.

Syntax	Description
`docker compose -f compose.prod.yaml up -d`	Use a specific file
`docker compose -f base.yml -f override.yml up -d`	Merge files; later files can add, merge, or override values
`docker compose -p myproject up -d`	Set the project name
`COMPOSE_FILE=base.yml:override.yml`	Default files via environment variable
`COMPOSE_PROJECT_NAME=myproject`	Default project name
`docker compose config`	Validate and print the merged config
`docker compose config --services`	List service names
`docker compose version`	Show Compose version

Profiles & Scaling

Run optional services and multiple replicas.

Syntax	Description
`profiles: ["debug"]`	Assign a service to a profile
`docker compose --profile debug up -d`	Start with a profile enabled
`COMPOSE_PROFILES=debug,test`	Enable profiles via environment variable
`docker compose up -d --scale worker=3`	Run 3 replicas of a service
`docker compose up -d --no-deps service`	Start or update one service without its dependencies
`docker compose up -d --force-recreate`	Recreate containers even without changes

Cleanup

Remove what a project created.

Command	Description
`docker compose down`	Remove containers and networks
`docker compose down -v`	Also remove project-owned named and anonymous volumes
`docker compose down --rmi all`	Also remove images
`docker compose down --remove-orphans`	Remove containers for removed services
`docker compose rm`	Remove stopped service containers
`docker compose stop service`	Stop a single service

tree Command in Linux: Display Directory Structure

hello@linuxize.com (Linuxize) — Mon, 13 Jul 2026 08:40:00 +0200

The ls command shows the contents of one directory at a time. When you want to see how a whole project is laid out, running ls in every subdirectory gets old fast. The tree command solves this by listing a directory and everything below it as an indented tree, so you can take in the entire hierarchy at a glance.

This guide explains how to install tree and use it to display directory structures, limit depth, filter files, show sizes, and save the output to a file.

Installing tree

tree is a small utility that is not installed by default on most distributions, but it is available in the standard repositories.

On Ubuntu, Debian, and derivatives:

Terminal
sudo apt update
sudo apt install tree

On Fedora, RHEL, and derivatives:

Terminal
sudo dnf install tree

Once installed, verify the version:

Terminal
tree --version

Basic Usage

The general syntax of the tree command is as follows:

txt
tree [OPTIONS] [DIRECTORY]

When invoked without arguments, tree lists the current directory recursively. For example, running it inside a small Node.js project produces output like this:

Terminal
tree

output

.
├── package.json
├── README.md
└── src
├── app.js
└── utils
└── helpers.js
3 directories, 4 files

Each level of nesting is indented and connected with line-drawing characters, so helpers.js is clearly inside src/utils. The report line at the bottom counts everything in the listing, and since tree 2.1 that count includes the starting directory itself.

To list a different directory, pass its path as an argument:

Terminal
tree /etc/nginx

Limiting the Depth

On a large directory the default recursive listing can print thousands of lines. The -L option limits how many levels deep tree descends:

Terminal
tree -L 2 /var/log

With -L 2, tree shows the contents of /var/log and one level of subdirectories, then stops. This is usually the first option to reach for when a plain tree floods the terminal.

Showing Hidden Files

Like ls, tree skips hidden files by default. Use -a to include entries that start with a dot:

Terminal
tree -a

output

.
├── .env
├── .git
│ ├── config
│ └── HEAD
├── package.json
├── README.md
└── src
├── app.js
└── utils
└── helpers.js
4 directories, 7 files

Notice that .env and the .git directory now show up in the listing. Combining -a with -L 1 is a quick way to audit what actually lives in a directory, dotfiles included.

Listing Directories Only

When you only care about the folder structure and not the files, use -d:

Terminal
tree -d

output

.
└── src
└── utils
3 directories

The files are gone and only the directory skeleton remains, which is handy for documenting a project layout.

Displaying File Sizes

The -s option prints the size of each file in bytes. In practice you will almost always use -h instead, which prints the sizes in human-readable units:

Terminal
tree -h

output

[4.0K] .
├── [ 412] package.json
├── [1.2K] README.md
└── [4.0K] src
├── [3.4K] app.js
└── [4.0K] utils
└── [ 890] helpers.js
3 directories, 4 files

The size shown next to a directory is the size of the directory entry itself, not its contents. To get cumulative directory sizes, add --du:

Terminal
tree --du -h

With --du, each directory reports the total size of everything inside it, similar to the du command . This option reads the full hierarchy before printing, so it can take time and consume extra memory on a large directory tree.

Filtering by Pattern

The -P option lists only files that match a wildcard pattern. Quote the pattern so the shell does not expand it first:

Terminal
tree -P "*.js"

Directories are still shown even when they contain no matching files. Add --prune to remove the empty branches:

Terminal
tree -P "*.js" --prune

output

.
└── src
├── app.js
└── utils
└── helpers.js
3 directories, 2 files

Only the JavaScript files and the directories that lead to them remain. The patterns follow the same rules as shell globs; see our guide to Linux wildcards and globbing for the full syntax.

The -I option does the opposite and excludes matching entries. Multiple patterns are separated with |:

Terminal
tree -I "node_modules|.git"

This is the most common tree invocation in day-to-day work, since it hides the noise of dependency and VCS directories. In tree 2.0 and later you can also pass --gitignore to skip everything that the project’s .gitignore files exclude.

Printing Full Paths

By default each entry shows only its own name. The -f option prints the full path prefix instead:

Terminal
tree -f src

output

src
├── src/app.js
└── src/utils
└── src/utils/helpers.js
2 directories, 2 files

Full paths are useful in saved listings because each entry keeps its context even when you view the output away from the original directory.

Sorting the Output

Entries are sorted alphabetically by default. The most useful alternatives are:

-t - Sort by last modification time, oldest first.
-r - Reverse the current sort order.
-v - Sort version strings naturally, so file2 comes before file10.
--sort=size - Sort by file size.

Note that -t places the oldest entries first, which is the opposite of what ls -t does. To see the most recently modified files at the top of each directory, combine it with -r:

Terminal
tree -t -r

Saving the Output to a File

The -o option writes the tree to a file instead of the terminal:

Terminal
tree -o structure.txt

The line-drawing characters are UTF-8 by default. If the file is destined for an environment that cannot render them, force plain ASCII connectors:

Terminal
tree --charset=ascii -o structure.txt

tree can also emit structured formats directly: -J produces JSON, -X produces XML, and -H <baseHref> produces a browsable HTML listing:

Terminal
tree -J -L 2 > structure.json

Quick Reference

Command	Description
`tree`	List the current directory recursively
`tree -L 2`	Limit the listing to two levels
`tree -a`	Include hidden files
`tree -d`	Directories only
`tree -h --du`	Human-readable cumulative sizes
`tree -P "*.js" --prune`	Only files matching a pattern
`tree -I "node_modules\|.git"`	Exclude matching entries
`tree -f`	Print full paths
`tree -o file.txt`	Write the output to a file
`tree -J`	Output JSON

Conclusion

The tree command turns a nested directory hierarchy into a single readable listing, and options such as -L, -I, and --du keep the output focused on what you actually need. If you want the same tree-style view for running processes instead of files, take a look at the pstree command .

How to Encrypt and Decrypt Files with GPG

hello@linuxize.com (Linuxize) — Sun, 12 Jul 2026 11:30:00 +0200

Sooner or later you end up with a file that should not sit around in plain text: a database dump with customer data, a document with credentials, or a backup you want to park on cloud storage you do not fully trust. Encrypting the file before it leaves your machine solves the problem, and GPG is the standard tool for the job on Linux.

GnuPG (GNU Privacy Guard), invoked as gpg, implements the OpenPGP standard. It supports two ways of encrypting a file: symmetric encryption, where a single passphrase both locks and unlocks the file, and public key encryption, where anyone can encrypt a file for you but only your private key can decrypt it.

This guide explains how to encrypt and decrypt files with gpg using both methods, how to exchange encrypted files with other people, and how to handle encryption in scripts.

Quick Reference

Task	Command
Encrypt with a passphrase	`gpg -c file`
Decrypt to a file	`gpg -o file -d file.gpg`
Generate a key pair	`gpg --full-generate-key`
List public keys	`gpg --list-keys`
Export your public key	`gpg --armor --export you@example.com > public.asc`
Import someone’s public key	`gpg --import public.asc`
Encrypt for a recipient	`gpg -e -r name@example.com file`
Sign and encrypt	`gpg -s -e -r name@example.com file`
Encrypt a directory	`tar czf - dir \| gpg -c -o dir.tar.gz.gpg`
Decrypt a directory	`gpg -d dir.tar.gz.gpg \| tar xzf -`

Installing GnuPG

GnuPG is preinstalled on nearly all Linux distributions because the package managers themselves depend on it. Verify that it is available:

Terminal
gpg --version

output

gpg (GnuPG) 2.4.4
libgcrypt 1.10.3

Your version numbers may differ, but any current GnuPG 2.x release supports the commands used in this guide.

If the command is missing, install the gnupg package with sudo apt install gnupg on Ubuntu, Debian, and Derivatives, or sudo dnf install gnupg2 on Fedora, RHEL, and Derivatives.

Encrypting a File with a Passphrase

Symmetric encryption is the simplest option: one passphrase encrypts the file, and the same passphrase decrypts it. There are no keys to generate or exchange, which makes it a good fit for encrypting your own backups or sending a file to someone you can share a passphrase with over a separate channel.

Use the -c (--symmetric) option:

Terminal
gpg -c database-backup.sql

gpg prompts for a passphrase, asks you to repeat it, and writes the encrypted result to database-backup.sql.gpg. The original file is left in place. Before removing it, decrypt the encrypted copy to a temporary file and compare the two files:

Terminal
gpg -o /tmp/database-backup.sql -d database-backup.sql.gpg
cmp database-backup.sql /tmp/database-backup.sql

The cmp command prints nothing when the files are identical. After a successful comparison, remove the temporary copy and the original plaintext file:

Terminal
rm /tmp/database-backup.sql
rm database-backup.sql

Pick a long passphrase. The encryption is only as strong as the passphrase protecting it, and a short or reused one undoes the benefit of encrypting at all.

By default the output is a binary file. If you need to paste the encrypted content into an email or a ticket, add -a (--armor) to produce ASCII text instead:

Terminal
gpg -c -a notes.txt

This writes notes.txt.asc, a plain text file that survives copy and paste. You can also choose the cipher explicitly with --cipher-algo AES256 if a policy requires a specific algorithm; run gpg --version to see which ciphers your build supports.

Decrypting a File

To decrypt, pass the encrypted file to gpg with -d (--decrypt) and use -o to name the output file:

Terminal
gpg -o database-backup.sql -d database-backup.sql.gpg

gpg asks for the passphrase and writes the decrypted file. Without -o, the -d option prints the decrypted content to standard output, which is useful when you only want to look at a small encrypted text file:

Terminal
gpg -d notes.txt.asc

If you decrypt the same file again a moment later, you may not be prompted for the passphrase. That is not a bug: gpg-agent caches passphrases for a few minutes. To clear the cache immediately, reload the agent:

Terminal
gpg-connect-agent reloadagent /bye

Generating a GPG Key Pair

Public key encryption removes the shared-passphrase problem. You publish your public key, anyone can use it to encrypt files for you, and only your private key can decrypt them. The private key never leaves your machine.

Generate a key pair with:

Terminal
gpg --full-generate-key

The command walks you through a few prompts: the key type (the default is fine), the expiration date, and your name and email address. Finally, it asks for a passphrase that protects the private key on disk. When the process finishes, list your keys to confirm:

Terminal
gpg --list-keys

output

pub ed25519 2026-01-01 [SC] [expires: 2029-01-01]
1A2B3C4D5E6F7A8B9C0D1E2F3A4B5C6D7E8F9A0B
uid [ultimate] Alice Example <alice@example.com>
sub cv25519 2026-01-01 [E] [expires: 2029-01-01]

The long hexadecimal string is the key fingerprint. It uniquely identifies the key, and other people use it to verify that a key really belongs to you.

Exchanging Public Keys

To let someone encrypt files for you, export your public key in ASCII format and send it to them:

Terminal
gpg --armor --export alice@example.com > alice-public.asc

When you receive a public key from someone else, import it into your keyring:

Terminal
gpg --import bob-public.asc

output

gpg: key 9F8E7D6C5B4A3F2E: public key "Bob Example <bob@example.com>" imported
gpg: Total number processed: 1
gpg: imported: 1

Before you trust an imported key, compare its fingerprint with the owner over a separate channel, such as a video call or an already-verified chat:

Terminal
gpg --fingerprint bob@example.com

If the fingerprints match, you can certify the key so gpg stops warning you about it:

Terminal
gpg --sign-key bob@example.com

Encrypting a File for a Recipient

With the recipient’s public key imported, encrypt a file for them using -e (--encrypt) and -r (--recipient):

Terminal
gpg -e -r bob@example.com report.pdf

This writes report.pdf.gpg, which only Bob’s private key can decrypt. If you have not certified Bob’s key yet, gpg shows a warning:

output

gpg: 9F8E7D6C5B4A3F2E: There is no assurance this key belongs to the named user
Use this key anyway? (y/N)

Answer y only if you have verified the fingerprint as described above. To silence the warning permanently, certify the key with --sign-key.

You can name several recipients, and each of them will be able to decrypt the same file. Include yourself if you want to keep a readable copy:

Terminal
gpg -e -r bob@example.com -r alice@example.com report.pdf

Without -r alice@example.com in that command, even you, the person who encrypted the file, could not decrypt the result.

Signing and Verifying Encrypted Files

Encryption hides the content, but it does not prove who created the file. Anyone with Bob’s public key can encrypt a file for him. Adding a signature with -s (--sign) closes that gap:

Terminal
gpg -s -u alice@example.com -e -r bob@example.com report.pdf

The -u (--local-user) option selects Alice’s signing key explicitly, which matters if you have more than one private key. gpg asks for the private key passphrase, then signs and encrypts in one pass. When Bob decrypts the file, gpg verifies the signature automatically:

Terminal
gpg -o report.pdf -d report.pdf.gpg

output

gpg: encrypted with cv25519 key, ID 9F8E7D6C5B4A3F2E, created 2026-01-01
"Bob Example <bob@example.com>"
gpg: Signature made Thu 01 Jan 2026 11:42:10 CET
gpg: using EDDSA key 1A2B3C4D5E6F7A8B9C0D1E2F3A4B5C6D7E8F9A0B
gpg: Good signature from "Alice Example <alice@example.com>" [full]

The Good signature line confirms both that the file came from Alice and that it was not modified after signing. If the file was altered in transit, gpg reports a bad signature instead. For verifying plain downloads rather than encrypted files, checksums are often enough; see our guide on the sha256sum and md5sum commands .

Encrypting a Directory

gpg encrypts single files, not directories. The usual pattern is to pack the directory with tar and encrypt the archive in one pipeline:

Terminal
tar czf - project/ | gpg -c -o project.tar.gz.gpg

The tar command writes a compressed archive to standard output, and gpg encrypts the stream into project.tar.gz.gpg without ever writing an unencrypted archive to disk.

To restore the directory, reverse the pipeline:

Terminal
gpg -d project.tar.gz.gpg | tar xzf -

The same pattern works with -e -r name@example.com in place of -c when you are encrypting the archive for someone else.

Decrypting in Scripts

Backup jobs and deploy scripts cannot type a passphrase interactively. For those cases, store the passphrase in a file and point gpg at it:

Terminal
gpg --batch --yes --pinentry-mode loopback \
 --passphrase-file /root/.backup-pass \
 -o backup.sql -d backup.sql.gpg

The --batch option disables all interactive prompts, --yes overwrites the output file if it exists, and --pinentry-mode loopback allows the passphrase to come from the file instead of the interactive pinentry dialog. GPG reads only the first line of the passphrase file. The same options work with -c for encrypting.

Warning

A passphrase file is a credential. Restrict it with chmod 600, keep it outside your repository, and add it to .gitignore so it never lands in version control. Avoid passphrase files when public key encryption fits the job. Scripts need no passphrase to encrypt with -e -r because that operation uses only the recipient’s public key.

Troubleshooting

gpg: decryption failed: No secret key
The file was encrypted for a key that is not in your keyring. This often happens when someone encrypts a file with their own key instead of yours, or when you moved to a new machine without migrating your private key. Run gpg --list-packets file.gpg | head to see which key ID the file was encrypted for.

gpg: public key decryption failed: Inappropriate ioctl for device
gpg could not open a passphrase prompt, which is common over SSH or in minimal shells. Tell it which terminal to use and retry:

Terminal
export GPG_TTY=$(tty)

Add the line to ~/.bashrc to make it permanent.

gpg does not ask for the passphrase
gpg-agent has cached it. This is expected behavior; run gpg-connect-agent reloadagent /bye to clear the cache, for example before stepping away from a shared machine.

There is no assurance this key belongs to the named user
The recipient’s key is imported but not certified. Verify the fingerprint with the owner, then run gpg --sign-key name@example.com.

Conclusion

Use gpg -c with a strong passphrase when you are protecting your own files, and key-based encryption with -e -r when files move between people, adding -s when the recipient needs proof of who sent them. For TLS certificates and encrypting data in transit rather than files at rest, see our guide on how to use OpenSSL .

strace Command in Linux: Trace System Calls

hello@linuxize.com (Linuxize) — Sat, 11 Jul 2026 10:15:00 +0200

A program exits with a vague error, or hangs, and the logs say nothing useful. Before guessing, you can watch exactly what the program asks the kernel to do. Every time a process opens a file, reads a socket, or allocates memory, it makes a system call, and strace records each one along with its arguments and return value. That trace often reveals the real problem in seconds: a config file the program looked for in the wrong place, a permission denied on a socket, or a call that blocks forever.

This guide explains how to trace a command with strace, attach to a running process, filter the calls you care about, and read the output to find the failing call.

Installing strace

strace is not always installed by default, so add it from your distribution’s repositories.

On Ubuntu, Debian, and Derivatives:

Terminal
sudo apt install strace

On Fedora, RHEL, and Derivatives:

Terminal
sudo dnf install strace

Tracing a Command

The general syntax is:

txt
strace [OPTIONS] COMMAND [ARGS]

The simplest use is to run a command under strace, which prints every system call the program makes to standard error. Trace a small command such as whoami to see the shape of the output:

Terminal
strace whoami

output

execve("/usr/bin/whoami", ["whoami"], 0x7ffd... /* 25 vars */) = 0
brk(NULL) = 0x55d3...
openat(AT_FDCWD, "/etc/ld.so.cache", O_RDONLY|O_CLOEXEC) = 3
openat(AT_FDCWD, "/lib/x86_64-linux-gnu/libc.so.6", O_RDONLY|O_CLOEXEC) = 3
...
openat(AT_FDCWD, "/etc/passwd", O_RDONLY|O_CLOEXEC) = 3
write(1, "dejan\n", 6) = 6
exit_group(0) = ?
+++ exited with 0 +++

Each line is one system call: the name, its arguments in parentheses, and the return value after the =. A return of 3 from openat is a file descriptor, meaning the open succeeded; a return of -1 carries an error name such as ENOENT. Notice the program opened /etc/passwd to look up the user name, then write sent the result to file descriptor 1, which is standard output.

Reading Failed Calls

The reason to reach for strace is usually a failure, and failures are easy to spot because the return value is -1 followed by the error code. Suppose a program cannot start and you trace it:

Terminal
strace ./myapp

A failing line looks like this:

output

openat(AT_FDCWD, "/etc/myapp/config.yaml", O_RDONLY) = -1 ENOENT (No such file or directory)

This single line tells you the program expected its config at /etc/myapp/config.yaml and the file is not there. A -1 EACCES instead would mean the file exists but the process lacks permission. For a short trace, scan for -1 to find failed calls. With a noisy program, use -Z to print only calls that returned an error:

Terminal
strace -Z ./myapp

Not every failed call is the root cause. Programs commonly probe several paths before finding a file, so read the calls around the failure and look for the last relevant error before the program exits.

Filtering the Calls You Care About

A full trace is noisy. When you only care about file access, limit the trace to the relevant calls with -e trace=. To see just the file-opening calls, trace openat:

Terminal
strace -e trace=openat ./myapp

You can name a category instead of individual calls. The %file category covers every call that takes a filename, and %network covers network-related calls:

Terminal
strace -e trace=%file ./myapp
strace -e trace=%network ./myapp

This focus turns a flood of output into the handful of lines that matter for the question you are asking.

Attaching to a Running Process

When a process is already running, perhaps stuck or pinning the CPU, attach to it by PID with -p instead of starting a new program. First find the PID with the ps command , then attach:

Terminal
sudo strace -p 2841

strace begins printing the calls the live process makes from that moment on. You may not need sudo when the process belongs to your user, but Linux capabilities and the kernel.yama.ptrace_scope setting can impose additional restrictions. Press Ctrl+C to detach and leave the process running. For a hung process, attaching usually shows it parked in a single blocking call such as read or futex, which points straight at what it is waiting for.

Following Child Processes

By default strace follows only the process it started. Programs that fork workers, such as shells or servers, do their real work in children that the trace would miss. Add -f to follow forks so the children are traced too:

Terminal
strace -f ./server

Each line is then prefixed with the PID that made the call, so you can tell the parent and its children apart.

Summarizing System Call Time

Beyond individual calls, strace can profile where a program spends its time in the kernel. The -c flag suppresses the per-call output and prints a summary table when the program exits:

Terminal
strace -c ./myapp

output

% time seconds usecs/call calls errors syscall
------ ----------- ----------- --------- --------- ----------------
41.23 0.004812 18 267 read
22.10 0.002579 10 251 12 openat
15.04 0.001755 14 125 mmap
...
------ ----------- ----------- --------- --------- ----------------
100.00 0.011670 843 14 total

The table ranks system calls by total time, shows how many times each was called, and counts how many returned an error. The 12 openat errors show that some file lookups failed, but programs often probe optional paths as part of normal operation. Inspect the individual calls before treating the count as a problem.

Saving a Trace to a File

Traces scroll fast, so for anything non-trivial write the output to a file with -o and read it afterward:

Terminal
strace -o trace.log -f ./myapp

This keeps strace output separate from the program’s own output and gives you a file to grep, for example grep ENOENT trace.log to list every missing-file error at once.

Quick Reference

Task	Command
Trace a command	`strace ./app`
Trace only failed calls	`strace -Z ./app`
Trace only file calls	`strace -e trace=%file ./app`
Trace network calls	`strace -e trace=%network ./app`
Attach to a running process	`sudo strace -p PID`
Follow child processes	`strace -f ./app`
Summarize call time and errors	`strace -c ./app`
Write trace to a file	`strace -o trace.log ./app`

Conclusion

Use focused filters and read the calls around a failure instead of treating every error as the cause. For another view of open files and sockets on a running process, use the lsof command .

How to Manage Node.js Processes with PM2

hello@linuxize.com (Linuxize) — Fri, 10 Jul 2026 09:20:00 +0200

A Node.js app can run fine with node app.js during development, but production needs something that can restart crashes, collect logs, and come back after a reboot. A single Node.js process runs one event loop, so busy services can hit a single-process ceiling before the server itself is out of capacity. PM2 is a Node.js process manager that covers those operational pieces: it restarts crashed apps, captures stdout and stderr into rotated log files, runs networked apps in cluster mode across CPU cores, and survives a reboot through a systemd unit. The CLI is short enough to learn in an afternoon, and it covers everything from local development to a multi-server fleet.

This guide explains how to install PM2 on Linux, start and manage Node.js processes, set up clustering for multi-core servers, and persist the process list across reboots.

Install PM2

PM2 is published as an npm package. PM2 7 requires Node.js 18 or newer. With Node.js already installed, add PM2 globally:

Terminal
sudo npm install -g pm2

If your projects use pnpm, pnpm add -g pm2 installs the same package. See the pnpm command guide for its global install setup.

Confirm the version:

Terminal
pm2 --version

output

7.0.3

The pm2 command is now on $PATH for every user. PM2 stores per-user state under ~/.pm2, so each Linux user has an isolated process list, log directory, and pid file.

Start an Application

The simplest invocation starts a single Node.js process and gives it a name you can refer to later:

Terminal
pm2 start app.js --name myapp

output

[PM2] Starting /home/sara/myapp/app.js in fork_mode (1 instance)
[PM2] Done.
┌────┬───────┬─────────┬───────┬──────┬──────────┬────────┐
│ id │ name │ mode │ pid │ ↺ │ status │ cpu │
├────┼───────┼─────────┼───────┼──────┼──────────┼────────┤
│ 0 │ myapp │ fork │ 12345 │ 0 │ online │ 0% │
└────┴───────┴─────────┴───────┴──────┴──────────┴────────┘

The --name flag is optional but worth setting on every start: PM2 falls back to the script filename otherwise, and “myapp” is easier to type than “server”.

pm2 start also accepts npm scripts. If your package.json has "start": "node app.js":

Terminal
pm2 start npm --name myapp -- start

The -- separator is required so PM2 stops parsing flags and passes the remainder to npm.

Inspect Processes

pm2 ls (or pm2 list) prints the current process table:

Terminal
pm2 ls

output

┌────┬─────────┬─────────┬─────────┬─────────┬──────────┬────────┐
│ id │ name │ mode │ pid │ uptime │ status │ memory │
├────┼─────────┼─────────┼─────────┼─────────┼──────────┼────────┤
│ 0 │ myapp │ fork │ 12345 │ 3m │ online │ 64.0mb │
│ 1 │ worker │ fork │ 12346 │ 1m │ online │ 42.0mb │
└────┴─────────┴─────────┴─────────┴─────────┴──────────┴────────┘

For per-process detail, including environment variables, restart count, and log paths, ask for a detailed view:

Terminal
pm2 show myapp

The output also reports the script path, the working directory, and the last few exit codes, which together cover most “why is it restarting” investigations.

Read Logs

PM2 captures stdout and stderr into log files under ~/.pm2/logs. The streaming view is the fastest way to see what is happening right now:

Terminal
pm2 logs myapp

output

0|myapp | App listening on http://127.0.0.1:3000
0|myapp | request from 127.0.0.1 GET /

The prefix combines the PM2 id with the app name, which matters in cluster mode where multiple instances share a name. Add --lines 100 to start from the last 100 lines, or --err to tail only stderr.

For long-lived apps, install the log rotation module:

Terminal
pm2 install pm2-logrotate
pm2 set pm2-logrotate:max_size 10M
pm2 set pm2-logrotate:retain 7

The settings cap each log file at 10 MB and keep seven rotated copies, which is enough to investigate problems without filling the disk.

Restart, Reload, and Stop

Three verbs cover most lifecycle work:

Terminal
pm2 restart myapp
pm2 reload myapp
pm2 stop myapp

restart kills and respawns the process. It is the fastest option but drops in-flight requests.

reload is the zero-downtime variant. PM2 starts the new process, waits until it reports ready, and only then terminates the old one. It only works in cluster mode (more below), so the listening socket can be passed across processes.

stop shuts the process down but keeps the entry in the table, so a later pm2 start myapp brings it back without re-typing the script path. To remove the entry completely, use pm2 delete myapp.

Run in Cluster Mode

A single Node.js process runs one event loop. On multi-core servers, PM2’s cluster mode forks the application into multiple processes that share the listening socket:

Terminal
pm2 start app.js -i 4 --name myapp

Pass max instead of a number to spawn one process per logical CPU:

Terminal
pm2 start app.js -i max --name myapp

Cluster mode requires the application to handle being one of several processes. Most HTTP frameworks (Express, Fastify, Koa) work out of the box because Node.js handles the socket distribution. Code that uses in-process state (counters, caches, WebSocket session maps) needs an external store such as Redis or a sticky-session mechanism for the cluster to behave correctly.

Manage Multiple Apps with an Ecosystem File

For more than a single app, switch from CLI flags to a configuration file:

Terminal
pm2 ecosystem

The command writes ecosystem.config.js in the current directory. Edit it to list your apps:

ecosystem.config.jsjs
module.exports = {
 apps: [
 {
 name: "api",
 script: "./api/server.js",
 instances: "max",
 exec_mode: "cluster",
 env: {
 NODE_ENV: "production",
 PORT: 3000,
 },
 },
 {
 name: "worker",
 script: "./worker/index.js",
 instances: 1,
 env: {
 NODE_ENV: "production",
 },
 },
 ],
};

Start everything at once:

Terminal
pm2 start ecosystem.config.js

The file is the right place to record per-environment overrides, log paths, memory limits (max_memory_restart: "512M"), and cron-style restart schedules. Commit it alongside the application.

Survive a Reboot

PM2 does not start itself at boot. To make it do so, generate a systemd unit:

Terminal
pm2 startup systemd

output

[PM2] To setup the Startup Script, copy/paste the following command:
sudo env PATH=$PATH:/usr/bin /usr/lib/node_modules/pm2/bin/pm2 startup systemd -u sara --hp /home/sara

Run the printed command exactly as shown. It installs and enables a systemd unit named pm2-<user>.service. Then save the current process list so PM2 knows what to start:

Terminal
pm2 save

After a reboot, the systemd unit launches PM2 as your user, which resurrects each saved app. Verify the unit is enabled:

Terminal
systemctl status pm2-sara

output

● pm2-sara.service - PM2 process manager
Loaded: loaded (/etc/systemd/system/pm2-sara.service; enabled; preset: enabled)
Active: active (running)

Monitor Resources

For an at-a-glance view of CPU and memory per app, run the built-in dashboard:

Terminal
pm2 monit

The terminal UI shows a live process list with CPU and memory graphs, plus a log tail per app. Press q to quit.

For programmatic access, pm2 jlist prints the same data as JSON, which feeds into your own dashboards or monitoring scripts.

Troubleshooting

pm2: command not found after install
npm’s global bin directory is not on $PATH. Run npm config get prefix and add <prefix>/bin to $PATH, or install Node.js through the official NodeSource setup, which places npm under /usr/bin by default.

Process keeps restarting
The script crashes on startup. Run pm2 logs myapp --err to see the most recent stderr output, then fix the underlying error. Use pm2 show myapp for the restart count.

pm2 reload falls back to restart
Reload only works in cluster mode. Add -i 2 (or more) when starting the app, and the next reload will be zero-downtime.

Quick Reference

Task	Command
Install PM2 globally	`sudo npm install -g pm2`
Start an app	`pm2 start app.js --name myapp`
List processes	`pm2 ls`
Stream logs	`pm2 logs myapp`
Restart	`pm2 restart myapp`
Zero-downtime reload	`pm2 reload myapp`
Stop	`pm2 stop myapp`
Delete from list	`pm2 delete myapp`
Cluster mode (4 instances)	`pm2 start app.js -i 4`
Save process list	`pm2 save`
Generate systemd unit	`pm2 startup systemd`

FAQ

Should I use PM2 in a Docker container?
Usually no. Containers already provide isolation, and an orchestrator (Docker, systemd, Kubernetes) restarts crashed containers. Running PM2 inside hides crashes from the orchestrator and makes the container harder to debug.

Does PM2 support TypeScript?
Yes. Either compile to JavaScript first and point PM2 at the compiled file, or use --interpreter ts-node when starting. Compiling is faster at runtime and simpler in production.

How do I pass environment variables to a PM2 app?
Add an env block to the ecosystem file, or prefix the CLI invocation: NODE_ENV=production pm2 start app.js. The ecosystem file is the durable option.

Conclusion

PM2 turns a Node.js process into a managed service with one short command, and the ecosystem file scales the same workflow to many apps on the same server. Pair it with cluster mode for multi-core HTTP services, generate the systemd unit so reboots do not take the site down, and the rest is operational hygiene.

For related setup, see our guides on installing Node.js on Ubuntu and deploying a Node.js application on Ubuntu 26.04 .

Bash Parameter Expansion: Defaults, Substrings, and Replacement

hello@linuxize.com (Linuxize) — Thu, 09 Jul 2026 09:40:00 +0200

Most Bash scripts call sed, awk, or cut for jobs the shell can do by itself. Stripping an extension from a filename, providing a default when a variable is empty, or replacing part of a string are all built into the ${...} syntax, run in the current process, and cost no fork to an external program. The syntax is dense, which is why many people never move past ${var}, but there are only a handful of patterns to learn.

This guide explains Bash parameter expansion: default values, length, substrings, prefix and suffix trimming, search and replace, and case conversion, with practical examples of each.

The Basic Form

${var} expands to the value of var, exactly like $var. The braces become mandatory when the variable name would otherwise run into the surrounding text:

Terminal
file="report"
echo "${file}_final.txt"

output

report_final.txt

Without braces, Bash would look for a variable named file_final. Everything else in this guide builds on this form by adding an operator inside the braces.

Default Values

The :- operator substitutes a fallback when a variable is unset or empty:

Terminal
echo "Deploying to ${ENVIRONMENT:-staging}"

output

Deploying to staging

The variable itself is not modified; the default only applies to this one expansion. To also assign the fallback to the variable, use := instead:

Terminal
: "${LOG_DIR:=/var/log/myapp}"
echo "$LOG_DIR"

output

/var/log/myapp

The leading : is the null command; it evaluates its arguments and does nothing else, which makes it the idiomatic way to trigger the assignment. This pattern is common at the top of scripts to give every configuration variable a sane default.

Two related operators round out the family. :? aborts the script with a message when the variable is missing, which turns a silent misconfiguration into a loud one:

Terminal
: "${API_KEY:?API_KEY must be set}"

output

bash: API_KEY: API_KEY must be set

And :+ is the inverse of :-: it expands to a value only when the variable is set and non-empty, which is useful for building optional command arguments:

Terminal
curl ${PROXY:+--proxy "$PROXY"} https://example.com

When PROXY is empty, the expansion vanishes entirely and curl runs without the option.

Each operator also exists without the colon (-, =, ?, +). The colon versions treat an empty string the same as an unset variable; the colon-free versions act only when the variable is truly unset. In practice, the colon versions are what you want nearly all the time.

Defaults work on positional parameters too, which makes optional script arguments trivial:

Terminal
target="${1:-.}"

This uses the first argument if given and the current directory otherwise; see our guide on Bash script arguments for the wider context.

String Length

${#var} expands to the length of the value in characters:

Terminal
password="s3cretPass"
echo "${#password}"

output

A common use is input validation, such as rejecting a password shorter than a minimum inside an if statement . For arrays, the same syntax with [@] counts elements instead: ${#files[@]}.

Substrings

The ${var:offset:length} form extracts a substring. Offsets count from zero, and the length is optional:

Terminal
date="2026-01-01"
echo "${date:0:4}"
echo "${date:5}"

output

2026
01-01

The first expansion takes four characters starting at position zero; the second takes everything from position five onward.

Negative offsets count from the end of the string, but they require a space or parentheses so Bash does not confuse the syntax with the :- default operator:

Terminal
file="backup-2026.tar.gz"
echo "${file: -6}"

output

tar.gz

A negative length means “stop that many characters before the end” rather than a count, so ${var:1:-1} trims one character from each side. Negative lengths require Bash 4.2 or later.

Trimming Prefixes and Suffixes

Four operators remove a pattern from the front or the back of the value. # removes the shortest match from the front, ## the longest match from the front, % the shortest match from the back, and %% the longest match from the back. The patterns are globs, the same wildcards used for filenames.

The classic use is pulling filenames apart:

Terminal
path="/var/www/site/index.backup.html"

echo "${path##*/}"
echo "${path%/*}"
echo "${path%.*}"
echo "${path##*.}"

output

index.backup.html
/var/www/site
/var/www/site/index.backup
html

The first two replicate the basename and dirname commands: ##*/ deletes the longest match of “anything followed by a slash” from the front, and %/* deletes the shortest “slash followed by anything” from the back. The last two split at the final dot, so %.* strips one extension while ##*. keeps only the extension.

The shortest/longest distinction matters exactly when the pattern can match at more than one place. With the file above, ${path%.*} removes only .html, while ${path%%.*} would remove .backup.html as well.

Renaming files in a loop shows the pattern in action. For bulk changes, preview the commands first:

Terminal
for f in *.jpeg; do
 printf 'mv -- %q %q\n' "$f" "${f%.jpeg}.jpg"
done

After checking the generated commands, run the rename:

Terminal
for f in *.jpeg; do
 mv -- "$f" "${f%.jpeg}.jpg"
done

Each name has its .jpeg suffix trimmed and .jpg appended, with no sed in sight. The -- tells mv that option parsing is done, which protects filenames that begin with a dash.

Search and Replace

The ${var/pattern/replacement} form replaces the first match of a glob pattern, and doubling the first slash replaces all matches:

Terminal
csv="one,two,three"
echo "${csv/,/;}"
echo "${csv//,/;}"

output

one;two,three
one;two;three

Anchors are available: ${var/#pattern/replacement} replaces only a match at the start of the string, and ${var/%pattern/replacement} only at the end. Omitting the replacement deletes the match:

Terminal
echo "${csv//,}"

output

onetwothree

Keep in mind the pattern is a glob, not a regular expression: * and ? work, but . is a literal dot and there are no + or ^ operators. When you genuinely need regular expressions, that is the job of sed or the =~ operator; for everything simpler, the expansion is faster and has no quoting headaches. Our Bash string manipulation guide compares these approaches side by side.

Changing Case

Bash 4 added case conversion operators: ^^ uppercases the value, ,, lowercases it, and the single forms ^ and , convert only the first character:

Terminal
name="alice"
echo "${name^}"
echo "${name^^}"

header="CONTENT-TYPE"
echo "${header,,}"

output

Alice
ALICE
content-type

Lowercasing is the standard trick for case-insensitive comparisons: normalize both sides with ,, and compare the results. Most current Linux distributions ship Bash 5, and Bash 4 is enough for these operators. Availability is mainly a concern in scripts that must also run on macOS’s ancient default Bash 3.2, where they are missing.

Indirect Expansion

${!var} expands to the value of the variable whose name is stored in var:

Terminal
staging_host="staging.example.com"
production_host="prod.example.com"

env="staging"
ref="${env}_host"
echo "${!ref}"

output

staging.example.com

Indirection occasionally saves the day in configuration-driven scripts, but if you find yourself using it often, an associative array is usually the cleaner tool.

Combining with Positional Parameters

All the operators work on $1, $2, and friends, and the substring form even works on $@:

Terminal
command="${1:?usage: $0 command [args...]}"
shift_args=("${@:2}")

The first line insists on at least one argument and prints a usage message otherwise; the second collects every argument after the first into an array. These two lines are the skeleton of most subcommand-style scripts.

Quick Reference

For a printable quick reference, see the Bash cheatsheet .

Expansion	Result
`${var:-default}`	Value, or `default` if unset or empty
`${var:=default}`	Same, and assigns the default to `var`
`${var:?message}`	Value, or exit with `message` if unset or empty
`${var:+word}`	`word` only if `var` is set and non-empty
`${#var}`	Length of the value
`${var:2:5}`	Five characters starting at offset 2
`${var: -3}`	Last three characters
`${var#pattern}`	Remove shortest matching prefix
`${var##pattern}`	Remove longest matching prefix
`${var%pattern}`	Remove shortest matching suffix
`${var%%pattern}`	Remove longest matching suffix
`${var/old/new}`	Replace first match
`${var//old/new}`	Replace all matches
`${var/#old/new}`	Replace match at start only
`${var/%old/new}`	Replace match at end only
`${var^^}` / `${var,,}`	Uppercase / lowercase the value
`${var^}` / `${var,}`	Uppercase / lowercase the first character
`${!var}`	Value of the variable named by `var`

Conclusion

Parameter expansion replaces a surprising share of the sed | awk | cut pipelines found in everyday scripts, with defaults via :- and :=, filename surgery via # and %, and replacement via // covering the bulk of real cases. The patterns pair naturally with the string techniques in our Bash string manipulation guide, and with set -u from the Bash set command , where a well-placed ${var:-} marks a variable as intentionally optional.

smartctl Command in Linux: Check Disk Health with SMART

hello@linuxize.com (Linuxize) — Wed, 08 Jul 2026 09:40:00 +0200

Disks rarely die without warning. Long before a drive stops responding, it usually accumulates reallocated sectors, read errors, or climbing temperatures, and the drive itself keeps count through SMART (Self-Monitoring, Analysis and Reporting Technology). The smartctl command reads those counters, so the question “is this disk failing?” gets an answer based on the drive’s own bookkeeping instead of guesswork.

This guide explains how to use smartctl to check drive health, read the attributes that actually predict failure, run self-tests, and keep an eye on NVMe wear.

smartctl Syntax

The basic syntax is:

txt
smartctl [OPTIONS] DEVICE

DEVICE is normally a whole disk such as /dev/sda, /dev/sdb, or /dev/nvme0, not a mounted directory. Most checks need root because smartctl sends commands directly to the drive. If you are not sure which device names your disks have, run lsblk first.

Installing smartctl

smartctl is part of the smartmontools package.

On Ubuntu, Debian, and Derivatives:

Terminal
sudo apt install smartmontools

On Fedora, RHEL, and Derivatives:

Terminal
sudo dnf install smartmontools

After installation, run smartctl with sudo unless your distribution has granted your user direct access to storage devices.

Checking Whether a Drive Supports SMART

Start with the identity summary:

Terminal
sudo smartctl -i /dev/sda

output

Model Family: Samsung based SSDs
Device Model: Samsung SSD 870 EVO 1TB
Serial Number: S6PTNM0T812345A
Firmware Version: SVT02B6Q
User Capacity: 1,000,204,886,016 bytes [1.00 TB]
SMART support is: Available - device has SMART capability.
SMART support is: Enabled

Besides confirming SMART support, this output gives you the model and serial number, which you will want when matching a physical drive to a device name or claiming a warranty. In the rare case SMART is available but disabled, enable it with sudo smartctl -s on /dev/sda.

Checking Overall Health

The quickest check is the drive’s own verdict:

Terminal
sudo smartctl -H /dev/sda

output

SMART overall-health self-assessment test result: PASSED

A FAILED result means the drive predicts its own failure within 24 hours and warranty replacement is justified; back up immediately.

Warning

Do not read PASSED as “healthy”. The overall verdict flips only when an attribute crosses the manufacturer’s failure threshold, and drives regularly corrupt data while still technically passing. The attributes in the next section tell the real story, and no SMART output replaces working backups.

Reading SMART Attributes

The attribute table is where failure announces itself early:

Terminal
sudo smartctl -A /dev/sda

output

ID# ATTRIBUTE_NAME FLAG VALUE WORST THRESH TYPE UPDATED WHEN_FAILED RAW_VALUE
5 Reallocated_Sector_Ct 0x0033 100 100 010 Pre-fail Always - 0
9 Power_On_Hours 0x0032 097 097 000 Old_age Always - 11284
12 Power_Cycle_Count 0x0032 099 099 000 Old_age Always - 413
177 Wear_Leveling_Count 0x0013 099 099 000 Pre-fail Always - 8
187 Reported_Uncorrect 0x0032 100 100 000 Old_age Always - 0
194 Temperature_Celsius 0x0022 067 052 000 Old_age Always - 33
197 Current_Pending_Sector 0x0032 100 100 000 Old_age Always - 0
198 Offline_Uncorrectable 0x0030 100 100 000 Old_age Offline - 0

Two number systems live in this table. VALUE is a normalized score where higher is better; the drive flags failure when it drops to THRESH. RAW_VALUE is the actual count, and for the attributes that matter, the raw count is what you read.

Four attributes predict failure well, and their healthy raw value is zero:

Reallocated_Sector_Ct (5) - Sectors the drive has retired and remapped to spares. A handful may stay stable for years, but a count that grows between checks is the classic sign of a dying disk.
Reported_Uncorrect (187) - Errors the drive could not correct internally. Any nonzero value correlates strongly with failure.
Current_Pending_Sector (197) - Sectors the drive could not read and is waiting to remap. Pending sectors mean data in those spots is already at risk.
Offline_Uncorrectable (198) - Confirmed unreadable sectors found during offline scanning.

Note the raw values now, check again in a week, and treat growth in any of these four as your cue to replace the drive. Temperature (194) is worth a glance too: sustained operation above roughly 50°C shortens drive life, and a spike often points at a failed case fan.

Running Self-Tests

Attributes are passive bookkeeping; self-tests actively exercise the drive. The test runs inside the drive’s firmware, so you can keep using the system while it works. Start with the short test, which takes a couple of minutes:

Terminal
sudo smartctl -t short /dev/sda

output

=== START OF OFFLINE IMMEDIATE AND SELF-TEST SECTION ===
Sending command: "Execute SMART Short self-test routine immediately in off-line mode".
Testing has begun.
Please wait 2 minutes for test to complete.

The long test (-t long) reads the entire surface and takes from under an hour on an SSD to many hours on a large hard drive; it is the right choice when a short test passes but you still suspect the drive. Check the results once the wait time has passed:

Terminal
sudo smartctl -l selftest /dev/sda

output

Num Test_Description Status Remaining LifeTime(hours) LBA_of_first_error
# 1 Short offline Completed without error 00% 11284 -
# 2 Extended offline Completed without error 00% 10102 -

A failed entry lists the LBA of the first error, which is the drive telling you exactly where it can no longer read. At that point the useful response is replacement, not repair; filesystem-level checks like fsck fix filesystem structures, not failing hardware underneath them.

Checking NVMe Drives

NVMe drives report health through a different log format, and smartctl -a presents the main fields directly:

Terminal
sudo smartctl -a /dev/nvme0

output

=== START OF SMART DATA SECTION ===
SMART overall-health self-assessment test result: PASSED
Critical Warning: 0x00
Temperature: 41 Celsius
Available Spare: 100%
Available Spare Threshold: 10%
Percentage Used: 3%
Data Units Written: 18,536,442 [9.49 TB]
Media and Data Integrity Errors: 0
Error Information Log Entries: 0

Three fields carry the signal. Percentage Used is the drive’s own wear estimate against its rated endurance, so 3% after a year of use projects decades of life, while a value racing toward 100% on a young drive means the workload is chewing through it. Available Spare falling toward its threshold plays the role reallocated sectors play on SATA drives. Media and Data Integrity Errors should be zero, full stop.

Checking Drives in USB Enclosures

USB adapters often hide the drive behind a bridge chip, and smartctl reports Unknown USB bridge instead of SMART data. Most bridges pass SMART through when asked explicitly:

Terminal
sudo smartctl -a -d sat /dev/sdb

The -d sat option tells smartctl to tunnel ATA commands through the bridge. If that fails, -d sntasmedia or -d sntjmicron handle common NVMe-to-USB chips, and some cheap enclosures simply do not pass SMART at all.

Continuous Monitoring with smartd

The smartmontools package also ships smartd, a daemon that polls your drives and warns you instead of waiting for you to remember. A single line in /etc/smartd.conf covers all drives:

/etc/smartd.conftxt
DEVICESCAN -a -o on -S on -s (S/../.././02|L/../../6/03) -m root -M exec /usr/share/smartmontools/smartd-runner

This monitors all detected devices, runs a short self-test daily at 02:00 and a long test on Saturdays at 03:00, and reports problems to root’s mail. Enable it with:

Terminal
sudo systemctl enable --now smartd

Distribution packages ship a commented default config that is close to this already, so often you only need to enable the service.

Troubleshooting

Permission denied or operation not permitted
Run the command with sudo. smartctl needs direct device access, and an unprivileged shell usually cannot send SMART commands to a disk.

SMART support is disabled
If smartctl -i says SMART is available but disabled, turn it on with sudo smartctl -s on /dev/sda, replacing /dev/sda with the correct device.

Unknown USB bridge
Try the SAT passthrough driver with sudo smartctl -a -d sat /dev/sdb. If that fails on an NVMe-to-USB enclosure, try -d sntasmedia or -d sntjmicron. Some adapters do not expose SMART data at all.

No such device or wrong disk shown
Confirm the device path with lsblk before running smartctl. SATA disks usually appear as /dev/sdX, while NVMe drives usually appear as /dev/nvme0 or /dev/nvme0n1.

Quick Reference

Task	Command
Identify drive and SMART support	`sudo smartctl -i /dev/sda`
Overall pass/fail verdict	`sudo smartctl -H /dev/sda`
Attribute table	`sudo smartctl -A /dev/sda`
Full ATA disk report	`sudo smartctl -x /dev/sda`
NVMe health	`sudo smartctl -a /dev/nvme0`
Start a short self-test	`sudo smartctl -t short /dev/sda`
Start a full-surface test	`sudo smartctl -t long /dev/sda`
View self-test results	`sudo smartctl -l selftest /dev/sda`
Drive behind a USB adapter	`sudo smartctl -a -d sat /dev/sdb`

Conclusion

A monthly smartctl -A glance at reallocated, pending, and uncorrectable counts, or smartd doing the same automatically, converts most disk failures from surprises into scheduled replacements. When the numbers start moving, copy the data off first and experiment second; a drive that is reallocating sectors owes you nothing. For checking the filesystems that live on top of healthy drives, see our guide on the fsck command .

Pattern	Description
`(ab)+`	ERE group repeated one or more times
`\(ab\)\+`	The same group in BRE
`cat\|dog`	ERE alternation, either side matches
`cat\\|dog`	The same alternation in GNU BRE
`^(a\|b)c$`	Alternation limited to the group
`\1`	Whatever group 1 matched
`\(.\)\1`	Any character repeated twice

Feature	Syntax by Flavor
Grouping	BRE `\(ab\)`; ERE and PCRE `(ab)`
Alternation	GNU BRE `a\\|b`; ERE and PCRE `a\|b`
One or more	GNU BRE `a\+`; ERE and PCRE `a+`
Optional	GNU BRE `a\?`; ERE and PCRE `a?`
Interval	BRE `a\{2,4\}`; ERE and PCRE `a{2,4}`
Backreference	BRE and PCRE `\1`; GNU grep and GNU sed also accept `\1` in ERE, but POSIX ERE and awk do not
`\d` and lookaround	PCRE supports both; BRE and ERE do not
Default in	BRE: `grep`, `sed`; ERE: `grep -E`, `sed -E`, awk; PCRE: `grep -P`

Linux Tips, Tricks and Tutorials on Linuxize

sudo Cheatsheet

Basic Usage #

Password Caching #

Listing Privileges #

Environment Handling #

Redirects and Pipes #

Editing the sudoers File #

sudoers Rule Syntax #

Aliases #

Defaults Directives #

Logging and Auditing #

Troubleshooting #

Related Guides #

nice and renice Commands in Linux: Set Process Priority

How Nice Values Work #

nice Command Syntax #

Running a Command With Lower Priority #

Running a Command With Higher Priority #

renice Command Syntax #

Changing the Priority of a Running Process #

Renicing All Processes for a User #

Renicing a Process Group #

Quick Reference #

Troubleshooting #

Conclusion #

Nginx Cheatsheet

Service and CLI Commands #

Configuration Layout #

Server Blocks #

Location Matching #

Serving Files #

Reverse Proxy #

Load Balancing #

HTTPS and TLS #

Redirects and Rewrites #

Access Control and Limits #

Compression and Caching #

Logging #

Common Variables #

Related Guides #

Fix "No Space Left on Device" When df Shows Free Space

Quick Reference #

Check the Exact Path That Failed #

Check Inode Usage #

Find Directories Using the Most Inodes #

Remove Excess Small Files Safely #

Check for Deleted Files Still Held Open #

Check tmpfs and Container Filesystems #

Check Btrfs Data and Metadata Allocation #

Check the inotify Watch Limit #

Check Filesystem and Kernel Errors #

Troubleshooting #

FAQ #

Conclusion #

ffmpeg Cheatsheet

Install ffmpeg #

Inspect Media Files #

Common Options #

Convert Between Formats #

Compress Video #

Audio #

Resize, Crop, and Rotate #

Trim and Concatenate #

Images, Thumbnails, and GIFs #

Subtitles #

Stream Mapping and Metadata #

Related Guides #

pnpm Cheatsheet

Install and Update pnpm #

Node.js Runtimes #

Project Setup #

Add Dependencies #

Install Dependencies #

Update and Inspect #

Remove and Clean #

Scripts and Execution #

Workspaces and Filtering #

Store and Cache #

Security and Diagnostics #

Basic Usage

Password Caching

Listing Privileges

Environment Handling

Redirects and Pipes

Editing the sudoers File

sudoers Rule Syntax

Aliases

Defaults Directives

Logging and Auditing

Troubleshooting

Related Guides

How Nice Values Work

nice Command Syntax

Running a Command With Lower Priority

Running a Command With Higher Priority

renice Command Syntax

Changing the Priority of a Running Process

Renicing All Processes for a User

Renicing a Process Group

Quick Reference

Troubleshooting

Conclusion

Service and CLI Commands

Configuration Layout

Server Blocks

Location Matching

Serving Files

Reverse Proxy

Load Balancing

HTTPS and TLS

Redirects and Rewrites

Access Control and Limits

Compression and Caching

Logging

Common Variables

Related Guides

Quick Reference

Check the Exact Path That Failed

Check Inode Usage

Find Directories Using the Most Inodes

Remove Excess Small Files Safely

Check for Deleted Files Still Held Open

Check tmpfs and Container Filesystems

Check Btrfs Data and Metadata Allocation

Check the inotify Watch Limit

Check Filesystem and Kernel Errors

Troubleshooting

FAQ

Conclusion

Install ffmpeg

Inspect Media Files

Common Options

Convert Between Formats

Compress Video

Audio

Resize, Crop, and Rotate

Trim and Concatenate

Images, Thumbnails, and GIFs

Subtitles

Stream Mapping and Metadata

Related Guides

Install and Update pnpm

Node.js Runtimes

Project Setup

Add Dependencies

Install Dependencies

Update and Inspect

Remove and Clean

Scripts and Execution

Workspaces and Filtering

Store and Cache

Security and Diagnostics

Related Guides

Quick Reference

Why the Lock Error Occurs

Step 1: Check the Process Holding the Lock

Step 2: Check Automatic Updates

Step 3: Stop a Stuck Package Process

Step 4: Repair Interrupted Package Configuration