3 - Most used commands

Most used commands

Check active users

#!/bin/bash
w

OUTPUT

No user login

c@c:~/cos3105$ ./test.sh
 02:30:47 up  1:13,  0 user,  load average: 0.02, 0.06, 0.03
USER     TTY      FROM             LOGIN@   IDLE   JCPU   PCPU  WHAT

After login

Check user online

Check server uptime

#!/bin/bash
uptime

OUTPUT

c@c:~/cos3105$ ./test.sh
 04:00:56 up  2:43,  1 user,  load average: 0.03, 0.02, 0.00

Check date and time that server was started

#!/bin/bash
uptime -s

OUTPUT

c@c:~/cos3105$ uptime -s
2025-08-19 01:17:20

#!/bin/bash
tail -f /var/log/auth.log

OUTPUT

c@c:~/cos3105$ ./test.sh
2025-08-19T04:14:43.959171+00:00 c sshd[35431]: Server listening on :: port 22.
2025-08-19T04:14:46.716069+00:00 c sshd[35433]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=10.0.2.2  user=c
2025-08-19T04:14:48.523852+00:00 c sshd[35433]: Failed password for c from 10.0.2.2 port 60368 ssh2
2025-08-19T04:15:01.698376+00:00 c CRON[35535]: pam_unix(cron:session): session opened for user root(uid=0) by root(uid=0)
2025-08-19T04:15:01.701073+00:00 c CRON[35535]: pam_unix(cron:session): session closed for user root
2025-08-19T04:15:07.549510+00:00 c sshd[35433]: Connection reset by authenticating user c 10.0.2.2 port 60368 [preauth]
2025-08-19T04:15:46.103685+00:00 c sshd[35659]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=10.0.2.2  user=c
2025-08-19T04:15:47.817427+00:00 c sshd[35659]: Failed password for c from 10.0.2.2 port 60375 ssh2
2025-08-19T04:17:01.707376+00:00 c CRON[35910]: pam_unix(cron:session): session opened for user root(uid=0) by root(uid=0)
2025-08-19T04:17:01.710963+00:00 c CRON[35910]: pam_unix(cron:session): session closed for user root

#!/bin/bash
tail -f /var/log/auth.log | grep 'authentication failure'

OUTPUT

Invalid login

Check server information

#!/bin/bash
uname -a

OUTPUT

c@c:~/cos3105$ ./test.sh
Linux c 6.8.0-71-generic #71-Ubuntu SMP PREEMPT_DYNAMIC Tue Jul 22 16:52:38 UTC 2025 x86_64 x86_64 x86_64 GNU/Linux

Check status CPU, I/O, Disks

#!/bin/bash
top

OUTPUT

Server Status

htop: A top alternative

#!/bin/bash
htop

OUTPUT

Server Status

Check RAM status

#!/bin/bash
free

OUTPUT

c@c:~/cos3105$ free
               total        used        free      shared  buff/cache   available
Mem:         4010056      634572     3116696        1080      489724     3375484
Swap:        4009980           0     4009980

Check process that use more RAM

#!/bin/bash
top

OUTPUT

after open program press m , top will sort process that uses high memory to the top

top sort high memory usage

Check service that load on BOOT

#!/bin/bash
systemctl list-unit-files --state=enabled

OUTPUT

c@c:~/cos3105$ ./test.sh
UNIT FILE                              STATE   PRESET
run-qemu.mount                         enabled enabled
apport-autoreport.path                 enabled enabled
tpm-udev.path                          enabled enabled
apparmor.service                       enabled enabled
apport.service                         enabled enabled
blk-availability.service               enabled enabled
cloud-config.service                   enabled enabled
cloud-final.service                    enabled enabled
cloud-init-local.service               enabled enabled
cloud-init.service                     enabled enabled
console-setup.service                  enabled enabled

Check service that running

#!/bin/bash
systemctl list-units --type=service --state=active

OUTPUT

c@c:~/cos3105$ ./test.sh
  UNIT                                                                                      LOAD   ACTIVE SUB     DESCRIPTION
  apparmor.service                                                                          loaded active exited  Load AppArmor profiles
  apport.service                                                                            loaded active exited  automatic crash report generation
  blk-availability.service                                                                  loaded active exited  Availability of block devices
  code-server@c.service                                                                     loaded active running code-server
  console-setup.service                                                                     loaded active exited  Set console font and keymap
  cron.service                                                                              loaded active running Regular background program processing daemon
  dbus.service                                                                              loaded active running D-Bus System Message Bus
  finalrd.service                                                                           loaded active exited  Create final runtime dir for shutdown pivot root
  fwupd.service                                                                             loaded active running Firmware update daemon
  getty@tty1.service                                                                        loaded active running Getty on tty1
  keyboard-setup.service                                                                    loaded active exited  Set the console keyboard layout

Check service that Failed

#!/bin/bash
systemctl list-units --type=service --state=failed

Check service that Active/Failed

#!/bin/bash
# All services (active, inactive, failed)
systemctl list-units --type=service --all

OUTPUT

c@c:~/cos3105$ ./test.sh
  UNIT                                                                                      LOAD      ACTIVE   SUB     DESCRIPTION
  apparmor.service                                                                          loaded    active   exited  Load AppArmor profiles
  apport-autoreport.service                                                                 loaded    inactive dead    Process error reports when automatic reporting is enabled
  apport.service                                                                            loaded    active   exited  automatic crash report generation
  apt-daily-upgrade.service                                                                 loaded    inactive dead    Daily apt upgrade and clean activities
  apt-daily.service                                                                         loaded    inactive dead    Daily apt download activities
● auditd.service                                                                            not-found inactive dead    auditd.service
  blk-availability.service                                                                  loaded    active   exited  Availability of block devices
  cloud-init-local.service                                                                  loaded    inactive dead    Cloud-init: Local Stage (pre-network)
  code-server@c.service                                                                     loaded    active   running code-server
● connman.service                                                                           not-found inactive dead    connman.service
● console-screen.service                                                                    not-found inactive dead    console-screen.service

Check service log

Since 6 hours ago

#!/bin/bash
journalctl --since '6 hour ago'

OUTPUT

c@c:~/cos3105$ ./test.sh
Aug 18 23:05:01 c CRON[105112]: pam_unix(cron:session): session opened for user root(uid=0) by root(uid=0)
Aug 18 23:05:01 c CRON[105113]: (root) CMD (command -v debian-sa1 > /dev/null && debian-sa1 1 1)
Aug 18 23:05:01 c CRON[105112]: pam_unix(cron:session): session closed for user root
Aug 18 23:10:31 c systemd[1]: Starting sysstat-collect.service - system activity accounting tool...
Aug 18 23:10:31 c systemd[1]: sysstat-collect.service: Deactivated successfully.
Aug 18 23:10:31 c systemd[1]: Finished sysstat-collect.service - system activity accounting tool.
Aug 18 23:15:01 c CRON[106860]: pam_unix(cron:session): session opened for user root(uid=0) by root(uid=0)
Aug 18 23:15:01 c CRON[106861]: (root) CMD (command -v debian-sa1 > /dev/null && debian-sa1 1 1)
Aug 18 23:15:01 c CRON[106860]: pam_unix(cron:session): session closed for user root
Aug 18 23:17:01 c CRON[107213]: pam_unix(cron:session): session opened for user root(uid=0) by root(uid=0)
Aug 18 23:17:01 c CRON[107214]: (root) CMD (cd / && run-parts --report /etc/cron.hourly)
Aug 18 23:17:01 c CRON[107213]: pam_unix(cron:session): session closed for user root

Check Network PORT status

#!/bin/bash
ss -4aut

OUTPUT

c@c:~/cos3105$ ./test.sh
Netid                State                    Recv-Q                Send-Q                                  Local Address:Port                                    Peer Address:Port                 Process
udp                  UNCONN                   0                     0                                          127.0.0.54:domain                                       0.0.0.0:*
udp                  UNCONN                   0                     0                                       127.0.0.53%lo:domain                                       0.0.0.0:*
udp                  UNCONN                   0                     0                                    10.0.2.15%enp0s3:bootpc                                       0.0.0.0:*
tcp                  LISTEN                   0                     4096                                       127.0.0.54:domain                                       0.0.0.0:*
tcp                  LISTEN                   0                     511                                           0.0.0.0:http-alt                                     0.0.0.0:*
tcp                  LISTEN                   0                     4096                                    127.0.0.53%lo:domain                                       0.0.0.0:*
tcp                  ESTAB                    0                     0                                           10.0.2.15:http-alt                                    10.0.2.2:58644
tcp                  TIME-WAIT                0                     0                                           10.0.2.15:54010                                  74.125.68.121:https
tcp                  ESTAB                    0                     0                                           10.0.2.15:52650                                  74.125.68.121:https
tcp                  ESTAB                    0                     0                                           10.0.2.15:http-alt                                    10.0.2.2:58664
tcp                  TIME-WAIT                0                     0                                           10.0.2.15:58828                                  74.125.68.121:https
tcp                  TIME-WAIT                0                     0                                           10.0.2.15:58818                                  74.125.68.121:https
tcp                  TIME-WAIT                0                     0                                           10.0.2.15:54024                                  74.125.68.121:https
tcp                  ESTAB                    0                     0                                           10.0.2.15:52644                                  74.125.68.121:https

Check Network Card Interface

#!/bin/bash
ip a

OUTPUT

c@c:~/cos3105$ ./test.sh
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host noprefixroute
       valid_lft forever preferred_lft forever
2: enp0s3: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
    link/ether 08:00:27:89:c0:c4 brd ff:ff:ff:ff:ff:ff
    inet 10.0.2.15/24 metric 100 brd 10.0.2.255 scope global dynamic enp0s3
       valid_lft 72149sec preferred_lft 72149sec
    inet6 fd17:625c:f037:2:a00:27ff:fe89:c0c4/64 scope global dynamic mngtmpaddr noprefixroute
       valid_lft 85886sec preferred_lft 13886sec
    inet6 fe80::a00:27ff:fe89:c0c4/64 scope link
       valid_lft forever preferred_lft forever

advanced

#!/bin/bash
ip -4 -brief address show

OUTPUT

c@c:~/cos3105$ ./test.sh
lo               UNKNOWN        127.0.0.1/8
enp0s3           UP             10.0.2.15/24 metric 100

TAR GZIP

Extract gzip

tar -xvzf images.tar.gz

To explain a little further, tar collected all the files into one package, images.tar. The gzip program applied compression, hence the gz extension. So the command does a couple things:

f: this must be the last flag of the command, and the tar file must be immediately after. It tells tar the name and path of the compressed file. z: tells tar to decompress the archive using gzip x: tar can collect files or extract them. x does the latter. v: makes tar talk a lot. Verbose output shows you all the files being extracted.

To extract into a custom folder, add the -C option with a folder name of your choice:

tar -xvzf images.tar.gz -C some_custom_folder_name

Compress gzip

tar -cvzf linuximage.tar.gz linuximage

ZIP/UNZIP

Install zip/unzip

sudo apt install zip unzip

To zip a file
Suppose that we have email.sh and want to zip file

zip email.zip email.sh

OUTPUT

c@c:~/cos3105$ zip email.zip email.sh
  adding: email.sh (deflated 36%)

To zip a folder name cjson

zip cjson.zip -r cjson

OUTPUT

c@c:~/cos3105$ zip cjson.zip -r cjson
  adding: cjson/ (stored 0%)
  adding: cjson/cJSON-1.7.18/ (stored 0%)
  adding: cjson/cJSON-1.7.18/library_config/ (stored 0%)
  adding: cjson/cJSON-1.7.18/library_config/libcjson_utils.pc.in (deflated 32%)
  adding: cjson/cJSON-1.7.18/library_config/cJSONConfig.cmake.in (deflated 57%)
  adding: cjson/cJSON-1.7.18/library_config/cJSONConfigVersion.cmake.in (deflated 53%)

To unzip file

c@c:~/cos3105$ unzip cjson.zip -d cjson

OUTPUT

c@c:~/cos3105$ unzip cjson.zip -d cjson
Archive:  cjson.zip
   creating: cjson/cjson/
   creating: cjson/cjson/cJSON-1.7.18/
   creating: cjson/cjson/cJSON-1.7.18/library_config/
  inflating: cjson/cjson/cJSON-1.7.18/library_config/libcjson_utils.pc.in
  inflating: cjson/cjson/cJSON-1.7.18/library_config/cJSONConfig.cmake.in
  inflating: cjson/cjson/cJSON-1.7.18/library_config/cJSONConfigVersion.cmake.in

CURL

curl (Client URL) is a command-line tool that allows you to send and receive data from servers using various protocols like HTTP, HTTPS, FTP, and more. It’s widely used for testing APIs, downloading files, and debugging web services.

curl [options] [URL]

Basic GET Request

Fetch webpages

curl https://httpbin.org/get

Save Output to a File

Use -o to save the response to a specific file:

curl -o output.html https://example.com

Or use -O to save with the original filename:

curl -O https://httpbin.org/image/webp

POST Requests with Data

Send data to a server using POST:

curl -X POST -d "name=John&age=25" https://httpbin.org/post

Send JSON data:

curl -X POST -H "Content-Type: application/json" -d '{"name":"John","age":25}' https://httpbin.org/post

Adding Headers

Include custom headers in your request:

curl -X GET "https://httpbin.org/bearer" -H "accept: application/json" -H "Authorization: Bearer ghp_1234567890abcdef"

Following Redirects

Use -L to follow redirects automatically:

curl -L https://bit.ly/shortened-url

Verbose Output for Learning

Use -v to see detailed information about the request and response:

curl -v https://httpbin.org/get

HTTP Methods

Specify different HTTP methods:

curl -X PUT -d "data" https://httpbin.org/put
curl -X DELETE https://httpbin.org/delete
curl -X PATCH -d "data" https://httpbin.org/patch

Test send Email

Via mailtrap.io for testing

#!/bin/bash

echo 'Looking to send emails in production? Check out our Email API/SMTP product!'
curl --location --request POST \
'https://sandbox.api.mailtrap.io/api/send/YOUR_ID' \
--header 'Authorization: Bearer TOKEN' \
--header 'Content-Type: application/json' \
--data-raw '{"from":{"email":"sender@example.com","name":"Mailtrap Test"},"to":[{"email":"receiver@example.com"}],"subject":"You are awesome!","text":"Congrats for sending test email with Mailtrap!","category":"Integration Test"}'

Handle success/errors
Don’t forget to replace for your own YOUR_ID and TOKEN!

if curl -f -s --location --request POST \
'https://sandbox.api.mailtrap.io/api/send/394' \
--header 'Authorization: Bearer d9ace522be' \
--header 'Content-Type: application/json' \
--data-raw '{"from":{"email":"sender@example.com","name":"Mailtrap Test"},"to":[{"email":"receiver@example.com"}],"subject":"You are awesome!","text":"Congrats for sending test email with Mailtrap!","category":"Integration Test"}' > /dev/null; then
    echo "Success 200 response"
else
    echo "Failed (non-2xx response or network error)"
fi

Get response code

# Get just the response code
curl -s -o /dev/null -w "%{http_code}" https://example.com

# Get response code with other info
curl -w "Response: %{http_code}\nTime: %{time_total}s\n" https://example.com

# Store response code in variable (bash)
response_code=$(curl -s -o /dev/null -w "%{http_code}" https://example.com)
if [ "$response_code" -eq 200 ]; then
    echo "Success!"
else
    echo "Error: $response_code"
fi

CRON

What is Cron?

Cron is a time-based job scheduler in Unix-like operating systems. It allows you to run scripts, commands, or programs automatically at specified times and intervals.

Basic Concepts

Cron daemon: The background service that runs scheduled jobs
Cron job: A scheduled task
Crontab: The configuration file that lists cron jobs for a user

Cron Syntax Each cron job follows this format:

* * * * * command-to-execute
│ │ │ │ │
│ │ │ │ └── Day of week (0-7, where 0 and 7 are Sunday)
│ │ │ └──── Month (1-12)
│ │ └────── Day of month (1-31)
│ └──────── Hour (0-23)
└────────── Minute (0-59)

Example

For more examples: https://crontab.guru/examples.html

# Run every minute
* * * * * /path/to/script.sh

# Run at 2:30 AM daily
30 2 * * * /path/to/backup.sh

# Run every 5 minutes
*/5 * * * * /path/to/monitor.sh

# Run at 9 AM on weekdays (Mon-Fri)
0 9 * * 1-5 /path/to/workday-task.sh

# Run on the first day of every month at midnight
0 0 1 * * /path/to/monthly-report.sh

# Run every Sunday at 3 AM
0 3 * * 0 /path/to/weekly-cleanup.sh

Managing Crontab

View current crontab

crontab -l

Edit crontab

crontab -e

Remove all cron jobs

crontab -r

Full Example

Bash script

#!/bin/bash


if [ ! -d "/home/c/cos3105/logs" ]; then
    mkdir /home/c/cos3105/logs
fi

touch "/home/c/cos3105/logs/log_$(date +"%Y_%m_%d_%H_%M_%S.txt")"

Cron script

# ===========================================
# CRON JOB CONFIGURATION
# ===========================================
# This runs ex_cron.sh every minute and logs output
#
# To ENABLE: Remove the # from the line below
# To DISABLE: Add # at the beginning of the line below
#
* * * * * /home/c/cos3105/ex_cron.sh >> /home/c/cos3105/cron_output.log 2>&1

OUTPUT

3 - Most used commands

Most used commands

Check active users

Check server uptime

Check date and time that server was started

Check log for SSH login

Check log for SSH login failure

Check server information

Check status CPU, I/O, Disks

Check RAM status

Check process that use more RAM

Check service that load on BOOT

Check service that running

Check service that Failed

Check service that Active/Failed

Check service log

Check Network PORT status

Check Network Card Interface

TAR GZIP

ZIP/UNZIP

CURL

Basic GET Request

Save Output to a File

POST Requests with Data

Adding Headers

Following Redirects

Verbose Output for Learning

HTTP Methods

Test send Email

CRON

Example

Managing Crontab

Full Example