Linux Commands on Linuxize

npm Command: Install and Manage Node.js Packages

hello@linuxize.com (Linuxize) — Fri, 05 Jun 2026 09:30:00 +0200

When you start or clone a Node.js project, one of the first things you usually do is install its packages. npm is the default package manager that ships with Node.js, and it is the command you use to add, update, remove, and run project dependencies. It reads and writes the package.json file that records what your project needs.

This guide walks through the npm commands you will use most often: starting a project, installing local and global packages, pinning versions, updating and removing dependencies, and running project scripts.

Syntax

The general form of the command is:

txt
npm <command> [args] [options]

npm ships with Node.js, so installing Node.js installs npm too. If you have not set up Node.js yet, see our guide on installing Node.js on Ubuntu 26.04 . Before we run package commands, confirm both tools are available:

Terminal
node --version
npm --version

output

v24.16.0
11.13.0

If npm reports a version, you are ready to go.

Initialize a Project

Every npm project centers on a package.json file. This file lists the project dependencies, scripts, package name, version, and other metadata. Create one in the current directory with:

Terminal
npm init

npm asks a series of questions (name, version, entry point, and so on) and writes your answers to package.json. To accept all the defaults without prompts, add the -y flag:

Terminal
npm init -y

This is the usual starting point for a new project. Once package.json exists, later npm install commands have a file where they can record dependencies.

Install Packages

To add a package to your project, run npm install with the package name:

Terminal
npm install express

This downloads express into a node_modules directory and records it under dependencies in package.json. npm also creates or updates package-lock.json, which records the exact versions that were installed.

For tools you only need while developing, such as test runners or linters, save them as development dependencies with -D (short for --save-dev):

Terminal
npm install -D eslint

These land under devDependencies and are skipped when a project is installed for production with npm install --omit=dev.

When you clone an existing project, you do not install each package by hand. Run install with no arguments from the project directory:

Terminal
npm install

npm reads package.json and the lock file, installs the missing packages, and updates package-lock.json when dependency ranges need to be resolved. This is the command you usually run during local development.

For CI jobs, clean deploys, and other repeatable installs, use npm ci instead:

Terminal
npm ci

npm ci requires an existing package-lock.json, removes any current node_modules directory, and installs the exact dependency tree from the lock file without changing package.json or package-lock.json.

Install Global Packages

Some packages are command-line tools you may want available everywhere instead of tied to one project. Install them globally with -g:

Terminal
sudo npm install -g http-server

The tool is then on your PATH and can be run from any directory. Reserve global installs for command-line utilities. Project dependencies should stay local so each project controls its own versions.

Tip

Using sudo for global installs works but can create permission headaches. A cleaner approach is to manage Node.js with a version manager such as nvm, which installs global packages under your home directory and removes the need for sudo.

Install a Specific Version

When a project needs a specific package release, append @ and the version number:

Terminal
npm install express@4.18.2

You can also install by tag, such as npm install express@latest for the newest release or @next for a prerelease line. Pinning a specific version is useful when you need to match an application requirement or avoid a breaking change in a newer release.

Update and Inspect Packages

Before updating packages, check what is currently installed and what newer versions are available:

Terminal
npm outdated

output

Package Current Wanted Latest Location
express 4.18.0 4.18.2 4.19.2 node_modules/express

The Wanted column is the newest version allowed by the range in package.json, while Latest is the newest published. Update packages to the wanted versions with:

Terminal
npm update

If you want to move to a new major version beyond your declared range, install that version explicitly as shown above.

Remove Packages

When a dependency is no longer needed, uninstall it and remove it from package.json with:

Terminal
npm uninstall express

npm removes the package from node_modules and updates both package.json and the lock file. For a global package, add -g:

Terminal
sudo npm uninstall -g http-server

Run Scripts

The scripts section of package.json defines named commands for common project tasks. A typical file might include:

json
{
 "scripts": {
 "start": "node index.js",
 "test": "jest"
 }
}

Run a script with npm run followed by its name:

Terminal
npm run start

The start and test names are special and can be run without run, so npm start and npm test both work. Scripts are how most projects expose their build, test, lint, and development commands.

List Installed Packages

When you need to inspect what is installed in the current project, use:

Terminal
npm list

By default, recent npm versions show the top-level project and its direct dependencies. If you need to inspect the full nested tree, add --all:

Terminal
npm list --all

Add -g to list globally installed packages instead.

Run a Package Without Installing It

The npx command, bundled with npm, runs a package binary without a permanent global install. Use it when you need a one-off tool but do not want to add it to the project:

Terminal
npx prettier@latest --check .

npx downloads the package if needed, runs it, and does not leave a global install behind. For project scaffolding, many packages also support the npm create form. For example, to start a Vite React project, run:

Terminal
npm create vite@latest my-app -- --template react

Quick Reference

For a printable quick reference, see the npm cheatsheet .

Task	Command
Create package.json	`npm init -y`
Install a package	`npm install <pkg>`
Install as dev dependency	`npm install -D <pkg>`
Install all dependencies	`npm install`
Clean install from lock file	`npm ci`
Install globally	`npm install -g <pkg>`
Install a specific version	`npm install <pkg>@1.2.3`
Show outdated packages	`npm outdated`
Update packages	`npm update`
Remove a package	`npm uninstall <pkg>`
Run a script	`npm run <script>`
List installed packages	`npm list`
List full dependency tree	`npm list --all`
Run without installing	`npx <pkg>`

Troubleshooting

EACCES: permission denied during a global install
A global install is trying to write to a system directory your user cannot modify. Either prefix the command with sudo, or, better, manage Node.js with nvm so global packages install under your home directory without root permissions.

A script exits with an npm error
The script ran but one of the commands inside it exited with an error. Scroll up to the actual command output above the npm error block; the underlying tool, not npm, is usually reporting the failure.

Conflicting peer dependency errors on install
A package expects a different version of a shared dependency than what is installed. Resolve the version mismatch where possible, or, as a temporary measure, retry with npm install --legacy-peer-deps while you sort out the conflict.

FAQ

What is the difference between dependencies and devDependencies?
dependencies are packages your application needs to run. devDependencies are needed only during development, such as test frameworks and linters, and are installed with -D. Production installs can skip them with --omit=dev.

What does package-lock.json do?
It records the exact version of every installed package, including nested dependencies. Commit it to version control, then use npm ci when you need an exact lock-file install in CI or deployment.

What is the difference between npm and npx?
npm installs and manages packages, while npx runs a package’s executable, downloading it temporarily if it is not installed. Use npx for one-off commands and scaffolding tools.

How do I install a package without saving it to package.json?
Add the --no-save flag, for example npm install --no-save <pkg>. The package is installed into node_modules but the change is not recorded in package.json.

Conclusion

A small set of commands, npm install, npm ci, npm update, npm uninstall, and npm run, covers nearly all package work in a Node.js project. Keep package-lock.json committed, and use npm ci whenever repeatable installs matter.

Fix "sudo: command not found" on Linux

hello@linuxize.com (Linuxize) — Thu, 04 Jun 2026 09:35:00 +0200

You log in to a fresh server, try to install a package, and the shell answers with sudo: command not found. It is a confusing message, because sudo feels like a built-in part of Linux. In reality sudo is a regular package that some minimal images and container base layers skip, and it is also one of the first commands to disappear when your shell environment is broken.

This guide explains the three reasons the error shows up: sudo is not installed, your user is not allowed to run it, or your PATH no longer points to /usr/bin. Each case has a clean fix.

Quick Reference

What to check	Command	What to do
Is sudo installed?	`ls -l /usr/bin/sudo`	Install the `sudo` package as root if the file is missing
Is your user allowed to use sudo?	`groups username`	Add the user to `sudo` on Debian/Ubuntu or `wheel` on Fedora/RHEL/Arch
Is PATH broken?	`echo $PATH`	Restore `/usr/bin`, `/usr/sbin`, `/bin`, and `/sbin` in your shell startup file
Does sudo work by absolute path?	`/usr/bin/sudo whoami`	Fix the shell `PATH` if this works but `sudo whoami` fails

Confirm the Real Cause

Before installing anything, check whether the sudo binary exists on the system:

Terminal
ls -l /usr/bin/sudo

output

-rwsr-xr-x 1 root root 277936 Jan 17 09:42 /usr/bin/sudo

If the file is there with the SUID bit (s in the owner permissions), sudo is installed and the error is environmental. If the file is missing, you need to install the package as the root user. Pick the section below that matches your situation.

Install sudo on Debian, Ubuntu, and Derivatives

Minimal Debian installs and many Docker base images leave sudo out. Switch to the root account first, because without sudo you cannot escalate privileges from a normal user:

Terminal
su -

Enter the root password, then install the package with apt:

Terminal
apt update
apt install sudo

If su itself is rejected because root has no password (the default on Ubuntu desktop installs), boot into recovery mode or use a live USB to set a root password before retrying.

Install sudo on Fedora, RHEL, and Derivatives

On Fedora, RHEL, Rocky Linux, and AlmaLinux, switch to root and install with dnf:

Terminal
su -
dnf install sudo

On older Red Hat-family systems you may see yum referenced in tutorials; dnf is the current package manager and the right choice on every supported release.

Install sudo on Arch Linux

Arch ships a minimal base, and sudo is a separate package:

Terminal
su -
pacman -S sudo

Install sudo on Alpine Linux

Alpine, which is common inside containers, uses apk. Two options exist: the full sudo package, or the lighter doas replacement.

Terminal
su -
apk add sudo

If you only need privilege escalation inside a container and want to keep the image small, apk add doas followed by a one-line /etc/doas.conf is often enough.

Add Your User to the sudo Group

Installing the package is only half the job. By default, only users that belong to a specific administrative group can run sudo. The group name varies by distribution.

On Debian and Ubuntu, the group is sudo:

Terminal
usermod -aG sudo sara

On Fedora, RHEL, and Arch, the group is wheel:

Terminal
usermod -aG wheel sara

Group changes only take effect on a new login session. Log out and back in, then verify membership:

Terminal
groups sara

output

sara : sara sudo

The presence of sudo (or wheel) in the list confirms the user can now run privileged commands.

Fix a Broken PATH

If /usr/bin/sudo exists but the shell still reports “command not found”, the problem is your PATH . A typo in ~/.bashrc or ~/.zshrc can wipe out the standard directories. Check the current value:

Terminal
echo $PATH

output

/home/sara/bin:/home/sara/.local/bin

When /usr/bin and /usr/local/bin are missing, the shell cannot find any of the system binaries. Restore a sane PATH for the current session by calling sudo with its absolute path:

Terminal
/usr/bin/sudo apt update

That works as a one-off, but the durable fix is to repair the shell config. Open the file that broke the variable:

Terminal
nano ~/.bashrc

A safe baseline looks like this:

~/.bashrcsh
export PATH="$HOME/bin:$HOME/.local/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"

The key detail is keeping $PATH itself in any line that extends it. A line like export PATH=$HOME/bin (without :$PATH) overwrites everything else and is the most common cause of this failure.

Source the file and try again:

Terminal
source ~/.bashrc
sudo whoami

output

root

A root response confirms sudo is back on the path and working.

Troubleshooting

sara is not in the sudoers file. This incident will be reported.
The user exists but is not authorized. Switch to root and either add the user to the admin group (as shown above) or edit /etc/sudoers with visudo and add a line such as sara ALL=(ALL:ALL) ALL. Never edit /etc/sudoers directly; visudo validates syntax and prevents lockout.

No root password and no sudo
On Ubuntu, root is disabled by default. Boot into the GRUB recovery menu, drop to a root shell, and run passwd root to set a password. Then install sudo and add your user to the group as shown above.

sudo: /etc/sudo.conf is owned by uid 1000, should be 0
File ownership in /etc was changed by mistake. As root, restore it with chown root:root /etc/sudo.conf /etc/sudoers and chmod 440 /etc/sudoers.

FAQ

Why does sudo work in one shell but not another?
The two shells likely load different startup files. Compare echo $PATH in each, and check ~/.bashrc, ~/.bash_profile, ~/.profile, and ~/.zshrc for conflicting PATH assignments.

Does adding a user to the sudo group take effect right away?
No. Group membership is read at login. Log out and back in, or start a new login shell with su - sara to pick up the change.

Is doas a real replacement for sudo?
For single-user systems and most container images, yes. doas is smaller and configured through a much shorter file. Multi-user servers with detailed access rules are still better served by sudo.

Conclusion

The “command not found” message points to one of three problems: a missing package, a missing group membership, or a broken PATH. Walking through them in that order resolves the error on almost every Linux system.

For follow-up reading, see our guides on creating a sudo user and the sudo command reference .

dpkg Command in Linux: Install and Manage Debian Packages

hello@linuxize.com (Linuxize) — Mon, 01 Jun 2026 10:20:00 +0200

When you install software on Ubuntu or Debian with apt , the package manager quietly calls dpkg in the background to do the actual work. dpkg is the low-level tool that unpacks and installs .deb files, maintains the package database, and handles removal and purging. Knowing how to use it directly is useful when you have a local .deb file that is not in a repository, when you need to query what files a package installed, or when you want to find which package owns a specific file on your system.

Syntax

txt
dpkg [OPTIONS] COMMAND [ARGUMENTS]

Install, remove, purge, and configure operations require sudo because they modify system directories and the package database. Query commands such as dpkg -l, dpkg -L, dpkg -S, and dpkg -s usually run without elevated privileges.

Install a Package

To install a local .deb file:

Terminal
sudo dpkg -i package.deb

dpkg unpacks the archive, runs the maintainer scripts, and registers the package in its database. If the package has unmet dependencies, the install fails with a dependency error. Fix it by running:

Terminal
sudo apt install -f

apt install -f (fix broken) resolves and installs any missing dependencies, then completes the pending dpkg installation.

For most local .deb installs, apt install ./package.deb is easier because it can resolve dependencies in the same step. Use dpkg -i when you specifically need the lower-level package operation.

Remove a Package

To uninstall a package while keeping its configuration files:

Terminal
sudo dpkg -r package-name

To uninstall a package and delete its configuration files at the same time (a full purge):

Terminal
sudo dpkg -P package-name

Use -P when you want a clean removal with no leftover config, or when you plan to reinstall with a fresh configuration.

List Installed Packages

To list every installed package with its version and status:

Terminal
dpkg -l

The output is wide. Each package line starts with three status columns: desired action, current package status, and error state. The normal installed state appears as ii, followed by the package name, version, architecture, and description:

output

Desired=Unknown/Install/Remove/Purge/Hold
| Status=Not/Inst/Conf-files/Unpacked/halF-conf/Half-inst/trig-aWait/Trig-pend
|/ Err?=(none)/Reinst-required (Status,Err: uppercase=bad)
||/ Name Version Architecture Description
+++-==============-=============-============-=================================
ii curl 8.5.0 amd64 command line tool for transferring data
ii nginx 1.26.0 amd64 small, powerful, scalable web/proxy server

The first i means the package is selected for installation, and the second i means it is installed and configured. Filter by name to narrow the output:

Terminal
dpkg -l 'nginx*'

output

ii nginx 1.26.0 amd64 small, powerful, scalable web/proxy server
ii nginx-common 1.26.0 all small, powerful, scalable web/proxy server (common files)

List Files Installed by a Package

To see every file a package placed on your system:

Terminal
dpkg -L nginx

output

/.
/etc
/etc/nginx
/etc/nginx/nginx.conf
/etc/nginx/sites-available
/etc/nginx/sites-enabled
/usr/sbin
/usr/sbin/nginx
...

This is useful when you need to find where a package installs its binary, config files, or documentation.

Find Which Package Owns a File

To identify which package installed a particular file:

Terminal
dpkg -S /usr/sbin/nginx

output

nginx: /usr/sbin/nginx

You can also search by pattern:

Terminal
dpkg -S '*/bin/curl'

output

curl: /usr/bin/curl

Show Package Details

To print the full metadata for an installed package including version, dependencies, and description:

Terminal
dpkg -s nginx

output

Package: nginx
Status: install ok installed
Priority: optional
Section: web
Installed-Size: 47
Maintainer: Ubuntu Developers <ubuntu-devel-discuss@lists.ubuntu.com>
Architecture: amd64
Version: 1.26.0-1ubuntu1
...

Inspect a .deb File Without Installing

To read the metadata of a .deb file before installing it:

Terminal
dpkg --info package.deb

output

 new Debian package, version 2.0.
size 1234567 bytes: control archive=2048 bytes.
...
Package: myapp
Version: 2.1.0
Architecture: amd64
...

To list the files the package would install without actually installing it:

Terminal
dpkg --contents package.deb

Extract a Package Without Installing

To unpack the contents of a .deb file into a directory for inspection:

Terminal
dpkg -x package.deb /tmp/extracted

The directory structure mirrors where files would be installed on the real system.

Export and Restore Package Selections

To export a list of all installed packages (useful for replicating a system):

Terminal
dpkg --get-selections > installed-packages.txt

To restore those selections on another machine:

Terminal
sudo dpkg --set-selections < installed-packages.txt
sudo apt-get dselect-upgrade

Reconfigure an Installed Package

Some packages run interactive setup at install time. To run that setup again:

Terminal
sudo dpkg-reconfigure package-name

This is commonly used to reconfigure tzdata for timezone changes, keyboard-configuration, or locales.

Fix Broken Package State

If a system update or manual operation leaves packages in a half-installed or unconfigured state, run:

Terminal
sudo dpkg --configure -a

This processes any pending package configuration steps. Follow it with sudo apt install -f if dependency issues remain.

Troubleshooting

dpkg reports dependency problems
dpkg installs the package file you give it, but it does not download missing dependencies. Run sudo apt install -f to install the required packages and finish the pending configuration.

A package operation was interrupted
If an update or install stopped before configuration finished, run sudo dpkg --configure -a. This resumes pending package configuration scripts.

dpkg cannot find a package
Use the installed package name, not the .deb filename. Run dpkg -l 'pattern*' to find matching installed packages, then use that package name with commands such as dpkg -L, dpkg -s, or sudo dpkg -r.

Quick Reference

For a printable quick reference, see the dpkg cheatsheet .

Command	Description
`dpkg -i pkg.deb`	Install a local .deb file
`dpkg -r package`	Remove a package, keep config
`dpkg -P package`	Purge a package and its config
`dpkg -l`	List all installed packages
`dpkg -l 'pattern*'`	Filter installed packages
`dpkg -L package`	List files installed by a package
`dpkg -S /path/to/file`	Find which package owns a file
`dpkg -s package`	Show package status and details
`dpkg --info pkg.deb`	Inspect a .deb file
`dpkg --contents pkg.deb`	List files in a .deb
`dpkg -x pkg.deb /dir`	Extract a .deb without installing
`dpkg --get-selections`	Export installed package list
`dpkg-reconfigure package`	Re-run package configuration
`dpkg --configure -a`	Fix incomplete installations

Conclusion

dpkg is the foundation of package management on Debian-based systems. For everyday installs and updates from repositories, apt is the better tool because it resolves dependencies automatically. Reach for dpkg directly when you need to install a .deb file from disk, audit what a package installed, or diagnose a broken package state.

iptables Command in Linux: Manage Firewall Rules

hello@linuxize.com (Linuxize) — Fri, 29 May 2026 09:30:00 +0100

When a packet arrives at a Linux machine, the kernel decides what to do with it based on a set of firewall rules. Those rules live in the kernel’s Netfilter framework, and for more than two decades the standard way to edit them from user space has been the iptables command.

iptables controls packet filtering, network address translation, and packet mangling. Higher-level front ends such as ufw and firewalld manage the same Netfilter firewall stack through simpler interfaces, although many modern systems use nftables underneath. Understanding the underlying command is still valuable, especially when you inherit a server that was set up by someone else. This guide walks through the concepts and the commands you need to read, edit, and persist firewall rules.

Tables and Chains

Before you write a rule, you need to know where it goes. iptables is organized into tables, and each table contains chains.

The three tables you will use most often are:

filter - the default table, used for allowing and blocking traffic
nat - used for network address translation, such as port forwarding and masquerading
mangle - used to alter packet headers, for example to set QoS marks

Each table has a set of built-in chains that correspond to moments in the life of a packet. In the filter table:

INPUT - packets destined for the local machine
OUTPUT - packets originating from the local machine
FORWARD - packets routed through the machine

A rule says: for packets that enter this chain and match these criteria, take this action. The action is called a target and is usually ACCEPT, DROP, REJECT, or the name of another chain.

iptables Syntax

The general form of the command is:

txt
iptables [-t TABLE] COMMAND CHAIN [MATCH] [-j TARGET]

If -t is omitted, iptables uses the filter table. Common commands include -A (append a rule), -I (insert), -D (delete), -L (list), -F (flush), and -P (set default policy).

All commands that change the firewall require root privileges. Run them with sudo or as root.

Warning

It is easy to lock yourself out of a remote server with a single wrong rule. Before you apply a restrictive ruleset over SSH, either test on a local machine first or use iptables-apply, which rolls back automatically if you lose access.

List Rules

To print every rule in the filter table, use the -L option:

Terminal
sudo iptables -L

The default output shows service names, resolves IP addresses, and hides packet and byte counters. For real work, add -n to keep numeric output and -v to show counters and interface information:

Terminal
sudo iptables -L -n -v

output

Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
1234 98K ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:22
0 0 DROP tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:23
Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination

To list a single chain, append its name:

Terminal
sudo iptables -L INPUT -n -v

To number the rules so you can reference them by index when deleting, add --line-numbers:

Terminal
sudo iptables -L INPUT -n -v --line-numbers

Add and Remove Rules

New rules are added to the end of a chain with -A (append) or at a specific position with -I (insert). The difference matters because iptables evaluates rules top to bottom and stops at the first match.

To allow incoming SSH connections:

Terminal
sudo iptables -A INPUT -p tcp --dport 22 -j ACCEPT

To allow HTTP and HTTPS:

Terminal
sudo iptables -A INPUT -p tcp --dport 80 -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 443 -j ACCEPT

To insert a rule as the first one in the chain, use -I CHAIN 1:

Terminal
sudo iptables -I INPUT 1 -p tcp --dport 22 -j ACCEPT

This is important when you are working over SSH. If a broad DROP rule already appears earlier in the chain, appending the accept rule after it would not help because the packet would be dropped first.

To delete a rule, either repeat the exact specification with -D:

Terminal
sudo iptables -D INPUT -p tcp --dport 23 -j DROP

Or delete by line number, which is easier when the rule has many options:

Terminal
sudo iptables -D INPUT 3

Allow and Block Specific IPs

To block all traffic from a single IP address:

Terminal
sudo iptables -A INPUT -s 203.0.113.10 -j DROP

To block a range using CIDR notation:

Terminal
sudo iptables -A INPUT -s 203.0.113.0/24 -j DROP

To allow SSH only from a trusted subnet:

Terminal
sudo iptables -A INPUT -p tcp -s 192.168.1.0/24 --dport 22 -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 22 -j DROP

The first rule accepts SSH from the local subnet. The second drops SSH from everywhere else. Order matters: if you reversed the two lines, every SSH attempt would be dropped before the accept rule had a chance to match.

Allow Established Connections

Most firewall setups include a rule that accepts traffic belonging to an already established connection. This lets return traffic through without needing a matching rule for each outbound request:

Terminal
sudo iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

Put this rule near the top of the INPUT chain so it matches early. Without it, the default DROP policy breaks outbound connections that expect responses.

Set a Default Policy

Each built-in chain has a default policy that applies when no rule matches. The -P option changes it:

Terminal
sudo iptables -P INPUT DROP
sudo iptables -P FORWARD DROP
sudo iptables -P OUTPUT ACCEPT

Switching INPUT to DROP is the foundation of a deny-by-default firewall: nothing gets in unless an explicit rule allows it. Before you flip the policy, make sure you have already added the rules that allow SSH, established connections, and anything else you need.

Flush Rules

To remove every rule from every chain in the current table:

Terminal
sudo iptables -F

To flush a specific chain only:

Terminal
sudo iptables -F INPUT

Flushing does not reset the default policies. If you have set INPUT to DROP, flushing will leave it at DROP with no rules, which blocks all inbound traffic. Reset the policy to ACCEPT first if that is not what you want:

Terminal
sudo iptables -P INPUT ACCEPT
sudo iptables -F

Save and Restore Rules

Rules added with iptables live in kernel memory only. They disappear on reboot unless you save them.

On Ubuntu, Debian, and Derivatives, the iptables-persistent package saves rules to /etc/iptables/rules.v4 and reloads them at boot:

Terminal
sudo apt install iptables-persistent

The installer asks whether to save the current rules. To update the saved copy later:

Terminal
sudo netfilter-persistent save

On Fedora, RHEL, and Derivatives, the equivalent service is iptables-services:

Terminal
sudo dnf install iptables-services
sudo systemctl enable --now iptables
sudo service iptables save

Independent of the distribution, you can dump and restore rules manually with iptables-save and iptables-restore:

Terminal
sudo iptables-save -f /etc/iptables/rules.v4
sudo iptables-restore /etc/iptables/rules.v4

This is also the recommended way to edit a large ruleset: save to a file, edit the file, then restore it atomically.

Troubleshooting

Rules disappear after a reboot
iptables rules are not persistent by default. Install iptables-persistent on Debian-based systems or iptables-services on RHEL-based ones, and save the ruleset.

SSH stops working after setting a DROP policy
You switched INPUT to DROP without an ACCEPT rule for port 22, or the ACCEPT rule is positioned after a more general DROP rule. Connect through the console, add the rule with -I INPUT 1, and save.

A rule looks correct but does not match
Check the order. iptables walks the chain top to bottom and stops at the first match, so an earlier accept or drop may be catching the packet first. Use iptables -L INPUT -n -v --line-numbers to inspect the order.

Changes are silently ignored
You may be editing the wrong table. A rule in filter does not affect NAT, and vice versa. Pass -t TABLE explicitly when you are not working in filter.

iptables: command not found
On some modern distributions, only nftables is installed by default. Install iptables with your package manager, or use nft directly.

Quick Reference

For a printable quick reference, see the iptables cheatsheet .

Action	Command
List rules (verbose, numeric)	`iptables -L -n -v --line-numbers`
Allow port	`iptables -A INPUT -p tcp --dport PORT -j ACCEPT`
Block IP	`iptables -A INPUT -s IP -j DROP`
Allow established connections	`iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT`
Insert rule at top	`iptables -I INPUT 1 -p tcp --dport 22 -j ACCEPT`
Delete rule by number	`iptables -D INPUT N`
Set default policy	`iptables -P INPUT DROP`
Flush all rules	`iptables -F`
Save rules	`iptables-save -f /etc/iptables/rules.v4`
Restore rules	`iptables-restore /etc/iptables/rules.v4`

FAQ

Is iptables still relevant in 2026?
It is still installed and widely used, but it is being replaced by nftables, which offers a cleaner syntax and better performance. On recent distributions, the iptables command is often a compatibility front end that writes nftables rules underneath.

Should I use iptables, ufw, or firewalld?
If you are managing rules by hand on Debian or Ubuntu, ufw is simpler and covers most cases. On Fedora and RHEL, firewalld is the default. Reach for raw iptables when you need fine-grained control that the front ends do not expose, or when you are troubleshooting an existing ruleset.

What is the difference between DROP and REJECT?
DROP silently discards the packet; the sender sees a timeout. REJECT sends an ICMP error back (or a TCP reset for TCP), so the sender gets immediate feedback. DROP is often preferred on public interfaces because it does not confirm that the port exists.

How do I block a country or a list of IPs?
For a handful of addresses, add one -s rule per entry. For larger lists, use the ipset tool to manage the addresses and reference the set from a single iptables rule.

Does iptables handle IPv6?
No. Use ip6tables for IPv6 rules. It has the same syntax and the same tables and chains, but operates on a separate rule set.

Conclusion

iptables is a low-level but reliable way to read and shape the Linux firewall. Once you have a working ruleset, save it with iptables-save and commit the file so the next person to touch the server has a clear starting point.

ripgrep Command in Linux: Fast Recursive Search

hello@linuxize.com (Linuxize) — Tue, 26 May 2026 09:30:00 +0200

Searching through a large codebase or a directory full of log files with grep often means adding -r for recursion, -n for line numbers, and --include or --exclude rules to avoid unrelated files. In a Git repository, you may also need extra excludes for build directories, vendor files, and binary output.

ripgrep (rg) handles the common case with better defaults. It searches directories recursively, respects .gitignore, .ignore, and .rgignore rules, skips hidden and binary files during recursive searches, and shows friendly interactive output. It is also much faster than traditional recursive grep on many large file trees because it uses Rust’s regex engine and parallel directory traversal.

This guide explains how to use the ripgrep command in Linux, from basic searches to file type filters, context lines, replacement previews, and config defaults.

Installing ripgrep

On Ubuntu, Debian, and Derivatives, install the ripgrep package with apt:

Terminal
sudo apt install ripgrep

On Fedora, RHEL, and Derivatives, use dnf:

Terminal
sudo dnf install ripgrep

On Arch Linux, install it from the official repositories:

Terminal
sudo pacman -S ripgrep

Verify the installation with:

Terminal
rg --version

The output shows the installed version:

output

ripgrep 15.1.0 (rev af60c2de9d)

Your distribution may ship a different version, but the examples in this guide use common options available in current ripgrep releases.

Syntax

The basic syntax for the rg command is:

txt
rg [OPTIONS] PATTERN [PATH ...]

The PATTERN argument is the text or regular expression to search for. If you omit PATH, rg searches recursively from the current directory.

For example, rg "error" searches the current directory tree, while rg "error" logs/ limits the search to the logs directory.

Basic Search

Search for a pattern in all files under the current directory:

Terminal
rg "error"

Example output:

output

logs/app.log:42:error: connection refused
logs/app.log:78:error: timeout after 30s
src/main.py:114:raise ValueError("error parsing config")

The output shows the filename, line number, and matching line. In an interactive terminal, rg also uses color by default, so you do not need the usual recursive grep flags for the common code-search workflow.

To search in a specific file, pass the filename after the pattern:

Terminal
rg "error" logs/app.log

To search in a specific directory, pass the directory path:

Terminal
rg "error" logs/

Filtering by File Type

Use -t to restrict the search to a known file type:

Terminal
rg -t py "import os"

This searches only Python files. ripgrep includes built-in definitions for many file types. To see the full list, run:

Terminal
rg --type-list

To exclude a file type, use -T:

Terminal
rg -T js "TODO"

You can also use glob patterns with -g to match or exclude specific filenames. Quote glob patterns so the shell does not expand them before rg receives them:

Terminal
rg -g '*.log' "error"

Use a leading ! to exclude matching paths:

Terminal
rg -g '!*.min.js' "console.log"

The ! prefix belongs to rg, so quoting is especially useful in shells where ! can trigger history expansion.

Case-Insensitive Search

Add -i to ignore letter case:

Terminal
rg -i "warning"

This matches warning, Warning, WARNING, and other case variants.

For a more flexible default, use -S or --smart-case:

Terminal
rg -S "warning"

With smart case, an all-lowercase pattern is case-insensitive, but a pattern with any uppercase letter is case-sensitive. For example, rg -S "warning" matches Warning, while rg -S "Warning" searches for that exact capitalization.

Fixed String Search

By default, rg treats the pattern as a regular expression. Use -F to search for a literal string instead, which is useful when the pattern contains regex characters:

Terminal
rg -F "price[0]"

Without -F, [0] would be interpreted as a character class. With -F, rg searches for the literal text price[0].

Counting and Listing Matches

To count matching lines per file instead of printing the matching lines, use -c:

Terminal
rg -c "error"

Example output:

output

logs/app.log:14
logs/nginx/access.log:3

The count is the number of matching lines, not the total number of matching words or strings.

To print only filenames that contain at least one match, use -l:

Terminal
rg -l "error"

To print only filenames that contain no matches, use --files-without-match:

Terminal
rg --files-without-match "error"

This is different from combining -v with -l. The --files-without-match option checks whether a file has zero matching lines.

Context Lines

When a matching line alone is not enough to understand the surrounding code, add context with -C:

Terminal
rg -C 3 "panic"

This prints three lines before and three lines after each match.

Use -A for lines after the match only:

Terminal
rg -A 2 "def connect"

Use -B for lines before the match only:

Terminal
rg -B 2 "def connect"

Context output is useful when you want to inspect the code around a function, error message, or configuration value without opening each file.

Multiple Patterns

Use -e to search for more than one pattern in a single pass:

Terminal
rg -e "error" -e "warning"

This matches any line containing either word. It is equivalent to the regex error|warning, but repeated -e options are easier to read when patterns become longer.

The -e option is also useful when a pattern begins with a dash:

Terminal
rg -e "--force"

Without -e, rg would try to interpret --force as an option.

Whole-Word Match

The -w flag restricts matches to whole words. This is useful when you want to find a variable name without matching it inside a longer name:

Terminal
rg -w "id"

This matches id, but not uid or invalid.

Invert Match

The -v flag prints lines that do not match the pattern:

Terminal
rg -v "^#" config.txt

This shows all lines in config.txt that do not begin with #.

If you want filenames that do not contain a pattern at all, use --files-without-match instead:

Terminal
rg --files-without-match "version" -g '*.json'

Searching Hidden Files and Ignoring .gitignore

By default, recursive rg searches skip hidden files and directories, and respect .gitignore, .ignore, and .rgignore files. This is usually what you want in a source tree.

To include hidden files and directories, use --hidden:

Terminal
rg --hidden "api_key"

To ignore .gitignore, .ignore, and .rgignore rules, use --no-ignore:

Terminal
rg --no-ignore "TODO"

The --no-ignore option does not include hidden files by itself. To search hidden files and ignored files in the same search, combine both options:

Terminal
rg --hidden --no-ignore "password"

Warning

Searching with --hidden --no-ignore can include build artifacts, dependency directories, cache folders, and other large trees. It is much slower and can produce noisy results, so use it only when you have a specific reason to search outside the normal project files.

Replacing Output

The -r option rewrites matching text in the output to show what a replacement would look like. It does not modify any files:

Terminal
rg "foo" -r "bar"

Example output:

output

src/config.py:5:bar = get_setting("bar")

The output shows the line as it would look after replacing foo with bar. This is useful for previewing a project-wide rename before using sed or a text editor’s find-and-replace feature.

For capture groups in replacements, wrap the command in single quotes so the shell does not expand $1, $name, or similar replacement references before rg runs.

Showing Only the Match

By default, rg prints the full line containing the match. Use -o to print only the matched text:

Terminal
rg -o 'v[0-9]+\.[0-9]+\.[0-9]+'

Example output:

output

package.json:4:v1.4.2
package-lock.json:8:v1.4.2

This is useful when you want to extract values from files rather than inspect matching lines in context.

ripgrep Configuration File

ripgrep can read default options from a configuration file, but it does not automatically look in ~/.config/ripgrep/ or any other fixed path. You must point RIPGREP_CONFIG_PATH to the file you want rg to read.

For example, create a config file named ~/.ripgreprc:

~/.ripgreprctxt
--smart-case
--hidden
--glob=!.git/

Then export the environment variable:

Terminal
export RIPGREP_CONFIG_PATH="$HOME/.ripgreprc"

Add that export line to your shell startup file, such as ~/.bashrc or ~/.zshrc, if you want the setting to apply in new terminal sessions.

Each config file line is passed to rg as one command-line argument. For options with values, use either --option=value on one line or put the option and its value on separate lines.

Troubleshooting

rg does not find a file you expected
The file may be hidden, ignored by .gitignore, ignored by .ignore or .rgignore, or detected as binary. Start with rg --debug "pattern" to see why paths were skipped, then add --hidden, --no-ignore, or both only when needed.

A glob pattern does not work as expected
Quote glob patterns, such as rg -g '*.conf' "server" and rg -g '!*.min.js' "console.log". Without quotes, your shell may expand * before rg sees the pattern.

A pattern starting with - is treated as an option
Use -e before the pattern, for example rg -e "--force". You can also use -- to stop option parsing, as in rg -- "--force".

Options Reference

-t TYPE - Search only files of the given type.
-T TYPE - Exclude files of the given type.
-g GLOB - Include or exclude files by glob. A ! prefix excludes paths.
-i - Search case-insensitively.
-F - Treat the pattern as a fixed string, not a regex.
-c - Count matching lines per file.
-l - List only filenames with matches.
--files-without-match - List only filenames without matches.
-C N - Show N lines of context around each match.
-A N - Show N lines after each match.
-B N - Show N lines before each match.
-e PATTERN - Add a search pattern. Repeat it to search for multiple patterns.
-w - Match whole words only.
-v - Invert the match and print non-matching lines.
-o - Print only the matched text, not the full line.
-r REPLACEMENT - Show output with matches replaced. This is a preview only.
-n - Show line numbers. This is enabled by default in interactive terminal output.
--hidden - Search hidden files and directories.
--no-ignore - Do not respect .gitignore, .ignore, and .rgignore rules.
-S, --smart-case - Search case-insensitively when the pattern is lowercase, and case-sensitively when it contains uppercase.
--stats - Print a summary of the search at the end.
-M N - Omit lines longer than N bytes.

Quick Reference

For a printable quick reference, see the ripgrep cheatsheet .

Task	Command
Search recursively from the current directory	`rg "pattern"`
Search in a specific file	`rg "pattern" file.txt`
Search in a specific directory	`rg "pattern" logs/`
Search only Python files	`rg -t py "pattern"`
Exclude JavaScript files	`rg -T js "pattern"`
Search by glob	`rg -g '*.log' "pattern"`
Exclude by glob	`rg -g '!*.min.js' "pattern"`
Search case-insensitively	`rg -i "pattern"`
Use smart case	`rg -S "pattern"`
Search for a fixed string	`rg -F "price[0]"`
Count matching lines per file	`rg -c "pattern"`
List matching filenames	`rg -l "pattern"`
List filenames without matches	`rg --files-without-match "pattern"`
Show three lines of context	`rg -C 3 "pattern"`
Search multiple patterns	`rg -e "foo" -e "bar"`
Match a whole word	`rg -w "id"`
Invert line matches	`rg -v "pattern"`
Include hidden files	`rg --hidden "pattern"`
Ignore ignore files	`rg --no-ignore "pattern"`
Include hidden and ignored files	`rg --hidden --no-ignore "pattern"`
Preview replacement output	`rg "old" -r "new"`
Print only matched text	`rg -o "pattern"`

Conclusion

ripgrep covers the same ground as grep , but its recursive search, file filtering, and ignore-file support make it a better default for many code and log searches. For path-based file finding, pair it with find , or use rg -l when you need a list of files that contain a specific pattern.

whois Command in Linux: Query Domain Registration Info

hello@linuxize.com (Linuxize) — Mon, 25 May 2026 11:30:00 +0200

When you need to know who owns a domain, when it expires, which registrar handles it, or which organization holds a particular IP block, the whois command is the fastest route. It queries the registry databases that record this information and returns a plain-text response you can scan in a terminal. The output format varies by registry, but the questions you can answer are consistent: registrar, name servers, registration and expiry dates, and contact info (where privacy rules allow).

This guide explains how to use whois in Linux to look up domains, IP addresses, and AS numbers, how to target a specific server, and how to parse the output for the fields you actually care about.

whois Syntax

The general form is:

txt
whois [OPTIONS] OBJECT

OBJECT is the domain, IP address, or AS number you want information about. With no options, whois picks the right registry automatically based on the type of query.

Install whois

whois is not always installed by default. On Ubuntu, Debian, and Derivatives:

Terminal
sudo apt update
sudo apt install whois

On Fedora, RHEL, and Derivatives:

Terminal
sudo dnf install whois

Confirm it is in place:

Terminal
whois --version

output

Version 5.6.6.

The Debian-family whois is an actively maintained client with built-in routing logic that knows which registry to ask for each TLD.

Look Up a Domain

The most common use is checking a domain:

Terminal
whois example.com

output

 Domain Name: EXAMPLE.COM
Registry Domain ID: 2336799_DOMAIN_COM-VRSN
Registrar WHOIS Server: whois.iana.org
Registrar URL: http://res-dom.iana.org
Updated Date: 2026-01-16T18:26:50Z
Creation Date: 1995-08-14T04:00:00Z
Registry Expiry Date: 2026-08-13T04:00:00Z
Registrar: RESERVED-Internet Assigned Numbers Authority
Registrar IANA ID: 376
Name Server: ELLIOTT.NS.CLOUDFLARE.COM
Name Server: HERA.NS.CLOUDFLARE.COM
DNSSEC: signedDelegation
...

The fields that matter most for everyday questions are:

Registrar, the company managing the registration.
Creation Date and Registry Expiry Date, which tell you how old the domain is and when it needs renewing.
Name Server, which lists the DNS servers authoritative for the domain.
DNSSEC, which shows whether the domain is cryptographically signed.

For ccTLDs (.de, .uk, .jp), the format differs because each country runs its own registry. The information is similar; the field names and order change.

Look Up an IP Address

whois on an IP returns the network allocation, not the domain:

Terminal
whois 93.184.216.34

output

inetnum: 93.184.216.0 - 93.184.216.255
netname: EDGECAST-NETBLK-03
descr: NETBLK-03-EU-93-184-216-0-24
country: EU
admin-c: DS7892-RIPE
tech-c: DS7892-RIPE
status: ASSIGNED PA
...

This kind of query is the right tool for “who owns this IP that has been hitting my server” investigations. The output names the network block, maintainer, and abuse contact details when the registry publishes them.

Look Up an AS Number

Pass an autonomous system number with the AS prefix:

Terminal
whois AS15169

output

ASNumber: 15169
ASName: GOOGLE
ASHandle: AS15169
RegDate: 2000-03-30
Updated: 2012-02-24
Ref: https://rdap.arin.net/registry/autnum/15169

AS lookups are useful when you trace a route with mtr or traceroute and want to know which network each hop belongs to.

Pick a Specific WHOIS Server

The default routing finds the right server for most TLDs, but you can force a query against a specific server with -h:

Terminal
whois -h whois.arin.net 8.8.8.8

The flag is the right tool for two situations: when the default routing picks the wrong upstream (rare but happens for some legacy TLDs), and when you want to compare answers between regional registries (ARIN, RIPE, APNIC, AFRINIC, LACNIC).

Limit the Recursion

Most modern whois clients follow a referral chain: query IANA, follow the pointer to the TLD registry, follow the pointer to the registrar, and return the most specific answer. To stop registry-to-registrar recursion, pass --no-recursion:

Terminal
whois --no-recursion example.com

The flag is most useful when you specifically want the registry data and not the registrar’s slightly different format.

The -H option has a different purpose. It hides legal disclaimers from the output, which can make short lookups easier to read:

Terminal
whois -H example.com

Filter the Output

Real whois responses are dozens of lines long with legal disclaimers and template text. To extract one field, pipe through grep:

Terminal
whois example.com | grep -E "Registrar:|Expiry Date:"

output

 Registry Expiry Date: 2026-08-13T04:00:00Z
Registrar: RESERVED-Internet Assigned Numbers Authority

For a name-server list:

Terminal
whois example.com | awk '/Name Server:/ {print $NF}'

output

ELLIOTT.NS.CLOUDFLARE.COM
HERA.NS.CLOUDFLARE.COM

These short patterns work for monitoring scripts that watch for domain expirations or DNSSEC status changes.

Check Domain Availability

If the domain is not registered, the response says so explicitly. The exact wording depends on the registry:

Terminal
whois never-existed-domain-xyzzy.com

output

No match for domain "NEVER-EXISTED-DOMAIN-XYZZY.COM".

Some registries (notably .io, .co, and several ccTLDs) return an empty or near-empty response for unregistered domains. Two heuristics that work in scripts:

For .com/.net/.org, grep for No match for or Domain Name: in the output.
For ccTLDs, grep for Domain not found or check whether the registration fields exist.

Rate Limits and Etiquette

Registries rate-limit whois queries. Hammering them with a script is the fastest way to get blocked. If you query many domains, add a sleep between calls and cache the result locally. For bulk lookups, use the registry’s RDAP service directly or pay for a commercial WHOIS API.

A simple polite pattern:

Terminal
while IFS= read -r domain; do
 whois "$domain"
 sleep 2
done < domains.txt

Two seconds between queries is a sane starting point; raise it if you see throttling responses.

Privacy and Redacted Output

Since GDPR took effect, most TLDs redact personal contact information for individual registrants. The response usually contains placeholders like REDACTED FOR PRIVACY or Data Protected, Not Disclosed. For organizations and legal entities, the contact information often stays visible.

This is not a defect in whois; the underlying registry data is simply less detailed than it used to be. For account-takeover prevention and abuse handling, focus on the registrar field and the abuse contact email, which remain published.

Quick Reference

Task	Command
Look up a domain	`whois example.com`
Look up an IP address	`whois 93.184.216.34`
Look up an AS number	`whois AS15169`
Query a specific server	`whois -h whois.arin.net 8.8.8.8`
Stop registry-to-registrar recursion	`whois --no-recursion example.com`
Hide legal disclaimers	`whois -H example.com`
Extract registrar and expiry fields	`whois example.com \| grep -E “Registrar:\|Expiry Date:"`
List name servers	`whois example.com \| awk ‘/Name Server:/ {print $NF}’`

Troubleshooting

whois: command not found
Install the package: sudo apt install whois on Ubuntu, Debian, and Derivatives, or sudo dnf install whois on Fedora, RHEL, and Derivatives. The package is small and adds no significant dependencies.

Output says “fgets: Connection reset by peer”
The registry rate-limited or blocked your IP. Wait a few minutes and retry, slow your script down, or query through a different network.

Response is in a different language or alphabet
Some ccTLD registries return data in the local language. Look for the English section (usually further down), or pipe through iconv if the encoding makes the response unreadable in your terminal.

FAQ

What is the difference between WHOIS and RDAP?
RDAP (Registration Data Access Protocol) is the modern replacement for WHOIS. It returns structured JSON instead of free-text and supports authentication and access controls. Most registries now serve both, and RDAP is usually the better choice for scripts that need predictable fields.

Why does the data for the same domain look different between two whois runs?
Different clients and servers can follow the referral chain differently. One response may come from the registry, while another may include data from the registrar’s WHOIS server. Use --no-recursion when you want to stop at the registry answer.

Can I run my own WHOIS server?
Yes, but only registrars and registries have authoritative data. Self-hosted WHOIS servers are useful for internal directories (IP allocation in a large network), not for public domain lookups.

Conclusion

whois is the answer to “who owns this”, whether the “this” is a domain, an IP, or an AS number. The output is plain text, the flags are short, and a handful of grep/awk patterns turn it into a script-friendly data source. For bulk work, slow the queries down and respect the rate limits the registries publish.

For related reading, see our guides on the dig command and the nslookup command .

Bash Arithmetic: Integer and Floating-Point Math

hello@linuxize.com (Linuxize) — Fri, 22 May 2026 14:41:00 +0200

Bash treats everything as a string by default, which catches many people out the first time they write total=$count+1 and end up with the literal text 5+1 instead of 6. The shell has dedicated arithmetic forms that evaluate numeric expressions properly, but they only handle integers; for floating-point math you reach for bc or awk. Once you know which form to use where, the math is short and predictable.

This guide explains how Bash arithmetic works, the differences between (( )), $(( )), and let, and how to combine them with external tools when you need decimals.

Why Plain Assignment Does Not Add

A first attempt at incrementing a variable usually looks like this:

sh
count=5
total=$count+1
echo "$total"

output

5+1

The shell sees $count as the string 5, joins it with +1, and assigns the result. To force numeric evaluation, use one of the arithmetic forms below.

The (( )) Compound Command

Wrap an expression in double parentheses to evaluate it as integer math:

sh
count=5
(( count = count + 1 ))
echo "$count"

output

Inside (( )), variable names work without $, the C-style operators are available (+, -, *, /, %, **, ++, --, <<, >>, &, |, ^, &&, ||), and the exit status of the whole expression is non-zero when the result is 0, which means you can use arithmetic in if:

sh
if (( count > 5 )); then
 echo "count is above 5"
fi

output

count is above 5

The shortcut increment and decrement operators read cleanly in loops:

sh
for (( i = 0; i < 3; i++ )); do
 echo "i=$i"
done

output

i=0
i=1
i=2

(( )) is the right form when you assign back to a variable or use the result for control flow. It does not print anything to standard output.

The $(( )) Expansion

When you want the value of an expression rather than the side effect, use the $(( )) arithmetic expansion. The result is substituted into the surrounding command like any other expansion:

sh
count=5
echo "Next: $(( count + 1 ))"

output

Next: 6

$(( )) is the right form for inline math inside echo, assignments to other variables, command arguments, and printf:

sh
files=42
echo "Average: $(( files / 7 )) per day"

output

Average: 6 per day

Notice that the division truncates: 42 / 7 happens to be exact, but 43 / 7 would yield 6, not 6.14. Bash arithmetic is integer-only; the decimal part is silently discarded.

The let Builtin

let is the older builtin for arithmetic. It evaluates each argument as an expression:

sh
let "count = 5 + 1"
echo "$count"

output

let is mostly historical at this point. (( )) does the same work without the quoting trap (let count=* would expand the * as a glob unless quoted) and reads more cleanly. New scripts should prefer (( )); let is worth recognizing in code you inherit.

Operators You Will Actually Use

Bash supports a wide list of arithmetic operators. These are the ones that come up in everyday scripts:

+, -, *, /, % - Standard arithmetic and remainder.
** - Exponentiation.
++, -- - Increment and decrement, prefix or postfix.
+=, -=, *=, /=, %= - Compound assignment.
==, !=, <, <=, >, >= - Numeric comparison (inside (( ))).
&&, ||, ! - Logical AND, OR, NOT.
<<, >>, &, |, ^, ~ - Bitwise shifts and operations.

A small example that uses several:

sh
size=1024
if (( size > 0 && size % 2 == 0 )); then
 echo "Power of two? $(( (size & (size - 1)) == 0 ? 1 : 0 ))"
fi

output

Power of two? 1

The ternary operator (? :) works inside arithmetic contexts, which keeps short branches readable without nesting if.

Number Bases

Bash arithmetic supports several integer bases. Prefix a number to declare its base:

0xNN for hexadecimal.
0NN for octal.
BASE#NNN for any base from 2 to 64.

Examples:

sh
echo "$(( 0xff ))"
echo "$(( 0755 ))"
echo "$(( 2#1010 ))"

output

255
493
10

Watch out for leading zeros: 08 is interpreted as octal and rejected because 8 is not a valid octal digit. If user input may include leading zeros (HTTP status codes parsed from a string, timestamps), strip them before arithmetic with ${var#0} or use the explicit 10# base prefix:

sh
value="08"
echo "$(( 10#$value ))"

output

Floating-Point Math with bc

Bash itself cannot do decimal math, but it is happy to call out to a tool that can. bc is the arbitrary-precision calculator that ships with most distributions:

sh
echo "scale=2; 43 / 7" | bc

output

6.14

The scale=2 directive sets two decimal places of precision. Without it, bc truncates the division the same way Bash does. Use a higher scale for currency or scientific work:

sh
echo "scale=10; 4*a(1)" | bc -l

output

3.1415926532

The -l flag loads the math library, which gives you s (sine), c (cosine), a (arctangent), l (natural log), e (exponential), and sqrt. The expression above computes pi from 4 * arctan(1).

To capture the result into a variable:

sh
pi=$(echo "scale=4; 4*a(1)" | bc -l)
echo "pi = $pi"

output

pi = 3.1415

bc is the right tool when you need genuine decimals and do not want a heavyweight dependency. For one-off interactive calculations, run bc -l and type expressions at its prompt.

Floating-Point Math with awk

awk is the other obvious choice and is often faster because it does not start a separate calculator process. Use awk for inline expressions inside scripts:

sh
rate=$(awk 'BEGIN { printf "%.2f\n", 43 / 7 }')
echo "rate = $rate"

output

rate = 6.14

printf inside awk works the same way as the C function, with %.2f controlling the number of decimal places. For a percentage:

sh
pct=$(awk -v a=23 -v b=89 'BEGIN { printf "%.1f%%\n", (a / b) * 100 }')
echo "pct = $pct"

output

pct = 25.8%

Pass values into awk with -v name=value rather than building the expression by string concatenation; the -v form avoids quoting headaches and shell-injection issues when the inputs come from user data.

Increment Counters in a Loop

Counter loops are the bread and butter of arithmetic in scripts, and they lean on the increment and decrement operators . Two equivalent forms work; pick the one that reads best:

sh
count=0
while IFS= read -r line; do
 (( count++ ))
done < input.txt
echo "Lines: $count"

sh
count=0
while IFS= read -r line; do
 count=$(( count + 1 ))
done < input.txt
echo "Lines: $count"

The (( count++ )) form is shorter and is what most authors prefer. Both produce the same result and run at the same speed.

If the script uses set -e, avoid (( count++ )) when count may start at zero. The arithmetic command returns a failure status when the expression evaluates to 0, so the first increment can stop the script. Use pre-increment or assignment instead:

sh
(( ++count ))
(( count += 1 ))

Troubleshooting

syntax error in expression
A variable that should hold a number contains non-numeric characters (often a leading or trailing space from read, or a stray letter). Inside (( )) and $(( )), Bash reports a syntax error on the offending token. Trim the input with ${var//[[:space:]]/} or validate it before the arithmetic line.

division by 0
A divisor evaluated to zero, often because the variable was empty and Bash treated it as 0. Quote the expansion in your check (if [ -n "$divisor" ]) before the divide, and either skip the operation or substitute a default with ${divisor:-1}.

Result is 0 when it should be a fraction
Bash arithmetic is integer-only. Switch to bc with an explicit scale= or to awk with %.Nf formatting for decimal output.

FAQ

When should I use (( )) versus $(( ))?
Use (( )) for assignments and control flow (if, while, for). Use $(( )) when you want the value substituted into a surrounding command. They share the same expression syntax.

Can I do floating-point math without an external tool?
Not in Bash. ksh93 and zsh support floating-point in their arithmetic contexts; Bash does not. For Bash, route decimals through bc or awk.

Is there a performance difference between bc and awk?
awk is usually faster because it runs entirely inside a single process and does not communicate over a pipe. For one-off calculations the difference is negligible; in a tight loop, prefer awk or precompute the values with a single awk call instead of running bc per iteration.

Conclusion

Reach for (( )) and $(( )) whenever a script needs counters, conditions, or quick integer math, and switch to bc or awk the moment decimals enter the picture. Pair that habit with Bash strict mode and the patterns in our Bash best practices guide so numeric code keeps working even when the inputs do not.

How to Install Podman on Ubuntu: Rootless Container Alternative to Docker

hello@linuxize.com (Linuxize) — Tue, 19 May 2026 09:40:00 +0200

Podman is a daemonless container engine that runs OCI containers without a long-lived root process. Each container is started as a regular user-owned process, which removes the privileged daemon that Docker relies on and makes containers safer to run on shared servers. The command-line surface mirrors Docker almost exactly, so most Dockerfiles, image references, and docker run patterns work with little to no change.

This guide explains how to install Podman on Ubuntu, configure rootless mode, run your first container, and use Podman as a drop-in replacement for the Docker CLI.

Quick Reference

For a printable quick reference, see the Podman cheatsheet .

Task	Command
Install Podman	`sudo apt install podman`
Run a container	`podman run -d --name web -p 8080:80 nginx`
List containers	`podman ps -a`
Build an image	`podman build -t myimage .`
List images	`podman images`
Pull an image	`podman pull alpine:latest`
Stop and remove	`podman rm -f web`
Inspect rootless setup	`podman info`

Install Podman

Podman has been part of the Ubuntu universe repository since 20.10, so on every supported release you can install it through apt without adding a third-party PPA.

Update the package index, then install:

Terminal
sudo apt update
sudo apt install podman

Confirm the version:

Terminal
podman --version

output

podman version 5.7.0

Ubuntu 26.04 ships Podman 5.7 from the universe repository. Ubuntu 24.04 ships the 4.9 series, while Ubuntu 22.04 ships the 3.4 series, so the exact version depends on the Ubuntu release you are using.

Verify the Rootless Setup

Podman supports both root and rootless modes, and the rootless mode is the one most users want. Run podman info as your regular user and look for rootless: true:

Terminal
podman info | head -20

output

host:
arch: amd64
cgroupManager: systemd
...
security:
rootless: true

Two pieces have to be in place for rootless containers to work: subordinate UID/GID mappings, and a user namespace. Ubuntu sets both up automatically on first run, but you can confirm with:

Terminal
cat /etc/subuid /etc/subgid

output

sara:100000:65536
sara:100000:65536

Each user gets a range of 65,536 subordinate UIDs and GIDs that Podman uses to map container processes to non-overlapping host IDs. If the file is missing your user, add an entry with sudo usermod --add-subuids 100000-165535 --add-subgids 100000-165535 sara and run podman system migrate to apply the change.

Run Your First Container

Pull and run an Nginx container in detached mode, exposing port 8080 on the host:

Terminal
podman run -d --name web -p 8080:80 nginx

output

Resolved "nginx" as an alias (/etc/containers/registries.conf.d/shortnames.conf)
Trying to pull docker.io/library/nginx:latest...
Getting image source signatures
Copying blob sha256:...
Writing manifest to image destination
Storing signatures
2b9bd4e1f3...

Check that the container is running:

Terminal
podman ps

output

CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
2b9bd4e1f3a8 docker.io/library/nginx:latest nginx -g daemon o... 10 seconds ago Up 10 seconds 0.0.0.0:8080->80/tcp web

Hit the published port from the host:

Terminal
curl -I http://localhost:8080

output

HTTP/1.1 200 OK
Server: nginx/1.27.4

The response confirms that the user-mode network stack forwarded the request into the container correctly. Stop and remove the container with:

Terminal
podman rm -f web

Configure Registries

By default Podman searches a configured list of registries when you run podman pull nginx (without a registry prefix). The list lives in /etc/containers/registries.conf. To prefer Docker Hub, edit the file:

Terminal
sudo nano /etc/containers/registries.conf

Set the unqualified-search registries:

/etc/containers/registries.conftoml
unqualified-search-registries = ["docker.io", "quay.io"]

Save and exit. From now on podman pull alpine resolves to docker.io/library/alpine:latest, which matches Docker’s default behavior. Save yourself confusion by always pulling with the full reference (podman pull docker.io/library/alpine) in scripts and CI pipelines.

Use Podman as a Docker Replacement

If you already have shell history, Makefiles, or scripts that call docker, install the alias package and keep them working:

Terminal
sudo apt install podman-docker

The package adds a /usr/bin/docker symlink that points to podman, plus a stub that suppresses the daemon-not-running warning. Test it:

Terminal
docker run --rm hello-world

output

Hello from Docker!

Behind the scenes, docker run invoked podman run. Most everyday commands (build, pull, push, images, ps, logs, exec) work identically. The differences show up around Docker Compose and the daemon socket; Podman 4 ships its own socket that Docker Compose can target by setting DOCKER_HOST.

Build an Image with a Dockerfile

Podman builds OCI images from a standard Dockerfile, no changes required. Create a small Flask app to demonstrate:

Terminal
mkdir hello-podman && cd hello-podman
nano app.py

app.pypy
from flask import Flask

app = Flask(__name__)


@app.route("/")
def index():
 return "Hello from Podman!"


if __name__ == "__main__":
 app.run(host="0.0.0.0", port=5000)

Write the Dockerfile:

Dockerfiledockerfile
FROM python:3.12-slim
WORKDIR /app
RUN pip install --no-cache-dir flask
COPY app.py .
EXPOSE 5000
CMD ["python", "app.py"]

Build the image:

Terminal
podman build -t hello-podman .

output

STEP 1/6: FROM python:3.12-slim
STEP 2/6: WORKDIR /app
...
Successfully tagged localhost/hello-podman:latest

Run a container from the new image:

Terminal
podman run -d --name hello -p 5000:5000 hello-podman
curl http://localhost:5000

output

Hello from Podman!

The image and container both live in the user’s storage (~/.local/share/containers), so no sudo is involved at any step.

Run Pods of Containers

The name “Podman” comes from its support for Kubernetes-style pods: groups of containers that share a network namespace. Create an empty pod, then add containers to it:

Terminal
podman pod create --name webapp -p 8080:80
podman run -d --pod webapp --name redis redis:7
podman run -d --pod webapp --name nginx nginx

Inside the pod, nginx can reach Redis at localhost:6379 because they share the network namespace. List pods with:

Terminal
podman pod ps

output

POD ID NAME STATUS CREATED INFRA ID # OF CONTAINERS
8f4d7b8c0e1f webapp Running 20 seconds ago c2a8f9b1d3e4 3

The count of three includes an infra container that holds the shared namespaces.

Run Podman as a systemd Service

To start a container at boot in rootless mode, use a Quadlet container unit. Quadlet is Podman’s current systemd integration method and keeps the container definition in a small, readable file.

Terminal
mkdir -p ~/.config/containers/systemd
nano ~/.config/containers/systemd/web.container

Add the container definition:

~/.config/containers/systemd/web.containerini
[Unit]
Description=Rootless Nginx container

[Container]
Image=docker.io/library/nginx:latest
ContainerName=web
PublishPort=8080:80

[Service]
Restart=always

[Install]
WantedBy=default.target

Reload the user systemd manager, then start the generated service:

Terminal
systemctl --user daemon-reload
systemctl --user start web.service

Enable lingering so the user services keep running after logout:

Terminal
sudo loginctl enable-linger sara

The [Install] section tells the Podman systemd generator to attach the service to the user’s default target. The container now starts without root or a system-wide daemon.

Troubleshooting

Error: short-name "nginx" did not resolve to an alias
The unqualified-search-registries list is empty. Edit /etc/containers/registries.conf and add at least docker.io, or pull with the full reference (podman pull docker.io/library/nginx).

ERRO[0000] cannot find UID/GID for user
The current user has no entry in /etc/subuid or /etc/subgid. Run sudo usermod --add-subuids 100000-165535 --add-subgids 100000-165535 $USER, then podman system migrate.

Ports under 1024 refuse to bind in rootless mode
The kernel restricts low ports for non-root users. Either publish to a high port (-p 8080:80), or allow your user to bind low ports with sudo sysctl net.ipv4.ip_unprivileged_port_start=80.

FAQ

Is Podman a drop-in Docker replacement?
For everyday run, build, pull, push, and exec workflows, yes. Compose and the long-lived socket need extra setup. Most CI jobs only need the CLI and switch over without changes.

Does Podman work with Docker Compose?
Yes. Start the Podman socket with systemctl --user enable --now podman.socket, export DOCKER_HOST=unix://$XDG_RUNTIME_DIR/podman/podman.sock, and run docker compose up.

Are Podman images compatible with Docker?
Yes. Both produce OCI-compliant images, so an image built with podman build runs unchanged under Docker, and vice versa.

Conclusion

Podman gives you the Docker workflow without the daemon and without root, which is often what you want on a multi-user server or a developer workstation. Install it from apt, alias docker if you have existing scripts, and the rest of the CLI feels familiar.

For follow-up reading, see our guides on installing Docker on Ubuntu 26.04 and building Docker images with a Dockerfile .

nmcli Command in Linux: NetworkManager CLI Reference

hello@linuxize.com (Linuxize) — Sun, 17 May 2026 09:15:00 +0200

When a Linux system needs a network change from a terminal, nmcli is usually the cleanest way to make it. It controls NetworkManager, the service that handles wired, wireless, VPN, and other connection profiles on many Linux desktops and servers.

This guide explains how to inspect device status, list and edit connections, join Wi-Fi networks, assign a static IP address, and get script-friendly output with nmcli.

Before You Begin

Before changing network settings, confirm that NetworkManager is installed and running:

Terminal
systemctl status NetworkManager

On distributions that use a different network stack, install NetworkManager from the package manager and enable the service before continuing. Most Ubuntu, Fedora, and Arch desktops have it preinstalled.

If you are connected over SSH , be careful with commands that disconnect an interface, change an address, or bring a profile down. A wrong gateway, IP address, or device name can drop the remote session.

nmcli Syntax

The general nmcli syntax is:

txt
nmcli [OPTIONS] OBJECT { COMMAND | help }

OBJECT is the part of NetworkManager you want to inspect or change. The most common objects are:

general - show overall NetworkManager status and hostname settings
networking - enable, disable, or check networking
radio - control Wi-Fi and WWAN radio switches
device - show and manage network interfaces
connection - show and manage saved connection profiles
monitor - watch NetworkManager events in real time

You can abbreviate most objects, for example nmcli con show instead of nmcli connection show, but the full form is clearer in scripts and documentation.

Show General Status

The general subcommand reports the overall NetworkManager state, the hostname, and whether networking is enabled:

Terminal
nmcli general status

output

STATE CONNECTIVITY WIFI-HW WIFI WWAN-HW WWAN
connected full enabled enabled enabled enabled

Read or change the system hostname through the same subcommand:

Terminal
nmcli general hostname
sudo nmcli general hostname server01

The second form writes the new hostname to /etc/hostname and updates the kernel value without a reboot. For more hostname options, see the guide on changing the hostname in Linux .

Manage Devices

A device in NetworkManager is a physical or virtual interface, for example eth0, wlan0, or wg0. List every known device with:

Terminal
nmcli device status

output

DEVICE TYPE STATE CONNECTION
eth0 ethernet connected Wired connection 1
wlan0 wifi connected home-wifi
lo loopback unmanaged --

Show detailed properties of a single device, including the MAC address, driver, and current IP configuration:

Terminal
nmcli device show eth0

Bring an interface up or down without changing the underlying connection profile:

Terminal
sudo nmcli device connect eth0
sudo nmcli device disconnect eth0

disconnect stops the connection but keeps the profile available for the next connect call. Do not disconnect the device that carries your current SSH session unless you have another access path.

Manage Connection Profiles

NetworkManager stores each network as a connection profile under /etc/NetworkManager/system-connections/. List every profile:

Terminal
nmcli connection show

output

NAME UUID TYPE DEVICE
Wired connection 1 3f4e... ethernet eth0
home-wifi 7a92... wifi wlan0

Activate a saved profile by name:

Terminal
sudo nmcli connection up "home-wifi"

Deactivate it without deleting the profile:

Terminal
sudo nmcli connection down "home-wifi"

Delete a profile when it is no longer needed:

Terminal
sudo nmcli connection delete "home-wifi"

Deleting a profile removes the saved NetworkManager configuration. If you only want to stop using it for the moment, bring it down instead.

Connect to a Wi-Fi Network

Scan for available networks. The radio must be on for the scan to return results:

Terminal
nmcli device wifi list

Join an open or WPA2 network in one call. NetworkManager creates a new profile and stores the password in the system keyring:

Terminal
sudo nmcli device wifi connect "home-wifi" password "secret-passphrase"

Avoid putting real Wi-Fi passwords in shell history, shared scripts, or configuration repositories. For interactive use, run sudo nmcli --ask device wifi connect "home-wifi" so nmcli prompts for the password instead.

For hidden networks, add the hidden yes flag so NetworkManager probes the SSID directly:

Terminal
sudo nmcli device wifi connect "office-hidden" password "secret-passphrase" hidden yes

Turn the radio on or off without removing saved profiles:

Terminal
sudo nmcli radio wifi off
sudo nmcli radio wifi on

Configure a Static IP Address

Static addressing is one of the most common scripted changes on a server. The example below sets a static IPv4 address, gateway, and DNS servers on the existing Wired connection 1 profile:

Terminal
sudo nmcli connection modify "Wired connection 1" \
 ipv4.method manual \
 ipv4.addresses 192.168.1.50/24 \
 ipv4.gateway 192.168.1.1 \
 ipv4.dns "1.1.1.1 9.9.9.9"

Apply the change by reactivating the profile:

Terminal
sudo nmcli connection up "Wired connection 1"

If you are changing a remote machine, confirm the address, prefix, gateway, and DNS values before running connection up. A wrong value can make the host unreachable. On Ubuntu systems that use Netplan instead, see the guide on configuring a static IP address on Ubuntu .

Switch back to DHCP at any point with:

Terminal
sudo nmcli connection modify "Wired connection 1" \
 ipv4.method auto \
 ipv4.addresses "" \
 ipv4.gateway "" \
 ipv4.dns ""
sudo nmcli connection up "Wired connection 1"

The empty values clear the manual entries that would otherwise stay on the profile.

Add a New Wired Connection

When the default profile is missing or has been deleted, create a fresh ethernet profile:

Terminal
sudo nmcli connection add type ethernet ifname eth0 con-name "wired-static" \
 ipv4.method manual \
 ipv4.addresses 192.168.1.50/24 \
 ipv4.gateway 192.168.1.1 \
 ipv4.dns 1.1.1.1
sudo nmcli connection up "wired-static"

This pattern works well in provisioning scripts when you first check whether the profile exists, or when you intentionally replace a known profile. If you only need to change an existing profile, use connection modify instead of deleting and recreating it.

Set DNS Servers

You can change DNS servers without changing the IP address method. For example, to set Cloudflare and Quad9 DNS on a wired profile:

Terminal
sudo nmcli connection modify "Wired connection 1" ipv4.dns "1.1.1.1 9.9.9.9"
sudo nmcli connection up "Wired connection 1"

To append another DNS server instead of replacing the whole list, prefix the property with +:

Terminal
sudo nmcli connection modify "Wired connection 1" +ipv4.dns 8.8.8.8

After changing DNS, verify name resolution with a lookup tool such as dig or nslookup .

Common Examples

Show only the active connections in a parseable format. The -t flag enables terse output and -f selects fields:

Terminal
nmcli -t -f NAME,DEVICE connection show --active

Watch interface events in real time, useful when a connection drops during a remote session:

Terminal
nmcli monitor

Reload all profile files from disk after editing them by hand:

Terminal
sudo nmcli connection reload

For low-level interface and route inspection outside NetworkManager, pair nmcli with the ip command .

Quick Reference

For a printable quick reference, see the nmcli cheatsheet .

Task	Command
Show overall status	`nmcli general status`
Show syntax help	`nmcli OBJECT help`
List devices	`nmcli device status`
List connection profiles	`nmcli connection show`
Activate a profile	`sudo nmcli connection up <name>`
Deactivate a profile	`sudo nmcli connection down <name>`
Scan Wi-Fi networks	`nmcli device wifi list`
Join a Wi-Fi network	`sudo nmcli device wifi connect <ssid> password <pwd>`
Prompt for Wi-Fi password	`sudo nmcli --ask device wifi connect <ssid>`
Set static IPv4	`sudo nmcli connection modify <name> ipv4.method manual ipv4.addresses <ip/cidr>`
Set DNS servers	`sudo nmcli connection modify <name> ipv4.dns "<a> <b>"`
Switch back to DHCP	`sudo nmcli connection modify <name> ipv4.method auto ipv4.addresses "" ipv4.gateway "" ipv4.dns ""`
Reload profile files	`sudo nmcli connection reload`
Watch events	`nmcli monitor`

Troubleshooting

Error: NetworkManager is not running
Start the service with sudo systemctl start NetworkManager and enable it at boot with sudo systemctl enable NetworkManager. On a fresh server install, the package may not be present yet.

Wi-Fi list is empty after nmcli device wifi list
The radio is most likely off. Run sudo nmcli radio wifi on, and check that no rfkill switch is blocking the device with rfkill list.

A new static IP does not take effect
NetworkManager applies the change only after the connection is reactivated. Run sudo nmcli connection up <name> after connection modify. If a stale DHCP lease is still in place, run sudo nmcli connection down <name> first.

Not authorized to control networking
The operation requires administrator privileges or a PolicyKit rule that allows the current user. Run the command with sudo, or ask the system administrator to grant the needed NetworkManager permissions.

A profile keeps reverting to DHCP after reboot
A second profile or a cloud-init configuration may be overwriting it. Check /etc/NetworkManager/system-connections/ and /etc/netplan/ for conflicting files.

Conclusion

nmcli gives you a scriptable way to inspect NetworkManager state, activate profiles, join Wi-Fi networks, and make persistent IP and DNS changes. For deeper network troubleshooting, use it alongside ip, ss, dig, and the system logs so you can see both the saved profile and the live kernel state.

timedatectl Command in Linux: Manage Time, Date, and Time Zone

hello@linuxize.com (Linuxize) — Sat, 16 May 2026 09:20:00 +0200

Wrong system time can break TLS checks, make cron jobs run at the wrong hour, and leave logs with misleading timestamps. On systemd-based Linux systems, timedatectl is the standard tool for checking and changing time settings.

timedatectl is part of systemd and is available on most systemd-based distributions. It handles time zones, NTP synchronization, RTC settings, and manual time adjustments from the command line. This guide explains how to use it with practical examples.

Syntax

txt
timedatectl [OPTIONS] COMMAND

When called without any arguments, timedatectl shows the current status, which is the same as running timedatectl status.

Check Current Time and Date

Run timedatectl with no arguments to see the full time status:

Terminal
timedatectl

output

 Local time: Tue 2026-04-14 12:00:00 CEST
Universal time: Tue 2026-04-14 10:00:00 UTC
RTC time: Tue 2026-04-14 10:00:00
Time zone: Europe/Berlin (CEST, +0200)
System clock synchronized: yes
NTP service: active
RTC in local TZ: no

The output shows the local time in your configured time zone, the same moment in UTC, and the hardware clock (RTC) time. System clock synchronized: yes means NTP has synced the clock recently. NTP service: active means systemd-timesyncd (or another NTP daemon) is running and managing synchronization.

If RTC in local TZ shows yes, the hardware clock is set to local time rather than UTC. Most Linux systems keep the hardware clock in UTC, which avoids daylight saving time complications when rebooting.

Set the Time Zone

To set the system time zone, use set-timezone followed by a time zone identifier:

Terminal
sudo timedatectl set-timezone America/New_York

After running this, timedatectl shows the new time zone immediately. The change persists across reboots.

If you do not know the exact time zone identifier, use list-timezones:

Terminal
timedatectl list-timezones

The list is long, so pipe it through grep to filter by region:

Terminal
timedatectl list-timezones | grep America

output

America/Adak
America/Anchorage
America/Anguilla
America/Antigua
America/Araguaina
America/Argentina/Buenos_Aires
...
America/New_York
...

Time zone identifiers follow the Region/City format, such as Europe/Paris, Asia/Tokyo, or Australia/Sydney. For a step-by-step walkthrough, see the guide on how to set or change the time zone in Linux .

Enable and Disable NTP Synchronization

NTP (Network Time Protocol) keeps the system clock accurate by periodically syncing it against internet time servers. timedatectl can enable or disable NTP management:

Terminal
sudo timedatectl set-ntp true

Terminal
sudo timedatectl set-ntp false

After enabling NTP, run timedatectl to confirm NTP service: active appears in the output.

Turn off NTP before setting the time manually. If NTP is active, timedatectl rejects direct clock changes.

Set the Time and Date Manually

To set the clock manually, you must first disable NTP synchronization:

Terminal
sudo timedatectl set-ntp false

Then set the time and date using the set-time subcommand. You can provide a full timestamp:

Terminal
sudo timedatectl set-time '2026-04-15 14:30:00'

To set only the time and keep the current date:

Terminal
sudo timedatectl set-time '14:30:00'

To set only the date and keep the current time:

Terminal
sudo timedatectl set-time '2026-04-15'

After setting the time, you can re-enable NTP to let the system sync automatically afterward:

Terminal
sudo timedatectl set-ntp true

Set the Hardware Clock Mode

The RTC, or hardware clock, can store time in UTC or in local time. Linux systems should normally keep the RTC in UTC because it avoids daylight saving time issues and works better on servers.

To make sure the hardware clock uses UTC, run:

Terminal
sudo timedatectl set-local-rtc 0

If you dual-boot with an operating system that expects the hardware clock to use local time, you can switch the RTC to local time:

Terminal
sudo timedatectl set-local-rtc 1

After changing the RTC mode, run timedatectl again and check the RTC in local TZ line. Use local RTC only when another operating system on the same machine requires it.

Check NTP Synchronization Status

For more detail about the NTP sync, use timesync-status. This subcommand is provided by systemd-timesyncd and shows the current server, offset, and polling interval:

Terminal
timedatectl timesync-status

output

 Server: 185.125.190.56 (ntp.ubuntu.com)
Poll interval: 34min 8s (min: 32s; max 34min 8s)
Leap: normal
Version: 4
Stratum: 2
Reference: 17.253.52.253
Precision: 1us (-19)
Root distance: 19.455ms (max: 5s)
Offset: -2.408ms
Delay: 29.124ms
Jitter: 5.716ms
Packet count: 5

Offset is how far your system clock drifted before the last sync. A small offset, under a few hundred milliseconds, is normal. A large offset can point to network problems or a misconfigured time source.

timesync-status only works when systemd-timesyncd is handling NTP. If your system uses a different NTP daemon such as chrony or ntpd, check its own status commands instead.

Machine-Parseable Output

The show subcommand prints the same information as status in a key-value format that is easier to parse in scripts:

Terminal
timedatectl show

output

Timezone=Europe/Berlin
LocalRTC=no
CanNTP=yes
NTP=yes
NTPSynchronized=yes
TimeUSec=Tue 2026-04-14 10:00:00 UTC
RTCTimeUSec=Tue 2026-04-14 10:00:00 UTC

Pass --property to extract a single value:

Terminal
timedatectl show --property=Timezone --value

output

Europe/Berlin

This is useful in automation and configuration management scripts where you need to check the current time zone without parsing the human-readable status output.

For timesync details in key-value format, use show-timesync:

Terminal
timedatectl show-timesync

This gives scripts access to systemd-timesyncd properties such as the current server name, poll interval, and root distance.

timedatectl Options

--no-ask-password - Do not prompt for authentication; use the invoking user’s credentials
--adjust-system-clock - When setting the RTC, also adjust the system clock accordingly
--no-pager - Print output without piping through a pager
-p NAME, --property=NAME - Show one named property from show output
-H ADDR, --host=ADDR - Execute the command on a remote host over SSH
-M MACHINE, --machine=MACHINE - Execute the command inside a local container

Quick Reference

For a printable quick reference, see the timedatectl cheatsheet .

Command	Description
`timedatectl`	Show current time, time zone, and NTP status
`timedatectl show`	Show status in key-value format (script-friendly)
`timedatectl list-timezones`	List all available time zone identifiers
`sudo timedatectl set-timezone TZ`	Set the time zone (e.g., `America/New_York`)
`sudo timedatectl set-ntp true`	Enable NTP synchronization
`sudo timedatectl set-ntp false`	Disable NTP synchronization
`sudo timedatectl set-time 'YYYY-MM-DD HH:MM:SS'`	Set time and date manually (NTP must be off)
`sudo timedatectl set-local-rtc 0`	Store the hardware clock in UTC
`timedatectl timesync-status`	Show NTP sync detail from systemd-timesyncd
`timedatectl show-timesync`	Show NTP sync detail in key-value format
`timedatectl show --property=Timezone --value`	Print the current time zone name only

Troubleshooting

Failed to set time: Automatic time synchronization is enabled
NTP is active and has locked the clock. Disable NTP first with sudo timedatectl set-ntp false, then run your set-time command.

Failed to set time: Access denied
You need administrator privileges. Prepend sudo to the command.

Failed to connect to bus: No such file or directory
timedatectl communicates with systemd-logind over D-Bus. This error usually appears in minimal containers or chroot environments where systemd is not running. In those cases, set the time directly with the date command: sudo date -s '2026-04-15 14:30:00'.

timesync-status returns Failed to query server: Unit dbus-org.freedesktop.timesync1.service not found
systemd-timesyncd is not installed or not running. If your system uses chrony or ntpd instead, check their status with chronyc tracking or ntpq -p.

FAQ

What is the difference between timedatectl and the date command?
date reads and formats timestamps, and it can set the system clock with sudo date -s. timedatectl is the systemd tool that also manages time zones, the RTC, and NTP synchronization. On systemd-based systems, use timedatectl for time configuration and date for formatting timestamps.

Does timedatectl work on non-systemd distributions?
No. timedatectl is part of systemd and requires systemd-logind and D-Bus to be running. On systems without systemd (such as Alpine Linux with OpenRC), use the date command and edit /etc/localtime or /etc/timezone directly.

How do I check which NTP servers the system is using?
Run timedatectl timesync-status to see the current NTP server. To see the full list of configured servers, check /etc/systemd/timesyncd.conf. The NTP= and FallbackNTP= lines list the configured time servers.

How do I view historical time changes in system logs?
timedatectl itself does not keep a history, but the system journal does. Search for time-related events with:

Terminal
journalctl -u systemd-timesyncd

For more on reading system logs, see the journalctl guide .

Conclusion

For day-to-day administration, timedatectl is usually enough to check the current time settings, switch time zones, toggle NTP, and inspect RTC behavior. If you need distribution-specific time zone steps, see the guide on how to set or change the time zone in Linux .

How to Check CPU Usage in Linux

hello@linuxize.com (Linuxize) — Fri, 15 May 2026 09:40:00 +0200

A Linux server tells you what its CPUs are doing through several built-in tools, each with a different angle. top and htop show the live picture. mpstat, vmstat, and sar from the sysstat package report numeric samples that suit scripts and dashboards. ps attributes usage to specific processes, and uptime summarizes the load over the last fifteen minutes.

This guide explains how to read CPU usage from each of those tools, which one to reach for in which situation, and how to interpret common output fields.

Quick Reference

Tool	Best for	Command
`top`	Live snapshot, sort by CPU	`top`
`htop`	Interactive, per-core view	`htop`
`mpstat`	Per-core sampling for scripts	`mpstat -P ALL 1 5`
`vmstat`	System-wide CPU and memory	`vmstat -y 1 5`
`sar`	Current or saved CPU samples	`sar -u 1 5`
`ps`	Per-process attribution	`ps -eo pid,user,%cpu,comm --sort=-%cpu \| head`
`uptime`	Load average summary	`uptime`
`nproc`	Logical core count	`nproc`
`lscpu`	CPU topology details	`lscpu`

Method 1: top

The top command is available on most Linux systems without any extra packages. Run it without arguments to open the live view:

Terminal
top

The header summarizes the CPU lines:

output

%Cpu(s): 4.2 us, 1.3 sy, 0.0 ni, 93.8 id, 0.5 wa, 0.0 hi, 0.2 si, 0.0 st

The fields tell you where CPU time goes. us is user-space code, sy is kernel code, id is idle, wa is time waiting for I/O, and st is time stolen by the hypervisor on a virtual machine. A high wa value points at slow disks rather than a CPU bottleneck.

Press 1 while top is open to switch from the aggregate line to one row per logical CPU. Press P to sort processes by CPU usage, M to sort by memory, and q to quit.

Method 2: htop

htop is an interactive replacement for top. It is available in the default repositories of most Linux distributions, but it may not be installed by default.

On Ubuntu, Debian, and Derivatives:

Terminal
sudo apt install htop

On Fedora, RHEL, and Derivatives:

Terminal
sudo dnf install htop

Run it the same way:

Terminal
htop

htop shows a colored bar per CPU at the top, a memory and swap bar, and a sortable process table below. Click a column header or use the function keys to sort. Search for a process with F3, filter with F4, and send a signal to a selected process with F9.

Method 3: mpstat

mpstat is part of the sysstat package and is the right tool when you need numeric CPU samples per core. Install it once before using mpstat or sar.

On Ubuntu, Debian, and Derivatives:

Terminal
sudo apt install sysstat

On Fedora, RHEL, and Derivatives:

Terminal
sudo dnf install sysstat

Sample all cores at one-second intervals five times:

Terminal
mpstat -P ALL 1 5

output

03:14:00 PM CPU %usr %nice %sys %iowait %irq %soft %steal %guest %gnice %idle
03:14:01 PM all 3.27 0.00 0.75 0.00 0.00 0.00 0.00 0.00 0.00 95.98
03:14:01 PM 0 4.95 0.00 0.99 0.00 0.00 0.00 0.00 0.00 0.00 94.06
03:14:01 PM 1 1.00 0.00 1.00 0.00 0.00 0.00 0.00 0.00 0.00 98.00

The all row is the aggregate. Each numbered row is a single logical CPU. Use this output when one core is pinned at 100 percent and the others are idle, which can happen when an application is single-threaded.

Method 4: vmstat

vmstat is part of procps and combines CPU usage with memory, swap, and I/O. The first report normally shows averages since boot, so use -y when you want only interval samples. The columns at the right are the CPU summary:

Terminal
vmstat -y 1 5

output

procs -----------memory---------- ---swap-- -----io---- -system-- ------cpu-----
r b swpd free buff cache si so bi bo in cs us sy id wa st
0 0 0 7430080 311288 1843264 0 0 8 18 148 263 3 1 96 0 0
0 0 0 7430080 311288 1843264 0 0 0 0 127 226 1 0 99 0 0

r is the run queue length, which is how many processes are ready to use a CPU. A run queue consistently larger than the number of CPUs is a sign of CPU pressure. The cpu columns mirror the meaning of the top header.

Method 5: sar

sar, also from sysstat, can print current samples and read saved activity logs. On Ubuntu and Debian, enable history collection after installing sysstat:

Terminal
sudo sed -i 's/^ENABLED="false"/ENABLED="true"/' /etc/default/sysstat
sudo systemctl enable --now sysstat

The collector setup differs between distributions. If sar shows no saved history, check your distribution’s sysstat service or timer configuration.

Show current CPU samples:

Terminal
sar -u 1 5

output

03:15:01 PM CPU %user %nice %system %iowait %steal %idle
03:15:02 PM all 2.34 0.00 0.71 0.05 0.00 96.90
03:15:03 PM all 2.18 0.00 0.69 0.04 0.00 97.09

Each row is a sample interval. Combine with -f to read an older log, for example sar -u -f /var/log/sysstat/sa10 for the tenth of the month on systems that store logs in /var/log/sysstat/. This is the right tool when you need to confirm that a slowdown reported yesterday lined up with a CPU spike.

Method 6: ps

The ps command lists every process and lets you sort by CPU percentage. The pattern most admins reach for is:

Terminal
ps -eo pid,user,%cpu,%mem,comm --sort=-%cpu | head

output

 PID USER %CPU %MEM COMMAND
1437 dejan 23.5 4.2 firefox
2049 dejan 11.2 2.8 node
1102 root 4.7 0.9 systemd-journal

The output is a snapshot at the moment ps ran. The %CPU value is the average CPU usage over the lifetime of the process, not an instantaneous reading. For a live view, repeat the command with watch:

Terminal
watch -n 2 'ps -eo pid,user,%cpu,%mem,comm --sort=-%cpu | head'

watch reruns the command every two seconds, which gives you a refreshing top-five view without leaving the shell.

Method 7: uptime and Load Averages

The uptime command is the smallest of the lot. Without arguments it prints the system uptime and the load average:

Terminal
uptime

output

 15:04:23 up 3:17, 2 users, load average: 0.42, 0.35, 0.31

The three numbers are the average number of processes that are runnable or in uninterruptible sleep over the last 1, 5, and 15 minutes. Compare them with nproc:

Terminal
nproc

output

A load average that stays below the core count is healthy. A load average well above the core count means processes are queueing for CPU time. The 15-minute value is the trend; the 1-minute value reacts to short spikes.

Method 8: Capacity Context

Before you read CPU usage, know what the host has. lscpu summarizes the CPU model, sockets, cores, and threads. For a deeper hardware view, see the guide on checking CPU information in Linux .

Terminal
lscpu

output

Architecture: x86_64
CPU op-mode(s): 32-bit, 64-bit
Address sizes: 46 bits physical, 48 bits virtual
Byte Order: Little Endian
CPU(s): 8
On-line CPU(s) list: 0-7
Vendor ID: GenuineIntel
Model name: Intel(R) Core(TM) i7-9700K CPU @ 3.60 GHz
Thread(s) per core: 1
Core(s) per socket: 8
Socket(s): 1

Thread(s) per core: 1 means hyper-threading is disabled or not present, so each logical CPU is a physical core. A high CPU usage on a chip with eight physical cores is different from the same number on a four-core chip with hyper-threading.

Troubleshooting

mpstat: command not found
The sysstat package is not installed. Install it with sudo apt install sysstat on Ubuntu, Debian, and Derivatives, or sudo dnf install sysstat on Fedora, RHEL, and Derivatives.

sar reports Cannot open /var/log/sysstat/
Sample collection is not enabled. Set ENABLED="true" in /etc/default/sysstat and restart the service with sudo systemctl restart sysstat. Wait at least one collection interval before rerunning sar.

top shows more than 100% CPU for one process
The default mode shows percentage relative to a single CPU, so a multi-threaded process can exceed 100 percent. Press Shift+I to toggle Irix mode off, and the value normalizes across all CPUs.

Load average looks high but no process consumes CPU
Load includes processes in D state, which is uninterruptible sleep. Check ps -eo state,pid,comm | awk '$1 ~ /D/' to find processes blocked on I/O. The cause is usually a slow or stalled disk.

Per-core view in htop is empty
Old terminal sizes hide the CPU bar. Resize the window or set Display options inside htop with F2.

FAQ

Which tool should I check first?
Run top or htop for a live picture, then drop to mpstat and sar when you need numbers or history. ps answers the per-process question once you know there is a problem.

What does %steal mean?
%steal is the time the hypervisor took from the guest VM to run something else. A consistent non-zero %steal value on a VM means the host is over-committed and the guest cannot get the CPU it asked for.

How do I count CPUs from a script?
Use nproc for the logical CPU count, or nproc --all to include offline CPUs. Both return a single integer and are stable across distributions.

Is high CPU always bad?
No. A batch job that finishes faster on a CPU running at full capacity is healthier than the same job spread thinly over a long period. CPU is bad when the load average exceeds the core count for sustained periods or when interactive workloads time out.

Conclusion

Pick the tool that matches the question. top and htop answer “what is happening right now”. mpstat and vmstat answer “is the load even across cores”. sar answers “what happened last night”. Treat load averages as a trend, not a verdict, and always read CPU numbers in the context of the core count from nproc.

systemctl Command in Linux: Start, Stop, and Manage Services

hello@linuxize.com (Linuxize) — Thu, 14 May 2026 10:30:00 +0200

Every modern Linux distribution runs a handful of services in the background at any given moment: an SSH daemon, a cron daemon, a web server, a database, a firewall. On systemd-based systems, the one tool you use to control all of them is systemctl.

systemctl is the command-line front end for systemd. It starts and stops services, enables them at boot, reloads unit files after an edit, and reports the status of each one. This guide walks through the commands you will reach for most often when managing services on a running system.

systemctl Syntax

The general syntax of the command is:

txt
systemctl [OPTIONS] COMMAND [UNIT...]

A UNIT is usually a service name such as nginx.service or cron.service. The .service suffix is optional when the unit type is unambiguous, so systemctl start nginx and systemctl start nginx.service do the same thing.

Most commands that change state (start, stop, enable, disable) require root privileges. Run them with sudo or as root.

Check the Status of a Service

Before you touch a service, check what it is doing. The status command prints the current state, recent log lines, the PID of the main process, and the path of the unit file:

Terminal
systemctl status nginx

output

● nginx.service - A high performance web server and a reverse proxy server
Loaded: loaded (/lib/systemd/system/nginx.service; enabled; preset: enabled)
Active: active (running) since Mon 2026-04-13 09:12:04 CEST; 2h 3min ago
Docs: man:nginx(8)
Main PID: 1591 (nginx)
Tasks: 3 (limit: 4612)
Memory: 6.2M
CPU: 112ms
CGroup: /system.slice/nginx.service
├─1591 "nginx: master process /usr/sbin/nginx -g daemon on; master_process on;"
└─1592 "nginx: worker process"

The two lines to read first are Loaded and Active. Loaded tells you whether the unit file was found and whether it is set to start at boot (enabled, disabled, masked, or static). Active tells you what the service is doing right now (active (running), inactive (dead), failed, and so on).

Start and Stop Services

To start a service that is not running:

Terminal
sudo systemctl start nginx

The command returns silently when the service starts. Run systemctl status nginx afterwards to confirm.

To stop a running service:

Terminal
sudo systemctl stop nginx

Stopping a service only affects the current session. If the service is enabled at boot, it will come back the next time the system starts.

Restart and Reload

A restart fully stops the service and starts it again, which terminates all active connections. This is the command you use after a binary upgrade or any change that the service cannot pick up on its own:

Terminal
sudo systemctl restart nginx

A reload asks the service to re-read its configuration without dropping active connections. Whether this works depends on the service itself. Web servers such as Nginx and Apache support it well; some services do not define a reload action.

Terminal
sudo systemctl reload nginx

If the unit file supports it, reload-or-restart is a safer combination: it tries reload first and falls back to a full restart if the service does not handle reload signals.

Terminal
sudo systemctl reload-or-restart nginx

Enable and Disable at Boot

Starting a service with start does not persist across a reboot. To make a service launch automatically at boot, use enable:

Terminal
sudo systemctl enable nginx

output

Created symlink /etc/systemd/system/multi-user.target.wants/nginx.service → /lib/systemd/system/nginx.service.

The output hints at what is happening behind the scenes. Enabling a service creates a symlink in one of the *.wants directories so that the appropriate boot target pulls the unit in.

To disable a service so that it no longer starts at boot:

Terminal
sudo systemctl disable nginx

enable and disable only change the boot behavior. To start or stop the service in the current session as well, add the --now flag:

Terminal
sudo systemctl enable --now nginx
sudo systemctl disable --now nginx

To check whether a service is currently enabled at boot:

Terminal
systemctl is-enabled nginx

Mask and Unmask

Disabling a service prevents it from starting at boot, but another service, socket, or admin can still start it manually. mask is the stronger option. It links the unit file to /dev/null so that every attempt to start it fails, whether from the command line, from another unit, or from a boot target.

Terminal
sudo systemctl mask apache2

To undo this:

Terminal
sudo systemctl unmask apache2

Masking is useful when two services conflict over the same port (for example, Nginx and Apache both wanting port 80) and you want to make sure the one you are not using cannot come back.

Reload systemd After Unit File Changes

When you add a new unit file or edit an existing one, systemd does not pick up the changes automatically. Tell it to reload its configuration with:

Terminal
sudo systemctl daemon-reload

Run this command after:

Creating a new .service file under /etc/systemd/system/
Editing a unit file (either directly or via systemctl edit)
Installing a package that ships a new unit file

After daemon-reload, restart the affected service if it was already running, so it starts under the new definition.

List Services

systemctl can list every unit it knows about, which is useful when you want to see what is active, what is failing, or what is simply installed. Because the listing commands have several useful variations, they have their own dedicated guide: see listing Linux services with systemctl for filtering by state, showing inactive units, and listing unit files.

The quickest view is:

Terminal
systemctl --failed

It prints every service that has failed since boot, which is usually the first thing you want to know on a box you do not fully trust yet.

View Service Logs

systemd stores service logs in the journal, which you query with journalctl. To follow the log for a single service:

Terminal
sudo journalctl -u nginx -f

The -u flag filters by unit, and -f follows new entries as they are written. For a full walkthrough of the journal, see the journalctl command guide.

Reboot, Power Off, and Suspend

systemctl also controls system power state. These commands do not require a service name:

Terminal
sudo systemctl reboot
sudo systemctl poweroff
sudo systemctl suspend
sudo systemctl hibernate

They are equivalent to the older reboot, poweroff, and halt commands, and they go through systemd so that services shut down cleanly.

Troubleshooting

Unit nginx.service could not be found.
The service is not installed, or the unit file is in a location systemd does not scan. Install the package, or run sudo systemctl daemon-reload if you just added a unit file manually.

Failed to start nginx.service: Unit is masked.
The unit has been masked. Run sudo systemctl unmask nginx and try again.

Service keeps failing after a config change
Run systemctl status SERVICE and journalctl -u SERVICE -n 50 to read the most recent log lines. Configuration syntax errors are the most common cause.

Changes to the unit file are ignored
You forgot sudo systemctl daemon-reload. systemd caches unit files in memory and needs to be told to reread them.

Permission denied
Most state-changing commands require root. Prefix the command with sudo, or switch to the root user.

Quick Reference

For a printable quick reference, see the systemctl cheatsheet .

Task	Command
Show service status	`systemctl status nginx`
Start a service	`sudo systemctl start nginx`
Stop a service	`sudo systemctl stop nginx`
Restart a service	`sudo systemctl restart nginx`
Reload configuration	`sudo systemctl reload nginx`
Enable at boot	`sudo systemctl enable nginx`
Enable and start now	`sudo systemctl enable --now nginx`
Disable at boot	`sudo systemctl disable nginx`
Check boot status	`systemctl is-enabled nginx`
Reload unit files	`sudo systemctl daemon-reload`
Show failed units	`systemctl --failed`
Follow service logs	`sudo journalctl -u nginx -f`

FAQ

What is the difference between enable and start?
start launches the service in the current session only. enable creates the symlinks that make systemd start the service at every boot. The two are independent, which is why --now exists to do both in one command.

What is the difference between disable and mask?
disable removes the service from boot targets, but it can still be started manually or pulled in by another unit. mask links the unit file to /dev/null so every start attempt fails.

How do I know if my system uses systemd?
Run ps -p 1 -o comm=. If the output is systemd, your init system is systemd and systemctl applies. Virtually every mainstream distribution has used systemd as the default since around 2015.

Does reload work for every service?
No. It depends on whether the unit file defines an ExecReload command and whether the service itself supports reloading. If you are unsure, use reload-or-restart, which falls back to restart when reload is not available.

What happens to running connections when I restart a service?
They are dropped. A full restart kills the process and starts a new one, so anything holding a connection will see it close. Use reload or reload-or-restart when the service supports it.

Conclusion

Most day-to-day work with systemctl comes down to status, start, stop, restart, enable, and disable. Keep daemon-reload in mind whenever you edit a unit file, and pair systemctl with journalctl when something fails to start.

Bash Best Practices: Writing Safer, Cleaner Scripts

hello@linuxize.com (Linuxize) — Wed, 13 May 2026 10:00:00 +0200

Bash scripts tend to start small and grow over time. A helper you wrote in five minutes to copy a few files can end up running in a cron job, a deployment pipeline, or a server startup script. When that happens, small oversights such as an unquoted variable or an ignored error become real outages.

This guide covers practical Bash best practices that keep scripts predictable, safe to re-run, and easy for other people to read.

Start With a Clear Shebang

Every Bash script should begin with a proper shebang line. The portable choice for Bash is:

~/script.shsh
#!/usr/bin/env bash

Using /usr/bin/env bash lets the script find Bash through the PATH, which matters on systems where Bash is installed outside /bin, such as macOS with Homebrew. If you rely on features that exist only in Bash, do not use #!/bin/sh. On many distributions /bin/sh points to dash or another minimal shell, and arrays, [[ ]], and local will not behave the same way.

Enable Strict Mode

By default, Bash ignores many errors. A command can fail, a variable can be unset, and the script will keep running as if nothing happened. Enabling strict mode at the top of the script changes that behavior.

~/script.shsh
#!/usr/bin/env bash
set -euo pipefail

Here is what each flag does:

-e - Exit immediately if any command returns a non-zero status.
-u - Treat unset variables as an error and exit.
-o pipefail - Make a pipeline fail if any command in it fails, not only the last one.

A common extra is IFS=$'\n\t', which prevents word splitting on spaces and avoids surprises when iterating over filenames that contain spaces.

~/script.shsh
#!/usr/bin/env bash
set -euo pipefail
IFS=$'\n\t'

Strict mode is not magic. It will not catch logic errors, and in some scripts you will need to opt out locally with || true for commands that are allowed to fail. The point is to flip the default from “keep going on errors” to “stop on errors”, which is almost always the safer choice. For a closer look at each option on its own, see our bash set command guide.

Always Quote Your Variables

Unquoted variables in Bash are expanded and then word-split. If a variable contains spaces, wildcards, or is empty, the result may be very different from what you expect.

Terminal
file="My Report.txt"
printf '<%s>\n' $file

Because $file is not quoted, Bash passes two arguments to printf: My and Report.txt. Quoting fixes it and keeps the filename as one value:

Terminal
printf '<%s>\n' "$file"

The same rule applies inside tests, loops, and command substitutions. When in doubt, quote. The only common case where you intentionally leave a variable unquoted is when you want word splitting, which should be rare and deliberate.

Prefer [[ ]] Over [ ]

Bash supports two test constructs: the older [ ] (a synonym for the test command) and the newer [[ ]] keyword. For Bash scripts, prefer [[ ]]:

sh
if [[ -f "$config" && "$env" == "production" ]]; then
 echo "Loading production config"
fi

[[ ]] handles empty variables safely even without quotes, supports pattern matching with == and regex with =~, and allows logical operators such as && and || inside the test. Only fall back to [ ] when writing a portable POSIX script that must run under sh or dash.

Use Functions for Repeated Logic

Once a script has more than a couple of steps, group related commands into functions. Functions make scripts easier to read, test, and refactor.

~/backup.shsh
log() {
 printf '[%s] %s\n' "$(date +'%F %T')" "$*"
}

backup_dir() {
 local src="$1"
 local dst="$2"

 log "Backing up $src to $dst"
 rsync -a "$src/" "$dst/"
}

backup_dir "/var/www" "/backup/www"

Declare variables inside functions with local so they do not leak into the rest of the script. Pass input as positional parameters, and return output via echo or printf rather than global variables when possible.

See Bash functions for more details on arguments, return values, and scoping.

Handle Errors Explicitly

Strict mode stops the script on errors, but it does not tell the user what went wrong. Adding a trap on ERR gives you a single place to log failures.

~/script.shsh
#!/usr/bin/env bash
set -Eeuo pipefail

on_error() {
 local exit_code=$?
 local line=$1
 echo "Error on line $line (exit code $exit_code)" >&2
 exit "$exit_code"
}

trap 'on_error $LINENO' ERR

The -E option makes the ERR trap inherit into functions and subshells. Without it, a failure inside a helper function may exit the script without running your error handler.

For cleanup tasks such as removing temporary files, use trap on EXIT:

~/script.shsh
tmp_dir=$(mktemp -d)
trap 'rm -rf "$tmp_dir"' EXIT

The EXIT trap runs whether the script exits normally, hits an error under set -e, or is interrupted with Ctrl+C. It is the safest way to guarantee cleanup.

Validate Input Early

Scripts that take arguments should fail fast when those arguments are missing or invalid. Check them before doing any work:

~/deploy.shsh
if [[ $# -lt 2 ]]; then
 echo "Usage: $0 <environment> <version>" >&2
 exit 1
fi

env="$1"
version="$2"

case "$env" in
 staging|production) ;;
 *)
 echo "Unknown environment: $env" >&2
 exit 1
 ;;
esac

For scripts with several flags, use getopts instead of parsing $@ manually. It handles short options, arguments, and error reporting in a consistent way.

Avoid Parsing the Output of ls

A common beginner mistake is looping over ls output:

sh
for f in $(ls /var/log); do
 echo "$f"
done

This breaks on filenames with spaces, newlines, or special characters. Use a glob or find instead:

sh
for f in /var/log/*; do
 echo "$f"
done

For recursive traversal, use find with -print0 and xargs -0, or a while read loop with IFS= and -d '' to handle unusual filenames correctly.

Keep Scripts Idempotent When Possible

A script you can safely re-run is much easier to work with than one that breaks on the second attempt. Aim for idempotent behavior: check before creating directories, use mkdir -p instead of mkdir, use ln -sf instead of ln -s, and guard commands with if blocks when they would otherwise fail on re-run.

Terminal
mkdir -p /opt/app/config

The same pattern applies to package installation, user creation, and configuration edits. Tools like Ansible enforce idempotency by design; in Bash, you have to add those checks yourself.

Use Shellcheck

Shellcheck is a static analyzer for shell scripts. It catches unquoted variables, unsafe for loops, and many other common mistakes before you hit them in production.

Install it from your package manager:

Terminal
sudo apt install shellcheck

Then run it against your script:

Terminal
shellcheck script.sh

Fix the warnings it raises, or document with an inline comment why a specific check is being ignored. Making shellcheck part of your editor or pre-commit hook removes an entire class of Bash bugs.

Prefer Readable Over Clever

Bash is full of shortcuts and obscure expansions. They can make scripts shorter, but they also make them harder to read six months later. Choose the clearer form, even when it is a few characters longer.

sh
if [[ -z "$name" ]]; then
 name="anonymous"
fi

is almost always easier to maintain than the golfed equivalent:

Terminal
: "${name:=anonymous}"

Aim for scripts that a teammate can read once and understand, not ones that require a reference manual.

Quick Reference

For a printable quick reference, see the Bash cheatsheet .

Before committing a Bash script, confirm the following:

#!/usr/bin/env bash shebang is present.
set -euo pipefail is enabled.
All variable expansions are quoted.
Tests use [[ ]] instead of [ ].
Functions replace long repeated blocks, with local variables.
trap handles errors and cleanup.
Input is validated before work begins.
No parsing of ls output.
shellcheck reports no warnings, or they are explicitly ignored.

FAQ

Is set -e enough on its own?
No. set -e stops on many errors, but it misses failures in pipelines and ignores unset variables. Combine it with -u and -o pipefail to cover those cases.

Does strict mode break existing scripts?
It often surfaces bugs that were already there, such as unset variables and ignored errors. The fix is to quote variables, use default values like ${VAR:-}, and handle expected failures with || true.

Should I write scripts in Bash or switch to Python?
Bash is a good fit for short glue scripts that mostly call other commands. Once a script grows past a few hundred lines, has complex data structures, or needs proper error handling and testing, Python or another language is usually a better choice.

Where can I learn more safe scripting patterns?
Keep the Shellcheck wiki open while you write, and read through the official Bash manual section on shell builtins. Both cover the reasoning behind each rule, not only the rule itself.

Conclusion

Strict mode, quoting, and a few well-placed traps cover most of the risk in Bash scripting. Make these practices your defaults, run shellcheck on every change, and your scripts will behave the same way on your laptop, in CI, and on a production server.

dd Command in Linux: Copy Disks, Partitions, and Files

hello@linuxize.com (Linuxize) — Sun, 10 May 2026 08:30:00 +0200

Most of the time when you copy a file on Linux, you reach for cp. It walks the filesystem, respects permissions, and works on individual files. But when you need to copy an entire disk, write an ISO image to a USB stick, or create a byte-for-byte backup of a partition, the filesystem view is not enough. For that, Linux ships with dd, a tool that copies raw data block by block between any two files or devices.

This guide explains how to use dd safely to write ISO images, clone disks, back up partitions, create test files, and benchmark storage performance.

dd Syntax

The general form of the dd command is:

txt
dd if=INPUT of=OUTPUT [OPTIONS]

The two key operands are if (input file) and of (output file). Either one can be a regular file, a block device such as /dev/sda, or even /dev/zero and /dev/urandom. Options control the block size, how many blocks to copy, and what conversions to apply.

Warning

dd writes exactly what you tell it to write, to exactly the target you point it at. Pointing of= at the wrong disk will overwrite that disk without warning or confirmation. Always double-check the target device with lsblk or sudo fdisk -l before running a dd command.

Writing an ISO Image to a USB Drive

The most common use for dd is flashing a Linux ISO to a USB drive so you can boot and install from it. First, identify the USB device with lsblk or sudo fdisk -l:

Terminal
lsblk

output

NAME MAJ:MIN RM SIZE RO TYPE MOUNTPOINTS
sda 8:0 0 465.8G 0 disk
├─sda1 8:1 0 512M 0 part /boot/efi
└─sda2 8:2 0 465.3G 0 part /
sdb 8:16 1 14.5G 0 disk
└─sdb1 8:17 1 14.5G 0 part

Here sda is the system disk and sdb is the USB drive. Make sure the USB is unmounted before writing to it:

Terminal
sudo umount /dev/sdb1

Then write the ISO image:

Terminal
sudo dd if=ubuntu-24.04-desktop-amd64.iso of=/dev/sdb bs=4M status=progress oflag=sync

Notice that the output target is the whole disk (/dev/sdb), not a partition (/dev/sdb1). Writing an ISO to a partition would leave the USB unbootable. The options do the following:

bs=4M - Read and write 4 MB at a time, which is much faster than the 512-byte default.
status=progress - Print a live progress indicator so you can see how much has been written.
oflag=sync - Flush every write to the device, so the final byte count reflects data actually on disk.

When dd finishes, run sync once more to make sure all buffered writes hit the USB stick before you remove it:

Terminal
sync

For alternative methods and distro-specific tips, see the guide on how to create a bootable Linux USB drive .

Cloning a Whole Disk

To make an exact block-level copy of one disk onto another, point if= and of= at two different block devices:

Terminal
sudo dd if=/dev/sda of=/dev/sdb bs=64K conv=noerror,sync status=progress

The destination disk must be at least as large as the source. Anything already on it is overwritten. The conversion flags handle read errors gracefully:

conv=noerror - Keep going when a read error occurs instead of aborting.
conv=sync - Pad short reads with zeros so the output stays aligned with the source.

Clone offline whenever possible. Cloning a disk that is actively being written to produces an inconsistent copy, especially for databases and journaling filesystems.

Backing Up a Partition to an Image File

dd can also write a partition or whole disk to a regular file. That file becomes a bit-for-bit image you can restore later:

Terminal
sudo dd if=/dev/sda1 of=/backup/sda1.img bs=4M status=progress

To save space, pipe the output through gzip:

Terminal
sudo dd if=/dev/sda1 bs=4M status=progress | gzip -c > /backup/sda1.img.gz

The compressed image is much smaller for filesystems that contain text or empty space, though the compression step adds CPU time.

To restore the image to a partition:

Terminal
gunzip -c /backup/sda1.img.gz | sudo dd of=/dev/sda1 bs=4M status=progress

The target partition must be unmounted during restore, and it must be at least as large as the original.

Backing Up and Restoring the MBR

The Master Boot Record sits in the first 512 bytes of a disk that uses a traditional BIOS partition table. You can back it up with dd:

Terminal
sudo dd if=/dev/sda of=/backup/mbr.img bs=512 count=1

To restore the MBR, swap the input and output:

Terminal
sudo dd if=/backup/mbr.img of=/dev/sda bs=512 count=1

On modern UEFI systems the partition table uses GPT instead of MBR, so this trick only applies to older BIOS installations. For GPT disks, use sgdisk --backup and sgdisk --load-backup from the gdisk package.

Creating an Empty File of a Specific Size

dd is often used to create test files of a known size. The count option sets how many blocks to write, and bs sets the block size:

Terminal
dd if=/dev/zero of=testfile bs=1M count=100

This creates a 100 MB file filled with zeros, useful for testing backups, simulating quota limits, or preparing a swap file. To create a file filled with random data instead, read from /dev/urandom:

Terminal
dd if=/dev/urandom of=random.bin bs=1M count=10

Random data is slower to generate because the kernel has to produce the bytes, while /dev/zero is effectively free.

Creating a Swap File

One practical use of the empty-file pattern is creating a swap file :

Terminal
sudo dd if=/dev/zero of=/swapfile bs=1M count=2048 status=progress
sudo chmod 600 /swapfile
sudo mkswap /swapfile
sudo swapon /swapfile

The chmod 600 step keeps the swap file readable only by root, which is required by mkswap on most distros. After swapon, the 2 GB swap file is active immediately. Add an entry to /etc/fstab to make it permanent.

Wiping a Disk

To destroy data on a disk before disposing of it or repurposing it, overwrite the entire device with zeros:

Terminal
sudo dd if=/dev/zero of=/dev/sdb bs=4M status=progress

For a stronger wipe that makes recovery harder on traditional spinning disks, use random data:

Terminal
sudo dd if=/dev/urandom of=/dev/sdb bs=4M status=progress

On SSDs, a dd wipe is not the right tool. SSDs remap blocks internally, so a full write does not guarantee every cell was overwritten. Use blkdiscard or the drive vendor’s secure-erase utility instead.

Benchmarking Disk Write Speed

dd is a quick way to measure sustained write throughput. Write a 1 GB file of zeros and let dd report the rate:

Terminal
dd if=/dev/zero of=tempfile bs=1M count=1024 oflag=direct

output

1024+0 records in
1024+0 records out
1073741824 bytes (1.1 GB, 1.0 GiB) copied, 3.1 s, 346 MB/s

The oflag=direct flag bypasses the page cache, so the number reflects actual disk speed rather than memory throughput. For a read benchmark, drop the caches first and then read the file back:

Terminal
sudo sh -c "sync && echo 3 > /proc/sys/vm/drop_caches"
dd if=tempfile of=/dev/null bs=1M

Remove the test file when you are done:

Terminal
rm tempfile

For more detailed I/O profiling, tools like fio and ioping produce more accurate, repeatable results.

Showing Progress on a Running dd

If you started dd without status=progress, you can still ask it to print a status line by sending the USR1 signal to its process. From another terminal, run:

Terminal
sudo kill -USR1 $(pidof dd)

dd will respond by printing the number of bytes copied so far and its current rate, then keep running.

Common Options

A quick rundown of the options covered in this guide, plus a few more worth knowing:

if=FILE - Input file or device.
of=FILE - Output file or device.
bs=N - Block size for both reads and writes (e.g., 4M for 4 MB).
ibs=N / obs=N - Separate input and output block sizes.
count=N - Number of input blocks to copy.
skip=N - Skip N blocks at the start of the input.
seek=N - Skip N blocks at the start of the output.
status=progress - Print progress while copying.
conv=noerror - Continue past read errors.
conv=sync - Pad short reads with zeros to keep block alignment.
oflag=direct - Bypass the kernel page cache on write.
oflag=sync - Flush each write to the device before continuing.

Quick Reference

Command	Description
`sudo dd if=image.iso of=/dev/sdX bs=4M status=progress oflag=sync`	Write an ISO image to a USB drive
`sudo dd if=/dev/sda of=/dev/sdb bs=64K conv=noerror,sync status=progress`	Clone one disk to another
`sudo dd if=/dev/sda1 of=/backup/sda1.img bs=4M status=progress`	Back up a partition to an image file
`sudo dd if=/dev/sda bs=4M status=progress \| gzip -c > disk.img.gz`	Compressed disk image backup
`sudo dd if=/dev/sda of=/backup/mbr.img bs=512 count=1`	Back up the MBR
`dd if=/dev/zero of=testfile bs=1M count=100`	Create a 100 MB file of zeros
`sudo dd if=/dev/zero of=/dev/sdX bs=4M status=progress`	Wipe a disk with zeros
`dd if=/dev/zero of=tempfile bs=1M count=1024 oflag=direct`	Benchmark disk write speed
`sudo kill -USR1 $(pidof dd)`	Ask a running dd for its progress

Troubleshooting

dd: failed to open ‘/dev/sdX’: Permission denied
Writing to a block device requires root privileges. Prefix the command with sudo. If you are already using sudo, double-check that the device path is correct and that the device is not exclusively held by another process.

dd: error writing ‘/dev/sdX’: No space left on device
The destination is smaller than the source. When cloning, the target disk or partition must be at least as large as the source. When writing an ISO, the USB drive must be larger than the ISO file.

The write is much slower than expected
The default block size of 512 bytes forces millions of tiny syscalls. Set bs=4M or bs=64K to speed things up. Also check whether other processes are doing heavy I/O on the same device.

The USB does not boot after writing the ISO
Verify that you wrote the image to the disk (/dev/sdb), not a partition (/dev/sdb1). Also confirm the ISO download with its SHA256 checksum; a truncated or corrupted download produces an unbootable stick.

dd: invalid number: ‘4M’
Older or minimal systems may ship a dd that does not accept the M, G, or K suffixes. On those systems, spell out the block size in bytes (bs=4194304 for 4 MB), or install GNU coreutils.

FAQ

What does dd stand for?
The name comes from the IBM Job Control Language statement “Data Definition.” Because of how often the command is used to overwrite disks by mistake, many Linux users jokingly call it “disk destroyer.” Either way, the behavior is the same: it copies bytes from input to output without touching the filesystem layer.

Is dd faster than cp for copying large files?
For regular files on a normal filesystem, cp is usually just as fast and safer to use. dd only wins when you are copying raw devices, working with exact byte offsets, or deliberately limiting how much data is copied with count.

Can I use dd on an SSD without damaging it?
Reading and writing with dd is fine. The concern with SSDs is full-disk wipes: a single pass of zeros is enough to erase visible data, but repeated full-drive writes wear out the flash cells. For secure erase, use blkdiscard or the drive’s built-in secure-erase command.

How do I see how much data dd has copied?
Add status=progress to the command, or send the running process the USR1 signal with sudo kill -USR1 $(pidof dd). Both methods print the byte count and current throughput without interrupting the copy.

Why use bs=4M instead of the default?
The default block size of 512 bytes means dd issues a separate read and write for every 512 bytes of data. Larger block sizes such as 4 MB dramatically reduce syscall overhead and let the kernel fill the disk pipeline efficiently, often cutting copy times by a factor of ten.

Conclusion

dd is one of the most direct tools in the Linux toolbox. It copies bytes, no more and no less, between any two files or devices. That power makes it indispensable for flashing installers, cloning disks, and building image backups, and the same power makes it unforgiving if you point it at the wrong target.

For related disk tools, see the guides on fdisk for partitioning and df for checking free space.

How to Install and Use uv: Fast Python Package Manager

hello@linuxize.com (Linuxize) — Sat, 09 May 2026 10:35:00 +0200

If you have worked with Python for a while, you have probably juggled pip, virtualenv, pip-tools, pipx, and pyenv just to keep a few projects running. Each tool does one thing, and wiring them together is slow and fragile. uv is a single binary that replaces all of them. It is written in Rust, published by Astral (the team behind ruff), and is typically ten to a hundred times faster than pip for common workflows.

This guide explains how to install uv on Linux, create and manage Python projects with it, add dependencies, work with virtual environments, and install specific Python versions.

Quick Reference

Command	Description
`uv init my-project`	Create a new project with `pyproject.toml`
`uv add requests`	Add a dependency and update the lockfile
`uv add --dev pytest`	Add a development dependency
`uv remove requests`	Remove a dependency
`uv sync`	Install dependencies from the lockfile
`uv lock`	Update the lockfile
`uv run script.py`	Run a command in the project environment
`uv venv`	Create a virtual environment
`uv pip install requests`	Pip-compatible install interface
`uv python install 3.12`	Install a specific Python version
`uv python list`	List installed and available Python versions
`uv tool install ruff`	Install a CLI tool globally
`uvx ruff check .`	Run a tool without installing it permanently

Installing uv

The recommended install path on Linux is the standalone script from Astral. It downloads a prebuilt binary, places it in ~/.local/bin, and does not require Python to be installed first:

Terminal
curl -LsSf https://astral.sh/uv/install.sh | sh

The script prints where it put the binary and whether it updated your shell rc file. Reload your shell or run source ~/.bashrc so the new PATH takes effect, then verify the install:

Terminal
uv --version

output

uv 0.11.11

If you prefer to install from a package manager, uv is also available through pip, pipx, and Homebrew:

Terminal
pip install uv

Terminal
pipx install uv

Terminal
brew install uv

On Ubuntu, Debian, and Derivatives, pip may refuse a system-wide install because the Python environment is marked as externally managed. In that case, use pipx install uv or the standalone installer.

If you installed uv with the standalone installer, update it to the latest release with:

Terminal
uv self update

Creating a Project

uv init scaffolds a new project with a pyproject.toml, a README.md, a .python-version file, and a starter module:

Terminal
uv init my-project
cd my-project

output

Initialized project `my-project`

The generated pyproject.toml looks like this:

pyproject.tomltoml
[project]
name = "my-project"
version = "0.1.0"
description = "Add your description here"
readme = "README.md"
requires-python = ">=3.12"
dependencies = []

uv has not created a virtual environment yet. That happens the first time you add a dependency or run a command in the project.

Adding and Removing Dependencies

To add a package, use uv add:

Terminal
uv add requests

output

Resolved 5 packages in 320ms
Installed 5 packages in 45ms
+ certifi==2025.1.31
+ charset-normalizer==3.4.1
+ idna==3.10
+ requests==2.32.3
+ urllib3==2.3.0

On the first run, uv creates a .venv directory in the project root, resolves the dependency graph, writes a uv.lock file that pins every package and its transitive dependencies, and installs everything into the venv. The requests line is also added to pyproject.toml under dependencies.

Development-only dependencies go into a separate group with --dev:

Terminal
uv add --dev pytest ruff

They are recorded under a dev dependency group in pyproject.toml and are installed into the same venv, but they are excluded when your project is published or installed as a library.

Remove a dependency with uv remove:

Terminal
uv remove requests

uv updates pyproject.toml, updates uv.lock, and uninstalls the package along with any dependencies that are no longer needed.

Running Code in the Project Environment

You do not have to activate the virtual environment manually. uv run executes a command inside the project venv and syncs dependencies first if needed:

Terminal
uv run python main.py

Terminal
uv run pytest

Scripts declared in pyproject.toml under [project.scripts] are also available:

Terminal
uv run my-command

If you prefer the classic workflow, activate the venv yourself:

Terminal
source .venv/bin/activate
python main.py

Either approach works, but uv run has the advantage of keeping the environment in sync with uv.lock every time you invoke it.

Syncing and Reproducing an Environment

When you clone a project that uses uv, run uv sync to install exactly the versions pinned in uv.lock:

Terminal
uv sync

output

Resolved 12 packages in 5ms
Installed 12 packages in 110ms

uv sync is deterministic: given the same uv.lock, it produces the same environment on any machine. This is the command to run in CI, in Docker builds, and on every fresh checkout.

If pyproject.toml changes but the lockfile is out of date, refresh the lock with:

Terminal
uv lock

Use uv lock --upgrade to bump every dependency to the latest version allowed by the version constraints in pyproject.toml, and uv lock --upgrade-package requests to bump a single package.

Working with Virtual Environments Directly

uv can also be used as a faster drop-in for virtualenv. To create a standalone venv in the current directory:

Terminal
uv venv

output

Using Python 3.12.8
Creating virtual environment at: .venv
Activate with: source .venv/bin/activate

Specify a Python version with --python:

Terminal
uv venv --python 3.11

Specify a different path:

Terminal
uv venv /tmp/myenv

Once the venv exists, use uv pip as a fast replacement for the regular pip commands:

Terminal
uv pip install requests
uv pip install -r requirements.txt
uv pip freeze
uv pip list

The uv pip interface is intentionally compatible with pip, which makes it easy to adopt uv in existing projects without restructuring them as pyproject.toml-based projects.

For a refresher on classic virtual environments, see the guide on Python virtual environments .

Installing and Managing Python Versions

uv can download and manage Python interpreters without touching your system Python. List the versions available and installed:

Terminal
uv python list

Install a specific version:

Terminal
uv python install 3.12

Terminal
uv python install 3.11 3.13

The downloaded interpreters live under ~/.local/share/uv/python/ and are independent of the system package manager. To use a specific version in a project, set it in the .python-version file or pass --python when creating the venv:

Terminal
uv venv --python 3.13

When uv run starts a project, it reads .python-version and the requires-python constraint in pyproject.toml, then picks or downloads a matching interpreter automatically.

Installing CLI Tools

uv ships with a tool manager similar to pipx. It installs Python-based CLIs in isolated environments so they do not pollute your system Python:

Terminal
uv tool install ruff

output

Resolved 1 package in 80ms
Installed 1 package in 12ms
+ ruff==0.9.2
Installed 1 executable: ruff

The ruff binary is now on your PATH. List, upgrade, or remove tools:

Terminal
uv tool list
uv tool upgrade ruff
uv tool uninstall ruff

To run a tool without installing it permanently, use uvx (an alias for uv tool run):

Terminal
uvx ruff check .

uvx downloads the tool into a cached environment, runs it, and reuses the cache on subsequent invocations. This is the fastest way to try a CLI without making it permanent.

Running Single-File Scripts

A Python script can declare its dependencies inline with a PEP 723 comment block. uv run reads that block and sets up an ephemeral environment before executing the script:

script.pypy
# /// script
# requires-python = ">=3.12"
# dependencies = [
# "requests",
# ]
# ///

import requests

response = requests.get("https://api.github.com")
print(response.status_code)

Run the script with:

Terminal
uv run script.py

uv creates a temporary venv, installs requests, runs the script, and keeps the environment in a cache for next time. This pattern is useful for small utilities and one-off automation where a full project is overkill.

Troubleshooting

uv: command not found after install
The installer places the binary in ~/.local/bin, which may not be on your PATH. Add it in your shell rc file: export PATH="$HOME/.local/bin:$PATH", then reload the shell. Verify with which uv.

Installation fails with “error: externally-managed-environment”
This message comes from system pip, not from uv. Use pipx install uv or the standalone installer instead. Installing Python packages into the system Python is discouraged on modern Ubuntu and Debian releases.

uv sync installs different versions than expected
Check that uv.lock is committed to your repository. Without the lockfile, uv sync falls back to resolving from pyproject.toml and may pick newer versions. Commit uv.lock to keep environments reproducible across machines.

uv cannot find a suitable Python interpreter
Run uv python install 3.12 (or whichever version your project requires) to let uv download a matching interpreter. The requires-python field in pyproject.toml tells uv which versions are acceptable.

Permission denied when installing to the system
uv does not need root. If a command prompts for sudo, the destination path is wrong. Use a project virtual environment or uv tool install for CLIs instead of writing to system directories.

FAQ

How is uv different from pip?
pip installs packages into an existing Python environment. uv is a full project manager: it creates and manages virtual environments, locks dependencies, installs Python interpreters, and runs scripts and tools. uv pip also provides a drop-in pip-compatible command for teams that want just the speed without adopting the full workflow.

Does uv replace Poetry or Hatch?
For most projects, yes. uv reads the standard pyproject.toml format used by Poetry and Hatch, manages lockfiles, and handles dependency groups. If you depend on specific features of Poetry plugins or Hatch build hooks, evaluate those needs before migrating.

Is uv compatible with existing requirements.txt workflows?
Yes. uv pip install -r requirements.txt works as a faster replacement for pip install -r, and uv pip compile generates a pinned requirements file from your unpinned input, similar to pip-compile from pip-tools.

Can I use uv with Docker?
Yes, and it is a good fit. The recommended pattern is to copy pyproject.toml and uv.lock first, run uv sync --frozen --no-install-project to install dependencies, then copy the rest of the source and run uv sync --frozen. This keeps the dependency layer cached across builds.

Where does uv store downloaded interpreters and package cache?
Interpreters go under ~/.local/share/uv/python/ and the package cache lives in ~/.cache/uv/. Both paths respect the XDG environment variables, so you can override them by setting XDG_DATA_HOME and XDG_CACHE_HOME.

Conclusion

uv rolls together the jobs that previously required pip, virtualenv, pip-tools, pipx, and pyenv into one fast binary. The speed is the headline feature, but the real payoff is a single, consistent workflow for projects, tools, scripts, and Python versions.

For related Python tooling on Linux, see the guide on installing Python on Ubuntu 24.04 and the guide on Python virtual environments .

netstat Command in Linux: Network Connections and Statistics

hello@linuxize.com (Linuxize) — Sat, 02 May 2026 09:00:00 +0100

When something on a server is holding port 80, a connection is refusing to close, or a service is not reachable from the outside, the first question is almost always the same: what is actually listening, and who is talking to whom. For years, the answer on Linux was the netstat command.

netstat is part of the classic net-tools package and prints network connections, listening ports, routing tables, interface counters, and per-protocol statistics. It has been deprecated in favor of ss and ip , but it is still installed on many systems and the tool many sysadmins reach for first. This guide explains how to read its output and which flags cover the cases you run into day to day.

Install netstat

On most modern distributions, net-tools is not installed by default. If netstat is not available, install it with your package manager.

On Ubuntu, Debian, and Derivatives:

Terminal
sudo apt install net-tools

On Fedora, RHEL, and Derivatives:

Terminal
sudo dnf install net-tools

Once the package is installed, verify the binary is on your path:

Terminal
netstat --version

netstat Syntax

The general form of the command is:

txt
netstat [OPTIONS]

Run without options, netstat prints a list of open non-listening sockets, which is rarely what you want. In practice, you almost always pass a combination of flags that describe what kind of sockets you care about (TCP, UDP, Unix), what state they are in, and how you want the output formatted.

List All Connections

To list every connection, both listening and established, use the -a option:

Terminal
sudo netstat -a

The output is divided into two parts. The top lists Internet sockets with columns for protocol, receive and send queue sizes, local and foreign address, and state. The bottom lists Unix domain sockets used for local inter-process communication.

Running netstat with sudo is recommended because without it, the command cannot read socket ownership for processes that belong to other users.

Show TCP and UDP Connections

The -t and -u flags filter the output by protocol. To show only TCP connections:

Terminal
sudo netstat -at

To show only UDP connections:

Terminal
sudo netstat -au

You can combine both flags to get TCP and UDP together:

Terminal
sudo netstat -atu

Show Listening Ports

When you want to know which services are accepting new connections, use the -l option. For TCP, it restricts the output to sockets in the LISTEN state. UDP does not use the same connection states, but UDP sockets that are ready to receive traffic are still shown.

Terminal
sudo netstat -tuln

The combined flags read as: show TCP (-t) and UDP (-u) sockets that are listening (-l), with numeric addresses and ports (-n). The output looks similar to this:

output

Proto Recv-Q Send-Q Local Address Foreign Address State
tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN
tcp 0 0 127.0.0.1:3306 0.0.0.0:* LISTEN
tcp6 0 0 :::80 :::* LISTEN
udp 0 0 0.0.0.0:68 0.0.0.0:*

From the output, we can see that SSH is listening on all interfaces on port 22, MySQL is bound to localhost only on port 3306, and a web server is listening on port 80 over IPv6.

Show the Process Using a Port

To find out which program owns a socket, add the -p option. It prints the PID and the process name next to each connection:

Terminal
sudo netstat -tulnp

output

Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN 812/sshd
tcp 0 0 127.0.0.1:3306 0.0.0.0:* LISTEN 1034/mysqld
tcp6 0 0 :::80 :::* LISTEN 1591/nginx: master

The PID/Program name column ties each listening port to a process. This is the quickest way to find out which service is holding a port when you get an Address already in use error.

To check one specific port, pipe the output to grep :

Terminal
sudo netstat -tulnp | grep ':80'

If the command prints a row, a process is listening on port 80. If it prints nothing, no TCP or UDP listener matched that port on the local system.

Show Numeric Output

By default, netstat resolves IP addresses to hostnames and port numbers to service names (for example, 22 becomes ssh). On a busy system, this can be slow because each address needs a DNS lookup.

The -n option disables name resolution and prints raw numbers:

Terminal
sudo netstat -n

Numeric output is also easier to pipe into other tools such as grep or awk, because the field values are predictable.

Continuous Monitoring

The -c option tells netstat to print the output every second until you stop it with Ctrl+C. It is useful when you want to watch a connection appear, change state, and close:

Terminal
sudo netstat -atnc

Each iteration prints the full table again, so it is best used together with a filter such as grep to isolate a single connection.

Show TCP Connection States

TCP connections move through states such as ESTABLISHED, LISTEN, TIME_WAIT, and CLOSE_WAIT. To show active TCP sockets with numeric addresses, run:

Terminal
sudo netstat -ant

The State column tells you where each connection is in the TCP lifecycle:

output

Proto Recv-Q Send-Q Local Address Foreign Address State
tcp 0 0 192.168.1.10:22 192.168.1.5:52710 ESTABLISHED
tcp 0 0 192.168.1.10:80 203.0.113.25:51422 TIME_WAIT
tcp 0 0 127.0.0.1:3306 127.0.0.1:41834 CLOSE_WAIT

ESTABLISHED means the connection is active. TIME_WAIT is normal after a connection closes. A large number of CLOSE_WAIT entries can mean the local application is not closing sockets correctly.

To show only established TCP connections, filter the output:

Terminal
sudo netstat -ant | grep ESTABLISHED

For new troubleshooting work, ss gives better built-in state filters, such as ss -tn state established.

Count Connections

On busy web servers, you may want a quick count instead of a full connection table. To count all current TCP connections that involve port 80, run:

Terminal
sudo netstat -ant | grep ':80' | wc -l

To count only established connections on port 80, add the TCP state to the filter:

Terminal
sudo netstat -ant | grep ':80' | grep ESTABLISHED | wc -l

These counts are useful as a quick signal, but they are not a replacement for application metrics. The number can change while the pipeline is running, especially on high-traffic systems.

Display the Routing Table

To print the kernel IP routing table, use the -r option:

Terminal
netstat -rn

output

Kernel IP routing table
Destination Gateway Genmask Flags MSS Window irtt Iface
0.0.0.0 192.168.1.1 0.0.0.0 UG 0 0 0 eth0
192.168.1.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0

The first row is the default route, which sends all traffic not matching another rule to 192.168.1.1. The ip route command from ip is the modern equivalent and is what you should use on new systems.

Interface Statistics

The -i option prints a per-interface summary that includes received and transmitted packets, errors, drops, and the MTU:

Terminal
netstat -i

output

Kernel Interface table
Iface MTU RX-OK RX-ERR RX-DRP TX-OK TX-ERR TX-DRP Flg
eth0 1500 2345678 0 12 1987654 0 0 BMRU
lo 65536 55432 0 0 55432 0 0 LRU

A growing RX-ERR or TX-ERR column is a hint that you have a cabling, duplex, or driver issue on that interface.

Protocol Statistics

To print a summary of statistics for each protocol, use -s:

Terminal
netstat -s

The output is long and grouped by protocol (Ip, Tcp, Udp, and so on). It includes counters such as total packets received, segments retransmitted, and connection resets. You can narrow the output to a single protocol by combining -s with -t or -u:

Terminal
netstat -st

netstat vs ss

On modern Linux distributions, ss is the recommended replacement for netstat. It is faster and reads information directly from the kernel through Netlink, with richer filter support. The ip command replaces the routing and interface parts of netstat.

A few common translations:

netstat -tuln is equivalent to ss -tuln
netstat -tulnp is equivalent to sudo ss -tulnp
netstat -s maps to ss -s (a much shorter summary)
netstat -i maps to ip -s link
netstat -r maps to ip route

For a full walkthrough of the replacement tool, see the guide on the ss command .

Quick Reference

For a printable quick reference, see the netstat cheatsheet .

Command	Description
`netstat`	Show active non-listening sockets
`sudo netstat -a`	Show all listening and non-listening sockets
`sudo netstat -at`	Show all TCP sockets
`sudo netstat -au`	Show all UDP sockets
`sudo netstat -tuln`	Show TCP and UDP listening sockets with numeric output
`sudo netstat -tulnp`	Show listening sockets with PID and process name
`sudo netstat -tulnp \| grep ':80'`	Find the process listening on port 80
`sudo netstat -ant`	Show all TCP sockets with numeric addresses
`sudo netstat -ant \| grep ESTABLISHED`	Show established TCP connections
`sudo netstat -ant \| grep ':80' \| wc -l`	Count TCP connections involving port 80
`sudo netstat -atnc`	Refresh TCP connection output every second
`netstat -rn`	Show the routing table with numeric addresses
`netstat -i`	Show interface statistics
`netstat -s`	Show protocol statistics
`netstat -st`	Show TCP protocol statistics

Troubleshooting

netstat: command not found
The net-tools package is not installed. Install it with your package manager, or use ss instead.

No PID/Program name column shown
You need to run the command with sudo. Without root privileges, netstat cannot read process information for sockets owned by other users.

Output is slow or hangs
DNS resolution is slow or failing. Add the -n option to disable name lookups and print numeric addresses and ports.

A port shows up as LISTEN on :: but not on 0.0.0.0
The service is listening on the IPv6 wildcard address. On systems with dual-stack enabled, this accepts IPv4 traffic too. Check your IPv6 configuration if only IPv4 clients are failing.

FAQ

Is netstat deprecated?
Yes. The net-tools suite, which includes netstat, ifconfig, and route, has been deprecated for years in favor of the iproute2 tools ss and ip. It is still functional and still shipped by most distributions, but new scripts should target ss and ip.

What is the difference between netstat on Linux and Windows?
The command name is the same, and the general idea is the same, but the flags are different. This guide covers the Linux version from net-tools. On Windows, the closest equivalents to netstat -tulnp are netstat -ano and Get-NetTCPConnection in PowerShell.

How do I find what process is using a specific port?
Run sudo netstat -tulnp | grep ':PORT', replacing PORT with the port number. The last column shows the PID and program name. With ss, the same query is sudo ss -tulnp 'sport = :PORT'.

Why is a port still TIME_WAIT after I stopped the service?
TIME_WAIT is a normal TCP state that keeps a closed connection around for a short period so late packets can be handled safely. The kernel clears these entries automatically, usually within one or two minutes.

Conclusion

netstat remains useful when you need to inspect network connections on systems that still have net-tools installed. For new scripts and current Linux systems, prefer ss for sockets and ip for routes and interface statistics.

git branch Command: Create, List, and Delete Branches

hello@linuxize.com (Linuxize) — Wed, 22 Apr 2026 22:12:53 +0200

Branches are how Git keeps your work separated from the main line of development. A new branch lets you experiment, fix a bug, or build a feature without touching what is already shipped, and a merge brings the work back together when it is ready. The tool that creates, lists, and removes those branches is git branch.

This guide explains how to use git branch to manage local and remote branches, filter by merged or upstream state, rename branches, and clean up stale ones.

git branch Syntax

The general form of the command is:

txt
git branch [OPTIONS] [BRANCH] [START_POINT]

With no arguments, git branch lists your local branches and marks the currently checked-out one with an asterisk. With a branch name, it creates a new branch pointing at the current commit. With additional flags, it can list remote branches, delete branches, rename them, or set upstream tracking.

Listing Branches

To list the local branches in the current repository, run git branch with no arguments:

Terminal
git branch

output

 develop
* main
feature/login

The asterisk marks the branch you are currently on. The branches are sorted alphabetically.

To include remote-tracking branches, add -a (all):

Terminal
git branch -a

output

 develop
* main
feature/login
remotes/origin/HEAD -> origin/main
remotes/origin/develop
remotes/origin/main

Anything prefixed with remotes/ is a local reference to a branch on a remote, not a branch you can commit to directly. Check it out to create a local tracking branch.

To list only remote-tracking branches, use -r:

Terminal
git branch -r

To see the latest commit on each branch, add -v:

Terminal
git branch -v

output

 develop a1b2c3d Add release notes
* main 7e8f9a0 Merge pull request #42
feature/login 3d4e5f6 Stub login form

For even more detail, -vv also prints the upstream branch each local branch tracks and whether it is ahead, behind, or in sync:

Terminal
git branch -vv

output

 develop a1b2c3d [origin/develop] Add release notes
* main 7e8f9a0 [origin/main] Merge pull request #42
feature/login 3d4e5f6 [origin/feature/login: ahead 2] Stub login form

Creating a Branch

To create a new branch, pass the name as an argument. This creates the branch at the current HEAD but does not switch to it:

Terminal
git branch feature/login

To start the branch from a specific commit, tag, or another branch, pass it as the second argument:

Terminal
git branch hotfix v1.4.0

Terminal
git branch hotfix 3d4e5f6

Creating a branch without switching to it is useful when you want to mark a commit for later work. Most of the time, though, you create a branch and switch to it in one step. The modern command for that is git switch -c:

Terminal
git switch -c feature/login

The older equivalent is git checkout -b feature/login. Both create the branch at the current commit and check it out immediately. See the create and list Git branches guide for a fuller walkthrough.

Renaming a Branch

To rename the branch you are currently on, use -m with the new name:

Terminal
git branch -m new-name

To rename any branch, pass both the old and the new name:

Terminal
git branch -m old-name new-name

If a branch with the target name already exists, this form fails to protect you from overwriting it. To force the rename and overwrite the existing branch, use the capital -M instead. Use -M with care: it discards the destination branch.

After renaming a branch that is already pushed, push the new name to the remote and delete the old one so collaborators see the change. The rename a Git branch guide walks through the full local-and-remote flow.

Deleting a Branch

To delete a local branch that has been merged into the current branch, use -d:

Terminal
git branch -d feature/login

output

Deleted branch feature/login (was 3d4e5f6).

Git refuses to delete a branch that has unmerged work, to protect you from losing commits:

output

error: The branch 'feature/wip' is not fully merged.
If you are sure you want to delete it, run 'git branch -D feature/wip'.

If you are sure the work is no longer needed, force the deletion with -D:

Terminal
git branch -D feature/wip

You cannot delete the branch you are currently on. Switch to another branch first, then delete it. For remote branch deletion, see the delete local and remote Git branch guide.

Filtering by Merged State

git branch can filter branches by whether they are fully merged into the current branch. List branches that have been merged:

Terminal
git branch --merged

This is the safest way to find branches that can be deleted without losing history. Before deleting anything, preview the filtered list:

Terminal
git branch --merged | grep -vE '^\*|^[[:space:]]*(main|develop)$'

The grep filter keeps the current branch and the protected main and develop branches out of the list. If the output looks correct, pipe the same list to git branch -d:

Terminal
git branch --merged | grep -vE '^\*|^[[:space:]]*(main|develop)$' | xargs -r git branch -d

To list branches that still have unmerged work, use --no-merged:

Terminal
git branch --no-merged

These are the branches you should review before deleting, because they contain commits that are not on your current branch.

Filtering Remote Branches Too

--merged and --no-merged accept a reference argument. To check against main from the remote:

Terminal
git branch --merged origin/main

This is useful in CI or cleanup scripts where you want to see which local branches are safely merged into the shipped code, regardless of which branch you are currently on.

Setting an Upstream Branch

An upstream branch tells Git which remote branch your local branch tracks for git pull and git push. To set it on an existing branch, use --set-upstream-to (or -u):

Terminal
git branch --set-upstream-to=origin/main main

output

Branch 'main' set up to track remote branch 'main' from 'origin'.

To remove tracking information from a branch, use --unset-upstream:

Terminal
git branch --unset-upstream main

When you push a new branch to a remote for the first time, pass -u to git push to create the remote branch and set it as the upstream in one step:

Terminal
git push -u origin feature/login

Showing the Current Branch

To print just the name of the branch you are on, use --show-current:

Terminal
git branch --show-current

output

main

This is the right command for shell prompts and scripts. It prints nothing if you are in a detached HEAD state, which scripts can detect and handle.

Copying a Branch

git branch -c copies a branch, including its reflog and configuration, to a new name:

Terminal
git branch -c old-branch new-branch

The original branch is kept. Use the capital -C to force the copy and overwrite an existing target branch. Copying is less common than creating a fresh branch, but it is useful when you want to preserve the history and config of a branch under a new name.

Sorting the Branch List

By default, branches are listed alphabetically. The --sort option changes the order. To sort by the date of the most recent commit:

Terminal
git branch --sort=-committerdate

The minus sign reverses the order, so the most recently updated branch appears first. This is handy when you return to a project after a break and want to see what you were working on last.

Quick Reference

Command	Description
`git branch`	List local branches
`git branch -a`	List local and remote-tracking branches
`git branch -r`	List only remote-tracking branches
`git branch -v`	Show the latest commit on each branch
`git branch -vv`	Show upstream tracking and ahead/behind counts
`git branch NAME`	Create a new branch at `HEAD`
`git branch NAME START`	Create a branch at a specific commit or tag
`git branch -m NEW`	Rename the current branch
`git branch -m OLD NEW`	Rename another branch
`git branch -d NAME`	Delete a merged branch
`git branch -D NAME`	Force-delete a branch with unmerged work
`git branch --merged`	List branches merged into the current branch
`git branch --no-merged`	List branches with unmerged work
`git branch -u origin/main`	Set the upstream of the current branch
`git branch --show-current`	Print the current branch name
`git branch --sort=-committerdate`	Sort by most recent commit

FAQ

What is the difference between git branch and git checkout?
git branch manages branches: creating, listing, renaming, and deleting. git checkout (and its modern replacement git switch) changes which branch you are on. Creating and switching in one step uses git switch -c or git checkout -b.

How do I delete a remote branch?
git branch -d only deletes local branches. To delete a branch on the remote, run git push origin --delete BRANCH_NAME. The delete local and remote Git branch guide covers the full flow, including cleanup of stale tracking references.

Why does Git say “branch is not fully merged”?
The branch has commits that are not reachable from your current branch. Git is protecting you from losing work. Review the commits with git log BRANCH_NAME, merge them if needed, and then use -d again. If you are certain the commits are not needed, force the delete with -D.

How do I see which branch a remote branch tracks locally?
Run git branch -vv. The output includes each local branch’s upstream in brackets along with its ahead and behind counts relative to that upstream.

Can I list branches sorted by who committed most recently?
Yes. Use git branch --sort=-committerdate to sort branches by the timestamp of their most recent commit, with the freshest branch first. This is a fast way to see what is actively being worked on.

Conclusion

git branch covers the full lifecycle of a branch: creating it, renaming it, keeping track of what it points at, and deleting it when the work is done. Combined with git switch for moving between branches and git merge for integrating changes, it is the foundation of any Git workflow.

For related Git commands, see the git diff guide for reviewing changes and the git log guide for inspecting branch history.

git fetch vs git pull: What Is the Difference?

hello@linuxize.com (Linuxize) — Sat, 18 Apr 2026 09:20:00 +0200

Sooner or later, every Git user runs into the same question: should you use git fetch or git pull to get the latest changes from the remote? The two commands look similar, and both talk to the remote repository, but they do very different things to your working branch.

This guide explains the difference between git fetch and git pull, how each command works, and when to use one over the other.

Quick Reference

If you want to…	Use
Download remote changes without touching your branch	`git fetch`
Download and immediately integrate remote changes	`git pull`
Preview incoming commits before merging	`git fetch` + `git log HEAD..origin/main --oneline`
Update your branch but refuse merge commits	`git pull --ff-only`
Rebase local commits on top of remote changes	`git pull --rebase`

What git fetch Does

git fetch downloads commits, branches, and tags from a remote repository and stores them locally under remote-tracking references such as origin/main or origin/feature-x. It does not touch your working directory, your current branch, or the index.

Terminal
git fetch origin

output

remote: Enumerating objects: 12, done.
remote: Counting objects: 100% (12/12), done.
From github.com:example/project
4a1c2e3..9f7b8d1 main -> origin/main
a6d4c02..1e2f3a4 feature-x -> origin/feature-x

The output shows which remote branches were updated. After the fetch, the local branch main is still pointing to whatever commit it was on before. Only the remote-tracking branch origin/main has moved.

You can then inspect what changed before doing anything with it:

Terminal
git log main..origin/main

This is the safe way to look at new work without merging or rebasing yet. It gives you a preview of what the remote has that your branch does not.

What git pull Does

git pull is a convenience command. Under the hood, it runs git fetch followed by an integration step (a merge by default, or a rebase if configured). In other words:

Terminal
git pull origin main

is roughly equivalent to:

Terminal
git fetch origin
git merge origin/main

After git pull, your current branch has moved forward, and your working directory may contain new files, updated files, or merge conflicts that need resolving. The change is immediate and affects your checked-out branch.

Side-By-Side Comparison

The difference between the two commands comes down to what they change in your repository.

Aspect	`git fetch`	`git pull`
Downloads new commits from remote	Yes	Yes
Updates remote-tracking branches (`origin/*`)	Yes	Yes
Updates your current local branch	No	Yes
Modifies the working directory	No	Yes
Can create merge conflicts	No	Yes
Safe to run at any time	Yes	Only when ready to integrate

git fetch is read-only from your branch’s perspective. git pull actively changes your branch.

When to Use git fetch

Use git fetch when you want to see what changed on the remote without integrating anything yet. This is useful before you start new work, before rebasing a feature branch, or when you want to inspect a teammate’s branch safely.

For example, after fetching, you can compare your branch with the remote like this:

Terminal
git log HEAD..origin/main --oneline

This shows commits that exist on the remote but not in your current branch. Running git fetch often is cheap and has no side effects on your work, which is why many developers do it regularly throughout the day.

When to Use git pull

Use git pull when you are ready to bring remote changes into your current branch and keep working on top of them. The common flow looks like this:

Terminal
git checkout main
git pull origin main

This is the quickest way to sync a branch with its upstream when you know the integration will be straightforward, such as on a shared main branch where you rarely have local commits. git pull always updates the branch you currently have checked out, so it is worth confirming where you are before you run it.

If you want a cleaner history without merge commits, configure pull to rebase:

Terminal
git config --global pull.rebase true

From that point on, git pull runs git fetch followed by git rebase instead of git merge. Your local commits are replayed on top of the fetched changes, producing a linear history.

Avoiding Merge Surprises

The biggest reason to prefer git fetch over git pull in day-to-day work is control. A bare git pull on a branch where you have local commits can create a merge commit, introduce conflicts, or rewrite history during a rebase, all in one step.

A safer pattern is:

Terminal
git fetch origin
git log HEAD..origin/main --oneline
git merge origin/main

You fetch first, review what is coming, then decide whether to merge, rebase, or defer the integration. For active feature branches, this workflow avoids most of the “what just happened to my branch” moments.

If you already ran git pull and need to inspect what happened, start with:

Terminal
git log --oneline --decorate -n 5

This helps you confirm whether Git created a merge commit, fast-forwarded the branch, or rebased your local work.

If the pull created a merge commit that you do not want, ORIG_HEAD often points to the commit your branch was on before the pull. In that case, you can reset back to it:

Terminal
git reset --hard ORIG_HEAD

Warning

git reset --hard discards uncommitted changes. Use it only when you are sure you do not need the current state of your working tree.

Useful Flags

A few flags make both commands more predictable in real workflows.

git fetch --all - Fetch from every configured remote, not only origin.
git fetch --prune - Remove remote-tracking branches that no longer exist on the remote.
git fetch --tags - Download tags in addition to branches.
git pull --rebase - Rebase your local commits on top of the fetched changes instead of merging.
git pull --ff-only - Update the branch only if Git can fast-forward it; prevents unexpected merge commits.

--ff-only is especially useful on shared branches. If your branch cannot move forward by simply advancing the pointer, the pull fails and you decide what to do next.

FAQ

Does git fetch modify any local files?
No. It only updates remote-tracking references such as origin/main. Your branches, working directory, and staging area stay the same.

Is git pull the same as git fetch plus git merge?
By default, yes. With pull.rebase set to true (or --rebase on the command line), it runs git fetch followed by git rebase instead.

Which one should I use daily?
Prefer git fetch for visibility and git pull --ff-only (or git pull --rebase) for the integration step. A bare git pull works, but it hides two operations behind one command.

How do I see what git fetch downloaded?
Use git log main..origin/main to see commits on the remote that are not yet in your local branch, or git diff main origin/main to compare the content directly.

Can git fetch cause conflicts?
No. Conflicts only happen when you merge or rebase the fetched commits into your branch. Fetching itself is conflict-free.

Conclusion

git fetch lets you inspect remote changes without touching your branch, while git pull fetches and integrates those changes in one step. If you want more control and fewer surprises, fetch first, review the incoming commits, and then merge or rebase on your own terms. For more Git workflow details, see the git log command and git diff command guides.

sha256sum and md5sum Commands: Verify File Integrity in Linux

hello@linuxize.com (Linuxize) — Fri, 17 Apr 2026 10:00:00 +0200

When you download an ISO image, a backup archive, or a large release tarball, there is no easy way to tell by looking whether the file arrived intact. A single flipped bit can break a boot image or turn a compressed archive into junk, and a compromised mirror can serve a tampered file that looks legitimate. The fix is to compare a cryptographic fingerprint of the file against a value the publisher has signed or posted somewhere you trust.

This guide shows how to use sha256sum and md5sum to generate, compare, and verify checksums on Linux, and when to use each one.

sha256sum and md5sum Syntax

Both commands follow the same form:

txt
sha256sum [OPTIONS] [FILE]...
md5sum [OPTIONS] [FILE]...

Without options, each command prints a hex digest followed by two spaces and the file name. Pass -c to verify files against a list of previously generated checksums.

sha256sum vs md5sum

The two tools do the same job: they read a file and print a fixed-length fingerprint. The difference is the algorithm and, by extension, how safe the result is against intentional tampering.

md5sum uses the MD5 algorithm and produces a 128-bit digest. MD5 is fast but has been broken for years: it is possible to construct two different files that share the same MD5 hash. Treat it as a checksum for accidental corruption only, not for authenticity or security.

sha256sum uses SHA-256 from the SHA-2 family and produces a 256-bit digest. It is the default choice for verifying downloads, release artifacts, and anything where the threat model includes a malicious middle party. Most Linux distributions publish SHA256SUMS files next to their ISO images for exactly this reason.

When in doubt, use sha256sum. Reach for md5sum only when a publisher provides MD5 values and nothing stronger, or when you need quick parity checks between known-good files.

Generating a Checksum for a File

To produce a SHA-256 digest for a single file, pass it as an argument:

Terminal
sha256sum ubuntu-24.04.2-desktop-amd64.iso

output

5e38b55d57d94ff029719342357325ed3bda38fa80054f9330dc789cd2d43931 ubuntu-24.04.2-desktop-amd64.iso

The output is one line: the hex digest, two spaces, and the file name. The same file always produces the same digest, so you can run the command again after a copy or a download and compare the values by eye.

md5sum behaves the same way:

Terminal
md5sum ubuntu-24.04.2-desktop-amd64.iso

output

2e3720b76b2f9f96edc43ec4d87d7d52 ubuntu-24.04.2-desktop-amd64.iso

Notice that the MD5 digest is shorter. That is the 128-bit hash encoded in 32 hex characters, compared with 64 hex characters for SHA-256.

Generating Checksums for Multiple Files

Both commands accept any number of file arguments and print one line per file:

Terminal
sha256sum *.tar.gz

output

b2b09c1e04b2a3a4c5d6e7f890123456789abcdef0123456789abcdef01234567 backup-2026-04-01.tar.gz
c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8091a2b3c4d5e6f708192a3b4c5d6e7f8 backup-2026-04-08.tar.gz

To save the output to a checksum file that you can share or verify later, redirect it:

Terminal
sha256sum *.tar.gz > SHA256SUMS

The resulting SHA256SUMS file can be published alongside the archives, and anyone who downloads them can run a single command to confirm that their copy matches.

Verifying a File Against a Known Checksum

The most common task is to check that a download matches the digest the publisher posted. Distributions usually ship a SHA256SUMS file that lists every release file and its digest. Change into the directory that holds both the archive and the checksum file, then pass -c:

Terminal
sha256sum -c SHA256SUMS

output

ubuntu-24.04.2-desktop-amd64.iso: OK
ubuntu-24.04.2-live-server-amd64.iso: OK

sha256sum reads each line of SHA256SUMS, recomputes the digest for the named file, and prints OK when they match. Any line whose file is missing or whose digest differs prints a clear error and causes the command to exit with a non-zero status, which is convenient in scripts.

When you only care about one file out of many, grep the relevant line into the check:

Terminal
grep "ubuntu-24.04.2-desktop-amd64.iso" SHA256SUMS | sha256sum -c -

The trailing - tells sha256sum to read the checksum list from standard input. This keeps the verification scoped to a single file without creating a second checksum file.

Comparing a File to a Published Digest

Sometimes the publisher does not provide a full SHA256SUMS file but instead shows a single digest on a release page. You can compare it directly without creating a file:

Terminal
echo "5e38b55d57d94ff029719342357325ed3bda38fa80054f9330dc789cd2d43931 ubuntu-24.04.2-desktop-amd64.iso" | sha256sum -c -

output

ubuntu-24.04.2-desktop-amd64.iso: OK

The key detail is the double space between the digest and the file name. That is the exact format sha256sum produces and expects, and a single space will cause the check to fail.

Quiet and Warn Modes

During an automated check, the per-file OK lines can be noisy. The --quiet option suppresses successful lines so only failures appear:

Terminal
sha256sum -c --quiet SHA256SUMS

If every file passes, the command prints nothing and exits with status 0. If a file fails, you see a single failure line and a non-zero exit status, which fits well in a CI job or a backup script.

To flag lines in a checksum file that are not formatted correctly, add --warn. This is helpful when the file was assembled by hand and you want to be sure every entry parses.

Common Options

The flags below are the ones you are likely to use day to day:

-c, --check - Read digests from a file and verify each one.
-b, --binary - Mark files as binary in the output (default on Linux).
-t, --text - Read files in text mode (rare on Linux, kept for portability).
--quiet - Suppress OK lines when checking.
--status - Print nothing; rely on the exit status alone.
--ignore-missing - Skip files listed in the digest file that are not present.
--tag - Output BSD-style tagged format, useful when mixing hash algorithms.

md5sum accepts the same flags, which makes it easy to swap one command for the other when the algorithm changes.

Quick Reference

Command	Description
`sha256sum file.iso`	Generate a SHA-256 checksum for one file
`md5sum file.iso`	Generate an MD5 checksum for one file
`sha256sum *.tar.gz > SHA256SUMS`	Save checksums for multiple files
`sha256sum -c SHA256SUMS`	Verify files against a checksum list
`grep “file.iso” SHA256SUMS	sha256sum -c -`
`sha256sum -c --quiet SHA256SUMS`	Show only failures during verification

Verifying a Download End to End

Putting the pieces together, a typical download check looks like this:

Terminal
wget https://releases.ubuntu.com/24.04/ubuntu-24.04.2-desktop-amd64.iso
wget https://releases.ubuntu.com/24.04/SHA256SUMS
sha256sum -c --ignore-missing SHA256SUMS

The --ignore-missing flag keeps the check focused on the file you actually downloaded instead of failing on every other release listed in SHA256SUMS.

For full confidence, also verify the signature on SHA256SUMS itself using the publisher’s GPG key. A digest is only as trustworthy as the source you got it from, so a signed checksum file closes the loop.

Troubleshooting

Checksum mismatch on a freshly downloaded file
Re-download the file, ideally from a different mirror. The most common cause is a truncated transfer or a network error. If the second download still fails, the file on the mirror may be stale or tampered with, and you should report it to the project.

No such file or directory when running with -c
The names in the checksum file are resolved relative to the current directory. Change into the directory that holds the files, or edit the checksum file to use paths that match where the files live.

improperly formatted checksum line warnings
A single space between the digest and the file name instead of two, trailing whitespace, or Windows line endings will all trip the parser. Run dos2unix on the file or recreate it with sha256sum > SHA256SUMS to reset the format.

The MD5 digest matches but you still do not trust the file
You are right to be cautious. MD5 collisions are practical, so match an MD5 against accidental corruption only. Ask the publisher for a SHA-256 digest or a signed checksum file.

FAQ

Which is faster, sha256sum or md5sum?
md5sum is faster, sometimes noticeably so on large files. The speed difference rarely matters on modern hardware, and it is not a good reason to pick MD5 over SHA-256 for security-sensitive checks.

Can I use sha256sum on a directory?
Not directly. Hash tools operate on files. To produce a digest that represents an entire directory, pipe a deterministic listing such as find ... -type f -print0 | sort -z | xargs -0 sha256sum through another sha256sum.

Where do I find the expected digest for a Linux distro ISO?
Every major distribution publishes a SHA256SUMS or SHA512SUMS file on its download page, usually along with a detached GPG signature. Prefer those files over digests shown in third-party blog posts.

Is sha256sum available by default on Linux?
Yes. Both sha256sum and md5sum ship with the GNU coreutils package, which is installed on every mainstream Linux distribution.

Conclusion

sha256sum should be the default for verifying downloads and backups, with md5sum reserved for quick corruption checks when the publisher provides nothing stronger. When you pair a SHA-256 digest with a signed checksum file and a trusted key, you can answer the question that matters most: did I get the file the publisher actually shipped?

git cherry-pick Command: Apply Commits from Another Branch

hello@linuxize.com (Linuxize) — Wed, 15 Apr 2026 10:20:00 +0200

Sometimes the change you need is already written, just on the wrong branch. A hotfix may land on main when it also needs to go to a maintenance branch, or a useful commit may be buried in a feature branch that you do not want to merge wholesale. In that situation, git cherry-pick lets you copy the effect of a specific commit onto your current branch.

This guide explains how git cherry-pick works, how to apply one or more commits safely, and how to handle the conflicts that can appear along the way.

Syntax

The general syntax for git cherry-pick is:

txt
git cherry-pick [OPTIONS] COMMIT...

OPTIONS - Flags that change how Git applies the commit.
COMMIT - One or more commit hashes, branch references, or commit ranges.

git cherry-pick replays the changes introduced by the selected commit on top of your current branch. Git creates a new commit, so the result has a different commit hash even when the file changes are the same.

Cherry-Picking a Single Commit

Start by finding the commit you want to copy. This example lists the recent commits on a feature branch:

Terminal
git log --oneline feature/auth

output

a3f1c92 Fix null pointer in auth handler
d8b22e1 Add login form validation
7c4e003 Refactor session logic

The output gives you the abbreviated commit hashes. In this case, a3f1c92 is the fix we want to move.

Switch to the target branch before running git cherry-pick:

Terminal
git switch main
git cherry-pick a3f1c92

output

[main 9b2d4f1] Fix null pointer in auth handler
Date: Tue Apr 14 10:42:00 2026 +0200
1 file changed, 2 insertions(+)

Git applies the change from a3f1c92 to main and creates a new commit, 9b2d4f1. The subject line is the same, but the commit hash is different because the parent commit is different.

Cherry-Picking Multiple Commits

If you need more than one non-consecutive commit, pass each hash in the order you want Git to apply them:

Terminal
git cherry-pick a3f1c92 d8b22e1

Git creates a separate new commit for each one. This works well when you need a few targeted fixes but do not want the rest of the source branch.

For a range of consecutive commits, use the range notation:

Terminal
git cherry-pick a3f1c92^..7c4e003

This tells Git to include a3f1c92 and every commit after it up to 7c4e003. If you omit the caret, the starting commit itself is excluded:

Terminal
git cherry-pick a3f1c92..7c4e003

That form applies every commit after a3f1c92 through 7c4e003.

Applying Changes Without Committing

Sometimes you want the changes from a commit, but not an automatic commit for each one. Use --no-commit (or -n) to apply the changes to your working tree and staging area without creating the commit yet:

Terminal
git cherry-pick --no-commit a3f1c92

This is useful when you want to combine several small fixes into one commit on the target branch, or when you need to edit the files before committing.

After reviewing the result, create the commit yourself:

Terminal
git status
git commit -m "Backport auth null-check fix"

This gives you more control over the final commit message and lets you group related backports together.

Recording Where the Commit Came From

For maintenance branches and backports, it is often helpful to keep a reference to the original commit. Use -x to append the source commit hash to the new commit message:

Terminal
git cherry-pick -x a3f1c92

Git adds a line like this to the new commit message:

output

(cherry picked from commit a3f1c92...)

That extra line makes future audits easier, especially when you need to prove that a fix on a release branch came from a reviewed change on another branch.

Cherry-Picking a Merge Commit

Cherry-picking a regular commit is straightforward, but merge commits need one extra option. Git must know which parent to treat as the main line:

Terminal
git cherry-pick -m 1 MERGE_COMMIT_HASH

-m 1 - Use the first parent as the base, which is usually the branch that received the merge.
-m 2 - Use the second parent instead.

If you are not sure which parent is which, inspect the history first:

Terminal
git log --oneline --graph

Cherry-picking merge commits is more advanced and easier to get wrong. If the goal is to bring over an entire merged feature, a normal merge is often clearer than cherry-picking the merge commit itself.

Resolving Conflicts

If the target branch has changed in the same area of code, Git may stop and ask you to resolve a conflict:

output

error: could not apply a3f1c92... Fix null pointer in auth handler
hint: After resolving the conflicts, mark them with
hint: "git add/rm <pathspec>", then run
hint: "git cherry-pick --continue".

Open the conflicted file and look for the conflict markers:

output

<<<<<<< HEAD
return session.getUser();
=======
if (session == null) return null;
return session.getUser();
>>>>>>> a3f1c92 (Fix null pointer in auth handler)

Edit the file to keep the final version you want, then stage it and continue:

Terminal
git add src/auth.js
git cherry-pick --continue

If you decide the commit is not worth applying after all, abort the operation:

Terminal
git cherry-pick --abort

git cherry-pick --abort puts the branch back where it was before the cherry-pick started.

A Safe Backport Workflow

When you cherry-pick onto a release or maintenance branch, slow down and make the source obvious. A simple workflow looks like this:

Terminal
git switch release/1.4
git pull --ff-only
git cherry-pick -x a3f1c92
git status

The important part is the sequence. Start from the branch that needs the fix, make sure it is up to date, cherry-pick with -x, then review and test the branch before pushing it. This avoids the common mistake of copying a fix into an outdated branch and shipping an untested backport.

If the picked commit depends on earlier refactors or new APIs that are not present on the target branch, stop there. In that case, either copy the prerequisite commits too or recreate the fix manually.

When to Use git cherry-pick

git cherry-pick is a good fit when you need a precise change without the rest of the branch:

Backporting a bug fix from main to a release branch
Recovering one useful commit from an abandoned feature branch
Moving a small fix that was committed on the wrong branch
Pulling a reviewed change into a hotfix branch without merging unrelated work

Avoid it when the target branch needs the full context of the source branch. If the commit depends on earlier commits, shared refactors, or schema changes, a merge or rebase is usually the cleaner option.

Troubleshooting

error: could not apply ... during cherry-pick
The target branch has conflicting changes. Resolve the files Git marks as conflicted, stage them with git add, then run git cherry-pick --continue.

Cherry-pick created duplicate-looking history
That is normal. Cherry-pick copies the effect of a commit, not the original object. The new commit has a different hash because it has a different parent.

The picked commit does not build on the target branch
The commit likely depends on earlier work that is missing from the target branch. Inspect the source branch history with git log and either cherry-pick the prerequisites too or reimplement the change manually.

You picked the wrong commit
If the cherry-pick already completed, use git revert on the new commit. If the operation is still in progress, use git cherry-pick --abort.

Quick Reference

For a printable quick reference, see the Git cheatsheet .

Task	Command
Pick one commit	`git cherry-pick COMMIT`
Pick several specific commits	`git cherry-pick C1 C2 C3`
Pick a consecutive range including the first commit	`git cherry-pick A^..B`
Apply changes without committing	`git cherry-pick --no-commit COMMIT`
Record the source commit in the message	`git cherry-pick -x COMMIT`
Continue after resolving a conflict	`git cherry-pick --continue`
Skip the current commit in a sequence	`git cherry-pick --skip`
Abort the operation	`git cherry-pick --abort`
Pick a merge commit	`git cherry-pick -m 1 MERGE_COMMIT`

FAQ

What is the difference between git cherry-pick and git merge?
git cherry-pick copies the effect of selected commits onto your current branch. git merge joins two branch histories and brings over all commits that are missing from the target branch.

Does cherry-pick change the original commit?
No. The source commit stays exactly where it is. Git creates a new commit on your current branch with the same file changes.

Should I use -x every time?
Not always, but it is a good habit for backports and maintenance branches. It gives you a clear link back to the original commit.

Can I cherry-pick commits from another remote branch?
Yes. Fetch the remote branch first, then cherry-pick the commit hash you want. You can inspect the incoming history with git log or review the file changes with git diff before applying anything.

Conclusion

git cherry-pick is the tool to reach for when one commit matters more than the branch it came from. Use it for targeted fixes, keep -x in mind for backports, and fall back to merge or rebase when the change depends on broader branch context.

ufw Command in Linux: Uncomplicated Firewall Reference

hello@linuxize.com (Linuxize) — Tue, 14 Apr 2026 07:45:00 +0200

If your server is open to the public network, it needs a firewall. On Ubuntu and Debian, the easiest way to set one up is with ufw. This tool sits on top of iptables (or nftables on newer systems) and replaces complex rules with simple, easy-to-read commands.

This guide walks through the ufw command, from enabling the firewall and setting default policies to writing rules for ports, services, and specific addresses.

ufw Syntax

The general form of the command is:

txt
sudo ufw [OPTIONS] COMMAND [ARGS]

OPTIONS - Flags such as --dry-run to preview what a rule would do.
COMMAND - The action, for example enable, allow, deny, delete, or status.
ARGS - The rule body, such as a port number, a service name, or a full rule specification.

ufw changes firewall rules, so almost every invocation needs sudo.

Checking the Firewall Status

Before you touch the rules, check whether the firewall is running and what is already in place:

Terminal
sudo ufw status

If ufw is inactive, you will see:

output

Status: inactive

This confirms that ufw is installed but not currently enforcing any firewall rules.

Once active, the same command lists the rules:

output

Status: active
To Action From
-- ------ ----
22/tcp ALLOW Anywhere
80/tcp ALLOW Anywhere
22/tcp (v6) ALLOW Anywhere (v6)
80/tcp (v6) ALLOW Anywhere (v6)

For a numbered view that is easier to reference when deleting rules, use:

Terminal
sudo ufw status numbered

And for a more detailed output that shows default policies and logging level:

Terminal
sudo ufw status verbose

Enabling and Disabling the Firewall

The first time you enable ufw, make sure you have already allowed SSH. Enabling the firewall over an SSH session without an allow ssh rule will lock you out of the server.

Allow SSH first:

Terminal
sudo ufw allow ssh

Then turn the firewall on:

Terminal
sudo ufw enable

output

Firewall is active and enabled on system startup

At this point, ufw starts enforcing the rules immediately and will come back automatically after a reboot.

To stop the firewall and clear it from the startup sequence:

Terminal
sudo ufw disable

A disabled ufw keeps the rules you defined. When you re-enable it, the same rules come back.

Default Policies

Default policies decide what happens to traffic that does not match any rule. The usual hardening is to deny incoming traffic and allow outgoing traffic:

Terminal
sudo ufw default deny incoming
sudo ufw default allow outgoing

After running these two commands, you only need to open the specific inbound ports your server should expose. Outbound traffic still flows freely, which is what most servers need.

You can also set the default for forwarded traffic, which matters if the host acts as a router or runs containers:

Terminal
sudo ufw default deny routed

Allowing Connections

The allow command is the one you will use most often. It accepts a service name, a port, a protocol, or a full rule.

Allow a Service by Name

ufw reads /etc/services and understands common service names:

Terminal
sudo ufw allow ssh
sudo ufw allow http
sudo ufw allow https

Each command opens the matching port (22, 80, and 443) for both TCP and UDP where applicable.

Allow a Specific Port

To open a port directly, pass the port number:

Terminal
sudo ufw allow 8080

By default, this opens the port for both TCP and UDP. To limit it to one protocol, add /tcp or /udp:

Terminal
sudo ufw allow 8080/tcp
sudo ufw allow 53/udp

Allow a Port Range

Port ranges require an explicit protocol:

Terminal
sudo ufw allow 6000:6007/tcp
sudo ufw allow 6000:6007/udp

The colon separates the start and the end of the range, both inclusive.

Allow Traffic From a Specific Address

To accept connections from a single IP address, use from:

Terminal
sudo ufw allow from 203.0.113.25

To restrict that to a single service, add to any port:

Terminal
sudo ufw allow from 203.0.113.25 to any port 22

Allow Traffic From a Subnet

CIDR notation works the same way for whole networks:

Terminal
sudo ufw allow from 192.168.1.0/24 to any port 3306

This is a common pattern for databases: the port stays closed to the internet and is only reachable from your internal network.

Allow Traffic on a Specific Interface

To tie a rule to a network interface, add on INTERFACE:

Terminal
sudo ufw allow in on eth1 to any port 3306

The in keyword applies the rule to inbound traffic on eth1. Use out for outbound traffic.

Denying Connections

The deny command is the mirror of allow and takes the same arguments:

Terminal
sudo ufw deny 23
sudo ufw deny from 198.51.100.77

When the default incoming policy is already deny, you usually do not need to write explicit deny rules for closed ports. Explicit denies are useful when you want to block a specific address while keeping a port open to everyone else.

To log the denied packets instead of silently dropping them, use reject:

Terminal
sudo ufw reject 23

A reject sends an ICMP message back to the sender, while a deny drops the packet with no response.

Rate Limiting SSH

ufw can throttle repeated connections from the same IP, which is handy for SSH brute-force protection:

Terminal
sudo ufw limit ssh

The limit rule denies a connection if the source address attempts six or more connections in 30 seconds. This is a quick way to slow down password-guessing bots without installing a full intrusion-prevention tool.

Deleting Rules

There are two common ways to remove a rule. The first is to repeat the rule with delete in front:

Terminal
sudo ufw delete allow 8080/tcp

The second is to delete by rule number:

Terminal
sudo ufw status numbered

output

 To Action From
-- ------ ----
[ 1] 22/tcp ALLOW IN Anywhere
[ 2] 80/tcp ALLOW IN Anywhere
[ 3] 8080/tcp ALLOW IN Anywhere

Terminal
sudo ufw delete 3

ufw asks for confirmation before removing the rule. Keep in mind that after a deletion, the numbering shifts for the remaining rules, so always check the numbered status again before deleting another rule.

For a deeper walkthrough, see how to list and delete UFW firewall rules .

Application Profiles

Services that come with their own ufw profile can be referenced by name. List them with:

Terminal
sudo ufw app list

output

Available applications:
Nginx Full
Nginx HTTP
Nginx HTTPS
OpenSSH

To open the ports that a profile covers, pass its name to allow:

Terminal
sudo ufw allow 'Nginx Full'

Quote profile names that contain spaces. To see what ports a profile includes, use:

Terminal
sudo ufw app info 'Nginx Full'

Dry Run

Before you commit to a change, you can preview the iptables rules ufw would add with --dry-run:

Terminal
sudo ufw --dry-run allow 8080/tcp

No rule is created. The output shows the exact lines ufw would write, which is useful when you are writing rules over SSH and want to double-check them first.

Logging

ufw can log packets that match rules, which helps when troubleshooting. The log level can be adjusted:

Terminal
sudo ufw logging on
sudo ufw logging medium

Valid levels are off, low, medium, high, and full. ufw logs through the kernel log facility, so the exact destination depends on your system logging setup. On many Ubuntu systems with rsyslog, you will see entries in /var/log/ufw.log, and you can often inspect them with journalctl as well.

Reset the Firewall

To clear every rule and set ufw back to its fresh state, run:

Terminal
sudo ufw reset

Warning

ufw reset disables the firewall and removes every rule, including the one that allows SSH. If you are connected over SSH, add an allow rule for SSH and re-enable the firewall right after the reset, or you will lose access the moment you turn it back on.

IPv6 Support

On most modern systems, ufw can manage IPv6 rules as well as IPv4 rules. Check the setting in /etc/default/ufw:

/etc/default/ufwsh
IPV6=yes

When IPV6=yes, generic rules such as sudo ufw allow 22/tcp are created for both IPv4 and IPv6. Rules that include an explicit address stay specific to that address family. In the status output, the IPv6 rules appear with (v6) next to them.

Quick Reference

For a printable quick reference, see the ufw cheatsheet .

Task	Command
Show status	`sudo ufw status verbose`
Show numbered rules	`sudo ufw status numbered`
Enable firewall	`sudo ufw enable`
Disable firewall	`sudo ufw disable`
Default deny incoming	`sudo ufw default deny incoming`
Default allow outgoing	`sudo ufw default allow outgoing`
Allow SSH	`sudo ufw allow ssh`
Allow port	`sudo ufw allow 8080/tcp`
Allow port range	`sudo ufw allow 6000:6007/tcp`
Allow from IP	`sudo ufw allow from 203.0.113.25`
Allow from subnet	`sudo ufw allow from 192.168.1.0/24`
Rate-limit SSH	`sudo ufw limit ssh`
Delete rule by number	`sudo ufw delete 3`
List app profiles	`sudo ufw app list`
Reset all rules	`sudo ufw reset`

Troubleshooting

ufw: command not found
Install the ufw package with sudo apt install ufw on Ubuntu or Debian. On Fedora, RHEL, and derivatives, firewalld is the default and ufw is rarely used.

Locked out after enabling the firewall over SSH
The default deny policy blocked your SSH session. You will need console access to the server. Once in, run sudo ufw allow ssh and sudo ufw reload to restore access. The usual safeguard is to allow SSH before the first enable.

Rule added but traffic still blocked
Confirm the rule is in the right direction (inbound vs outbound) and on the right interface. Check with sudo ufw status verbose. If Docker is running, it writes its own iptables rules that can bypass ufw.

Changes do not take effect
After manual edits to /etc/ufw/ files, reload the firewall with sudo ufw reload. Commands issued through ufw apply immediately and do not need a reload.

FAQ

Is ufw the same as iptables?
No. ufw is a front end that generates iptables (or nftables) rules for you. The kernel still enforces the rules through its packet filter, but you do not need to edit the raw tables yourself.

Does ufw start automatically after reboot?
Yes, once you run sudo ufw enable, the service is registered with systemd and starts on boot. You can confirm with systemctl status ufw.

How do I allow a port for a single IP address?
Use the from and to any port form: sudo ufw allow from 203.0.113.25 to any port 22. This keeps the port closed to the rest of the internet and only opens it for that one address.

What is the difference between deny and reject?
deny drops the packet without any reply. reject sends an ICMP message back to the sender telling them the connection was refused. Reject is slightly friendlier to well-behaved clients but makes the server more visible to scans.

How do I undo everything and start over?
Run sudo ufw reset. It disables the firewall and removes every rule. Remember to re-add the SSH rule before re-enabling, especially on a remote server.

Conclusion

ufw keeps firewall management readable: allow what you need, deny what you do not, and lean on the default policies to cover the rest. If you want step-by-step instructions for setting it up on a new server, see how to set up a firewall with UFW on Ubuntu 24.04 .

nslookup Command in Linux: Query DNS Records

hello@linuxize.com (Linuxize) — Sat, 11 Apr 2026 11:00:00 +0200

When a website does not load or email stops arriving, the first thing to check is whether the domain resolves to the correct address. The nslookup command is a quick way to query DNS servers and inspect the records behind a domain name.

nslookup ships with most Linux distributions and works on macOS and Windows as well. It supports both one-off queries from the command line and an interactive mode for running multiple lookups in a row.

This guide explains how to use nslookup with practical examples covering record types, reverse lookups, and troubleshooting.

Syntax

txt
nslookup [OPTIONS] [NAME] [SERVER]

NAME — The domain name or IP address to look up.
SERVER — The DNS server to query. If omitted, nslookup uses the server configured in /etc/resolv.conf.
OPTIONS — Query options such as -type=MX or -debug.

When called without arguments, nslookup starts in interactive mode.

Installing nslookup

On most distributions nslookup is already installed. To check, run:

Terminal
nslookup -version

If the command is not found, install it using your distribution’s package manager.

Install nslookup on Ubuntu, Debian, and Derivatives

Terminal
sudo apt update && sudo apt install dnsutils

Install nslookup on Fedora, RHEL, and Derivatives

Terminal
sudo dnf install bind-utils

Install nslookup on Arch Linux

Terminal
sudo pacman -S bind

The nslookup command is bundled with the same packages that provide dig .

Look Up a Domain Name

The simplest use is passing a domain name as an argument:

Terminal
nslookup linux.org

output

Server: 127.0.0.53
Address: 127.0.0.53#53
Non-authoritative answer:
Name: linux.org
Address: 104.26.14.72
Name: linux.org
Address: 104.26.15.72
Name: linux.org
Address: 172.67.73.26

The first two lines show the DNS server that answered the query. Everything under “Non-authoritative answer” is the actual result. In this case, linux.org resolves to three IPv4 addresses.

“Non-authoritative” means the answer came from a resolver’s cache rather than directly from the domain’s authoritative name server.

Query a Specific DNS Server

By default, nslookup queries the resolver configured in /etc/resolv.conf. To query a different server, add it as the last argument.

For example, to query Google’s public DNS:

Terminal
nslookup linux.org 8.8.8.8

output

Server: 8.8.8.8
Address: 8.8.8.8#53
Non-authoritative answer:
Name: linux.org
Address: 104.26.14.72
Name: linux.org
Address: 104.26.15.72
Name: linux.org
Address: 172.67.73.26

This is useful when you want to compare results across different resolvers or verify whether a DNS change has propagated to public servers.

Query Record Types

By default, nslookup returns A (IPv4 address) records. Use the -type option to query other record types.

MX Records (Mail Servers)

MX records identify the mail servers responsible for receiving email for a domain:

Terminal
nslookup -type=mx google.com

output

Server: 127.0.0.53
Address: 127.0.0.53#53
Non-authoritative answer:
google.com mail exchanger = 10 smtp.google.com.

The number before the mail server hostname is the priority. A lower number means higher priority.

NS Records (Name Servers)

NS records show which name servers are authoritative for a domain:

Terminal
nslookup -type=ns google.com

output

Server: 127.0.0.53
Address: 127.0.0.53#53
Non-authoritative answer:
google.com nameserver = ns1.google.com.
google.com nameserver = ns2.google.com.
google.com nameserver = ns3.google.com.
google.com nameserver = ns4.google.com.

TXT Records

TXT records store arbitrary text data, commonly used for SPF, DKIM, and domain ownership verification:

Terminal
nslookup -type=txt google.com

output

Server: 127.0.0.53
Address: 127.0.0.53#53
Non-authoritative answer:
google.com text = "v=spf1 include:_spf.google.com ~all"
google.com text = "facebook-domain-verification=22rm551cu4k0ab0bxsw536tlds4h95"
google.com text = "docusign=05958488-4752-4ef2-95eb-aa7ba8a3bd0e"

The output may include many entries. The example above shows a subset of the TXT records returned for google.com.

AAAA Records (IPv6)

AAAA records return the IPv6 address of a domain:

Terminal
nslookup -type=aaaa google.com

output

Server: 127.0.0.53
Address: 127.0.0.53#53
Non-authoritative answer:
Name: google.com
Address: 2a00:1450:4017:818::200e

SOA Record (Start of Authority)

The SOA record contains administrative information about the domain, including the primary name server, the responsible email address, and timing parameters for zone transfers:

Terminal
nslookup -type=soa google.com

output

Server: 127.0.0.53
Address: 127.0.0.53#53
Non-authoritative answer:
google.com
origin = ns1.google.com
mail addr = dns-admin.google.com
serial = 897592583
refresh = 900
retry = 900
expire = 1800
minimum = 60

The serial number increments each time the zone is updated. DNS secondaries use it to decide whether they need a zone transfer.

CNAME Records

CNAME records point one domain name to another:

Terminal
nslookup -type=cname www.github.com

If a CNAME record exists, the output shows the canonical name the alias points to. If the domain does not have a CNAME record, nslookup returns No answer.

Run an `ANY` Query

To ask the DNS server for an ANY response, use -type=any:

Terminal
nslookup -type=any google.com

ANY queries do not reliably return every record type for a domain. Many DNS servers return only a subset of records or refuse the query entirely.

Reverse DNS Lookup

A reverse lookup finds the hostname associated with an IP address. Pass an IP address instead of a domain name:

Terminal
nslookup 208.118.235.148

output

148.235.118.208.in-addr.arpa name = ip-208-118-235-148.twdx.net.

Reverse lookups query PTR records. They are useful for verifying that an IP address maps back to the expected hostname, which matters for mail server configuration and security checks.

Interactive Mode

Running nslookup without arguments starts an interactive session where you can run multiple queries without retyping the command:

Terminal
nslookup

output

At the > prompt, type a domain name to look it up:

output

> linux.org
Server: 127.0.0.53
Address: 127.0.0.53#53
Non-authoritative answer:
Name: linux.org
Address: 104.26.14.72
Name: linux.org
Address: 104.26.15.72

You can change query settings during the session with the set command. For example, to switch to MX record lookups and then query a domain:

output

> set type=mx
> google.com
Server: 127.0.0.53
Address: 127.0.0.53#53
Non-authoritative answer:
google.com mail exchanger = 10 smtp.google.com.

To change the DNS server:

output

> server 8.8.8.8
Default server: 8.8.8.8
Address: 8.8.8.8#53

Type exit to leave interactive mode.

Interactive mode is convenient when you need to test several domains or record types in a row without running separate commands each time.

Debugging DNS Issues

The -debug option shows the full query and response details, including TTL values and additional sections that nslookup normally hides:

Terminal
nslookup -debug linux.org

The debug output is verbose, but it is helpful when you need to see TTL values, check whether answers are authoritative, or trace unexpected behavior.

nslookup vs dig

Both nslookup and dig query DNS servers, but they differ in output and capabilities:

nslookup produces simpler, more readable output. It also has an interactive mode that is convenient for quick checks.
dig provides detailed, structured output with sections (QUESTION, ANSWER, AUTHORITY, ADDITIONAL) and supports advanced options like +trace for tracing the full resolution path and +dnssec for verifying DNSSEC signatures.

For quick lookups and basic troubleshooting, nslookup is often faster to type and read. For in-depth DNS debugging, dig gives you more control and detail.

Troubleshooting

nslookup returns NXDOMAIN
The domain does not exist or is misspelled. Verify the domain name and check that it is registered.

nslookup returns SERVFAIL
The DNS server could not process the query. Try a different resolver to isolate the problem:

Terminal
nslookup linux.org 1.1.1.1

If public resolvers return the correct answer, the issue is with your configured resolver.

Connection timed out; no servers could be reached
This means nslookup could not contact the DNS server. Check your network connection and verify that /etc/resolv.conf contains a reachable name server. A firewall may also be blocking outbound DNS traffic on port 53.

Non-authoritative answer appears on every query
This is normal. It means the answer came from a resolver’s cache, not directly from the domain’s authoritative server. The result is still valid.

Quick Reference

For a printable quick reference, see the nslookup cheatsheet .

Task	Command
Look up a domain	`nslookup example.com`
Query a specific DNS server	`nslookup example.com 8.8.8.8`
Query MX records	`nslookup -type=mx example.com`
Query NS records	`nslookup -type=ns example.com`
Query TXT records	`nslookup -type=txt example.com`
Query AAAA (IPv6) records	`nslookup -type=aaaa example.com`
Query SOA record	`nslookup -type=soa example.com`
Query CNAME record	`nslookup -type=cname example.com`
Run an `ANY` query	`nslookup -type=any example.com`
Reverse DNS lookup	`nslookup 192.0.2.1`
Start interactive mode	`nslookup`
Enable debug output	`nslookup -debug example.com`

FAQ

Can I use nslookup to check DNS propagation?
Yes. Query the same domain against several public DNS servers and compare the results. For example, run nslookup example.com 8.8.8.8, nslookup example.com 1.1.1.1, and nslookup example.com 9.9.9.9. If the answers differ, the change has not fully propagated.

Is nslookup deprecated?
The ISC (the organization behind BIND) once marked nslookup as deprecated in favor of dig, but later reversed that decision. nslookup is actively maintained and included in current BIND releases. It remains a practical tool for quick DNS lookups.

What does “Non-authoritative answer” mean?
It means the response came from a caching resolver, not from one of the domain’s authoritative name servers. The data is still accurate, but it may be slightly behind if a DNS change was made very recently and the cache has not expired yet.

Conclusion

The nslookup command is a quick way to query DNS records from the command line. Use -type to look up MX, NS, TXT, AAAA, and other record types, and pass a server argument to test against a specific resolver. For deeper DNS debugging, pair it with dig . To look up domain ownership and registration details instead of DNS records, use the whois command .

env Command in Linux: Show and Set Environment Variables

hello@linuxize.com (Linuxize) — Tue, 07 Apr 2026 10:30:00 +0200

When you need to run a program with a different set of variables, test a script in a clean environment, or write a shebang line that works across systems, the env command is the right tool. It prints the current environment, sets or removes variables for a single command, and can even start a process with no inherited variables at all.

This guide covers how to use the env command with practical examples for everyday tasks.

env Syntax

txt
env [OPTIONS] [NAME=VALUE]... [COMMAND [ARGS]]

When called without arguments, env prints every environment variable in the current session, one per line. When followed by NAME=VALUE pairs and a command, it runs that command with the specified variables added or changed without affecting the current shell.

Print All Environment Variables

The simplest use of env is printing the full environment:

Terminal
env

output

SHELL=/bin/bash
USER=john
HOME=/home/john
LANG=en_US.UTF-8
PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
TERM=xterm-256color
XDG_SESSION_TYPE=tty
EDITOR=vim

Each line is a KEY=value pair. This is identical to what printenv shows with no arguments. The difference between the two commands becomes clear when you start passing options: printenv is designed for inspecting variables, while env is designed for modifying the environment before launching a program.

Print Variables with NUL Separator

By default, env separates each variable with a newline character. If variable values contain newlines themselves, the output becomes ambiguous. The -0 (or --null) option ends each entry with a NUL byte instead:

Terminal
env -0 | tr '\0' '\n' | head -5

This is useful when piping environment data into tools that expect NUL-delimited input, such as xargs with its -0 flag.

Run a Command with Modified Variables

The most practical feature of env is launching a command with variables changed for that command only. Place NAME=VALUE pairs before the command:

Terminal
env LANG=C sort unsorted.txt

This runs sort with LANG set to C, which forces byte-order sorting regardless of the system locale. The current shell’s LANG value stays unchanged after the command finishes.

You can set multiple variables at once:

Terminal
env DB_HOST=localhost DB_PORT=5432 python3 app.py

The application sees DB_HOST and DB_PORT in its environment, but those variables do not persist in your shell session after the process exits.

Tip

You can achieve the same result with the shell’s built-in VAR=value command syntax (for example, LANG=C sort unsorted.txt). The env command is useful when you need additional options like -i or -u, or when you want to be explicit about environment manipulation in scripts.

Run a Command in a Clean Environment

The -i (or --ignore-environment) option clears the entire inherited environment before running the command. Only the variables you explicitly set on the command line will be present:

Terminal
env -i bash -c 'env'

output

PWD=/home/john
SHLVL=1
_=/usr/bin/env

The output shows almost nothing. The shell itself sets a few internal variables (PWD, SHLVL, _), but everything the parent shell normally passes along (PATH, HOME, LANG, USER) is gone.

This is useful for testing whether a script depends on variables it does not set itself. You can combine -i with explicit variables to create a minimal, controlled environment:

Terminal
env -i HOME=/home/john PATH=/usr/bin:/bin bash -c 'echo $HOME; echo $PATH'

output

/home/john
/usr/bin:/bin

A bare - (hyphen) works as a shorthand for -i:

Terminal
env - PATH=/usr/bin bash -c 'echo $PATH'

Unset a Variable for a Command

The -u (or --unset) option removes a specific variable from the environment before running the command:

Terminal
env -u EDITOR vim

This launches vim without the EDITOR variable in its environment. Other variables remain untouched. You can unset multiple variables by repeating -u:

Terminal
env -u LANG -u LC_ALL python3 script.py

The difference from -i is that -u is surgical: it removes only the named variables and leaves everything else in place.

Change Directory Before Running a Command

The -C (or --chdir) option changes the working directory before executing the command:

Terminal
env -C /var/log cat syslog | head -3

This is equivalent to running cd /var/log && cat syslog, but without affecting the current shell’s working directory. It is a convenient way to run a command in another directory from within a script or one-liner.

Info

The -C option requires GNU coreutils 8.28 or later. Check your version with env --version.

Using env in Shebangs

One of the most common uses of env is in shebang lines at the top of scripts:

sh
#!/usr/bin/env bash
echo "Hello from Bash"

When the kernel encounters #!/usr/bin/env bash, it runs /usr/bin/env with bash as its argument. env then searches the PATH for the bash executable and runs it. This is more portable than hardcoding #!/bin/bash, because bash is not always located in /bin on every system (for example, on FreeBSD it is typically at /usr/local/bin/bash).

The same pattern works for other interpreters:

sh
#!/usr/bin/env python3

sh
#!/usr/bin/env node

On systems with GNU coreutils 8.30 or later, you can pass arguments to the interpreter using the -S (split string) option:

sh
#!/usr/bin/env -S python3 -u

Without -S, the kernel treats python3 -u as a single argument. The -S option tells env to split the string into separate arguments before executing.

env Options

-i, --ignore-environment - Start with an empty environment
-u NAME, --unset=NAME - Remove NAME from the environment
-C DIR, --chdir=DIR - Change working directory to DIR before running the command
-0, --null - End each output line with a NUL byte instead of a newline
-S STRING, --split-string=STRING - Split STRING into separate arguments (useful in shebangs)
-v, --debug - Print verbose information for each processing step
--block-signal=SIG - Block delivery of the specified signal to the command
--default-signal=SIG - Reset signal handling to the default for the command
--ignore-signal=SIG - Set signal handling to ignore for the command

Quick Reference

For a printable quick reference, see the env cheatsheet .

Command	Description
`env`	Print all environment variables
`env -0`	Print variables with NUL separator
`env VAR=value command`	Run a command with a modified variable
`env -i command`	Run a command in a clean environment
`env -i VAR=value command`	Run a command with only the specified variables
`env -u VAR command`	Run a command with a variable removed
`env -C /path command`	Run a command in a different directory
`#!/usr/bin/env bash`	Portable shebang line
`#!/usr/bin/env -S python3 -u`	Shebang with interpreter arguments

FAQ

What is the difference between env and printenv?
Both commands print environment variables when called without arguments. The difference is in their purpose: printenv is a read-only inspection tool that can print individual variables by name (printenv HOME). env is designed to modify the environment and run commands. Use printenv when you need to check a value, and env when you need to change the environment for a process.

What is the difference between env and export?
export is a shell built-in that adds a variable to the current shell’s environment permanently (until the session ends or you unset it). env sets variables only for the duration of a single command and does not affect the current shell. If you need a variable to persist for all subsequent commands in your session, use export. If you need a variable set for one command only, use env or the shell’s VAR=value command syntax.

When should I use env -i?
Use env -i when you want to verify that a script or program works without relying on inherited environment variables. It is also useful in security-sensitive contexts where you want to prevent a child process from seeing variables like AWS_SECRET_ACCESS_KEY or database credentials that exist in the parent shell.

Why use #!/usr/bin/env bash instead of #!/bin/bash?
The env-based shebang is more portable. On most Linux distributions, bash lives at /bin/bash, but on other Unix systems (FreeBSD, macOS with Homebrew, NixOS) it may be installed elsewhere. Using #!/usr/bin/env bash searches the PATH for the interpreter, so the script works regardless of where bash is installed.

Conclusion

The env command gives you fine-grained control over the environment a process sees without touching your current shell session. For a broader look at how environment and shell variables work in Linux, including persistent configuration and the PATH variable, see the guide on how to set and list environment variables .

htop Command in Linux: Monitor Processes Interactively

hello@linuxize.com (Linuxize) — Mon, 06 Apr 2026 11:00:00 +0200

When a server starts responding slowly or a desktop session feels sluggish, you need to figure out which process is consuming the most CPU or memory. The top command can do this, but its interface is minimal and navigation takes some getting used to. htop is an interactive process viewer that improves on top with color-coded meters, mouse support, and the ability to scroll, search, filter, and kill processes without leaving the viewer.

This guide explains how to install and use htop to monitor system resources and manage processes on Linux.

Installing htop

htop is available in the default repositories of most Linux distributions but is not always pre-installed.

On Ubuntu, Debian, and Derivatives:

Terminal
sudo apt install htop

On Fedora, RHEL, and Derivatives:

Terminal
sudo dnf install htop

Verify the installation by checking the version:

Terminal
htop --version

output

htop 3.4.1

htop Syntax

txt
htop [OPTIONS]

Running htop without arguments opens the interactive process viewer with default settings:

Terminal
htop

Understanding the Interface

The htop screen is divided into three areas: a header with system meters, a process list in the center, and a footer with function key shortcuts.

Header Area

The top section shows system-wide resource usage at a glance:

CPU bars: one bar per CPU core, color-coded by usage type. Green is normal user processes, red is kernel (system) activity, blue is low-priority (nice) processes, and cyan is virtualization overhead (steal time)
Memory bar: shows used, buffered, and cached memory as a proportion of total RAM. Green is memory in use by applications, blue is buffers, and yellow is file cache
Swap bar: shows swap usage. If this bar is consistently full, the system does not have enough physical memory for its workload
Tasks: total number of processes and threads, with a count of how many are currently running
Load average: the 1-minute, 5-minute, and 15-minute system load averages
Uptime: how long the system has been running since the last boot

Process List

Below the header, each row represents one process. The default columns are:

PID - process ID
USER - the owner of the process
PRI - kernel scheduling priority
NI - nice value (user-space priority, ranges from -20 to 19)
VIRT - total virtual memory the process has allocated
RES - resident memory, the portion of physical RAM the process is actually using
SHR - shared memory, the portion of RES that is shared with other processes (such as shared libraries)
S - process state (R running, S sleeping, D uninterruptible sleep, Z zombie, T stopped)
CPU% - percentage of CPU time the process is using
MEM% - percentage of physical memory the process is using
TIME+ - total CPU time consumed since the process started
Command - the full command line that launched the process

Function Keys

The bottom bar shows the available actions:

F1 - open the help screen
F2 - open the setup menu to customize meters and columns
F3 - search for a process by name
F4 - filter the process list to show only matching entries
F5 - toggle tree view
F6 - choose a column to sort by
F7 - decrease the nice value (higher priority) of the selected process
F8 - increase the nice value (lower priority) of the selected process
F9 - send a signal to the selected process
F10 - quit htop

Sorting Processes

By default, htop sorts processes by CPU usage, so the heaviest processes float to the top. To change the sort column, press F6 and select a column from the list using the arrow keys.

For quick sorting without opening the menu, use these shortcut keys:

P - sort by CPU%
M - sort by MEM%
T - sort by TIME+

Press the same key again to reverse the sort order. This is useful when you want to find the least active processes or the ones that started most recently.

You can also set the initial sort column from the command line:

Terminal
htop -s PERCENT_MEM

This starts htop with the process list sorted by memory usage, which is handy when you are investigating high memory consumption on a server.

Searching for a Process

Press F3 (or /) to open the search bar at the bottom of the screen. Type part of the process name and htop will highlight the first matching entry in the process list. Press F3 again to jump to the next match.

The search is incremental, so the highlight updates as you type each character. Press Esc to close the search bar and return to normal navigation.

Filtering Processes

Press F4 to activate the filter. Unlike search, which jumps between matches, filtering hides all processes that do not match the text you type. Only matching entries remain visible in the list.

This is especially useful on busy systems with hundreds of running processes. For example, typing postgres after pressing F4 reduces the list to only PostgreSQL worker processes and the postmaster, making it much easier to see their combined resource usage.

Press Esc to clear the filter and restore the full process list.

Tree View

Press F5 to toggle tree view. In this mode, htop groups child processes under their parent and displays the process hierarchy as an indented tree. This makes it straightforward to see which processes were spawned by a service manager, a shell session, or a container runtime.

To start htop in tree view directly from the command line:

Terminal
htop -t

Tree view combines well with filtering. Press F4, type a service name, and the tree shows only that service and its child processes. For a dedicated look at process hierarchies outside of htop, see the pstree command .

Killing a Process

To stop a process from within htop, use the arrow keys to highlight it (or search with F3), then press F9. This opens a signal selection menu on the left side of the screen.

The most commonly used signals are:

15 SIGTERM - asks the process to shut down gracefully. This is the default and the safest first choice
9 SIGKILL - forces the process to terminate immediately. Use this only when SIGTERM does not work, because the process gets no chance to clean up
2 SIGINT - the same signal sent by pressing Ctrl+C in a terminal
1 SIGHUP - often used to tell a daemon to reload its configuration without restarting

Select the signal with the arrow keys and press Enter to send it. For more detail on process signals and how to send them from the command line, see the kill command guide .

Warning

SIGKILL bypasses all cleanup routines. Files and sockets may be left in an inconsistent state. Always try SIGTERM first and wait a few seconds before escalating to SIGKILL.

You can also tag multiple processes with Space and then press F9 to send a signal to all of them at once. Press U to untag all processes when you are done.

Changing Process Priority

You can adjust the scheduling priority (nice value) of a process directly from htop. Select the process and press:

F7 - decrease the nice value (give the process higher priority)
F8 - increase the nice value (give the process lower priority)

Nice values range from -20 (highest priority) to 19 (lowest priority). Only root can set negative nice values, so you will need to run htop with sudo to raise a process above normal priority.

This is useful when a background task like a large compilation is consuming too much CPU and you want to lower its priority so that interactive services remain responsive.

Showing Only One User’s Processes

To limit the process list to a single user, start htop with the -u option:

Terminal
htop -u www-data

This shows only processes owned by www-data, which is useful when you are debugging a web server or an application service and do not want system processes cluttering the view.

Monitoring Specific Processes

To watch a known set of processes by their PIDs, use the -p option:

Terminal
htop -p 1234,5678

The display is restricted to those two processes, but the header meters still show system-wide resource usage. This gives you a focused view while keeping overall load visible at the top.

Customizing the Display

Press F2 to open the setup screen. From here you can:

Rearrange the header meters (move CPU bars, swap positions, switch between bar, text, graph, or LED display styles)
Add or remove columns in the process list
Change the color scheme
Toggle display options like showing kernel threads or custom thread names

Changes are saved to ~/.config/htop/htoprc and persist across sessions.

Command-Line Options

-d N - set the update interval to N tenths of a second. For example, -d 20 updates every 2 seconds instead of the default 1.5 seconds
-u USER - show only processes belonging to USER
-p PID[,PID...] - show only the specified process IDs
-t - start in tree view
-s COLUMN - sort by the given column name (use names like PERCENT_CPU, PERCENT_MEM, TIME)
-C - use monochrome mode (no colors), useful on terminals with limited color support
-H - highlight new and old processes

Quick Reference

For a printable quick reference, see the htop cheatsheet .

Key / Command	Action
`F1`	Help
`F2`	Setup (customize meters and columns)
`F3` or `/`	Search for a process
`F4`	Filter the process list
`F5`	Toggle tree view
`F6`	Choose sort column
`F7` / `F8`	Decrease / increase nice value
`F9`	Send a signal to the selected process
`F10` or `q`	Quit
`P`	Sort by CPU%
`M`	Sort by MEM%
`T`	Sort by TIME+
`Space`	Tag a process
`U`	Untag all processes
`htop -u USER`	Show only one user’s processes
`htop -p PID,PID`	Monitor specific PIDs
`htop -t`	Start in tree view
`htop -d 20`	Update every 2 seconds
`htop -s PERCENT_MEM`	Sort by memory usage

Troubleshooting

htop: command not found
htop is not installed by default on every distribution. Install it with your package manager: sudo apt install htop on Debian-based systems or sudo dnf install htop on Fedora and RHEL.

Cannot change process priority (permission denied)
Setting a nice value below 0 requires root privileges. Run htop with sudo to adjust priority for processes owned by other users or to set negative nice values.

CPU bars show unexpected colors
Each color represents a different type of CPU usage. Green is normal user processes, red is kernel activity, blue is low-priority (nice) processes, and cyan is virtualization steal time. Press F1 inside htop to see the full color legend for your version.

Memory bar looks full but the system is responsive
Linux uses free memory for disk cache and buffers. The memory bar in htop distinguishes between application memory (green), buffers (blue), and cache (yellow). Cached memory is released to applications when they need it, so a full-looking bar does not mean the system is out of memory.

Processes appear and disappear quickly
Short-lived processes can start and exit between screen refreshes. Lower the update interval with -d 5 (half a second) to catch fast processes. Keep in mind that a very short interval increases the CPU usage of htop itself.

FAQ

What is the difference between htop and top?
Both show running processes and system metrics in real time. htop adds color-coded CPU and memory meters, mouse support, horizontal and vertical scrolling, built-in search and filtering, and the ability to kill or renice processes without typing a PID. The top command is pre-installed on virtually every Linux system, while htop may need to be installed separately.

Does htop use more resources than top?
Slightly. htop reads additional process details from /proc, so it uses a bit more CPU and memory than top. On modern hardware the difference is negligible, even on systems with thousands of processes.

What do VIRT, RES, and SHR mean?
VIRT is the total virtual memory the process has mapped, including memory it has allocated but may not be using yet. RES (Resident) is the portion actually held in physical RAM. SHR (Shared) is the subset of RES that is shared with other processes, such as shared libraries loaded by multiple programs.

How do I save my htop configuration?
Press F2 to open the setup screen, make your changes, and press F10 to exit. htop saves the configuration automatically to ~/.config/htop/htoprc.

Can I run htop over SSH?
Yes. htop works in any terminal emulator, including SSH sessions. If you are monitoring a remote server over a long session, consider running htop inside screen or tmux so the session persists if the connection drops.

Conclusion

htop gives you a clear, interactive view of what is running on your system and the resources each process is consuming. For related tools, see the ps command for snapshot process listings, kill for sending signals from the command line, and pstree for visualizing the process hierarchy.

lsof Command in Linux: List Open Files and Network Connections

hello@linuxize.com (Linuxize) — Wed, 01 Apr 2026 10:00:00 +0100

When you delete a file but the disk space does not come back, or a port appears occupied and you cannot tell what is using it, the lsof command gives you the answer. lsof stands for “list open files.” In Linux, many resources are represented as files, so lsof can show regular files, directories, pipes, sockets, and network connections.

This guide explains how to use lsof to inspect open files, trace network connections, and identify which processes hold resources on your system.

lsof Syntax

txt
lsof [OPTIONS] [FILE]

When called without arguments, lsof attempts to list every open file visible to the current user. That output is usually thousands of lines long, so in practice you will almost always combine it with a filter or run it with sudo when you need a full system-wide view.

Understanding the Output

Running lsof without arguments produces output like this:

Terminal
sudo lsof | head -5

output

COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
systemd 1 root cwd DIR 8,1 4096 2 /
systemd 1 root rtd DIR 8,1 4096 2 /
nginx 1234 root 6u IPv4 28743 0t0 TCP *:http (LISTEN)
bash 5678 john 1u REG 8,1 102400 789 /home/john/log.txt

Each column tells you something specific:

COMMAND - the name of the process
PID - process ID
USER - the user running the process
FD - file descriptor (cwd is the current working directory, txt is the program executable, a number like 4u is an open file handle where r means read, w means write, and u means read and write)
TYPE - type of file (REG for a regular file, DIR for a directory, IPv4/IPv6 for network sockets, unix for Unix domain sockets)
SIZE/OFF - file size or current offset
NAME - the file path or network address

Find What Is Using a Port

The most common use for lsof is finding which process is listening on a given port. For that, use numeric output, limit the search to TCP, and filter to the LISTEN state:

Terminal
sudo lsof -nP -iTCP:80 -sTCP:LISTEN

output

COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
nginx 1234 root 6u IPv4 34120 0t0 TCP *:80 (LISTEN)
nginx 1235 www-data 6u IPv4 34120 0t0 TCP *:80 (LISTEN)

The output shows that nginx is listening on port 80. The PID column gives you the process ID if you need to stop or restart it. The -nP options keep addresses and port numbers numeric, which makes the output easier to read in scripts and troubleshooting sessions.

To filter by both protocol and port number, specify the protocol before the port:

Terminal
sudo lsof -nP -iTCP:443 -sTCP:LISTEN

This is useful when both TCP and UDP services share the same port number and you want to narrow the results to listening TCP sockets only.

List All Network Connections

To see all open network connections on the system, pass -i without a port:

Terminal
sudo lsof -i

To narrow the results to a specific protocol, add TCP or UDP:

Terminal
sudo lsof -i TCP

output

COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
nginx 1234 root 6u IPv4 34120 0t0 TCP *:http (LISTEN)
sshd 2345 root 3u IPv4 39210 0t0 TCP *:ssh (LISTEN)
curl 5678 john 5u IPv4 56789 0t0 TCP workstation:54321->93.184.216.34:http (ESTABLISHED)

Listening services show an asterisk for the address. Established connections show the remote address and port.

List Files Opened by a Process

To see all files opened by a specific process, pass the process ID with -p:

Terminal
sudo lsof -p 1234

To exclude a process instead, prefix the PID with ^:

Terminal
sudo lsof -p ^1234

You can also filter by process name with -c. This matches any running process whose name starts with the given string:

Terminal
sudo lsof -c nginx

List Files Opened by a User

To see all files a particular user has open, use -u followed by the username:

Terminal
lsof -u john

To see files opened by everyone except that user, prefix the username with ^:

Terminal
sudo lsof -u ^john

This is useful on multi-user systems when you want to audit what a specific account is accessing.

Find Which Process Has a File Open

Pass a file path directly to lsof to see which processes currently have it open:

Terminal
lsof /var/log/nginx/access.log

output

COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
nginx 1234 root 5w REG 8,1 249856 654321 /var/log/nginx/access.log
nginx 1235 www-data 5w REG 8,1 249856 654321 /var/log/nginx/access.log

This works for any file, including device files, sockets, and named pipes.

List All Open Files in a Directory

To list all files open within a directory and its subdirectories, use +D:

Terminal
sudo lsof +D /var/log

For a non-recursive listing (top-level only), use lowercase +d:

Terminal
sudo lsof +d /var/log

+D is especially useful before unmounting a filesystem. If any process has a file open inside the mount point, umount will refuse to proceed. Running lsof +D /mountpoint tells you exactly which process is blocking it.

Find Deleted Files Still Holding Disk Space

When you delete a file that a running process still has open, the kernel keeps the data on disk until the process closes the file descriptor or exits. This is a common cause of the “disk is full but I cannot find any large files” problem.

To find these held-open deleted files, use +L1:

Terminal
sudo lsof +L1

output

COMMAND PID USER FD TYPE DEVICE SIZE/OFF NLINK NODE NAME
python3 4567 john 3r REG 8,1 2097152 0 456 /tmp/data.bin (deleted)

The NLINK column shows 0, meaning the file has no directory entry left but is still open. Restarting the process listed under COMMAND will release the space. For more ways to find large files on Linux , including files that are still visible on disk, see that dedicated guide.

Get Only Process IDs

The -t option outputs only process IDs, with no headers or other columns. This is designed for scripting:

Terminal
sudo lsof -t -iTCP:8080 -sTCP:LISTEN

output

A common pattern is to stop the process listening on a port:

Terminal
kill $(sudo lsof -t -iTCP:8080 -sTCP:LISTEN)

Verify the process first with sudo lsof -nP -iTCP:8080 -sTCP:LISTEN before killing it, so you know what you are stopping.

Combining Filters

By default, lsof treats multiple options as OR logic: the output includes files matching any of the conditions. To switch to AND logic (a result must satisfy all conditions), add -a:

Terminal
sudo lsof -a -u john -i TCP

Without -a, this command would return all TCP connections on the system plus all files opened by john. With -a, it returns only TCP connections that belong specifically to john.

Quick Reference

For a printable quick reference, see the lsof cheatsheet .

Command	Description
`lsof`	List all open files
`lsof -nP -iTCP:PORT -sTCP:LISTEN`	Find what is listening on a TCP port
`lsof -i TCP`	List all TCP connections
`lsof -nP -iTCP:443 -sTCP:LISTEN`	Filter by protocol and port
`lsof -p PID`	Files opened by a process
`lsof -c nginx`	Files opened by processes named nginx
`lsof -u john`	Files opened by a user
`lsof /path/to/file`	Processes that have a specific file open
`lsof +D /dir`	All open files in a directory (recursive)
`lsof +L1`	Deleted files still held open
`lsof -t -iTCP:PORT -sTCP:LISTEN`	Output only PIDs listening on a TCP port
`lsof -a -u john -i TCP`	AND logic: TCP connections for a specific user

FAQ

Why does lsof require sudo?
Without root privileges, lsof can only show files opened by your own processes. Running it with sudo gives you visibility into all processes on the system. Some distributions also restrict access to /proc for non-root users, which limits what lsof can read without elevated permissions.

What is the difference between lsof and ss?
lsof covers the full range of open files: regular files, directories, pipes, devices, and network sockets in a single view. The ss command is purpose-built for network sockets and provides more detail about socket states and statistics. Use lsof when you want to tie a network connection back to a specific file or see everything a process has open. Use ss when you need to inspect socket state in detail.

How do I find which process is using a port?
Run sudo lsof -nP -iTCP:PORT -sTCP:LISTEN, replacing PORT with the number you want to check. The ss command with ss -tlnp is another approach covered in the guide on how to check listening ports .

Can I monitor file access in real time with lsof?
No. lsof takes a snapshot at the moment you run it. For real-time filesystem event monitoring, use inotifywait from the inotify-tools package.

lsof shows a file path ending in (deleted). What does that mean?
The file was removed from the directory while a process still had it open. The data remains on disk until the process releases the file descriptor. This is the cause of the “disk full but no large files visible” problem described in the section above. Use lsof +L1 to list all such files and restart the holding process to free the space.

Conclusion

lsof is one of the most practical diagnostic tools available on Linux. Whether you are tracking down a port conflict, auditing which files a user has open, or recovering disk space from deleted but held-open files, it gives you a direct view into what every process is accessing at any moment.

For related tools, see the ps command guide for process inspection and the ss command guide for dedicated network socket statistics.

sed Delete Lines: Remove Lines by Number, Pattern, or Range

hello@linuxize.com (Linuxize) — Mon, 30 Mar 2026 14:00:00 +0200

When working with text files, you will often need to remove specific lines, whether it is stripping comments from a configuration file, cleaning up blank lines in log output, or cutting a range of lines from a data dump. The sed stream editor handles all of these cases from the command line, without opening the file in an editor.

sed processes input line by line, applies your commands, and writes the result to standard output. The original file stays untouched unless you explicitly tell sed to edit in place. If you need to find and replace text rather than remove entire lines, see How to Use sed to Find and Replace Strings in Files .

This guide explains how to use the sed delete command (d) with practical examples covering line numbers, patterns, ranges, and regular expressions.

How the Delete Command Works

The general form of a sed delete expression is:

txt
sed 'ADDRESSd' file

ADDRESS selects which lines to delete, and d is the delete command. When sed encounters a line that matches the address, it removes that line from the output entirely. Any line that does not match the address is printed as usual.

For demonstration purposes, the examples in this guide use the following file:

colors.txttxt
red
green
blue
yellow
white
black
orange
purple

Delete by Line Number

The simplest form of delete targets a specific line number. To remove the third line, place 3 before the d command:

Terminal
sed '3d' colors.txt

output

red
green
yellow
white
black
orange
purple

Notice that “blue” (which was on line 3) is gone from the output, but the original colors.txt file is unchanged. This is the default behavior of sed, and it gives you a safe way to preview changes before committing them.

Sometimes you need to remove the last line of a file without knowing how many lines it contains. The $ address represents the last line:

Terminal
sed '$d' colors.txt

output

red
green
blue
yellow
white
black
orange

Here “purple” (the last line) has been removed from the output.

Delete Multiple Specific Lines

If you need to remove several individual lines, separate the addresses with a semicolon. The following command deletes lines 2, 5, and 8 in a single pass:

Terminal
sed '2d;5d;8d' colors.txt

output

red
blue
yellow
black
orange

The output is missing “green” (line 2), “white” (line 5), and “purple” (line 8). You can list as many addresses as needed this way.

Delete a Range of Lines

To delete a block of consecutive lines, specify a range with two numbers separated by a comma. The following command removes lines 3 through 6:

Terminal
sed '3,6d' colors.txt

output

red
green
orange
purple

Everything from “blue” (line 3) through “black” (line 6) is gone, and the remaining lines print normally.

You can also combine a line number with $ to delete from a given line to the end of the file. This keeps only the first four lines:

Terminal
sed '5,$d' colors.txt

output

red
green
blue
yellow

Adding ! after the address inverts the selection, so sed deletes every line that is not in the range. The following command keeps only lines 3 through 5 and removes everything else:

Terminal
sed '3,5!d' colors.txt

output

blue
yellow
white

This is a convenient way to extract a slice from a file without piping through head and tail.

Delete Every Nth Line

GNU sed supports the step address first~step, which matches every Nth line starting from a given position. To delete every even-numbered line (2, 4, 6, …):

Terminal
sed '0~2d' colors.txt

output

red
blue
white
orange

The first number is the starting offset (0 means “before the first line”, so the first match is line 2) and the second number is the step. In this case sed deletes lines 2, 4, 6, and 8.

To delete every third line starting from line 3:

Terminal
sed '3~3d' colors.txt

output

red
green
yellow
white
orange
purple

Lines 3 (“blue”) and 6 (“black”) are removed. This syntax is specific to GNU sed and is not available in the BSD version shipped with macOS.

Delete Lines Matching a Pattern

One of the most common uses of sed delete is removing lines that contain a specific string. Wrap the search pattern in forward slashes before the d command:

Terminal
sed '/blue/d' colors.txt

output

red
green
yellow
white
black
orange
purple

Every line containing the string “blue” is removed from the output. Keep in mind that this is a substring match, so a pattern like /bl/d would also delete the line “black” because it contains “bl”.

If you want the match to be case-insensitive, add the I flag after d:

Terminal
sed '/Blue/Id' colors.txt

This removes lines containing “blue”, “Blue”, “BLUE”, or any other case variation.

Delete Lines Not Matching a Pattern

Adding ! after the pattern address inverts the match, so sed deletes every line that does not contain the pattern. The following command removes all lines that do not have the letter “e”:

Terminal
sed '/e/!d' colors.txt

output

red
green
blue
yellow
white
orange
purple

Only “black” (line 6) was removed because it is the only line without an “e”. This works similarly to grep , but the advantage of sed is that you can combine it with other editing commands in the same expression.

Delete a Range Between Two Patterns

You can use two patterns separated by a comma to define a range. sed starts deleting at the first line that matches the opening pattern and stops after the first line that matches the closing pattern. The following command removes everything from “green” through “white”:

Terminal
sed '/green/,/white/d' colors.txt

output

red
black
orange
purple

Both the “green” and “white” lines are included in the deletion, along with “blue” and “yellow” between them.

You can also mix a line number with a pattern. This deletes from line 1 through the first line that contains “blue”:

Terminal
sed '1,/blue/d' colors.txt

output

yellow
white
black
orange
purple

This kind of mixed address is useful when you know where the range starts (a fixed line) but not where it ends.

Delete Empty Lines

Removing blank lines is one of the most common sed tasks. To delete completely empty lines, use the pattern ^$, which matches lines where the beginning and end have nothing between them:

Terminal
sed '/^$/d' file.txt

This works well for truly empty lines, but it will not catch lines that contain only spaces or tabs. To remove those as well, use the [[:space:]] character class:

Terminal
sed '/^[[:space:]]*$/d' file.txt

The * quantifier matches zero or more whitespace characters, so this pattern covers both empty lines and lines that appear blank but contain invisible whitespace.

Delete Lines Matching a Regular Expression

The pattern between the slashes is a regular expression, so you can use anchors, character classes, and quantifiers for more precise matching.

A common example is stripping comment lines from a configuration file. The ^# pattern matches any line that starts with #:

Terminal
sed '/^#/d' config.txt

To delete lines that end with a semicolon, anchor the pattern to the end of the line with $:

Terminal
sed '/;$/d' source.txt

You can also match by line length. The following command deletes lines that are shorter than 5 characters. The \{0,4\} quantifier means “between 0 and 4 of any character”:

Terminal
sed '/^.\{0,4\}$/d' file.txt

If you find the backslash escaping awkward, use extended regular expressions with the -E flag (or -r on older systems). This lets you write the same expression without escaping the braces:

Terminal
sed -E '/^.{0,4}$/d' file.txt

Combining Delete with Other Commands

One of the strengths of sed is that you can chain multiple operations in a single expression. For example, the following command first removes comment lines and then replaces “localhost” with “127.0.0.1” in whatever remains:

Terminal
sed '/^#/d; s/localhost/127.0.0.1/g' config.txt

The commands are separated by a semicolon and execute left to right. If a line is deleted by an earlier command, the later commands never see it, so the replacement only applies to non-comment lines.

Editing Files In Place

All of the examples above print the modified text to standard output without changing the original file. When you are satisfied with the result, add the -i flag to apply the changes directly:

Terminal
sed -i '/^$/d' file.txt

Warning

The -i flag modifies the file permanently. Always preview the output without -i first, or create a backup by passing a suffix: sed -i.bak '/^$/d' file.txt. This saves the original as file.txt.bak.

On macOS, the BSD version of sed requires an explicit extension argument even if you do not want a backup. Use sed -i '' '/^$/d' file.txt for in-place editing without creating a backup file.

Quick Reference

For a printable quick reference, see the sed cheatsheet .

Expression	What it deletes
`sed '3d'`	Line 3
`sed '$d'`	Last line
`sed '2d;5d'`	Lines 2 and 5
`sed '3,6d'`	Lines 3 through 6
`sed '5,$d'`	Line 5 to end of file
`sed '3,5!d'`	All lines except 3 through 5
`sed '0~2d'`	Every even-numbered line
`sed '/pattern/d'`	Lines matching pattern
`sed '/pattern/!d'`	Lines not matching pattern
`sed '/start/,/end/d'`	From first match of start to first match of end
`sed '/^$/d'`	Empty lines
`sed '/^#/d'`	Comment lines starting with #

FAQ

How do I delete a line containing a specific word? Use sed '/word/d' file.txt. This removes any line where “word” appears as a substring. If you want to match the whole word only (so that “keyword” is not affected), use word boundaries: sed '/\bword\b/d' file.txt.

Can I delete lines from multiple files at once? Yes. Pass multiple filenames after the expression: sed -i '/pattern/d' file1.txt file2.txt. To process files recursively, combine sed with find: find . -name "*.log" -exec sed -i '/DEBUG/d' {} +.

What is the difference between sed '/pattern/d' and grep -v 'pattern'? Both remove matching lines from the output. The difference is that sed can combine deletion with other editing commands in the same expression and supports in-place editing with -i. If all you need is simple line filtering, grep -v is shorter to type.

How do I delete a range of lines and save the result? You can either redirect the output to a new file (sed '3,6d' file.txt > cleaned.txt) or edit in place with a backup (sed -i.bak '3,6d' file.txt). Do not redirect to the same input file, because the shell will truncate it before sed has a chance to read it.

Conclusion

The sed delete command gives you a fast way to remove lines by number, pattern, or range without opening a file in an editor. For replacing text within lines rather than removing them, see the companion guide on sed find and replace . If you need to work with individual columns or fields within a line, awk is often the better tool for the job.

git clone: Clone a Repository

hello@linuxize.com (Linuxize) — Fri, 20 Mar 2026 09:15:00 +0100

git clone copies an existing Git repository into a new directory on your local machine. It sets up tracking branches for each remote branch and creates a remote called origin pointing back to the source.

This guide explains how to use git clone with the most common options and protocols.

Syntax

The basic syntax of the git clone command is:

txt
git clone [OPTIONS] REPOSITORY [DIRECTORY]

REPOSITORY is the URL or path of the repository to clone. DIRECTORY is optional; if omitted, Git uses the repository name as the directory name.

Clone a Remote Repository

The most common way to clone a repository is over HTTPS. For example, to clone a GitHub repository:

Terminal
git clone https://github.com/user/repo.git

This creates a repo directory in the current working directory, initializes a .git directory inside it, and checks out the default branch.

You can also clone over SSH if you have an SSH key configured :

Terminal
git clone git@github.com:user/repo.git

SSH is generally preferred for repositories you will push to, as it does not require entering credentials each time.

Clone into a Specific Directory

By default, git clone creates a directory named after the repository. To clone into a different directory, pass the target path as the second argument:

Terminal
git clone https://github.com/user/repo.git my-project

To clone into the current directory, use . as the target:

Terminal
git clone https://github.com/user/repo.git .

Warning

Cloning into . requires the current directory to be empty.

Clone a Specific Branch

By default, git clone checks out the default branch (usually main or master). To clone and check out a different branch, use the -b option:

Terminal
git clone -b develop https://github.com/user/repo.git

The full repository history is still downloaded; only the checked-out branch differs. To limit the download to a single branch, combine -b with --single-branch:

Terminal
git clone -b develop --single-branch https://github.com/user/repo.git

Shallow Clone

A shallow clone downloads only a limited number of recent commits rather than the full history. This is useful for speeding up the clone of large repositories when you do not need the full commit history.

To clone with only the latest commit:

Terminal
git clone --depth 1 https://github.com/user/repo.git

To include the last 10 commits:

Terminal
git clone --depth 10 https://github.com/user/repo.git

Shallow clones are commonly used in CI/CD pipelines to reduce download time. To convert a shallow clone to a full clone later, run:

Terminal
git fetch --unshallow

Clone a Local Repository

git clone also works with local paths. This is useful for creating an isolated copy for testing:

Terminal
git clone /path/to/local/repo new-copy

Troubleshooting

Destination directory is not empty
git clone URL . works only when the current directory is empty. If files already exist, clone into a new directory or move the existing files out of the way first.

Authentication failed over HTTPS
Most Git hosting services no longer accept account passwords for Git operations over HTTPS. Use a personal access token or configure a credential manager so Git can authenticate securely.

Permission denied (publickey)
This error usually means your SSH key is missing, not loaded into your SSH agent, or not added to your account on the Git hosting service. Verify your SSH setup before retrying the clone.

Host key verification failed
SSH could not verify the identity of the remote server. Confirm you are connecting to the correct host, then accept or update the host key in ~/.ssh/known_hosts.

Quick Reference

For a printable quick reference, see the Git cheatsheet .

Command	Description
`git clone URL`	Clone a repository via HTTPS or SSH
`git clone URL dir`	Clone into a specific directory
`git clone URL .`	Clone into the current (empty) directory
`git clone -b branch URL`	Clone and check out a specific branch
`git clone -b branch --single-branch URL`	Clone only a specific branch
`git clone --depth 1 URL`	Shallow clone: latest commit only
`git clone --depth N URL`	Shallow clone: last N commits
`git clone /path/to/repo`	Clone a local repository

FAQ

What is the difference between HTTPS and SSH cloning?
HTTPS cloning works out of the box but prompts for credentials unless you use a credential manager. SSH cloning requires a key pair to be configured but does not prompt for a password on each push or pull.

Does git clone download all branches?
Yes. All remote branches are fetched, but only the default branch is checked out locally. Use git branch -r to list all remote branches, or git checkout branch-name to switch to one.

How do I clone a private repository?
For HTTPS, provide your username and a personal access token when prompted. For SSH, ensure your public key is added to your account on the hosting service.

Can I clone a specific tag instead of a branch?
Yes. Use -b with the tag name: git clone -b v1.0.0 https://github.com/user/repo.git. Git checks out that tag in a detached HEAD state, so create a branch if you plan to make commits.

Conclusion

git clone is the starting point for working with any existing Git repository. After cloning, you can inspect the commit history with git log , review changes with git diff , learn when to use git fetch vs git pull , and configure your username and email if you have not done so already.

jobs Command in Linux: List and Manage Background Jobs

hello@linuxize.com (Linuxize) — Thu, 19 Mar 2026 07:00:00 +0100

The jobs command is a Bash built-in that lists all background and suspended processes associated with the current shell session. It shows the job ID, state, and the command that started each job.

This article explains how to use the jobs command, what each option does, and how job specifications work for targeting individual jobs.

Syntax

The general syntax for the jobs command is:

txt
jobs [OPTIONS] [JOB_SPEC...]

When called without arguments, jobs lists all active jobs in the current shell.

Listing Jobs

To see all background and suspended jobs, run jobs without any arguments:

Terminal
jobs

If you have two processes (one running and one stopped), the output will look similar to this:

output

[1]- Stopped vim notes.txt
[2]+ Running ping google.com &

Each line shows:

The job number in brackets ([1], [2])
A + or - sign indicating the current and previous job (more on this below)
The job state (Running, Stopped, Done)
The command that started the job

To include the process ID (PID) in the output, use the -l option:

Terminal
jobs -l

output

[1]- 14205 Stopped vim notes.txt
[2]+ 14230 Running ping google.com &

The PID is useful when you need to send a signal to a process with the kill command.

Job States

Jobs reported by the jobs command can be in one of these states:

Running — the process is actively executing in the background.
Stopped — the process has been suspended, typically by pressing Ctrl+Z.
Done — the process has finished. This state appears once and is then cleared from the list.
Terminated — the process was killed by a signal.

When a background job finishes, the shell displays its Done status the next time you press Enter or run a command.

Job Specifications

Job specifications (job specs) let you target a specific job when using commands like fg, bg, kill , or disown. They always start with a percent sign (%):

%1, %2, … — refer to a job by its number.
%% or %+ — the current job (the most recently backgrounded or suspended job, marked with +).
%- — the previous job (marked with -).
%string — the job whose command starts with string. For example, %ping matches a job started with ping google.com.
%?string — the job whose command contains string anywhere. For example, %?google also matches ping google.com.

Here is a practical example. Start two background jobs:

Terminal
sleep 300 &
ping -c 100 google.com > /dev/null &

Now list them:

Terminal
jobs

output

[1]- Running sleep 300 &
[2]+ Running ping -c 100 google.com > /dev/null &

You can bring the sleep job to the foreground by its number:

Terminal
fg %1

Or by the command prefix:

Terminal
fg %sleep

Both are equivalent and bring job [1] to the foreground.

Options

The jobs command accepts the following options:

-l — List jobs with their process IDs in addition to the normal output.
-p — Print only the PID of each job’s process group leader. This is useful for scripting.
-r — List only running jobs.
-s — List only stopped (suspended) jobs.
-n — Show only jobs whose status has changed since the last notification.

To show only running jobs:

Terminal
jobs -r

To get just the PIDs of all jobs:

Terminal
jobs -p

output

14205
14230

Using `jobs` in Interactive Shells

The jobs command is primarily useful in an interactive shell where job control is enabled. In a regular shell script, job control is usually off, so jobs may return no output even when background processes exist.

If you need to manage background work in a script, track process IDs with $! and use wait with the PID instead of a job spec:

sh
# Start a background task
long_task &
task_pid=$!

# Poll until it finishes
while kill -0 "$task_pid" 2>/dev/null; do
 echo "Task is still running..."
 sleep 5
done

echo "Task complete."

To wait for several background tasks, store their PIDs and pass them to wait:

sh
task_a &
pid_a=$!

task_b &
pid_b=$!

task_c &
pid_c=$!

wait "$pid_a" "$pid_b" "$pid_c"
echo "All tasks complete."

In an interactive shell, you can still wait for a job by its job spec:

Terminal
wait %1

Quick Reference

Command	Description
`jobs`	List all background and stopped jobs
`jobs -l`	List jobs with PIDs
`jobs -p`	Print only PIDs
`jobs -r`	List only running jobs
`jobs -s`	List only stopped jobs
`fg %1`	Bring job 1 to the foreground
`bg %1`	Resume job 1 in the background
`kill %1`	Terminate job 1
`disown %1`	Remove job 1 from the job table
`wait`	Wait for all background jobs to finish

FAQ

What is the difference between jobs and ps?
jobs shows only the processes started from the current shell session. The ps command lists all processes running on the system, regardless of which shell started them.

Why does jobs show nothing even though processes are running?
jobs only tracks processes started from the current shell. If you started a process in a different terminal or via a system service, it will not appear in jobs. Use ps aux to find it instead.

How do I stop a background job?
Use kill %N where N is the job number. For example, kill %1 sends SIGTERM to job 1. If the job does not stop, use kill -9 %1 to force-terminate it.

What do the + and - signs mean in jobs output?
The + marks the current job, the one that fg and bg will act on by default. The - marks the previous job. When the current job finishes, the previous job becomes the new current job.

How do I keep a background job running after closing the terminal?
Use nohup before the command, or disown after backgrounding it. For long-running interactive sessions, consider Screen or Tmux .

Conclusion

The jobs command lists all background and suspended processes in the current shell session. Use it together with fg, bg, and kill to control jobs interactively. For a broader guide on running and managing background processes, see How to Run Linux Commands in the Background .

git diff Command: Show Changes Between Commits

hello@linuxize.com (Linuxize) — Tue, 17 Mar 2026 07:30:00 +0100

Every change in a Git repository can be inspected before it is staged or committed. The git diff command shows the exact lines that were added, removed, or modified — between your working directory, the staging area, and any two commits or branches.

This guide explains how to use git diff to review changes at every stage of your workflow.

Basic Usage

Run git diff with no arguments to see all unstaged changes — differences between your working directory and the staging area:

Terminal
git diff

output

diff --git a/app.py b/app.py
index 3b1a2c4..7d8e9f0 100644
--- a/app.py
+++ b/app.py
@@ -10,6 +10,7 @@ def main():
print("Starting app")
+ print("Debug mode enabled")
run()

Lines starting with + were added. Lines starting with - were removed. Lines with no prefix are context — unchanged lines shown for reference.

If nothing is shown, all changes are already staged or there are no changes at all.

Staged Changes

To see changes that are staged and ready to commit, use --staged (or its synonym --cached):

Terminal
git diff --staged

This compares the staging area against the last commit. It shows exactly what will go into the next commit.

Terminal
git diff --cached

Both flags are equivalent. Use whichever you prefer.

Comparing Commits

Pass two commit hashes to compare them directly:

Terminal
git diff abc1234 def5678

To compare a commit against its parent, use the ^ suffix:

Terminal
git diff HEAD^ HEAD

HEAD refers to the latest commit. HEAD^ is one commit before it. You can go further back with HEAD~2, HEAD~3, and so on.

To see what changed in the last commit:

Terminal
git diff HEAD^ HEAD

Comparing Branches

Use the same syntax to compare two branches:

Terminal
git diff main feature-branch

This shows all differences between the tips of the two branches.

To see only what a branch adds relative to main — excluding changes already in main — use the three-dot notation:

Terminal
git diff main...feature-branch

The three-dot form finds the common ancestor of both branches and diffs from there to the tip of feature-branch. This is the most useful form for reviewing a pull request before merging.

Comparing a Specific File

To limit the diff to a single file, pass the path after --:

Terminal
git diff -- path/to/file.py

The -- separator tells Git the argument is a file path, not a branch name. Combine it with commit references to compare a file across commits:

Terminal
git diff HEAD~3 HEAD -- path/to/file.py

Summary with –stat

To see a summary of which files changed and how many lines were added or removed — without the full diff — use --stat:

Terminal
git diff --stat

output

 app.py | 3 +++
config.yml | 1 -
2 files changed, 3 insertions(+), 1 deletion(-)

This is useful for a quick overview before reviewing the full diff.

Word-Level Diff

By default, git diff highlights changed lines. To highlight only the changed words within a line, use --word-diff:

Terminal
git diff --word-diff

output

@@ -10,6 +10,6 @@ def main():
print("[-Starting-]{+Running+} app")

Removed words appear in [-brackets-] and added words in {+braces+}. This is especially useful for prose or configuration files where only part of a line changes.

Ignoring Whitespace

To ignore whitespace-only changes, use -w:

Terminal
git diff -w

Use -b to ignore changes in the amount of whitespace (but not all whitespace):

Terminal
git diff -b

These options are useful when reviewing files that have been reformatted or indented differently.

Quick Reference

For a printable quick reference, see the Git cheatsheet .

Command	Description
`git diff`	Unstaged changes in working directory
`git diff --staged`	Staged changes ready to commit
`git diff HEAD^ HEAD`	Changes in the last commit
`git diff abc1234 def5678`	Diff between two commits
`git diff main feature`	Diff between two branches
`git diff main...feature`	Changes in feature since branching from main
`git diff -- file`	Diff for a specific file
`git diff --stat`	Summary of changed files and line counts
`git diff --word-diff`	Word-level diff
`git diff -w`	Ignore all whitespace changes

FAQ

What is the difference between git diff and git diff --staged?
git diff shows changes in your working directory that have not been staged yet. git diff --staged shows changes that have been staged with git add and are ready to commit. To see all changes — staged and unstaged combined — use git diff HEAD.

What does the three-dot ... notation do in git diff?
git diff main...feature finds the common ancestor of main and feature and shows the diff from that ancestor to the tip of feature. This isolates the changes that the feature branch introduces, ignoring any new commits in main since the branch was created. In git diff, the two-dot form is just another way to name the two revision endpoints, so git diff main..feature is effectively the same as git diff main feature.

How do I see only the file names that changed, not the full diff?
Use git diff --name-only. To include the change status (modified, added, deleted), use git diff --name-status instead.

How do I compare my local branch against the remote?
Fetch first to update remote-tracking refs, then diff against the updated remote branch. To see what your current branch changes relative to origin/main, use git fetch && git diff origin/main...HEAD. If you want a direct endpoint comparison instead, use git fetch && git diff origin/main HEAD. If you want a clearer overview of what git fetch changes compared with git pull, see our guide on git fetch vs git pull .

Can I use git diff to generate a patch file?
Yes. Redirect the output to a file: git diff > changes.patch. Apply it on another machine with git apply changes.patch.

Conclusion

git diff is the primary tool for reviewing changes before you stage or commit them. Use git diff for unstaged work, git diff --staged before committing, and git diff main...feature to review a branch before merging. For a history of committed changes, see the git log guide , and for syncing remote changes safely, see git fetch vs git pull .

git log Command: View Commit History

hello@linuxize.com (Linuxize) — Mon, 16 Mar 2026 08:50:00 +0100

Every commit in a Git repository is recorded in the project history. The git log command lets you browse that history — showing who made each change, when, and why. It is one of the most frequently used Git commands and one of the most flexible.

This guide explains how to use git log to view, filter, and format commit history.

Basic Usage

Run git log with no arguments to see the full commit history of the current branch, starting from the most recent commit:

Terminal
git log

output

commit a3f1d2e4b5c6789012345678901234567890abcd
Author: Jane Smith <jane@example.com>
Date: Mon Mar 10 14:22:31 2026 +0100
Add user authentication module
commit 7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c
Author: John Doe <john@example.com>
Date: Fri Mar 7 09:15:04 2026 +0100
Fix login form validation

Each entry shows the full commit hash, author name and email, date, and commit message. Press q to exit the log view.

Compact Output with –oneline

The default output is verbose. Use --oneline to show one commit per line — the abbreviated hash and the subject line only:

Terminal
git log --oneline

output

a3f1d2e Add user authentication module
7b8c9d0 Fix login form validation
c1d2e3f Update README with setup instructions

This is useful for a quick overview of recent work.

Limiting the Number of Commits

To show only the last N commits, pass -n followed by the number:

Terminal
git log -n 5

You can also write it without the space:

Terminal
git log -5

Filtering by Author

Use --author to show only commits by a specific person. The value is matched as a substring against the author name or email:

Terminal
git log --author="Jane"

To match multiple authors, pass --author more than once:

Terminal
git log --author="Jane" --author="John"

Filtering by Date

Use --since and --until to limit commits to a date range. These options accept a variety of formats:

Terminal
git log --since="2 weeks ago"
git log --since="2026-03-01" --until="2026-03-15"

Searching Commit Messages

Use --grep to find commits whose message contains a keyword:

Terminal
git log --grep="authentication"

The search is case-sensitive by default. Add -i to make it case-insensitive:

Terminal
git log -i --grep="fix"

Viewing Changed Files

To see a summary of which files were changed in each commit without the full diff, use --stat:

Terminal
git log --stat

output

commit a3f1d2e4b5c6789012345678901234567890abcd
Author: Jane Smith <jane@example.com>
Date: Mon Mar 10 14:22:31 2026 +0100
Add user authentication module
src/auth.py | 84 ++++++++++++++++++++++++++++++++++++++++++++++++
src/models.py | 12 +++++++
tests/test_auth.py | 45 +++++++++++++++++
3 files changed, 141 insertions(+)

To see the full diff for each commit, use -p (or --patch):

Terminal
git log -p

Combine with -n to limit the output:

Terminal
git log -p -3

Viewing History of a Specific File

To see only the commits that touched a particular file, pass the file path after --:

Terminal
git log -- path/to/file.py

The -- separator tells Git that what follows is a path, not a branch name. Add -p to see the exact changes made to that file in each commit:

Terminal
git log -p -- path/to/file.py

Branch and Graph View

To visualize how branches diverge and merge, use --graph:

Terminal
git log --oneline --graph

output

* a3f1d2e Add user authentication module
* 7b8c9d0 Fix login form validation
| * 3e4f5a6 WIP: dark mode toggle
|/
* c1d2e3f Update README with setup instructions

Add --all to include all branches, not just the current one:

Terminal
git log --oneline --graph --all

This gives a full picture of the repository’s branch and merge history.

Comparing Two Branches

To see commits that are in one branch but not another, use the .. notation:

Terminal
git log main..feature-branch

This shows commits reachable from feature-branch that are not yet in main — useful for reviewing what a branch adds before merging.

Custom Output Format

Use --pretty=format: to define exactly what each log line shows. Some useful placeholders:

%h — abbreviated commit hash
%an — author name
%ar — author date, relative
%s — subject (first line of commit message)

For example:

Terminal
git log --pretty=format:"%h %an %ar %s"

output

a3f1d2e Jane Smith 5 days ago Add user authentication module
7b8c9d0 John Doe 8 days ago Fix login form validation

Excluding Merge Commits

To hide merge commits and see only substantive changes, use --no-merges:

Terminal
git log --no-merges --oneline

Quick Reference

For a printable quick reference, see the Git cheatsheet .

Command	Description
`git log`	Full commit history
`git log --oneline`	One line per commit
`git log -n 10`	Last 10 commits
`git log --author="Name"`	Filter by author
`git log --since="2 weeks ago"`	Filter by date
`git log --grep="keyword"`	Search commit messages
`git log --stat`	Show changed files per commit
`git log -p`	Show full diff per commit
`git log -- file`	History of a specific file
`git log --oneline --graph`	Visual branch graph
`git log --oneline --graph --all`	Graph of all branches
`git log main..feature`	Commits in feature not in main
`git log --no-merges`	Exclude merge commits
`git log --pretty=format:"%h %an %s"`	Custom output format

FAQ

How do I search for a commit that changed a specific piece of code?
Use -S (the “pickaxe” option) to find commits that added or removed a specific string: git log -S "function_name". For regex patterns, use -G "pattern" instead.

How do I see who last changed each line of a file?
Use git blame path/to/file. It annotates every line with the commit hash, author, and date of the last change.

What is the difference between git log and git reflog?
git log shows the commit history of the current branch. git reflog shows every movement of HEAD — including commits that were reset, rebased, or are no longer reachable from any branch. It is the main recovery tool if you lose commits accidentally.

How do I find a commit by its message?
Use git log --grep="search term". For case-insensitive search add -i. If you need to search the full commit message body as well as the subject, add --all-match only when combining multiple --grep patterns, or use git log --grep="search term" --format=full to inspect matching commits more closely. Use -E only when you need extended regular expressions in the grep pattern.

How do I show a single commit in full detail?
Use git show <hash>. It prints the commit metadata and the full diff. To show just the files changed without the diff, use git show --stat <hash>.

Conclusion

git log is the primary tool for understanding a project’s history. Start with --oneline for a quick overview, use --graph --all to visualize branches, and combine --author, --since, and --grep to zero in on specific changes. For undoing commits found in the log, see the git revert guide or how to undo the last commit . If you need to move one specific change onto another branch, see git cherry-pick .

git stash: Save and Restore Uncommitted Changes

hello@linuxize.com (Linuxize) — Sun, 15 Mar 2026 09:30:00 +0100

When you are in the middle of a feature and need to switch branches to fix a bug or review someone else’s work, you have a problem: your changes are not ready to commit, but you cannot switch branches with a dirty working tree. git stash solves this by saving your uncommitted changes to a temporary stack so you can restore them later.

This guide explains how to use git stash to save, list, apply, and delete stashed changes.

Basic Usage

The simplest form saves all modifications to tracked files and reverts the working tree to match the last commit:

Terminal
git stash

output

Saved working directory and index state WIP on main: abc1234 Add login page

Your working tree is now clean. You can switch branches, pull updates, or apply a hotfix. When you are ready to return to your work, restore the stash.

By default, git stash saves both staged and unstaged changes to tracked files. It does not save untracked or ignored files unless you explicitly include them (see below).

Stashing with a Message

A plain git stash entry shows the branch and last commit message, which becomes hard to read when you have multiple stashes. Use -m to attach a descriptive label:

Terminal
git stash push -m "WIP: user authentication form"

This makes it easy to identify the right stash when you list them later.

Listing Stashes

To see all saved stashes, run:

Terminal
git stash list

output

stash@{0}: On main: WIP: user authentication form
stash@{1}: WIP on main: abc1234 Add login page

Stashes are indexed from newest (stash@{0}) to oldest. The index is used when you want to apply or drop a specific stash.

To inspect the contents of a stash before applying it, use git stash show:

Terminal
git stash show stash@{0}

Add -p to see the full diff:

Terminal
git stash show -p stash@{0}

Applying Stashes

There are two ways to restore a stash.

git stash pop applies the most recent stash and removes it from the stash list:

Terminal
git stash pop

git stash apply applies a stash but keeps it in the list so you can apply it again or to another branch:

Terminal
git stash apply

To apply a specific stash by index, pass the stash reference:

Terminal
git stash apply stash@{1}

If applying the stash causes conflicts, resolve them the same way you would resolve a merge conflict, then stage the resolved files.

Stashing Untracked and Ignored Files

By default, git stash only saves changes to files that Git already tracks. New files you have not yet staged are left behind.

Use -u (or --include-untracked) to include untracked files:

Terminal
git stash -u

To include both untracked and ignored files — for example, generated build artifacts or local config files — use -a (or --all):

Terminal
git stash -a

Partial Stash

If you only want to stash some of your changes and leave others in the working tree, use the -p (or --patch) flag to interactively select which hunks to stash:

Terminal
git stash -p

Git will step through each changed hunk and ask whether to stash it. Type y to stash the hunk, n to leave it, or ? for a full list of options.

Creating a Branch from a Stash

If you have been working on a stash for a while and the branch has diverged enough to cause conflicts on apply, you can create a new branch from the stash directly:

Terminal
git stash branch new-branch-name

This creates a new branch, checks it out at the commit where the stash was originally made, applies the stash, and drops it from the list if it applied cleanly. It is the safest way to resume stashed work that has grown out of sync with the base branch.

Deleting Stashes

To remove a specific stash once you no longer need it:

Terminal
git stash drop stash@{0}

To delete all stashes at once:

Terminal
git stash clear

Use clear with care — there is no undo.

Quick Reference

For a printable quick reference, see the Git cheatsheet .

Command	Description
`git stash`	Stash staged and unstaged changes
`git stash push -m "message"`	Stash with a descriptive label
`git stash -u`	Include untracked files
`git stash -a`	Include untracked and ignored files
`git stash -p`	Interactively choose what to stash
`git stash list`	List all stashes
`git stash show stash@{0}`	Show changed files in a stash
`git stash show -p stash@{0}`	Show full diff of a stash
`git stash pop`	Apply and remove the latest stash
`git stash apply stash@{0}`	Apply a stash without removing it
`git stash branch branch-name`	Create a branch from the latest stash
`git stash drop stash@{0}`	Delete a specific stash
`git stash clear`	Delete all stashes

FAQ

What is the difference between git stash pop and git stash apply?
pop applies the stash and removes it from the stash list. apply restores the changes but keeps the stash entry so you can apply it again — for example, to multiple branches. Use pop for normal day-to-day use and apply when you need to reuse the stash.

Does git stash save untracked files?
No, not by default. Run git stash -u to include untracked files, or git stash -a to also include files that match your .gitignore patterns.

Can I stash only specific files?
Yes. In modern Git, you can pass pathspecs to git stash push, for example: git stash push -m "label" -- path/to/file. If you need a more portable workflow, use git stash -p to interactively select which hunks to stash.

How do I recover a dropped stash?
If you accidentally ran git stash drop or git stash clear, the underlying commit may still exist for a while. Run git fsck --no-reflogs | grep "dangling commit" to list unreachable commits, then git show <hash> to inspect them. If you find the right stash commit, you can recreate it with git stash store -m "recovered stash" <hash> and then apply it normally.

Can I apply a stash to a different branch?
Yes. Switch to the target branch with git switch branch-name, then run git stash apply stash@{0}. If there are no conflicts, the changes are applied cleanly. If the branches have diverged significantly, consider git stash branch to create a fresh branch from the stash instead.

Conclusion

git stash is the cleanest way to set aside incomplete work without creating a throwaway commit. Use git stash push -m to keep your stash list readable, prefer pop for one-time restores, and use git stash branch when applying becomes messy. For a broader overview of Git workflows, see the Git cheatsheet or the git revert guide .

How to Create a systemd Service File in Linux

hello@linuxize.com (Linuxize) — Tue, 10 Mar 2026 09:00:00 +0100

systemd is the init system used by most modern Linux distributions, including Ubuntu, Debian, Fedora, and RHEL. It manages system processes, handles service dependencies, and starts services automatically at boot.

A systemd service file — also called a unit file — tells systemd how to start, stop, and manage a process. This guide explains how to create a systemd service file, install it on the system, and manage it with systemctl .

Quick Reference

Task	Command
Create a service file	`sudo nano /etc/systemd/system/myservice.service`
Reload systemd after changes	`sudo systemctl daemon-reload`
Enable service at boot	`sudo systemctl enable myservice`
Start the service	`sudo systemctl start myservice`
Enable and start at once	`sudo systemctl enable --now myservice`
Check service status	`sudo systemctl status myservice`
Stop the service	`sudo systemctl stop myservice`
Disable at boot	`sudo systemctl disable myservice`
View service logs	`sudo journalctl -u myservice`
View live logs	`sudo journalctl -fu myservice`

Understanding systemd Unit Files

Service files are plain text files with an .service extension. They are stored in one of two locations:

/etc/systemd/system/ — system-wide services, managed by root. Files here take priority over package-installed units.
/usr/lib/systemd/system/ or /lib/systemd/system/ — units installed by packages, depending on the distribution. Do not edit these directly; copy them to /etc/systemd/system/ to override.

A service file is divided into three sections:

[Unit] — describes the service and declares dependencies.
[Service] — defines how to start, stop, and run the process.
[Install] — controls how and when the service is enabled.

Creating a Simple Service File

In this example, we will create a service that runs a custom Bash script. First, create the script you want to run:

Terminal
sudo nano /usr/local/bin/myapp.sh

Add the following content to the script:

/usr/local/bin/myapp.shsh
#!/bin/bash
echo "myapp started" >> /var/log/myapp.log
# your application logic here
exec /usr/local/bin/myapp

Make the script executable:

Terminal
sudo chmod +x /usr/local/bin/myapp.sh

Now create the service file:

Terminal
sudo nano /etc/systemd/system/myapp.service

Add the following content:

/etc/systemd/system/myapp.serviceini
[Unit]
Description=My Custom Application
After=network.target

[Service]
Type=simple
ExecStart=/usr/local/bin/myapp.sh
Restart=on-failure
RestartSec=5

[Install]
WantedBy=multi-user.target

After saving the file, reload systemd to pick up the new unit:

Terminal
sudo systemctl daemon-reload

Enable and start the service:

Terminal
sudo systemctl enable --now myapp

Check that it is running:

Terminal
sudo systemctl status myapp

output

● myapp.service - My Custom Application
Loaded: loaded (/etc/systemd/system/myapp.service; enabled; vendor preset: enabled)
Active: active (running) since Mon 2026-03-10 09:00:00 CET; 2s ago
Main PID: 1234 (myapp.sh)
Tasks: 1 (limit: 4915)
CGroup: /system.slice/myapp.service
└─1234 /bin/bash /usr/local/bin/myapp.sh

Unit File Sections Explained

[Unit] Section

The [Unit] section contains metadata and dependency declarations.

Common directives:

Description= — a short human-readable name shown in systemctl status output.
After= — start this service only after the listed units are active. Does not create a dependency; use Requires= for hard dependencies.
Requires= — this service requires the listed units. If they fail, this service fails too.
Wants= — like Requires=, but the service still starts even if the listed units fail.
Documentation= — a URL or man page reference for the service.

[Service] Section

The [Service] section defines the process and how systemd manages it.

Common directives:

Type= — the startup type. See Service Types below.
ExecStart= — the command to run when the service starts. Must be an absolute path.
ExecStop= — the command to run when the service stops. If omitted, systemd sends SIGTERM.
ExecReload= — the command to reload the service configuration without restarting.
Restart= — when to restart automatically. See Restart Policies below.
RestartSec= — how many seconds to wait before restarting. Default is 100ms.
User= — run the process as this user instead of root.
Group= — run the process as this group.
WorkingDirectory= — set the working directory for the process.
Environment= — set environment variables: Environment="KEY=value".
EnvironmentFile= — read environment variables from a file.

[Install] Section

The [Install] section controls how the service is enabled.

WantedBy=multi-user.target — the most common value. Enables the service for normal multi-user (non-graphical) boot.
WantedBy=graphical.target — use this if the service requires a graphical environment.

Service Types

The Type= directive tells systemd how the process behaves at startup.

Type	Description
`simple`	Default. The process started by `ExecStart` is the main process.
`forking`	The process forks and the parent exits. systemd tracks the child. Use with traditional daemons.
`oneshot`	The process runs once and exits. systemd waits for it to finish before marking the service as active.
`notify`	Like `simple`, but the process notifies systemd when it is ready using `sd_notify()`.
`idle`	Like `simple`, but the process is delayed until all active jobs finish.

For most custom scripts and applications, Type=simple is the right choice.

Restart Policies

The Restart= directive controls when systemd automatically restarts the service.

Value	Restarts when
`no`	Never (default).
`always`	The process exits for any reason.
`on-failure`	The process exits with a non-zero code, is killed by a signal, or times out.
`on-abnormal`	Killed by a signal or times out, but not clean exit.
`on-success`	Only if the process exits cleanly (exit code 0).

For long-running services, Restart=on-failure is the most common choice. Use Restart=always for services that must stay running under all circumstances.

Running a Service as a Non-Root User

Running services as root is a security risk. Use the User= and Group= directives to run the service as a dedicated user:

/etc/systemd/system/myapp.serviceini
[Unit]
Description=My Custom Application
After=network.target

[Service]
Type=simple
User=myappuser
Group=myappuser
ExecStart=/usr/local/bin/myapp
Restart=on-failure
WorkingDirectory=/opt/myapp
Environment="NODE_ENV=production"

[Install]
WantedBy=multi-user.target

Create the system user before enabling the service:

Terminal
sudo useradd -r -s /usr/sbin/nologin myappuser

Troubleshooting

Service fails to start — “Failed to start myapp.service”
Check the logs with journalctl : sudo journalctl -u myapp --since "5 minutes ago". The output shows the exact error message from the process.

Changes to the service file have no effect
You must run sudo systemctl daemon-reload after every edit to the unit file. systemd reads the file at reload time, not at start time.

“ExecStart= must be an absolute path”
The ExecStart= value must start with /. Use the full path to the binary — for example /usr/bin/python3 not python3. Use which python3 to find the absolute path.

Service starts but immediately exits
The process may be crashing on startup. Check sudo journalctl -u myapp -n 50 for error output. If Type=simple, make sure ExecStart= runs the process in the foreground — not a script that launches a background process and exits.

Service does not start at boot despite being enabled
Confirm the [Install] section has a valid WantedBy= target and that systemctl enable was run after daemon-reload. Check with systemctl is-enabled myapp.

FAQ

Where should I put my service file?
Put custom service files in /etc/systemd/system/. Files there take priority over package-installed units in /usr/lib/systemd/system/ and persist across package upgrades.

What is the difference between enable and start?
systemctl start starts the service immediately for the current session only. systemctl enable creates a symlink so the service starts automatically at boot. To do both at once, use systemctl enable --now myservice.

How do I view logs for my service?
Use sudo journalctl -u myservice to see all logs. Add -f to follow live output, or --since "1 hour ago" to limit the time range. See the journalctl guide for full usage.

Can I run a service as a regular user without root?
Yes, using user-level systemd units stored in ~/.config/systemd/user/. Manage them with systemctl --user enable myservice. They run when the user logs in and stop when they log out (unless lingering is enabled with loginctl enable-linger username).

How do I reload a service after changing its configuration?
If the service supports it, use sudo systemctl reload myservice — this sends SIGHUP or runs ExecReload= without restarting the process. Otherwise, use sudo systemctl restart myservice.

Conclusion

Creating a systemd service file gives you full control over how and when your process runs — including automatic restarts, boot integration, and user isolation. Once the file is in place, use systemctl enable --now to activate it and journalctl -u to monitor it. For scheduling tasks that run once at a set time rather than continuously, consider cron jobs as an alternative.

ss Command in Linux: Display Socket Statistics

hello@linuxize.com (Linuxize) — Thu, 05 Mar 2026 09:00:00 +0100

ss is a command-line utility for displaying socket statistics on Linux. It is the modern replacement for the deprecated netstat command and is faster, more detailed, and available by default on all current Linux distributions.

This guide explains how to use ss to list open sockets, filter results by protocol and port, and identify which process is using a given connection.

ss Syntax

txt
ss [OPTIONS] [FILTER]

When invoked without options, ss displays all non-listening sockets that have an established connection.

List All Sockets

To list all sockets regardless of state, use the -a option:

Terminal
ss -a

The output includes columns for the socket type (Netid), state, receive and send queue sizes, local address and port, and peer address and port:

output

Netid State Recv-Q Send-Q Local Address:Port Peer Address:Port
tcp ESTAB 0 0 192.168.1.10:ssh 192.168.1.5:52710
tcp LISTEN 0 128 0.0.0.0:http 0.0.0.0:*
udp UNCONN 0 0 0.0.0.0:bootpc 0.0.0.0:*

Filter by Socket Type

TCP Sockets (`-t`)

To list only TCP sockets:

Terminal
ss -t

To include listening TCP sockets as well, combine with -a:

Terminal
ss -ta

UDP Sockets (`-u`)

To list only UDP sockets:

Terminal
ss -ua

Unix Domain Sockets (`-x`)

To list Unix domain sockets used for inter-process communication:

Terminal
ss -xa

Show Listening Sockets

The -l option shows only sockets that are in the listening state:

Terminal
ss -tl

The most commonly used combination is -tulpn, which shows all TCP and UDP listening sockets with process names and numeric addresses:

Terminal
ss -tulpn

output

Netid State Recv-Q Send-Q Local Address:Port Peer Address:Port Process
tcp LISTEN 0 128 0.0.0.0:22 0.0.0.0:* users:(("sshd",pid=1234,fd=3))
tcp LISTEN 0 511 0.0.0.0:80 0.0.0.0:* users:(("nginx",pid=5678,fd=6))
udp UNCONN 0 0 0.0.0.0:68 0.0.0.0:* users:(("dhclient",pid=910,fd=6))

Each option in the combination does the following:

-t — show TCP sockets
-u — show UDP sockets
-l — show listening sockets only
-p — show the process name and PID
-n — show numeric addresses and ports instead of resolving hostnames and service names

Show Process Information

The -p option adds the process name and PID to the output. This requires root privileges to see processes owned by other users:

Terminal
sudo ss -tp

output

State Recv-Q Send-Q Local Address:Port Peer Address:Port Process
ESTAB 0 0 192.168.1.10:ssh 192.168.1.5:52710 users:(("sshd",pid=2341,fd=5))

Use Numeric Output

By default, ss resolves port numbers to service names (for example, port 22 becomes ssh). The -n option disables this and shows raw port numbers:

Terminal
ss -tn

This is useful when you need to match exact port numbers in scripts or when name resolution is slow.

Filter by Port

To find which process is using a specific port, filter by destination or source port. For example, to list all sockets using port 80:

Terminal
ss -tulpn | grep :80

You can also use the built-in filter syntax:

Terminal
ss -tnp 'dport = :443'

To filter by source port:

Terminal
ss -tnp 'sport = :22'

Filter by Connection State

ss supports filtering by connection state. Common states include ESTABLISHED, LISTEN, TIME-WAIT, and CLOSE-WAIT.

To show only established TCP connections:

Terminal
ss -tn state ESTABLISHED

To show only sockets in the TIME-WAIT state:

Terminal
ss -tn state TIME-WAIT

Filter by Address

To show sockets connected to or from a specific IP address:

Terminal
ss -tn dst 192.168.1.5

To filter by source address:

Terminal
ss -tn src 192.168.1.10

You can combine address and port filters:

Terminal
ss -tnp dst 192.168.1.5 dport = :22

Show IPv4 or IPv6 Only

To restrict output to IPv4 sockets, use -4:

Terminal
ss -tln -4

To show only IPv6 sockets, use -6:

Terminal
ss -tln -6

Show Summary Statistics

The -s option prints a summary of socket counts by type and state without listing individual sockets:

Terminal
ss -s

output

Total: 312
TCP: 14 (estab 4, closed 3, orphaned 0, timewait 3)
Transport Total IP IPv6
RAW 1 0 1
UDP 6 4 2
TCP 11 7 4
INET 18 11 7
FRAG 0 0 0

This is useful for a quick overview of the network state on a busy server.

Practical Examples

The following examples cover common diagnostics you will use together with tools like ip , ifconfig , and check listening ports .

Find which process is listening on port 8080:

Terminal
sudo ss -tlpn sport = :8080

List all established SSH connections to your server:

Terminal
ss -tn state ESTABLISHED '( dport = :22 or sport = :22 )'

Show all connections to a remote host:

Terminal
ss -tn dst 203.0.113.10

Count established TCP connections:

Terminal
ss -tn state ESTABLISHED | tail -n +2 | wc -l

Quick Reference

For a printable quick reference, see the ss cheatsheet .

Command	Description
`ss -a`	List all sockets
`ss -t`	List TCP sockets
`ss -u`	List UDP sockets
`ss -x`	List Unix domain sockets
`ss -l`	Show listening sockets only
`ss -tulpn`	Listening TCP/UDP with process and numeric output
`ss -tp`	TCP sockets with process names
`ss -tn`	TCP sockets with numeric addresses
`ss -s`	Show socket summary statistics
`ss -tn state ESTABLISHED`	Show established TCP connections
`ss -tnp dport = :80`	Filter by destination port
`ss -tn dst 192.168.1.5`	Filter by remote address
`ss -4`	IPv4 sockets only
`ss -6`	IPv6 sockets only

Troubleshooting

ss -p does not show process names
Process information for sockets owned by other users requires elevated privileges. Use sudo ss -tp or sudo ss -tulpn.

Filters return no results
Use quoted filter expressions such as ss -tn 'dport = :443', and verify whether you should filter by sport or dport.

Service names hide numeric ports
If output shows service names (ssh, http) instead of port numbers, add -n to keep numeric ports and avoid lookup ambiguity.

Output is too broad on busy servers
Start with protocol and state filters (-t, -u, state ESTABLISHED) and then add address or port filters to narrow results.

You need command-level context, not only sockets
Use ss with ps or pgrep when you need additional process detail.

FAQ

What is the difference between ss and netstat?
ss is the modern replacement for netstat. It reads directly from kernel socket structures, making it significantly faster on systems with many connections. netstat is part of the net-tools package, which is deprecated and not installed by default on most current distributions.

Why do I need sudo with ss -p?
Without root privileges, ss can only show process information for sockets owned by your own user. To see process names and PIDs for all sockets, run ss with sudo.

What does Recv-Q and Send-Q mean in the output?
Recv-Q is the number of bytes received but not yet read by the application. Send-Q is the number of bytes sent but not yet acknowledged by the remote host. Non-zero values on a listening socket or consistently high values can indicate a performance issue.

How do I find which process is using a specific port?
Run sudo ss -tulpn | grep :<port>. The -p flag adds process information and -n keeps port numbers numeric so the grep match is reliable.

Conclusion

ss is the standard tool for inspecting socket connections on modern Linux systems. The -tulpn combination covers most day-to-day needs, while the state and address filters make it easy to narrow results on busy servers. For related network diagnostics, see the ip and ifconfig command guides, or check listening ports for a broader overview.

uniq Command in Linux: Remove and Count Duplicate Lines

hello@linuxize.com (Linuxize) — Wed, 04 Mar 2026 08:01:00 +0100

uniq is a command-line utility that filters adjacent duplicate lines from sorted input and writes the result to standard output. It is most commonly used together with sort to remove or count duplicates across an entire file.

This guide explains how to use the uniq command with practical examples.

uniq Command Syntax

The syntax for the uniq command is as follows:

txt
uniq [OPTIONS] [INPUT [OUTPUT]]

If no input file is specified, uniq reads from standard input. The optional OUTPUT argument redirects the result to a file instead of standard output.

Removing Duplicate Lines

By default, uniq removes adjacent duplicate lines, keeping one copy of each. Because it only compares consecutive lines, the input must be sorted first — otherwise only back-to-back duplicates are removed.

Given a file with repeated entries:

fruits.txttxt
apple
apple
banana
cherry
banana
cherry
cherry

Running uniq on the unsorted file removes only the back-to-back duplicates (apple apple and cherry cherry), but leaves the second banana and the second cherry intact:

Terminal
uniq fruits.txt

output

apple
banana
cherry
banana
cherry

To remove all duplicates regardless of position, sort the file first:

Terminal
sort fruits.txt | uniq

output

apple
banana
cherry

Counting Occurrences

To prefix each output line with the number of times it appears, use the -c (--count) option:

Terminal
sort fruits.txt | uniq -c

output

 2 apple
2 banana
3 cherry

The count and the line are separated by whitespace. This is especially useful for finding the most frequent lines in a file. To rank them from most to least common, pipe the output back to sort:

Terminal
sort fruits.txt | uniq -c | sort -rn

output

 3 cherry
2 banana
2 apple

Showing Only Duplicate Lines

To print only lines that appear more than once (one copy per group), use the -d (--repeated) option:

Terminal
sort fruits.txt | uniq -d

output

apple
banana
cherry

To print every instance of a repeated line rather than just one, use -D:

Terminal
sort fruits.txt | uniq -D

output

apple
apple
banana
banana
cherry
cherry
cherry

Showing Only Unique Lines

To print only lines that appear exactly once (no duplicates), use the -u (--unique) option:

Terminal
sort fruits.txt | uniq -u

If every line appears more than once, the output is empty. In the example above, all three fruits are duplicated, so nothing is printed.

Ignoring Case

By default, uniq comparisons are case-sensitive, so Apple and apple are treated as different lines. To compare lines case-insensitively, use the -i (--ignore-case) option:

Terminal
sort -f file.txt | uniq -i

Skipping Fields and Characters

uniq can be told to skip leading fields or characters before comparing lines.

To skip the first N whitespace-separated fields, use -f N (--skip-fields=N). This is useful when lines share a common prefix (such as a timestamp) that should not be part of the comparison:

log.txttxt
2026-01-01 ERROR disk full
2026-01-02 ERROR disk full
2026-01-03 WARNING low memory

Terminal
uniq -f 1 log.txt

output

2026-01-01 ERROR disk full
2026-01-03 WARNING low memory

The first field (the date) is skipped, so the two ERROR disk full lines are treated as duplicates.

To skip the first N characters instead of fields, use -s N (--skip-chars=N). To limit the comparison to the first N characters per line, use -w N (--check-chars=N).

Combining uniq with Other Commands

uniq works well in pipelines with grep , cut , sort , and wc .

To count the number of unique lines in a file:

Terminal
sort file.txt | uniq | wc -l

To find the top 10 most common words in a text file:

Terminal
grep -Eo '[[:alnum:]]+' file.txt | sort | uniq -c | sort -rn | head -10

To list unique IP addresses from an access log:

Terminal
awk '{print $1}' /var/log/nginx/access.log | sort | uniq

To find lines that appear in one file but not another (using -u against merged sorted files):

Terminal
sort file1.txt file2.txt | uniq -u

Quick Reference

Command	Description
`sort file.txt \| uniq`	Remove all duplicate lines
`sort file.txt \| uniq -c`	Count occurrences of each line
`sort file.txt \| uniq -c \| sort -rn`	Rank lines by frequency
`sort file.txt \| uniq -d`	Show only duplicate lines (one per group)
`sort file.txt \| uniq -D`	Show all instances of duplicate lines
`sort file.txt \| uniq -u`	Show only lines that appear exactly once
`uniq -i file.txt`	Compare lines case-insensitively
`uniq -f 2 file.txt`	Skip first 2 fields when comparing
`uniq -s 5 file.txt`	Skip first 5 characters when comparing
`uniq -w 10 file.txt`	Compare only first 10 characters

Troubleshooting

Duplicates are not removed uniq only removes adjacent duplicate lines. If the file is not sorted, non-consecutive duplicates are not detected. Always sort the input first: sort file.txt | uniq.

-c output has inconsistent spacing The count is right-aligned and padded with spaces. If you need to process the output further, use awk to normalize spacing while preserving the full line text: sort file.txt | uniq -c | awk '{count=$1; $1=\"\"; sub(/^ +/, \"\"); print count, $0}'.

Case variants are treated as different lines Use the -i option to compare case-insensitively. Also sort with -f so that case-insensitive duplicates are adjacent before uniq processes them: sort -f file.txt | uniq -i.

FAQ

What is the difference between sort -u and sort | uniq? Both produce the same output for simple deduplication. sort -u is slightly more efficient. sort | uniq is more flexible because uniq supports options like -c (count occurrences) and -d (show only duplicates) that sort -u does not.

Does uniq modify the input file? No. uniq reads from a file or standard input and writes to standard output. The original file is never modified. To save the result, use redirection: sort file.txt | uniq > deduped.txt.

How do I count unique lines in a file? Pipe through sort, uniq, and wc : sort file.txt | uniq | wc -l.

How do I find lines that only appear in one of two files? Merge both files and use uniq -u: sort file1.txt file2.txt | uniq -u. Lines shared by both files become duplicates in the merged sorted stream and are suppressed. Lines that exist in only one file remain unique and are printed.

Can uniq work on columns instead of full lines? Yes. Use -f N to skip the first N fields, -s N to skip the first N characters, or -w N to limit comparison to the first N characters. This lets you deduplicate based on a portion of each line.

Conclusion

The uniq command is a focused tool for filtering and counting duplicate lines. It is most effective when used after sort in a pipeline and pairs naturally with wc , grep , and head for text analysis tasks.

If you have any questions, feel free to leave a comment below.

top Command in Linux: Monitor Processes in Real Time

hello@linuxize.com (Linuxize) — Sat, 28 Feb 2026 14:10:00 +0100

top is a command-line utility that displays running processes and system resource usage in real time. It helps you inspect CPU usage, memory consumption, load averages, and process activity from a single interactive view.

This guide explains how to use top to monitor your system and quickly identify resource-heavy processes.

top Command Syntax

The syntax for the top command is as follows:

txt
top [OPTIONS]

Run top without arguments to open the interactive monitor:

Terminal
top

Understanding the top Output

The screen is split into two areas:

Summary area — system-wide metrics displayed in the header lines
Task area — per-process metrics listed below the header

A typical top header looks like this:

output

top - 14:32:01 up 3 days, 4:12, 2 users, load average: 0.45, 0.31, 0.28
Tasks: 213 total, 1 running, 212 sleeping, 0 stopped, 0 zombie
%Cpu(s): 3.2 us, 1.1 sy, 0.0 ni, 95.3 id, 0.2 wa, 0.0 hi, 0.1 si, 0.0 st
MiB Mem : 15886.7 total, 8231.4 free, 4912.5 used, 2742.8 buff/cache
MiB Swap: 2048.0 total, 2048.0 free, 0.0 used. 10374.2 avail Mem
PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND
1234 www-data 20 0 123456 45678 9012 S 4.3 0.3 0:42.31 nginx
987 mysql 20 0 987654 321098 12345 S 1.7 2.0 3:12.04 mysqld
5678 root 20 0 65432 5678 3456 S 0.0 0.0 0:00.12 sshd

CPU State Percentages

The %Cpu(s) line breaks CPU time into the following states:

us — time running user-space (non-kernel) processes
sy — time running kernel processes
ni — time running user processes with a manually adjusted nice value
id — idle time
wa — time waiting for I/O to complete
hi — time handling hardware interrupt requests
si — time handling software interrupt requests
st — time stolen from this virtual machine by the hypervisor (relevant on VMs)

High wa typically points to a disk or network I/O bottleneck. High us or sy points to CPU pressure. For memory details, see the free command. For load average context, see uptime .

Task Area Columns

Column	Description
`PID`	Process ID
`USER`	Owner of the process
`PR`	Scheduling priority assigned by the kernel
`NI`	Nice value (-20 = highest priority, 19 = lowest)
`VIRT`	Total virtual memory the process has mapped
`RES`	Resident set size — physical RAM currently in use
`SHR`	Shared memory with other processes
`S`	Process state: `R` running, `S` sleeping, `D` uninterruptible, `Z` zombie
`%CPU`	CPU usage since the last refresh
`%MEM`	Percentage of physical RAM in use
`TIME+`	Total CPU time consumed since the process started
`COMMAND`	Process name or full command line (toggle with `c`)

Common Interactive Controls

Press these keys while top is running:

Key	Action
`q`	Quit `top`
`h`	Show help
`k`	Kill a process by PID
`r`	Renice a process
`P`	Sort by CPU usage
`M`	Sort by memory usage
`N`	Sort by PID
`T`	Sort by running time
`1`	Toggle per-CPU core display
`c`	Toggle full command line
`u`	Filter by user

Refresh Interval and Batch Mode

To change the refresh interval (seconds), use -d:

Terminal
top -d 2

To run top in batch mode (non-interactive), use -b. This is useful for scripts and logs:

Terminal
top -b -n 1

To capture multiple snapshots:

Terminal
top -b -n 5 -d 1 > top-snapshot.txt

Filtering and Sorting

Start top with a user filter:

Terminal
top -u root

To monitor a specific process by PID, use -p:

Terminal
top -p 1234

Pass a comma-separated list to monitor multiple PIDs at once:

Terminal
top -p 1234,5678

To show individual threads instead of processes, use -H:

Terminal
top -H

Thread view is useful when profiling multi-threaded applications — each thread appears as a separate row with its own CPU and memory usage.

Inside top, use:

P to sort by CPU
M to sort by memory
u to show a specific user

For deeper process filtering, combine top with ps , pgrep , and kill .

Quick Reference

Command	Description
`top`	Start interactive process monitor
`top -d 2`	Refresh every 2 seconds
`top -u user`	Show only a specific user’s processes
`top -p PID`	Monitor a specific process by PID
`top -H`	Show individual threads
`top -b -n 1`	Single non-interactive snapshot
`top -b -n 5 -d 1`	Collect 5 snapshots at 1-second intervals

Troubleshooting

top is not installed Install the procps package (procps-ng on some distributions), then run top again.

Display refresh is too fast or too slow Use -d to tune the refresh rate, for example top -d 2.

Cannot kill or renice a process You may not own the process. Use sudo or run as a user with sufficient privileges.

FAQ

What is the difference between top and htop? top is available by default on most Linux systems and is lightweight. htop provides a richer interactive UI with color coding, mouse support, and easier navigation, but requires a separate installation.

What does load average mean? Load average shows the average number of runnable or uninterruptible tasks over the last 1, 5, and 15 minutes. A value above the number of CPU cores indicates the system is under pressure. See uptime for more detail.

What is a zombie process? A zombie process has finished execution but its entry remains in the process table because the parent process has not yet read its exit status. A small number of zombie processes is harmless; a growing count may indicate a bug in the parent application.

What do VIRT, RES, and SHR mean? VIRT is the total virtual address space the process has reserved. RES is the actual physical RAM currently in use. SHR is the portion of RES that is shared with other processes (for example, shared libraries). RES minus SHR gives the memory used exclusively by that process.

Can I save top output to a file? Yes. Use batch mode, for example: top -b -n 1 > top.txt.

Conclusion

The top command is one of the fastest ways to inspect process activity and system load in real time. Learn the interactive keys and sort options to diagnose performance issues quickly.

If you have any questions, feel free to leave a comment below.

sort Command in Linux: Sort Lines of Text

hello@linuxize.com (Linuxize) — Fri, 27 Feb 2026 09:30:00 +0100

sort is a command-line utility that sorts lines of text from files or standard input and writes the result to standard output. By default, sort arranges lines alphabetically, but it supports numeric sorting, reverse order, sorting by specific fields, and more.

This guide explains how to use the sort command with practical examples.

sort Command Syntax

The syntax for the sort command is as follows:

txt
sort [OPTIONS] [FILE]...

If no file is specified, sort reads from standard input. When multiple files are given, their contents are merged and sorted together.

Sorting Lines Alphabetically

By default, sort sorts lines in ascending alphabetical order. To sort a file, pass the file name as an argument:

Terminal
sort file.txt

For example, given a file with the following content:

file.txttxt
banana
apple
cherry
date

Running sort produces:

output

apple
banana
cherry
date

The original file is not modified. sort writes the sorted output to standard output. To save the result to a file, use output redirection:

Terminal
sort file.txt > sorted.txt

Sorting in Reverse Order

To sort in descending order, use the -r (--reverse) option:

Terminal
sort -r file.txt

output

date
cherry
banana
apple

Sorting Numerically

Alphabetical sorting does not work correctly for numbers. For example, 10 would sort before 2 because 1 comes before 2 alphabetically. Use the -n (--numeric-sort) option to sort numerically:

Terminal
sort -n numbers.txt

Given the file:

numbers.txttxt
10
2
30
5

The output is:

output

To sort numerically in reverse (largest first), combine -n and -r:

Terminal
sort -nr numbers.txt

output

Sorting by a Specific Column

By default, sort uses the entire line as the sort key. To sort by a specific field (column), use the -k (--key) option followed by the field number.

Fields are separated by whitespace by default. For example, to sort the following file by the second column (file size):

files.txttxt
report.pdf 2500
notes.txt 80
archive.tar 15000
readme.md 200

Terminal
sort -k2 -n files.txt

output

notes.txt 80
readme.md 200
report.pdf 2500
archive.tar 15000

To use a different field separator, specify it with the -t option. For example, to sort /etc/passwd by the third field (UID), using : as the separator:

Terminal
sort -t: -k3 -n /etc/passwd

Removing Duplicate Lines

To output only unique lines (removing adjacent duplicates after sorting), use the -u (--unique) option:

Terminal
sort -u file.txt

Given a file with repeated entries:

file.txttxt
apple
banana
apple
cherry
banana

output

apple
banana
cherry

This is equivalent to running sort file.txt | uniq. See our guide to the uniq command for more on how it handles duplicate lines.

Ignoring Case

By default, sort is case-sensitive. Uppercase letters sort before lowercase. To sort case-insensitively, use the -f (--ignore-case) option:

Terminal
sort -f file.txt

Checking if a File Is Already Sorted

To verify that a file is already sorted, use the -c (--check) option. It exits silently if the file is sorted, or prints an error and exits with a non-zero status if it is not:

Terminal
sort -c file.txt

output

sort: file.txt:2: disorder: banana

This is useful in scripts to validate input before processing.

Sorting Human-Readable Sizes

When working with output from commands like du, sizes are expressed in human-readable form such as 1K, 2M, or 3G. Standard numeric sort does not handle these correctly. Use the -h (--human-numeric-sort) option:

Terminal
du -sh /var/* | sort -h

output

4.0K /var/backups
16K /var/cache
1.2M /var/log
3.4G /var/lib

Combining sort with Other Commands

sort is commonly used in pipelines with other commands.

To count and rank the most frequent words in a file, combine grep , sort, and uniq :

Terminal
grep -Eo '[[:alnum:]_]+' file.txt | sort | uniq -c | sort -rn

To display the ten largest files in a directory, combine sort with head :

Terminal
du -sh /var/* | sort -rh | head -10

To extract and sort a specific field from a CSV using cut :

Terminal
cut -d',' -f2 data.csv | sort

Quick Reference

Option	Description
`sort file.txt`	Sort alphabetically (ascending)
`sort -r file.txt`	Sort in reverse order
`sort -n file.txt`	Sort numerically
`sort -nr file.txt`	Sort numerically, largest first
`sort -k2 file.txt`	Sort by the second field
`sort -t: -k3 file.txt`	Sort by field 3 using `:` as separator
`sort -u file.txt`	Sort and remove duplicate lines
`sort -f file.txt`	Sort case-insensitively
`sort -h file.txt`	Sort human-readable sizes (1K, 2M, 3G)
`sort -c file.txt`	Check if file is already sorted

For a printable quick reference, see the sort cheatsheet .

Troubleshooting

Numbers sort in wrong order
You are using alphabetical sort on numeric data. Add the -n option to sort numerically: sort -n file.txt.

Human-readable sizes sort incorrectly
Sizes like 1K, 2M, and 3G require -h (--human-numeric-sort). Standard -n only handles plain integers.

Uppercase entries appear before lowercase
sort is case-sensitive by default. Use -f to sort case-insensitively, or use LC_ALL=C sort to enforce byte-order sorting.

Output looks correct on screen but differs from file
Output redirection with > truncates the file before reading. Never redirect to the same file you are sorting: sort file.txt > file.txt will empty the file. Use a temporary file or the sponge utility from moreutils.

FAQ

Does sort modify the original file?
No. sort writes to standard output and never modifies the input file. Use sort file.txt > sorted.txt or sort -o file.txt file.txt to save the output.

How do I sort a file and save it in place?
Use the -o option: sort -o file.txt file.txt. Unlike > file.txt, the -o option is safe to use with the same input and output file.

How do I sort by the last column?
Use a negative field number with the -k option: sort -k-1 sorts by the last field. Alternatively, use awk to reorder columns before sorting.

What is the difference between sort -u and sort | uniq?
sort -u is slightly more efficient as it removes duplicates during sorting. sort | uniq is more flexible because uniq supports options like -c (count occurrences) and -d (show only duplicates).

How do I sort lines randomly?
Use sort -R (random sort) or the shuf command: shuf file.txt. Both produce a random permutation of the input lines.

Conclusion

The sort command is a versatile tool for ordering lines of text in files or command output. It is most powerful when combined with other commands like grep , cut , and head in pipelines.

If you have any questions, feel free to leave a comment below.

journalctl Command in Linux: Query and Filter System Logs

hello@linuxize.com (Linuxize) — Thu, 26 Feb 2026 10:00:00 +0100

journalctl is a command-line utility for querying and displaying logs collected by systemd-journald, the systemd logging daemon. It gives you structured access to all system logs — kernel messages, service output, authentication events, and more — from a single interface.

This guide explains how to use journalctl to view, filter, and manage system logs.

journalctl Command Syntax

The general syntax for the journalctl command is:

txt
journalctl [OPTIONS] [MATCHES]

When invoked without any options, journalctl displays all collected logs starting from the oldest entry, piped through a pager (usually less). Press q to exit.

Only the root user or members of the adm or systemd-journal groups can read system logs. Regular users can view their own user journal with the --user flag.

Quick Reference

Command	Description
`journalctl`	Show all logs
`journalctl -f`	Follow new log entries in real time
`journalctl -n 50`	Show last 50 lines
`journalctl -r`	Show logs newest first
`journalctl -e`	Jump to end of logs
`journalctl -u nginx`	Logs for a specific unit
`journalctl -u nginx -f`	Follow unit logs in real time
`journalctl -b`	Current boot logs
`journalctl -b -1`	Previous boot logs
`journalctl --list-boots`	List all boots
`journalctl -p err`	Errors and above
`journalctl -p warning --since "1 hour ago"`	Recent warnings
`journalctl -k`	Kernel messages
`journalctl --since "yesterday"`	Logs since yesterday
`journalctl --since "2026-02-01" --until "2026-02-02"`	Logs in a time window
`journalctl -g "failed"`	Search by pattern
`journalctl -o json-pretty`	JSON output
`journalctl --disk-usage`	Show journal disk usage
`journalctl --vacuum-size=500M`	Reduce journal to 500 MB

For a printable quick reference, see the journalctl cheatsheet .

Viewing System Logs

To view all system logs, run journalctl without any options:

Terminal
journalctl

To show the most recent entries first, use the -r flag:

Terminal
journalctl -r

To jump directly to the end of the log, use -e:

Terminal
journalctl -e

To show the last N lines (similar to tail ), use the -n flag:

Terminal
journalctl -n 50

To disable the pager and print directly to the terminal, use --no-pager:

Terminal
journalctl --no-pager

Following Logs in Real Time

To stream new log entries as they arrive (similar to tail -f), use the -f flag:

Terminal
journalctl -f

This is one of the most useful options for monitoring a running service or troubleshooting an active issue. Press Ctrl+C to stop.

Filtering by Systemd Unit

To view logs for a specific systemd service, use the -u flag followed by the unit name:

Terminal
journalctl -u nginx

You can combine -u with other filters. For example, to follow nginx logs in real time:

Terminal
journalctl -u nginx -f

To view logs for multiple units at once, specify -u more than once:

Terminal
journalctl -u nginx -u php-fpm

To print the last 100 lines for a service without the pager:

Terminal
journalctl -u nginx -n 100 --no-pager

For more on starting and stopping services, see how to start, stop, and restart Nginx and Apache .

Filtering by Time

Use --since and --until to limit log output to a specific time range.

To show logs since a specific date and time:

Terminal
journalctl --since "2026-02-01 10:00"

To show logs within a window:

Terminal
journalctl --since "2026-02-01 10:00" --until "2026-02-01 12:00"

journalctl accepts many natural time expressions:

Terminal
journalctl --since "1 hour ago"
journalctl --since "yesterday"
journalctl --since today

You can combine time filters with unit filters. For example, to view nginx logs from the past hour:

Terminal
journalctl -u nginx --since "1 hour ago"

Filtering by Priority

systemd uses the standard syslog priority levels. Use the -p flag to filter by severity:

Terminal
journalctl -p err

The output will include the specified priority and all higher-severity levels. The available priority levels from highest to lowest are:

Level	Name	Description
0	`emerg`	System is unusable
1	`alert`	Immediate action required
2	`crit`	Critical conditions
3	`err`	Error conditions
4	`warning`	Warning conditions
5	`notice`	Normal but significant events
6	`info`	Informational messages
7	`debug`	Debug-level messages

To view only warnings and above from the last hour:

Terminal
journalctl -p warning --since "1 hour ago"

Filtering by Boot

The journal stores logs from multiple boots. Use -b to filter by boot session.

To view logs from the current boot:

Terminal
journalctl -b

To view logs from the previous boot:

Terminal
journalctl -b -1

To list all available boot sessions with their IDs and timestamps:

Terminal
journalctl --list-boots

The output will look something like this:

output

-2 abc123def456 Mon 2026-02-24 08:12:01 CET—Mon 2026-02-24 18:43:22 CET
-1 def456abc789 Tue 2026-02-25 09:05:14 CET—Tue 2026-02-25 21:11:03 CET
0 789abcdef012 Wed 2026-02-26 08:30:41 CET—Wed 2026-02-26 14:00:00 CET

To view logs for a specific boot ID:

Terminal
journalctl -b abc123def456

To view errors from the previous boot:

Terminal
journalctl -b -1 -p err

Kernel Messages

To view kernel messages only (equivalent to dmesg ), use the -k flag:

Terminal
journalctl -k

To view kernel messages from the current boot:

Terminal
journalctl -k -b

To view kernel errors from the previous boot:

Terminal
journalctl -k -p err -b -1

Filtering by Process

In addition to filtering by unit, you can filter logs by process name, executable path, PID, or user ID using journal fields.

To filter by process name:

Terminal
journalctl _COMM=sshd

To filter by executable path:

Terminal
journalctl _EXE=/usr/sbin/sshd

To filter by PID:

Terminal
journalctl _PID=1234

To filter by user ID:

Terminal
journalctl _UID=1000

Multiple fields can be combined to narrow the results further.

Searching Log Messages

To search log messages by a pattern, use the -g flag followed by a regular expression:

Terminal
journalctl -g "failed"

To search within a specific unit:

Terminal
journalctl -u ssh -g "invalid user"

You can also pipe journalctl output to grep for more complex matching:

Terminal
journalctl -u nginx -n 500 --no-pager | grep -i "upstream"

Output Formats

By default, journalctl displays logs in a human-readable format. Use the -o flag to change the output format.

To display logs with ISO 8601 timestamps:

Terminal
journalctl -o short-iso

To display logs as JSON (useful for scripting and log shipping):

Terminal
journalctl -o json-pretty

To display message text only, without metadata:

Terminal
journalctl -o cat

The most commonly used output formats are:

Format	Description
`short`	Default human-readable format
`short-iso`	ISO 8601 timestamps
`short-precise`	Microsecond-precision timestamps
`json`	One JSON object per line
`json-pretty`	Formatted JSON
`cat`	Message text only

Managing Journal Size

The journal stores logs on disk under /var/log/journal/. To check how much disk space the journal is using:

Terminal
journalctl --disk-usage

output

Archived and active journals take up 512.0M in the file system.

To reduce the journal size, use the --vacuum-size, --vacuum-time, or --vacuum-files options:

Terminal
journalctl --vacuum-size=500M

Terminal
journalctl --vacuum-time=30d

Terminal
journalctl --vacuum-files=5

These commands remove old archived journal files until the specified limit is met. To configure a permanent size limit, edit /etc/systemd/journald.conf and set SystemMaxUse=.

Practical Troubleshooting Workflow

When a service fails, we can use a short sequence to isolate the issue quickly. First, check service state with systemctl :

Terminal
sudo systemctl status nginx

Then inspect recent error-level logs for that unit:

Terminal
sudo journalctl -u nginx -p err -n 100 --no-pager

If the problem started after reboot, inspect previous boot logs:

Terminal
sudo journalctl -u nginx -b -1 -p err --no-pager

To narrow the time window around the incident:

Terminal
sudo journalctl -u nginx --since "30 minutes ago" --no-pager

If you need pattern matching across many lines, pipe to grep :

Terminal
sudo journalctl -u nginx -n 500 --no-pager | grep -Ei "error|failed|timeout"

Troubleshooting

“No journal files were found”
The systemd journal may not be persistent on your system. Check if /var/log/journal/ exists. If it does not, create it with mkdir -p /var/log/journal and restart systemd-journald. Alternatively, set Storage=persistent in /etc/systemd/journald.conf.

“Permission denied” reading logs
Regular users can only access their own user journal. To read system logs, run journalctl with sudo, or add your user to the adm or systemd-journal group: usermod -aG systemd-journal USERNAME.

-g pattern search returns no results
The -g flag uses PCRE2 regular expressions. Make sure the pattern is correct and that your journalctl version supports -g (available on modern systemd releases). As an alternative, pipe the output to grep.

Logs missing after reboot
The journal is stored in memory by default on some distributions. To enable persistent storage across reboots, set Storage=persistent in /etc/systemd/journald.conf and restart systemd-journald.

Journal consuming too much disk space
Use journalctl --disk-usage to check the current size, then journalctl --vacuum-size=500M to trim old entries. For a permanent limit, configure SystemMaxUse= in /etc/systemd/journald.conf.

FAQ

What is the difference between journalctl and /var/log/syslog?
/var/log/syslog is a plain text file written by rsyslog or syslog-ng. journalctl reads the binary systemd journal, which stores structured metadata alongside each message. The journal offers better filtering, field-based queries, and persistent boot tracking.

How do I view logs for a service that keeps restarting?
Use journalctl -u servicename -f to follow logs in real time, or journalctl -u servicename -n 200 to view the most recent entries. Adding -p err will surface only error-level messages.

How do I check logs from before the current boot?
Use journalctl -b -1 for the previous boot, or journalctl --list-boots to see all available boot sessions and then journalctl -b BOOTID to query a specific one.

Can I export logs to a file?
Yes. Use journalctl --no-pager > output.log for plain text, or journalctl -o json-pretty > output.json for structured JSON. You can combine this with any filter flags.

How do I reduce the amount of disk space used by the journal?
Run journalctl --vacuum-size=500M to immediately trim archived logs to 500 MB. For a persistent limit, set SystemMaxUse=500M in /etc/systemd/journald.conf and restart the journal daemon with systemctl restart systemd-journald.

Conclusion

journalctl is a powerful and flexible tool for querying the systemd journal. Whether you are troubleshooting a failing service, reviewing kernel messages, or auditing authentication events, mastering its filter options saves significant time. If you have any questions, feel free to leave a comment below.

Linux patch Command: Apply Diff Files

hello@linuxize.com (Linuxize) — Sun, 22 Feb 2026 18:00:00 +0100

The patch command applies a set of changes described in a diff file to one or more original files. It is the standard way to distribute and apply source code changes, security fixes, and configuration updates in Linux, and pairs directly with the diff command.

This guide explains how to use the patch command in Linux with practical examples.

Syntax

The general syntax of the patch command is:

txt
patch [OPTIONS] [ORIGINALFILE] [PATCHFILE]

You can pass the patch file using the -i option or pipe it through standard input:

txt
patch [OPTIONS] -i patchfile [ORIGINALFILE]
patch [OPTIONS] [ORIGINALFILE] < patchfile

patch Options

Option	Long form	Description
`-i FILE`	`--input=FILE`	Read the patch from FILE instead of stdin
`-p N`	`--strip=N`	Strip N leading path components from file names in the patch
`-R`	`--reverse`	Reverse the patch (undo a previously applied patch)
`-b`	`--backup`	Back up the original file before patching
`--dry-run`		Test the patch without making any changes
`-d DIR`	`--directory=DIR`	Change to DIR before doing anything
`-N`	`--forward`	Skip patches that appear to be already applied
`-l`	`--ignore-whitespace`	Ignore whitespace differences when matching lines
`-f`	`--force`	Force apply even if the patch does not match cleanly
`-u`	`--unified`	Interpret the patch as a unified diff

Create and Apply a Basic Patch

The most common workflow is to use diff to generate a patch file and patch to apply it.

Start with two versions of a file. Here is the original:

hello.pytxt
print("Hello, World!")
print("Version 1")

And the updated version:

hello_new.pytxt
print("Hello, Linux!")
print("Version 2")

Use diff with the -u flag to generate a unified diff and save it to a patch file:

Terminal
diff -u hello.py hello_new.py > hello.patch

The hello.patch file will contain the following differences:

output

--- hello.py 2026-02-21 10:00:00.000000000 +0100
+++ hello_new.py 2026-02-21 10:05:00.000000000 +0100
@@ -1,2 +1,2 @@
-print("Hello, World!")
-print("Version 1")
+print("Hello, Linux!")
+print("Version 2")

To apply the patch to the original file:

Terminal
patch hello.py hello.patch

output

patching file hello.py

hello.py now contains the updated content from hello_new.py.

Dry Run Before Applying

Use --dry-run to test whether a patch will apply cleanly without actually modifying any files:

Terminal
patch --dry-run hello.py hello.patch

output

patching file hello.py

If the patch cannot be applied cleanly, patch reports the conflict without touching any files. This is useful before applying patches from external sources or when you are unsure whether a patch has already been applied.

Back Up the Original File

Use the -b option to create a backup of the original file before applying the patch. The backup is saved with a .orig extension:

Terminal
patch -b hello.py hello.patch

output

patching file hello.py

After running this command, hello.py.orig contains the original unpatched file. You can restore it manually if needed.

Strip Path Components with -p

When a patch file is generated from a different directory structure than the one where you apply it, the file paths inside the patch may not match your local paths. Use -p N to strip N leading path components from the paths recorded in the patch.

For example, a patch generated with git diff will reference files like:

output

--- a/src/utils/hello.py
+++ b/src/utils/hello.py

To apply this patch from the project root, use -p1 to strip the a/ and b/ prefixes:

Terminal
patch -p1 < hello.patch

-p1 is the standard option for patches generated by git diff and by diff -u from the root of a project directory. Without it, patch would look for a file named a/src/utils/hello.py on disk, which does not exist.

Reverse a Patch

Use the -R option to undo a previously applied patch and restore the original file:

Terminal
patch -R hello.py hello.patch

output

patching file hello.py

The file is restored to its state before the patch was applied.

Apply a Multi-File Patch

A single patch file can contain changes to multiple files. In this case, you do not specify a target file on the command line — patch reads the file names from the diff headers inside the patch:

Terminal
patch -p1 < project.patch

patch processes each file name from the diff headers and applies the corresponding changes. Use -p1 when the patch was produced by git diff or diff -u from the project root.

Quick Reference

Task	Command
Apply a patch	`patch original.txt changes.patch`
Apply from stdin	`patch -p1 < changes.patch`
Specify patch file with `-i`	`patch -i changes.patch original.txt`
Dry run (test without applying)	`patch --dry-run -p1 < changes.patch`
Back up original before patching	`patch -b original.txt changes.patch`
Strip one path prefix (git patches)	`patch -p1 < changes.patch`
Reverse a patch	`patch -R original.txt changes.patch`
Ignore whitespace differences	`patch -l original.txt changes.patch`
Apply to a specific directory	`patch -d /path/to/dir -p1 < changes.patch`

Troubleshooting

Hunk #1 FAILED at line N.
The patch does not match the current content of the file. This usually means the file has already been modified since the patch was created, or you are applying the patch against the wrong version. patch creates a .rej file containing the failed hunk so you can review and apply the change manually.

Reversed (or previously applied) patch detected! Assume -R?
patch has detected that the changes in the patch are already present in the file — the patch may have been applied before. Answer y to reverse the patch or n to skip it. Use -N (--forward) to automatically skip already-applied patches without prompting.

patch: **** malformed patch at line N
The patch file is corrupted or not in a recognized format. Make sure the patch was generated with diff -u (unified format). Non-unified formats require the -c (context) or specific format flag to be passed to patch.

File paths in the patch do not match files on disk.
Adjust the -p N value. Run patch --dry-run -p0 < changes.patch first, then increment N (-p1, -p2) until patch finds the correct files.

FAQ

How do I create a patch file?
Use the diff command with the -u flag: diff -u original.txt updated.txt > changes.patch. The -u flag produces a unified diff, which is the format patch works with by default. See the diff command guide for details.

What does -p1 mean?
-p1 tells patch to strip one leading path component from file names in the patch. Patches generated by git diff prefix file paths with a/ and b/, so -p1 removes that prefix before patch looks for the file on disk.

How do I undo a patch I already applied?
Run patch -R originalfile patchfile. patch reads the diff in reverse and restores the original content.

What is a .rej file?
When patch cannot apply one or more sections of a patch (called hunks), it writes the failed hunks to a file with a .rej extension alongside the original file. You can open the .rej file and apply those changes manually.

What is the difference between patch and git apply?
Both apply diff files, but git apply is designed for use inside a Git repository and integrates with the Git index. patch is a standalone POSIX tool that works on any file regardless of version control.

Conclusion

The patch command is the standard tool for applying diff files in Linux. Use --dry-run to verify a patch before applying it, -b to keep a backup of the original, and -R to reverse changes when needed.

If you have any questions, feel free to leave a comment below.

Understanding the /etc/fstab File in Linux

hello@linuxize.com (Linuxize) — Wed, 18 Feb 2026 13:00:00 +0100

The /etc/fstab file (filesystem table) is a system configuration file that defines how filesystems, partitions, and storage devices are mounted at boot time. The system reads this file during startup and mounts each entry automatically.

Understanding /etc/fstab is essential when you need to add a new disk, create a swap file , mount a network share , or change mount options for an existing filesystem.

This guide explains the /etc/fstab file format, what each field means, common mount options, and how to add new entries safely.

/etc/fstab Format

The /etc/fstab file is a plain text file with one entry per line. Each line defines a filesystem to mount. Lines beginning with # are comments and are ignored by the system.

To view the contents of the file safely, use less :

Terminal
less /etc/fstab

A typical /etc/fstab file looks like this:

output

# <file system> <mount point> <type> <options> <dump> <pass>
UUID=a1b2c3d4-e5f6-7890-abcd-ef1234567890 / ext4 errors=remount-ro 0 1
UUID=b2c3d4e5-f6a7-8901-bcde-f12345678901 /home ext4 defaults 0 2
UUID=c3d4e5f6-a7b8-9012-cdef-123456789012 none swap sw 0 0
tmpfs /tmp tmpfs defaults,noatime 0 0

Each entry contains six space-separated fields:

txt
UUID=a1b2c3d4... /home ext4 defaults 0 2
[---------------] [---] [--] [------] - -
| | | | | |
| | | | | +-> 6. Pass (fsck order)
| | | | +----> 5. Dump (backup flag)
| | | +-----------> 4. Options
| | +------------------> 3. Type
| +-------------------------> 2. Mount point
+---------------------------------------------> 1. File system

Field Descriptions

File system - The device or partition to mount. This can be specified as:
- A UUID: UUID=a1b2c3d4-e5f6-7890-abcd-ef1234567890
- A disk label: LABEL=home
- A device path: /dev/sda1
- A network path: 192.168.1.10:/export/share (for NFS)
Using UUIDs is recommended because device paths like /dev/sda1 can change if disks are added or removed. To find the UUID of a partition, run blkid:
Terminal
```
sudo blkid
```
Mount point - The directory where the filesystem is attached. The directory must already exist. Common mount points include /, /home, /boot, and /mnt/data. For swap entries, this field is set to none.
Type - The filesystem type. Common values include:
- ext4 - The default Linux filesystem
- xfs - High-performance filesystem used on RHEL-based distributions
- btrfs - Copy-on-write filesystem with snapshot support
- swap - Swap partition or file
- tmpfs - Temporary filesystem stored in memory
- nfs - Network File System
- vfat - FAT32 filesystem (USB drives, EFI partitions)
- auto - Let the kernel detect the filesystem type automatically
Options - A comma-separated list of mount options. See the Common Mount Options section below for details.
Dump - Used by the dump backup utility. A value of 0 means the filesystem is not included in backups. A value of 1 means it is. Most modern systems do not use dump, so this is typically set to 0.
Pass - The order in which fsck checks filesystems at boot. The root filesystem should be 1. Other filesystems should be 2 so they are checked after root. A value of 0 means the filesystem is not checked.

Common Mount Options

The fourth field in each fstab entry is a comma-separated list of mount options. The following options are the most commonly used:

defaults - Uses the standard default options (rw, suid, dev, exec, auto, nouser, async). Some effective behaviors can still vary by filesystem and kernel settings.
ro - Mount the filesystem as read-only.
rw - Mount the filesystem as read-write.
noatime - Do not update file access times. This can improve performance, especially on SSDs.
nodiratime - Do not update directory access times.
noexec - Do not allow execution of binaries on the filesystem.
nosuid - Do not allow set-user-ID or set-group-ID bits to take effect.
nodev - Do not interpret character or block special devices on the filesystem.
nofail - Do not report errors if the device does not exist at boot. Useful for removable drives and network shares.
auto - Mount the filesystem automatically at boot (default behavior).
noauto - Do not mount automatically at boot. The filesystem can still be mounted manually with mount.
user - Allow a regular user to mount the filesystem.
errors=remount-ro - Remount the filesystem as read-only if an error occurs. Common on root filesystem entries.
_netdev - The filesystem requires network access. The system waits for the network to be available before mounting. Use this for NFS, CIFS, and iSCSI mounts.
x-systemd.automount - Mount the filesystem on first access instead of at boot. Managed by systemd.

You can combine multiple options separated by commas:

txt
UUID=a1b2c3d4... /data ext4 defaults,noatime,nofail 0 2

Adding an Entry to /etc/fstab

Before editing /etc/fstab, always create a backup:

Terminal
sudo cp /etc/fstab /etc/fstab.bak

Step 1: Find the UUID

Identify the UUID of the partition you want to mount:

Terminal
sudo blkid /dev/sdb1

output

/dev/sdb1: UUID="d4e5f6a7-b8c9-0123-def0-123456789abc" TYPE="ext4"

Step 2: Create the Mount Point

Create the directory where the filesystem will be mounted:

Terminal
sudo mkdir -p /mnt/data

Step 3: Add the Entry

Open /etc/fstab in a text editor :

Terminal
sudo nano /etc/fstab

Add a new line at the end of the file:

/etc/fstabsh
UUID=d4e5f6a7-b8c9-0123-def0-123456789abc /mnt/data ext4 defaults,nofail 0 2

Step 4: Reload and Test the Entry

On systemd-based systems, reload the generated mount units after editing /etc/fstab:

Terminal
sudo systemctl daemon-reload

Then verify the file syntax and mount relationships:

Terminal
sudo findmnt --verify

Instead of rebooting, use mount -a to mount fstab entries that are not already mounted and do not use the noauto option:

Terminal
sudo mount -a

If the command produces no output, the entry is correct. If there is an error, fix the fstab entry before rebooting, as an incorrect fstab can prevent the system from booting normally.

Verify the filesystem is mounted :

Terminal
df -h /mnt/data

Common fstab Examples

Swap File

To add a swap file to fstab:

/etc/fstabsh
/swapfile none swap sw 0 0

To mount an NFS share that requires network access:

/etc/fstabsh
192.168.1.10:/export/share /mnt/nfs nfs defaults,_netdev,nofail 0 0

To mount a Windows/Samba share with a credentials file:

/etc/fstabsh
//192.168.1.20/share /mnt/smb cifs credentials=/etc/samba/creds,_netdev,nofail 0 0

Set strict permissions on the credentials file so other users cannot read it:

Terminal
sudo chmod 600 /etc/samba/creds

USB or External Drive

To mount a removable drive that may not always be attached:

/etc/fstabsh
UUID=e5f6a7b8-c9d0-1234-ef01-23456789abcd /mnt/usb ext4 defaults,nofail,noauto 0 0

The nofail option prevents boot errors when the drive is not connected. The noauto option prevents automatic mounting; mount it manually with sudo mount /mnt/usb when needed.

tmpfs for /tmp

To mount /tmp as a temporary filesystem in memory:

/etc/fstabsh
tmpfs /tmp tmpfs defaults,noatime,size=2G 0 0

Quick Reference

Task	Command
View fstab contents	`less /etc/fstab`
Back up fstab	`sudo cp /etc/fstab /etc/fstab.bak`
Find partition UUIDs	`sudo blkid`
Reload systemd mount units	`sudo systemctl daemon-reload`
Verify fstab syntax	`sudo findmnt --verify`
Mount all fstab entries	`sudo mount -a`
Check mounted filesystems	`mount` or `df -h`
Check filesystem type	`lsblk -f`
Restore fstab from backup	`sudo cp /etc/fstab.bak /etc/fstab`

Troubleshooting

System does not boot after editing fstab
An incorrect fstab entry can cause a boot failure. Boot into recovery mode or a live USB, mount the root filesystem, and fix or restore /etc/fstab from the backup. Always test with sudo mount -a before rebooting.

mount -a reports “wrong fs type” or “bad superblock”
The filesystem type in the fstab entry does not match the actual filesystem on the device. Use sudo blkid or lsblk -f to check the correct type.

Network share fails to mount at boot
Add the _netdev option to tell the system to wait for network availability before mounting. For systemd-based systems, x-systemd.automount can also help with timing issues.

“mount point does not exist”
The directory specified in the second field does not exist. Create it with mkdir -p /path/to/mountpoint before running mount -a.

UUID changed after reformatting a partition
Reformatting a partition assigns a new UUID. Run sudo blkid to find the new UUID and update the fstab entry accordingly.

FAQ

What happens if I make an error in /etc/fstab?
If the entry references a non-existent device without the nofail option, the system may drop to an emergency shell during boot. Always use nofail for non-essential filesystems and test with sudo mount -a before rebooting.

Should I use UUID or device path (/dev/sda1)?
Use UUID. Device paths can change if you add or remove disks, or if the boot order changes. UUIDs are unique to each filesystem and do not change unless you reformat the partition.

What does the nofail option do?
It tells the system to continue booting even if the device is not present or cannot be mounted. Without nofail, a missing device causes the system to drop to an emergency shell.

How do I remove an fstab entry?
Open /etc/fstab with sudo nano /etc/fstab, delete or comment out the line (add # at the beginning), save the file, and then unmount the filesystem with sudo umount /mount/point.

What is the difference between noauto and nofail?
noauto prevents the filesystem from being mounted automatically at boot; you must mount it manually. nofail still mounts automatically but does not cause a boot error if the device is missing.

Conclusion

The /etc/fstab file controls how filesystems are mounted at boot. Each entry specifies the device, mount point, filesystem type, options, and check order. Always back up fstab before editing, use UUIDs instead of device paths, and test changes with sudo mount -a before rebooting.

traceroute Command in Linux

hello@linuxize.com (Linuxize) — Sat, 07 Feb 2026 16:00:00 +0100

The traceroute command is a network diagnostic tool that displays the path packets take from your system to a destination host. It shows each hop (router) along the route and the time it takes for packets to reach each one.

Network administrators use traceroute to identify where packets are being delayed or dropped, making it essential for troubleshooting connectivity issues, latency problems, and routing failures.

This guide covers how to use the traceroute command with practical examples and explanations of the most common options.

Syntax

The general syntax for the traceroute command is:

txt
traceroute [OPTIONS] DESTINATION

OPTIONS - Flags that modify the behavior of the command.
DESTINATION - The target hostname or IP address to trace.

Installing traceroute

The traceroute command is not installed by default on all Linux distributions. To check if it is available on your system, type:

Terminal
traceroute --version

If traceroute is not present, the command will print “traceroute: command not found”. You can install it using your distribution’s package manager.

Install traceroute on Ubuntu, Debian, and Derivatives

Terminal
sudo apt update && sudo apt install traceroute

Install traceroute on Fedora, RHEL, and Derivatives

Terminal
sudo dnf install traceroute

Install traceroute on Arch Linux

Terminal
sudo pacman -S traceroute

How traceroute works

When you run traceroute, it sends packets with incrementally increasing TTL (Time to Live) values, starting at 1. Each router along the path decrements the TTL by 1. When the TTL reaches 0, the router discards the packet and sends back an ICMP “Time Exceeded” message.

By increasing the TTL with each round of packets, traceroute discovers each hop along the route until the packets reach the final destination.

By default, traceroute sends three UDP packets per hop (on Linux) and displays the round-trip time for each packet.

Basic Usage

To trace the route to a destination, run traceroute followed by the hostname or IP address:

Terminal
traceroute google.com

The output should look something like this:

output

traceroute to google.com (142.250.185.78), 30 hops max, 60 byte packets
1 router.local (192.168.1.1) 1.234 ms 1.102 ms 1.056 ms
2 10.0.0.1 (10.0.0.1) 12.345 ms 12.234 ms 12.123 ms
3 isp-gateway.example.net (203.0.113.1) 15.678 ms 15.567 ms 15.456 ms
4 core-router.example.net (198.51.100.1) 20.123 ms 20.012 ms 19.901 ms
5 google-peer.example.net (192.0.2.1) 22.345 ms 22.234 ms 22.123 ms
6 142.250.185.78 (142.250.185.78) 25.678 ms 25.567 ms 25.456 ms

Understanding the Output

Each line in the traceroute output represents a hop along the route. Let us break down what each field means:

Hop number - The sequential number of the router in the path (1, 2, 3, etc.).
Hostname - The DNS name of the router, if available.
IP address - The IP address of the router in parentheses.
Round-trip times - Three time measurements in milliseconds, one for each probe packet sent to that hop.

The first line shows the destination, maximum number of hops (default 30), and packet size (default 60 bytes).

Interpreting the Results

Asterisks (* * *) indicate that no response was received for that hop. This can happen when:

The router is configured to not respond to traceroute probes.
A firewall is blocking the packets.
The packets were lost due to network congestion.

Increasing latency at a specific hop suggests a bottleneck or congested link at that point in the network.

Consistent high latency from a certain hop onward indicates the issue is at or before that router.

Common Options

The traceroute command accepts several options to customize its behavior:

-n - Do not resolve IP addresses to hostnames. This speeds up the output by skipping DNS lookups.
-m max_ttl - Set the maximum number of hops (default is 30).
-q nqueries - Set the number of probe packets per hop (default is 3).
-w waittime - Set the time in seconds to wait for a response (default is 5).
-I - Use ICMP ECHO packets instead of UDP (may require root privileges).
-T - Use TCP SYN packets instead of UDP (may require root privileges).
-p port - Set the destination port for UDP or TCP probes.
-s source_addr - Use the specified source IP address.
-i interface - Send packets through the specified network interface.

Skip DNS Resolution

To speed up the trace and display only IP addresses, use the -n option:

Terminal
traceroute -n google.com

The output shows numeric IP addresses without hostnames:

output

traceroute to google.com (142.250.185.78), 30 hops max, 60 byte packets
1 192.168.1.1 1.234 ms 1.102 ms 1.056 ms
2 10.0.0.1 12.345 ms 12.234 ms 12.123 ms
3 203.0.113.1 15.678 ms 15.567 ms 15.456 ms

This is useful when DNS resolution is slow or when you only need IP addresses.

Change Maximum Hops

By default, traceroute stops after 30 hops. To change this limit, use the -m option:

Terminal
traceroute -m 15 google.com

This limits the trace to 15 hops maximum.

Change Number of Probes

To send a different number of probe packets per hop, use the -q option:

Terminal
traceroute -q 1 google.com

This sends only one probe per hop, resulting in faster but less detailed output.

Use ICMP Instead of UDP

By default, Linux traceroute uses UDP packets. Some networks block UDP, so you can use ICMP ECHO packets instead:

Terminal
sudo traceroute -I google.com

Info

The -I option may require root privileges, depending on your kernel and system configuration.

Use TCP Instead of UDP

For networks that block both UDP and ICMP, you can use TCP SYN packets:

Terminal
sudo traceroute -T google.com

You can also specify a port, such as port 443 for HTTPS:

Terminal
sudo traceroute -T -p 443 google.com

This is useful for tracing routes through firewalls that only allow specific TCP ports.

Trace IPv6 Routes

To trace IPv6 routes, use the -6 option:

Terminal
traceroute -6 ipv6.google.com

Specify Source Interface

If your system has multiple network interfaces, you can specify which one to use:

Terminal
traceroute -i eth0 google.com

Or specify the source IP address:

Terminal
traceroute -s 192.168.1.100 google.com

Traceroute vs tracepath

Linux systems often include tracepath, which is similar to traceroute but does not require root privileges and automatically discovers the MTU (Maximum Transmission Unit) along the path.

Feature	traceroute	tracepath
Root required	Yes (for ICMP/TCP)	No
Protocol	UDP, ICMP, TCP	UDP only
MTU discovery	Manual or `--mtu` option	Automatic
Customization	Many options	Limited

Use tracepath for quick traces without root access:

Terminal
tracepath google.com

Use traceroute when you need more control over the probe method or when tracepath does not provide enough information.

Practical Examples

Diagnose Slow Connections

If a website is loading slowly, trace the route to identify where the delay occurs:

Terminal
traceroute -n example.com

Look for hops with significantly higher latency than the previous ones. The hop before the latency spike is often the source of the problem.

Check if a Host is Reachable

If ping shows packet loss, use traceroute to find where packets are being dropped:

Terminal
traceroute google.com

Hops showing * * * followed by successful hops indicate a router that does not respond to probes but forwards traffic. If all remaining hops show * * *, the issue is at or after the last responding hop.

Trace Through a Firewall

If standard UDP probes are blocked, try ICMP or TCP:

Terminal
sudo traceroute -I google.com
sudo traceroute -T -p 80 google.com

Compare Routes to Different Servers

To understand routing differences, trace routes to multiple servers:

Terminal
traceroute -n server1.example.com
traceroute -n server2.example.com

This helps identify whether traffic to different destinations takes different paths through your network.

Quick Reference

Task	Command
Basic trace	`traceroute example.com`
Skip DNS resolution	`traceroute -n example.com`
Limit to N hops	`traceroute -m 15 example.com`
One probe per hop	`traceroute -q 1 example.com`
Use ICMP	`sudo traceroute -I example.com`
Use TCP	`sudo traceroute -T example.com`
Use TCP on port 443	`sudo traceroute -T -p 443 example.com`
Specify interface	`traceroute -i eth0 example.com`
Set timeout	`traceroute -w 3 example.com`
Trace with tracepath	`tracepath example.com`

Troubleshooting

All hops show * * *
The destination or your network may be blocking traceroute probes. Try using ICMP (-I) or TCP (-T) instead of the default UDP. If the issue persists, a firewall between you and the destination is likely blocking all probe types.

Only the first hop responds
Your local router responds, but nothing beyond it does. This often indicates a firewall or routing issue at your ISP. Contact your network administrator or ISP for assistance.

Trace never completes
The destination may not be reachable, or the maximum hop count is too low. Increase the maximum hops with -m 60 and check if the trace progresses further.

High latency at a specific hop
A single hop with high latency does not always indicate a problem. Routers often deprioritize ICMP responses. If the final destination has acceptable latency, the intermediate high latency may not affect actual traffic.

Latency increases then decreases
This can occur due to asymmetric routing, where the return path differs from the outbound path. The times displayed include the round trip, so a longer return path can inflate the displayed latency.

Permission denied
Options like -I (ICMP) and -T (TCP) may require root privileges. Run the command with sudo.

FAQ

What is the difference between traceroute and ping?
ping tests whether a destination is reachable and measures round-trip latency. traceroute shows the path packets take and the latency at each hop along the route. Use ping for basic connectivity checks and traceroute for diagnosing where problems occur.

Why do some hops show asterisks?
Asterisks (* * *) mean no response was received. The router may be configured to ignore traceroute probes, a firewall may be blocking them, or the packets may have been lost. This does not necessarily mean the router is down.

What is the default protocol used by traceroute?
On Linux, traceroute uses UDP by default. On Windows, tracert uses ICMP. You can switch Linux traceroute to ICMP with -I or TCP with -T.

How do I trace the route on Windows?
Windows uses the tracert command instead of traceroute. The syntax is similar: tracert example.com. It uses ICMP by default.

What does TTL mean in traceroute?
TTL (Time to Live) is a field in the IP packet header that limits the packet’s lifespan. Each router decrements the TTL by 1. When it reaches 0, the router discards the packet and sends an ICMP “Time Exceeded” message. Traceroute uses this mechanism to discover each hop.

How can I trace the route to a specific port?
Use the -p option with TCP (-T) or UDP to specify the destination port:

Terminal
sudo traceroute -T -p 443 example.com

Is there an alternative to traceroute for continuous diagnostics?
mtr combines ping and traceroute in a single, continuously updating view and is useful for ongoing packet loss and latency checks.

Conclusion

If UDP probes are blocked on your network, fall back to sudo traceroute -I (ICMP) or sudo traceroute -T -p 443 (TCP on HTTPS). The TCP form is most likely to pass through stateful firewalls.

For more options, refer to the traceroute man page by running man traceroute in your terminal.

Linux Users and Permissions

hello@linuxize.com (Linuxize) — Tue, 03 Feb 2026 12:00:00 +0100

Linux access control starts with users, groups, and permissions. This series covers the essential commands and files that control who can log in, what they can do, and which files they can access.

Each article includes clear examples you can run on any Linux system. The series is organized into five modules:

What You Will Learn

Getting Started - Listing users, creating accounts, and managing passwords
Groups - Creating groups, assigning users to them, and removing groups
Privileges - su, sudo, and safe privilege escalation
Permissions & Ownership - chmod, chown, and permission basics
System Files & Defaults - /etc/passwd and umask behavior

Prerequisites

Basic familiarity with the Linux command line
Access to a Linux system (or WSL on Windows)

SSH Essentials

hello@linuxize.com (Linuxize) — Fri, 30 Jan 2026 18:00:00 +0100

SSH (Secure Shell) is a cryptographic network protocol used for secure communication between a client and a remote server. It is the standard way to log into remote Linux machines, transfer files, and create encrypted tunnels.

This series covers everything you need to work with SSH, from basic connections to advanced techniques like tunneling and chroot jails.

You can also use the SSH cheatsheet as a quick reference while reading the series.

What You’ll Learn

Getting Started — The SSH command, enabling SSH on different systems, configuring the client, and changing the default port
Key-Based Authentication — Generating SSH keys on Linux and Windows, setting up keys on various distributions, and configuring passwordless login
Tunneling & Port Forwarding — Local and remote port forwarding, dynamic tunneling, and SOCKS proxies for private browsing
File Transfer — Copying files with SCP and SFTP, changing the SFTP port, setting up chroot jails, mounting remote directories with SSHFS, and using Rsync over SSH

Prerequisites

Access to a Linux, macOS, or Windows terminal
A remote server or virtual machine to connect to
Basic familiarity with the Linux command line

Each article includes step-by-step instructions and practical examples. By the end of this series, you will be able to securely manage remote servers, automate authentication with SSH keys, and transfer files over encrypted connections.

Bash Scripting Fundamentals

hello@linuxize.com (Linuxize) — Wed, 14 Jan 2026 12:31:00 +0100

Bash is the default shell on most Linux distributions and macOS. Learning to write Bash scripts is an essential skill for anyone working with Linux systems, whether you’re a system administrator, developer, or DevOps engineer.

This series will guide you from the basics of Bash scripting to more advanced skills. You’ll learn how to automate tasks, process text, handle user input, and write maintainable scripts.

You can also use the Bash cheatsheet as a quick reference while reading the series.

What You’ll Learn

Getting Started - Shebang, running scripts, comments, and shell configuration
Variables & Data - Working with strings, numbers, arrays, and environment variables
Input/Output - Reading input, writing files, and handling redirections
Control Flow - Conditionals, comparisons, and pattern matching
Loops - For, while, until loops and controlling loop execution
Functions & Advanced - Reusable code, exit codes, background processes, and productivity tips

Prerequisites

Basic familiarity with the Linux command line
Access to a Linux or macOS terminal (or WSL on Windows)

Each article includes practical examples you can run on your own system. By the end of this series, you’ll be able to write scripts that automate your daily tasks and solve real-world problems.

How to Use the Export Command in Linux

hello@linuxize.com (Linuxize) — Fri, 09 Jan 2026 16:10:00 +0100

The export command is an essential part of the Bash shell in Linux. It allows you to share variables or functions you create so that they can be used by other programs or new shells started from your current terminal.

By default, variables exist only in the shell where they are created. When you use export, the variable becomes an environment variable, meaning it is passed to child processes.

In this article, we will show you how to use the export command to create, list, and manage environment variables and functions.

What Is an Environment Variable?

Environment variables are system-wide variables that are inherited by all spawned child processes and shells.

Environment variables allow you to customize how the system works and the behavior of the applications on the system. For example, environment variables can store information about the default text editor or browser, the paths to executable files, or the system locale and keyboard layout settings.

Common examples include:

PATH – Defines where the shell looks for executable files.
HOME – Your home directory.
USER – Your username.
LANG - The current locales settings.
SHELL - The path of the current user’s shell, such as bash or zsh.

Syntax Overview

The syntax of the export command is:

txt
export [-f] [-n] [name[=value] …]

Or to list exported variables:

txt
export -p

Where:

name - the shell variable or function to export.
-p - lists all exported variables in the current shell.
-n - removes the export property from the specified variable(s) (they remain defined in the current shell but won’t be inherited by child processes).
-f - treats the specified name(s) as functions instead of variables.

To see why export matters, compare a regular shell variable with an exported one:

Terminal
NAME="linuxize"
bash -c 'echo "$NAME"'

export NAME="linuxize"
bash -c 'echo "$NAME"'

The first command does not pass NAME to the child shell. After export, the child shell can read it.

List All Exported Variables

To see all exported variables in your current shell, type:

sh
export -p

Example output:

output

declare -x PATH="/usr/local/bin:/usr/bin:/bin"
declare -x HOME="/home/user"
declare -x LANG="en_US.UTF-8"

These are variables that any child process will inherit.

You can also use printenv or env to see all currently active environment variables.

Creating and Exporting Environment Variables

To create a new environment variable , use the following form:

sh
export VARIABLE=VALUE

Variable names are case-sensitive. By convention, environment variables should have UPPER CASE names.

Example:

sh
export COUNT=2024

Check its value:

sh
echo $COUNT

output

Variables defined without export are local to the current shell and won’t be inherited by child processes.

You can also first define a variable and export it separately:

sh
COUNT=2024
export COUNT

Exporting Functions

Functions can be exported to child shells using the -f option. Example:

sh
greet() {
echo "Hello World!"
}

Terminal
export -f greet

Info

Without -f, export assumes you’re exporting a variable, not a function.

This works in Bash. Function export is not portable across all shells.

Then, start a new child shell by typing bash, and enter the function name:

Terminal
greet

output

Hello World!

If you haven’t exported the function, it will not be available in the child shell, and there will be no output.

Remove Export Property

To stop exporting a variable while retaining it in the current shell:

Terminal
export -n VARIABLE

To remove a variable completely from both current and child processes:

Terminal
unset VARIABLE

Make Environment Variables Permanent

Exported variables are not permanent and last only for the current session.

To make environment variables persistent across sessions, add export VARIABLE=value to your shell configuration file. Common places include:

/etc/profile
~/.bashrc
~/.bash_profile
/etc/environment (typically uses plain VARIABLE=value, not export VARIABLE=value)

Example:

sh
export JAVA_HOME="/path/to/java/home"
export PATH=$PATH:$JAVA_HOME/bin

Conclusion

The export command is important for managing environment variables and functions in Linux.

Important aspects to remember:

Child processes inherit exported variables/functions.
Use export -f for functions.
Remove exports with export -n or completely delete with unset.
Persistent exports require adding them to the shell configuration files.

Mastering export will make your shell scripts and session management much more powerful.

ifconfig Command in Linux: Configure Network Interfaces

hello@linuxize.com (Linuxize) — Mon, 28 Jun 2021 20:31:00 +0100

ifconfig (interface configuration) is a network management tool used to configure and view the status of network interfaces in Linux. With ifconfig, you can assign IP addresses, enable or disable interfaces, change MTU values, modify MAC addresses, and more.

Warning

ifconfig is deprecated and replaced by the ip command. It may not be installed on modern Linux distributions. Where possible, use ip for new scripts and workflows.

This guide explains how to use the ifconfig command with practical examples.

How to Install `ifconfig`

ifconfig is part of the net-tools package, which is not installed by default on many modern distributions.

If you get an error saying ifconfig: command not found, install the package using the instructions below.

Install `ifconfig` on Ubuntu, Debian, and Derivatives

Terminal
sudo apt install net-tools

Install `ifconfig` on Fedora, RHEL, and Derivatives

Terminal
sudo dnf install net-tools

`ifconfig` Command Syntax

The general syntax for ifconfig is:

txt
ifconfig [INTERFACE] [OPTIONS] [ADDRESS]

INTERFACE - the name of the network interface (for example, eth0, ens3, or lo)
ADDRESS - the IP address to assign to the interface

Info

Modern Linux distributions use predictable interface names such as ens3 or enp0s3 instead of the traditional eth0. Run ifconfig -a to see the actual interface names on your system.

The configurations set with ifconfig are not persistent. After a system restart, all changes are lost. To make changes permanent, edit the distribution-specific network configuration files or use a network manager.

Only root or users with sudo privileges can modify network interfaces.

Display Network Interface Information

Run ifconfig without options to display all active network interfaces:

Terminal
ifconfig

To display all interfaces, including inactive ones, add the -a flag:

Terminal
ifconfig -a

output

eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
inet 172.20.10.3 netmask 255.255.255.240 broadcast 172.20.10.15
inet6 2401:4900:1d65:40a1:4ebb:58ff:fe9c:f555 prefixlen 64 scopeid 0x0<global>
inet6 fe80::4ebb:58ff:fe9c:f555 prefixlen 64 scopeid 0x20<link>
ether 4c:bb:58:9c:f5:55 txqueuelen 1000 (Ethernet)
RX packets 84110 bytes 70667629 (70.6 MB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 59727 bytes 20886290 (20.8 MB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
lo: flags=73<UP,LOOPBACK,RUNNING> mtu 65536
inet 127.0.0.1 netmask 255.0.0.0
inet6 ::1 prefixlen 128 scopeid 0x10<host>
loop txqueuelen 1000 (Local Loopback)
RX packets 4198 bytes 498729 (498.7 KB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 4198 bytes 498729 (498.7 KB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0

To display information for a specific interface, pass its name as an argument:

Terminal
ifconfig eth0

The equivalent ip command is:

Terminal
ip addr show eth0

Assign an IP Address and Netmask to a Network Interface

To assign an IP address and netmask to an interface, use the following syntax:

txt
ifconfig INTERFACE IP_ADDRESS netmask SUBNET_MASK

For example, to assign the IP address 192.168.0.101 with netmask 255.255.0.0 to eth0:

Terminal
ifconfig eth0 192.168.0.101 netmask 255.255.0.0

You can also assign a secondary IP address using interface aliasing:

Terminal
ifconfig eth0:0 192.168.0.102 netmask 255.255.0.0

The equivalent ip command for assigning an address is:

Terminal
ip addr add 192.168.0.101/16 dev eth0

Enable and Disable a Network Interface

To disable an active network interface, pass the down flag after the interface name:

Terminal
ifconfig eth0 down

To enable an inactive interface, use the up flag:

Terminal
ifconfig eth0 up

If you are connected over SSH through the same interface, bringing it down will disconnect your session. Use caution on remote systems and make sure you have out-of-band access before applying interface state changes.

The equivalent ip commands are:

Terminal
ip link set eth0 down
ip link set eth0 up

Enable and Disable Promiscuous Mode

Promiscuous mode allows a network interface to capture and view all packets on the network segment, not just those addressed to it. It is commonly used for network analysis and packet capture with tools like tcpdump .

To enable promiscuous mode on an interface:

Terminal
ifconfig eth0 promisc

To disable promiscuous mode:

Terminal
ifconfig eth0 -promisc

The equivalent ip commands are:

Terminal
ip link set eth0 promisc on
ip link set eth0 promisc off

Change the MTU of a Network Interface

The MTU (Maximum Transmission Unit) defines the maximum size of packets transmitted on an interface. Lowering the MTU can help on networks with fragmentation issues; raising it (jumbo frames) can improve throughput on supported networks.

To change the MTU value, use the following syntax:

txt
ifconfig INTERFACE mtu MTU_VALUE

For example, to set the MTU of eth0 to 9000:

Terminal
ifconfig eth0 mtu 9000

The equivalent ip command is:

Terminal
ip link set eth0 mtu 9000

Change the MAC Address of a Network Interface

The MAC (Media Access Control) address is the hardware address that uniquely identifies a network interface on a local network.

To change the MAC address, first bring the interface down, then set the new address with the hw ether flag:

Terminal
ifconfig eth0 down
ifconfig eth0 hw ether 00:00:2d:3a:2a:28
ifconfig eth0 up

The interface must be down before changing its MAC address. The equivalent ip commands are:

Terminal
ip link set eth0 down
ip link set eth0 address 00:00:2d:3a:2a:28
ip link set eth0 up

Troubleshooting

ifconfig: command not found
The net-tools package is not installed. Install it with sudo apt install net-tools on Ubuntu, Debian, and Derivatives, or sudo dnf install net-tools on Fedora, RHEL, and Derivatives.

Changes are lost after a reboot
ifconfig changes are applied only to the running system and do not survive a restart. To make changes permanent, use your distribution’s network manager (NetworkManager, systemd-networkd, or Netplan) or edit the appropriate configuration files.

The interface name is not eth0
Modern Linux systems use predictable interface names such as ens3, enp0s3, or wlp2s0. Run ifconfig -a or ip link show to list the actual interface names on your system.

Cannot change the MAC address while the interface is up
The interface must be brought down before changing its MAC address. Run ifconfig eth0 down first, change the address, then bring it back up with ifconfig eth0 up.

Quick Reference

`ifconfig` command	`ip` equivalent	Description
`ifconfig`	`ip addr show`	Show active interfaces
`ifconfig -a`	`ip addr show`	Show all interfaces including inactive
`ifconfig eth0`	`ip addr show eth0`	Show a specific interface
`ifconfig eth0 IP netmask MASK`	`ip addr add IP/PREFIX dev eth0`	Assign an IP address
`ifconfig eth0 down`	`ip link set eth0 down`	Disable an interface
`ifconfig eth0 up`	`ip link set eth0 up`	Enable an interface
`ifconfig eth0 promisc`	`ip link set eth0 promisc on`	Enable promiscuous mode
`ifconfig eth0 -promisc`	`ip link set eth0 promisc off`	Disable promiscuous mode
`ifconfig eth0 mtu VALUE`	`ip link set eth0 mtu VALUE`	Change MTU
`ifconfig eth0 hw ether MAC`	`ip link set eth0 address MAC`	Change MAC address

FAQ

Should I use ifconfig or ip?
Use ip for new scripts and day-to-day work. ifconfig is no longer maintained and is absent from many modern distributions. The ip command provides all of the same functionality and more. See the Quick Reference table above for the ip equivalents of common ifconfig commands.

Why do my network changes disappear after a reboot?
ifconfig configures the live kernel network state only. The changes are not written to any configuration file. To persist changes, use your distribution’s network configuration system: Netplan on Ubuntu, NetworkManager on Fedora, or /etc/network/interfaces on Debian.

How do I find my IP address on Linux?
Run ifconfig to display all active interfaces and their assigned addresses. The inet field shows the IPv4 address and inet6 shows the IPv6 address. The modern alternative is ip addr show.

What is promiscuous mode and is it safe to enable?
Promiscuous mode allows an interface to receive all packets on the network, not just those addressed to it. It is safe to enable in controlled environments for diagnostic purposes (for example, with tcpdump). On shared networks, it can capture other hosts’ traffic, so it should only be used with appropriate authorization.

Conclusion

Use ifconfig to view and configure network interfaces, assign IP addresses, toggle interface state, and modify MAC addresses and MTU values. For new systems and scripts, prefer the ip command , which replaces ifconfig and is available on most modern Linux distributions. For more details, see the ifconfig man page .

Grep Exclude: Patterns, Files, and Directories

hello@linuxize.com (Linuxize) — Tue, 18 May 2021 05:31:00 +0100

Grep is a command-line tool for searching files for lines that match a pattern. By default, it prints every matching line to standard output.

In many situations, you need the opposite, to exclude or ignore certain words, patterns, files, or directories from the search results. This guide explains how to use grep exclusion options with practical examples.

Grep Exclude Syntax

Use the following syntax when excluding matches, files, or directories:

txt
grep [OPTIONS] PATTERN [FILE...]

The most common options for exclusion are -v, --exclude, --include, and --exclude-dir.

Exclude Words and Patterns

To display only the lines that do not match a search pattern, use the -v (or --invert-match) option.

For example, to print the lines in /etc/passwd that do not contain the string nologin:

Terminal
grep -wv nologin /etc/passwd

output

root:x:0:0:root:/root:/bin/bash
git:x:994:994:git daemon user:/:/usr/bin/git-shell
linuxize:x:1000:1000:linuxize:/home/linuxize:/bin/bash

The -w option tells grep to match only whole words, so nologin does not match inside longer strings like nologinuser.

Exclude Multiple Patterns

To exclude more than one pattern, use the -e option for each pattern:

Terminal
grep -wv -e nologin -e bash /etc/passwd

You can use -e as many times as needed.

Another option is to join the patterns with the OR operator (|). By default, grep interprets patterns as basic regular expressions, where | must be escaped:

Terminal
grep -wv 'nologin\|bash' /etc/passwd

With extended regular expressions (-E), the | operator does not need escaping:

Terminal
grep -Ewv 'nologin|bash' /etc/passwd

Both commands produce the same result: lines that contain neither nologin nor bash.

Exclude Lines Matching a Position

You can use regular expressions to exclude lines where a pattern appears at a specific position. In the following example, lines where games appears at the beginning are excluded:

Terminal
grep -v "^games" file.txt

Exclude from Piped Output

A command’s output can be filtered through grep using a pipe. For example, to list all running processes except those owned by root:

Terminal
ps -ef | grep -wv root

Only the lines that do not contain the whole word root are printed.

Exclude Files

When performing a recursive search with -r or -R, you can limit which files grep examines using --exclude and --include.

–exclude

The --exclude option skips files whose names match a glob pattern. In the following example, grep searches for linuxize in all files in the current directory but skips .png and .jpg files:

Terminal
grep -rl --exclude="*.png" --exclude="*.jpg" linuxize .

You can use --exclude multiple times to skip different file types.

–include

The --include option is the opposite of --exclude: grep searches only the files whose names match the specified pattern. For example, to search only .conf files:

Terminal
grep -rl --include="*.conf" linuxize /etc

This is useful when you want to narrow the search to a specific file type rather than listing everything to exclude.

Combining –include and –exclude

You can use both options together. The following command searches only .log files but skips any file named debug.log:

Terminal
grep -rl --include="*.log" --exclude="debug.log" error /var/log

Exclude Directories

When searching recursively, use --exclude-dir to skip specific directories or folders. The path is relative to the search directory.

The following example searches for linuxize in all files under /etc but skips the /etc/pki directory:

Terminal
grep -R --exclude-dir=pki linuxize /etc

To exclude multiple directories, use --exclude-dir for each one:

Terminal
grep -r --exclude-dir=proc --exclude-dir=boot --exclude-dir=sys gnu /

The difference between -r and -R is that -R follows symbolic links while -r does not.

Combining File and Directory Exclusions

You can combine --exclude, --include, and --exclude-dir in a single command. For example, to search .conf files under /etc while skipping the pki and ssl directories:

Terminal
grep -rl --include="*.conf" --exclude-dir=pki --exclude-dir=ssl error /etc

If you mostly need recursive project searches with file-type filters and ignore-file support, ripgrep can be simpler than combining several grep exclude options.

Quick Reference

Option	Description
`-v`	Invert match, show lines that do not match
`-e pattern`	Specify a pattern (use multiple times to exclude several)
`--exclude="GLOB"`	Skip files matching the glob pattern
`--include="GLOB"`	Search only files matching the glob pattern
`--exclude-dir=DIR`	Skip directories matching the name
`-r`	Recursive search (does not follow symlinks)
`-R`	Recursive search (follows symlinks)

FAQ

What is the difference between -v and --exclude?
The -v option inverts line matching, so it shows lines that do not contain the pattern. The --exclude option skips entire files based on their filename. They operate at different levels.

How do I make grep ignore a file or directory?
To ignore files by name during a recursive search, use --exclude="GLOB". To ignore directories, use --exclude-dir=DIR. Both options accept glob patterns and can be specified multiple times to skip several files or directories in one command.

How do I exclude multiple directories?
Use --exclude-dir once for each directory you want to skip: grep -r --exclude-dir=dir1 --exclude-dir=dir2 pattern .

Can I use regular expressions with --exclude or --exclude-dir?
No. These options accept only glob patterns (like *.log or test_*), not regular expressions.

What is the difference between -r and -R?
Both search directories recursively. The difference is that -R follows symbolic links while -r does not. Use -r to avoid searching the same files twice through symlinks.

How do I exclude case-insensitively?
Add the -i option to make the pattern match case-insensitive: grep -vi pattern file.txt. The --exclude and --exclude-dir options always use case-sensitive glob matching.

Conclusion

Grep provides several options for excluding content from search results. Use -v to invert line matching, --exclude and --include to filter files by name, and --exclude-dir to skip directories during recursive searches.

Linux File Permissions Explained

hello@linuxize.com (Linuxize) — Fri, 30 Apr 2021 05:01:47 +0100

In Linux, file permissions, attributes, and ownership control the access level that the system processes and users have to files. This ensures that only authorized users and processes can access specific files and directories.

Linux File Permissions

The basic Linux permissions model works by associating each system file with an owner and a group and assigning permission access rights for three different classes of users:

The file owner.
The group members.
Others (everybody else).

File ownership can be changed using the chown and chgrp commands.

Three file permissions types apply to each class of users:

The read permission.
The write permission.
The execute permission.

This concept allows you to control which users can read the file, write to the file, or execute the file.

To view the file permissions, use the ls command:

Terminal
ls -l file_name

output

-rw-r--r-- 12 linuxize users 12.0K Apr 28 10:10 file_name
|[-][-][-]- [------] [---]
| | | | | | |
| | | | | | +-----------> 7. Group
| | | | | +-------------------> 6. Owner
| | | | +--------------------------> 5. Alternate Access Method
| | | +----------------------------> 4. Others Permissions
| | +-------------------------------> 3. Group Permissions
| +----------------------------------> 2. Owner Permissions
+------------------------------------> 1. File Type

The first character indicates the file type. It can be a regular file (-), directory (d), a symbolic link (l), or other special types of files. The following nine characters represent the file permissions, three triplets of three characters each. The first triplet shows the owner permissions, the second one group permissions, and the last triplet shows everybody else permissions.

In the example above, rw-r--r-- means that the file owner has read and write permissions (rw-), the group and others have only read permissions (r--).

File permissions have a different meaning depending on the file type.

Each of the three permission triplets can be constructed of the following characters and have different effects, depending on whether they are set to a file or to a directory:

Effect of Permissions on Files

Permission	Character	Meaning on File
Read	`-`	The file is not readable. You cannot view the file contents.
	`r`	The file is readable.
Write	`-`	The file cannot be changed or modified.
	`w`	The file can be changed or modified.
Execute	`-`	The file cannot be executed.
	`x`	The file can be executed.
	`s`	If found in the `user` triplet, it sets the `setuid` bit. If found in the `group` triplet, it sets the `setgid` bit. It also means that `x` flag is set. When the `setuid` or `setgid` flags are set on an executable file, the file is executed with the file’s owner and/or group privileges.
	`S`	Same as `s`, but the `x` flag is not set. This flag is rarely used on files.
	`t`	If found in the `others` triplet, it sets the `sticky` bit. It also means that `x` flag is set. This flag is useless on files.
	`T`	Same as, `t` but the `x` flag is not set. This flag is useless on files.

Effect of Permissions on Directories (Folders)

Directories are special types of files that can contain other files and directories.

Permission	Character	Meaning on Directory
Read	`-`	The directory’s contents cannot be shown.
	`r`	The directory’s contents can be shown. (e.g., You can list files inside the directory with `ls` .)
Write	`-`	The directory’s contents cannot be altered.
	`w`	The directory’s contents can be altered. (e.g., You can create new files , delete files ..etc.)
Execute	`-`	The directory cannot be changed to.
	`x`	The directory can be navigated using `cd` .
	`s`	If found in the `user` triplet, it sets the `setuid` bit. If found in the `group` triplet it sets the `setgid` bit. It also means that `x` flag is set. When the `setgid` flag is set on a directory, the new files created within it inherits the directory group ID (GID) instead of the primary group ID of the user who created the file. `setuid` has no effect on directories.
	`S`	Same as `s`, but the `x` flag is not set. This flag is useless on directories.
	`t`	If found in the `others` triplet, it sets the `sticky` bit. It also means that `x` flag is set. When the sticky bit is set on a directory, only the file’s owner, the directory’s owner, or the administrative user can delete or rename the files within the directory.
	`T`	Same as `t`, but the `x` flag is not set. This flag is useless on directories.

Changing File Permissions

File permissions can be changed using the chmod command. Only root, the file owner, or a user with sudo privileges can change the permissions of a file. Be extra careful when using chmod, especially when changing permissions recursively. The command can accept one or more files and/or directories separated by spaces as arguments.

Permissions can be specified using a symbolic mode, numeric mode, or a reference file.

Symbolic (Text) Method

The syntax of the chmod command when using the symbolic mode has the following format:

sh
chmod [OPTIONS] [ugoa…][-+=]perms…[,…] FILE...

The first set of flags ([ugoa…]), called user flags, defines the user classes whose permissions will be changed.

u - The file owner.
g - The users who are members of the group.
o - All other users.
a - All users, identical to ugo.

When the users’ flag is omitted, it defaults to a.

The second set of flags ([-+=]), the operation flags, defines whether the permissions are to be removed, added, or set:

- - Removes the specified permissions.
+ - Adds specified permissions.
= - Changes the current permissions to the specified permissions. If no permissions are given after the = symbol, all permissions from the specified user class are removed.

The permissions (perms...) are explicitly set using either zero or one or more of the following letters: r, w, x, X, s, and t. Use a single letter from the set u, g, and o when copying permissions from one to another users’ class.

When setting permissions for more than one user class ([,…]), use commas (without spaces) to separate the symbolic modes.

Here are some examples of how to use the chmod command in symbolic mode:

Give the members of the group permission to execute the file, but not to read and write to it:
Terminal
```
chmod g=x filename
```
Remove the write permission for all users:
Terminal
```
chmod a-w filename
```
Recursively remove the execute permission for other users:
Terminal
```
chmod -R o-x dirname
```
Remove the read, write, and execute permission for all users except the file’s owner:
Terminal
```
chmod og-rwx filename
```
The same thing can also be accomplished by using the following form:
Terminal
```
chmod og= filename
```
Give read, write and execute permission to the file’s owner, read permissions to the file’s group, and no permissions to all other users:
Terminal
```
chmod u=rwx,g=r,o= filename
```

Numeric Method

The syntax of the chmod command when using the numeric mode has the following format:

sh
chmod [OPTIONS] NUMBER FILE...

When using the numeric mode, you can set the permissions for all three user classes (owner, group, and all others) at the same time.

The permission number can be a 3-digit or 4-digit number. When a 3-digit number is used, the first digit represents the permissions of the file’s owner, the second one the file’s group, and the last one all other users.

Each write, read, and execute permissions have the following number value:

r (read) = 4
w (write) = 2
x (execute) = 1
no permissions = 0

The permissions number of a specific user class is represented by the sum of the values of the permissions for that group.

To find out the file’s permissions in numeric mode, simply calculate the totals for all users’ classes. For example, to give read, write and execute permission to the file’s owner, read and execute permissions to the file’s group and only read permissions to all other users, you would do the following:

Owner: rwx=4+2+1=7
Group: r-x=4+0+1=5
Others: r–=4+0+0=4

Using the method above, we get the number 754, which represents the desired permissions.

To set the setuid, setgid, and sticky bit flags, use a 4-digit number.

When a 4-digit number is used, the first digit has the following meaning:

setuid=4
setgid=2
sticky=1
no changes = 0

The next three digits have the same meaning as when using 3 digits number.

If the first digit is 0 it can be omitted, and the mode can be represented with 3 digits. The numeric mode 0755 is the same as 755.

To calculate the numeric mode, you can also use another method (binary method), but it is a little more complicated. Knowing how to calculate the numeric mode using 4, 2, and 1 is sufficient for most users.

You can check the file’s permissions in the numeric notation using the stat command:

sh
stat -c "%a" file_name

Here are some examples of how to use the chmod command in numeric mode:

Give the file’s owner read and write permissions and only read permissions to group members and all other users:
Terminal
```
chmod 644 file
```
Give the file’s owner read, write and execute permissions, read and execute permissions to group members and no permissions to all other users:
Terminal
```
chmod 750 file
```
Give read, write, and execute permissions, and a sticky bit to a given directory:
Terminal
```
chmod 1777 dirname
```
Recursively set read, write, and execute permissions to the file owner and no permissions for all other users on a given directory:
Terminal
```
chmod -R 700 dirname
```

Quick Reference

For a printable quick reference, see the chmod cheatsheet .

Common permission values:

Mode	Symbolic	Who can do what
`777`	`rwxrwxrwx`	Everyone can read, write, and execute
`755`	`rwxr-xr-x`	Owner full access; group and others read and execute
`750`	`rwxr-x---`	Owner full access; group read and execute; others none
`700`	`rwx------`	Owner full access; group and others none
`664`	`rw-rw-r--`	Owner and group read/write; others read only
`644`	`rw-r--r--`	Owner read/write; group and others read only
`600`	`rw-------`	Owner read/write; group and others none
`400`	`r--------`	Owner read only; group and others none

Symbolic chmod examples:

Command	Effect
`chmod u+x file`	Add execute for owner
`chmod g-w file`	Remove write for group
`chmod o= file`	Remove all permissions for others
`chmod a+r file`	Add read for everyone
`chmod u=rwx,g=rx,o= file`	Set exact permissions for all classes
`chmod -R 755 dir`	Recursively set permissions on a directory

FAQ

What is the difference between chmod and chown?
chmod changes the permission bits (read, write, execute) on a file. chown changes the file’s owner and group. Both affect who can access the file, but they control different aspects.

What does chmod 777 mean and is it safe?
777 gives read, write, and execute permission to the owner, group, and all other users. It is rarely appropriate and should be avoided on files that contain sensitive data or are executable by services, as it allows anyone on the system to modify or run them.

Why does a directory need execute permission?
On a directory, execute permission allows you to enter it and access items inside it by name. Without execute permission, you can list the directory contents only in limited cases, but you cannot traverse it with commands such as cd or open files within it.

What is the sticky bit and when should I use it?
The sticky bit on a directory (mode 1xxx, shown as t in ls -l) restricts deletion so that only the file’s owner, the directory’s owner, or root can delete files inside it. It is used on shared directories like /tmp to prevent users from deleting each other’s files.

What is setuid and why is it dangerous?
When set on an executable file, setuid causes the file to run with the owner’s privileges rather than the caller’s. For example, /usr/bin/passwd is setuid root so ordinary users can change their own password. Misusing setuid on custom scripts is a common privilege escalation risk.

How do I view permissions in numeric mode?
Use the stat command: stat -c "%a %n" file. It prints the octal permission value alongside the filename.

Conclusion

In Linux, access to files is controlled through permission bits assigned to three classes — owner, group, and others. Use chmod with symbolic or numeric mode to change permissions, and use ls -l or stat to inspect them. For a focused command reference, see the chmod command guide .

Listing Linux Services with systemctl

hello@linuxize.com (Linuxize) — Wed, 23 Dec 2020 20:11:17 +0100

In Linux, a service is a program that runs in the background . Services can be started on-demand or at boot time.

If you are using Linux as your primary operating system or development platform, you will deal with different services such as a web server, SSH, or cron . Knowing how to list running services or check the service status is important when debugging system issues.

Most recent Linux distributions use systemd as the default init system and service manager. Systemd is a suite of tools for managing Linux systems. It is used to boot up the machine, manage services, automount filesystems, log events, set up the hostname, and other system tasks.

This article explains how to use systemctl to list services, filter by state, and check service status.

Listing Services

Systemd uses the concept of units, which can be services, sockets, mount points, devices, etc. Units are defined using text files in ini format. These files include information about the unit, its settings, and commands to execute. The filename extension defines the unit file type. For example, system service unit files have a .service extension. To write one from scratch, see How to Create a systemd Service File in Linux .

systemctl is a command-line utility used for controlling systemd and managing services. It is part of the systemd ecosystem and is available by default on most modern Linux distributions.

To get a list of all loaded service units, type:

Terminal
sudo systemctl list-units --type service

output

UNIT LOAD ACTIVE SUB DESCRIPTION
cron.service loaded active running Regular background program processing daemon
...

Each line of output contains the following columns from left to right:

UNIT — The name of the service unit.
LOAD — Whether the unit file has been loaded into memory.
ACTIVE — The high-level activation state, which can be active, reloading, inactive, failed, activating, or deactivating. It is a generalization of the SUB column.
SUB — The low-level activation state. The value of this field depends on the unit type. For example, a service unit can be in one of the following states: dead, exited, failed, inactive, or running.
DESCRIPTION — A short description of the unit.

By default, the command lists only the loaded active units. To see loaded but inactive units too, pass the --all option:

Terminal
sudo systemctl list-units --type service --all

Filtering by State

You can use the --state flag to filter services by their current state. This is useful when you want to see only running services or only those that have failed.

To list only running services:

Terminal
systemctl list-units --type service --state=running

To list only failed services:

Terminal
systemctl list-units --type service --state=failed

There is also a shortcut for listing all failed units across the system:

Terminal
systemctl --failed

To list exited services (services that ran once and completed):

Terminal
systemctl list-units --type service --state=exited

Listing Installed Unit Files

The list-unit-files command shows all installed unit files on disk, not just the currently loaded ones. This is useful for checking which services are enabled to start at boot:

Terminal
systemctl list-unit-files --type service

output

UNIT FILE STATE PRESET
cron.service enabled enabled
nginx.service enabled enabled
ssh.service enabled enabled
apparmor.service enabled enabled
apt-daily.service static -
...

The STATE column shows the enable status of each service:

enabled — The service starts automatically at boot.
disabled — The service does not start at boot.
static — The service cannot be enabled directly. It is started only as a dependency of another unit.
masked — The service is completely blocked from starting.

To list only the services that are enabled at boot, you can filter by state:

Terminal
systemctl list-unit-files --type service --state=enabled

Displaying Service Status

To check the status of a service, use the systemctl status command. For example, to determine the current status of the nginx service you would run:

Terminal
sudo systemctl status nginx.service

Tip

You can omit the “.service” suffix. systemctl status nginx is the same as systemctl status nginx.service.

output

● nginx.service - A high performance web server and a reverse proxy server
Loaded: loaded (/lib/systemd/system/nginx.service; enabled; vendor preset: enabled)
Active: active (running) since Mon 2026-03-03 19:13:50 UTC; 4 days ago
Docs: man:nginx(8)
Main PID: 3061064 (nginx)
Tasks: 2 (limit: 470)
Memory: 6.0M
CGroup: /system.slice/nginx.service
├─3061064 nginx: master process /usr/sbin/nginx -g daemon on; master_process on;
└─3061065 nginx: worker process

The command will print the following information:

Loaded — Whether the service unit has been loaded and the full path to the unit file. It also shows whether the unit is enabled to start at boot.
Active — Whether the service is active and running. If your terminal supports colors and the service is active, the dot (●) and “active (running)” part will be printed in green. The line also shows how long the service has been running.
Docs — The service documentation.
Main PID — The process ID of the main service process.
Tasks — The number of tasks accounted for the unit and the tasks limit.
Memory — Information about used memory.
CGroup — Information about related Control Groups.

Quick Status Checks

If you only want to check whether a service is running without the full status output, use the systemctl is-active command. For example, to verify that the nginx service is running, you would run:

Terminal
systemctl is-active nginx.service

output

active

To check whether a service is enabled to start at boot, use systemctl is-enabled:

Terminal
systemctl is-enabled nginx.service

output

enabled

Both commands return an exit status of 0 for true and non-zero for false, which makes them useful inside shell scripts:

sh
if systemctl is-active --quiet nginx; then
 echo "Nginx is running"
fi

The --quiet flag suppresses the text output so only the exit status is used.

Quick Reference

Command	Description
`systemctl list-units --type service`	List loaded active services
`systemctl list-units --type service --all`	List all loaded services including inactive
`systemctl list-units --type service --state=running`	List only running services
`systemctl --failed`	List all failed units
`systemctl list-unit-files --type service`	List all installed service unit files
`systemctl list-unit-files --state=enabled`	List services enabled at boot
`systemctl status service_name`	Show detailed service status
`systemctl is-active service_name`	Check if a service is running
`systemctl is-enabled service_name`	Check if a service starts at boot
`systemctl list-units --no-pager`	List units without pager (useful for scripts)

For a printable quick reference, see the systemctl cheatsheet .

Troubleshooting

Unit service_name.service could not be found
Check the exact unit name with systemctl list-unit-files --type service | grep name. Some services use different unit names than package names.

systemctl output is paged and hard to use in scripts
Add --no-pager to listing and status commands so output is printed directly to stdout.

Service shows failed but status output is too short
Use systemctl status service_name for recent errors, then run journalctl -u service_name for full logs.

You can list services but cannot manage them
Listing usually works without root privileges. Starting, stopping, enabling, and disabling services requires sudo or equivalent administrative permissions.

FAQ

What is the difference between list-units and list-unit-files? list-units shows units that are currently loaded in memory. list-unit-files shows all installed unit files on disk, regardless of whether they are loaded. Use list-unit-files when you want to see which services are enabled or disabled at boot.

Do I need sudo to list services? No. Most systemctl listing and status commands work without sudo. You only need elevated privileges to start, stop, enable, or disable services.

What does a “static” unit file state mean? A static service cannot be enabled or disabled directly with systemctl enable. It is designed to be started only as a dependency of another unit or by manual invocation.

How do I find out why a service failed? Run systemctl status service_name to see the last few log lines. For the full log output, use the journalctl -u service_name command.

Conclusion

We have shown you how to use the systemctl command to list Linux services, filter them by state, and check their status. To view detailed logs for a service, use the journalctl command.

nmap Command in Linux with Practical Examples

hello@linuxize.com (Linuxize) — Wed, 16 Dec 2020 20:31:47 +0100

When you need to see which hosts are online, which ports are open, or which service is listening on a remote system, nmap is usually the first tool to reach for. It is widely used for network inventory, service discovery, troubleshooting, and security reviews.

The nmap command can also detect service versions, guess the remote operating system, and run scripts for deeper checks. This guide explains the most useful nmap options in Linux through practical examples.

Warning

Scan only systems and networks you own or have permission to test. Unauthorized scanning can trigger alerts and may violate local law or policy.

nmap Command Syntax

Use the following syntax when running nmap:

txt
nmap [OPTIONS] TARGET...

OPTIONS - Scan type, host discovery, output, and detection flags such as -sn, -Pn, -sV, or -p.
TARGET - One or more IP addresses, hostnames, CIDR ranges, or target lists.

Installing Nmap

Nmap is available on all major operating systems, including Linux, BSD, macOS, and Windows.

If you prefer a GUI, Nmap also ships with Zenmap .

Official packages and installers are available from the Nmap download page .

Ubuntu, Debian, and Derivatives

Nmap is available from the default Ubuntu and Debian repositories. To install it, run:

Terminal
sudo apt update
sudo apt install nmap

Fedora, RHEL, and Derivatives

On Fedora and other Red Hat derivatives, run:

Terminal
sudo dnf install nmap

macOS

macOS users can install Nmap by downloading the “.dmg” installation package from the Nmap site or via Homebrew:

Terminal
brew install nmap

Windows

The easiest way to install Nmap on Windows is to download and run the installer from the official site.

You can run it from Command Prompt, PowerShell, or Zenmap. For more details, check the post-install usage instructions .

Run a Basic nmap Scan

Nmap is typically used to audit network security, network mapping, identify open ports, and search for online devices. For quick single-port checks or simple TCP/UDP tests, netcat is a lightweight alternative.

The simplest scan targets a single host without any extra options:

Terminal
nmap scanme.nmap.org

When you run nmap as a regular user without raw packet privileges, it falls back to a TCP connect scan (-sT). That means Nmap asks the operating system to complete the TCP connection instead of crafting raw SYN packets itself.

The output includes the responsive host, latency, and the ports Nmap found open or filtered:

output

Starting Nmap 7.91 ( https://nmap.org ) at 2020-12-16 20:19 CET
Nmap scan report for cast.lan (192.168.10.121)
Host is up (0.048s latency).
Not shown: 981 closed ports
PORT STATE SERVICE
21/tcp open ftp
22/tcp open ssh
25/tcp open smtp
53/tcp open domain
80/tcp open http
110/tcp open pop3
143/tcp open imap
443/tcp open https
587/tcp open submission
993/tcp open imaps
995/tcp open pop3s
1025/tcp open NFS-or-IIS
1080/tcp open socks
8080/tcp open http-proxy
8081/tcp open blackice-icecap
Nmap done: 1 IP address (1 host up) scanned in 1.78 seconds

In this example, Nmap reports several open TCP ports such as 22/tcp for SSH and 443/tcp for HTTPS. “Not shown” tells you how many scanned ports were closed and therefore omitted from the main list.

When to Use `sudo nmap`

The most common follow-up question is when to run sudo nmap. On Linux, privileged scans allow Nmap to use raw packets, which enables SYN scanning (-sS) and some advanced detection features.

Run this command to use the default privileged TCP SYN scan:

Terminal
sudo nmap 192.168.10.121

With sudo, Nmap usually switches to SYN scan (-sS). This is generally faster and lighter than a full TCP connect scan, which is why queries such as sudo nmap are so common.

If you want to be explicit, specify the scan type directly:

Terminal
sudo nmap -sS 192.168.10.121

Use -v or -vv for more detailed progress information:

Terminal
sudo nmap -vv 192.168.10.121

To perform a UDP scan, run nmap as root and add -sU:

Terminal
sudo nmap -sU 192.168.10.121

UDP scans are slower because UDP does not confirm closed ports the same way TCP does. For that reason, it is often better to target only the ports you care about.

Nmap also supports IPv6 targets. To scan an IPv6 host, use -6:

Terminal
sudo nmap -6 fd12:3456:789a:1::1

Specify Target Hosts

Nmap treats every non-option argument as a target host.

Tip

Arguments that begin with - or -- are treated as options.

The simplest form is to pass one or more IP addresses or hostnames:

Terminal
nmap 192.168.10.121 host.to.scan

Use CIDR notation to scan a network range:

Terminal
nmap 192.168.10.0/24

You can also use octet ranges. This example scans 192.168.10.1, 192.168.11.1, and 192.168.12.1:

Terminal
nmap 192.168.10-12.1

Commas let you define multiple values in the same octet:

Terminal
nmap 192.168.10,11,12.1

You can combine these forms in one command:

Terminal
nmap 10.8-10.10,11,12.0/28 192.168.1-2.100,101

If you want to confirm the target list before scanning, use -sL:

Terminal
nmap -sL 10.8-10.10,11,12.0/28 192.168.1-2.100,101

This lists the targets without performing a scan, which is useful when you are working with a large or complex range.

To exclude one or more hosts from a range, use --exclude:

Terminal
nmap 10.8-10.10,11,12.0/28 --exclude 10.10.12.12

Scan Specific Ports

By default, Nmap performs a quick scan for the 1000 most popular ports. These ports are not the first 1000 consecutive ports, but the 1000 most commonly used ports ranging from 1 to 65389.

To scan for all ports from 1 through 65535, use the -p- option:

Terminal
nmap -p- 192.168.10.121

Each port can be in one of the following states:

open - A service on the target accepted the connection or probe.
closed - The host responded, but nothing is listening on that port.
filtered - A firewall, packet filter, or network rule prevented Nmap from confirming the port state.

Ports and port ranges are specified with -p.

To scan only port 443, run:

Terminal
nmap -p 443 192.168.10.121

To scan multiple ports, separate them with commas:

Terminal
nmap -p 80,443 192.168.10.121

Use a dash for ranges. This example scans UDP ports 1 through 1024:

Terminal
sudo nmap -sU -p 1-1024 192.168.10.121

You can combine ranges and individual ports:

Terminal
nmap -p 1-1024,8080,9000 192.168.10.121

You can also use service names. For example, this scans the SSH port:

Terminal
nmap -p ssh 192.168.10.121

Discover Live Hosts with `-sn`

To perform host discovery without a port scan, use -sn:

Terminal
sudo nmap -sn 192.168.10.0/24

This tells Nmap to find which hosts are up and skip the port scan stage. It is useful when you want a fast inventory of live systems on a subnet before deciding what to scan next.

Skip Host Discovery with `-Pn`

By default, Nmap performs host discovery first and scans only hosts it believes are online. That behavior is efficient, but it can miss hosts when firewalls drop discovery probes.

Use -Pn to skip host discovery and treat every target as online:

Terminal
sudo nmap -Pn 192.168.10.121

This is especially useful when a host blocks ping or other discovery probes but still has open ports you want to test. The tradeoff is speed: -Pn can make large scans much slower because Nmap attempts the requested scan against every target you specify.

If you see guidance online for -P0 or -PN, that refers to older Nmap syntax. The current option is -Pn.

Disable DNS Name Resolution

Nmap’s default behavior is to perform reverse-DNS resolution for each discovered host, which increases the scan time.

When scanning large ranges, disabling DNS lookups can make the scan noticeably faster. Use -n:

Terminal
sudo nmap -n 192.168.10.0/16

Detect Services, Versions, and OS Details

To identify the service and version behind an open port, use -sV:

Terminal
sudo nmap -sV scanme.nmap.org

This helps when the port number alone is not enough, especially if a service is running on a non-standard port.

output

...
PORT STATE SERVICE VERSION
19/tcp filtered chargen
22/tcp open ssh OpenSSH 6.6.1p1 Ubuntu 2ubuntu2.13 (Ubuntu Linux; protocol 2.0)
80/tcp open http Apache httpd 2.4.7 ((Ubuntu))
135/tcp filtered msrpc
139/tcp filtered netbios-ssn
445/tcp filtered microsoft-ds
9929/tcp open nping-echo Nping echo
31337/tcp open tcpwrapped
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
...

To attempt operating system detection, use -O:

Terminal
sudo nmap -O scanme.nmap.org

If Nmap can fingerprint the remote system, the output looks similar to this:

output

...
Device type: general purpose
Running: Linux 5.X
OS CPE: cpe:/o:linux:linux_kernel:5
OS details: Linux 5.0 - 5.4
Network Distance: 18 hops
OS detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 26.47 seconds

If you want OS detection, version detection, default scripts, and traceroute in one command, use -A:

Terminal
sudo nmap -A 192.168.10.121

Aggressive scan mode is useful during focused testing, but it is heavier and slower than a basic scan. It is usually better to start small and add options as needed.

Save nmap Output

By default, Nmap prints the information to standard output (stdout).

If you scan a large network or need to keep the results, save the output to a file.

To save the normal human-readable output, use -oN:

Terminal
sudo nmap -sU -p 1-1024 192.168.10.121 -oN output.txt

To save XML output for later parsing or import into other tools, use -oX:

Terminal
sudo nmap -sU -p 1-1024 192.168.10.121 -oX output.xml

If you want normal, XML, and grepable output files in one run, use -oA with a base filename:

Terminal
sudo nmap -sV 192.168.10.121 -oA scan-results

This creates files such as scan-results.nmap and scan-results.xml.

Nmap still supports grepable output with -oG, which can be processed with tools such as grep , awk , and cut . However, the Nmap documentation treats grepable output as deprecated, so XML is the better choice for new automation.

Use the Nmap Scripting Engine

One of the most powerful features of Nmap is its scripting engine. Nmap ships with hundreds of scripts , and you can also write your own scripts in the Lua language.

You can use scripts to gather extra information, test specific services, and automate common checks.

For example, this script checks a web target against a malware host list:

Terminal
nmap -sV --script http-malware-host scanme.nmap.org

Because NSE scripts range from simple information gathering to intrusive checks, review the script before running it against production systems.

Quick Reference

Task	Command
Basic scan	`nmap target`
SYN scan as root	`sudo nmap -sS target`
Scan specific ports	`nmap -p 22,80,443 target`
Scan all ports	`nmap -p- target`
Host discovery only	`sudo nmap -sn 192.168.10.0/24`
Skip host discovery	`sudo nmap -Pn target`
Detect service versions	`sudo nmap -sV target`
OS detection	`sudo nmap -O target`
Save normal output	`nmap target -oN output.txt`
Save all major formats	`nmap target -oA scan-results`

Troubleshooting

Host appears down, but you know it is online
Try -Pn to skip host discovery. Some firewalls drop the probes Nmap uses to decide whether a host is up.

UDP scan is taking too long
Limit the ports with -p instead of scanning large UDP ranges. UDP scans are slower and often return less clear feedback than TCP scans.

DNS lookups are slowing the scan
Add -n to skip reverse DNS resolution, especially when scanning large networks.

You are not seeing SYN scan behavior
Run the command with sudo or specify -sS. Without raw packet privileges, Nmap falls back to TCP connect scan.

Conclusion

The nmap command is one of the most useful Linux tools for host discovery, port scanning, and service detection. If you want a lighter tool for quick socket tests, see netcat next.

Chattr Command in Linux (File Attributes)

hello@linuxize.com (Linuxize) — Wed, 09 Dec 2020 20:11:34 +0100

Many Linux filesystems support special file attributes that control how the kernel and system tools handle a file. You can mark a file as immutable so it cannot be changed or removed by mistake, or set a log file to append-only so new entries can be added without allowing old ones to be overwritten. These attributes work separately from standard permission bits , and support depends on the filesystem.

The chattr command sets or removes supported attributes, and its companion lsattr displays them. This guide explains the most useful flags with practical examples.

`chattr` Syntax

The chattr command takes the following general form:

txt
chattr [OPTIONS] [OPERATOR][ATTRIBUTES] FILE...

The [OPERATOR] is one of three symbols:

+ - Add the specified attributes to the existing ones.
- - Remove the specified attributes from the existing ones.
= - Set the specified attributes as the only attributes, replacing all others.

The operator is followed by one or more [ATTRIBUTES] flags. The most useful flags are:

i - Immutable. The file cannot be modified, deleted, renamed, or linked to. Only root or a process with the required capability can set or clear this flag.
a - Append only. The file can only be opened in append mode for writing. Existing content cannot be overwritten or truncated. Only root or a process with the required capability can set or clear this flag.
A - No atime updates. The kernel will not update the access time (atime) when the file is read.
d - No dump. The file is skipped by the dump backup program.
e - Extents. The file uses extents for mapping blocks on disk. This flag may appear in lsattr output, but it cannot be removed with chattr.
s - Secure deletion. This flag is documented by chattr, but current ext2, ext3, and ext4 kernels do not honor it.
S - Synchronous updates. Changes to the file are written to disk immediately.
j - Data journaling. File data is written to the ext3 or ext4 journal before being written to the file itself.
u - Undeletable. This flag is documented by chattr, but current ext2, ext3, and ext4 kernels do not honor it.

For the full list, run man chattr.

The most commonly used option is:

-R - Apply attribute changes recursively to directories and their contents.

By default, file attributes are not preserved when copying a file with commands like cp or rsync .

Viewing Attributes with `lsattr`

Before changing attributes, you need to see what is already set. The lsattr command shows the current attribute flags for one or more files:

Terminal
lsattr todo.txt

output

--------------e----- todo.txt

Each position in the output corresponds to an attribute flag. In this case only the e (extents) flag is set, which is the default on ext4 filesystems.

If you prefer descriptive names instead of single-letter flags, use -l:

Terminal
lsattr -l todo.txt

You can also pass a directory to lsattr to see the attributes of every file inside it. This is helpful when auditing a configuration directory like /etc/:

Terminal
lsattr /etc/

By default this skips hidden files. Add -a to include dot files in the listing:

Terminal
lsattr -a /etc/

If you want to see the attributes of the directory itself rather than its contents, use -d:

Terminal
lsattr -d /etc/

For a full recursive listing of a directory tree, use -R:

Terminal
lsattr -R /etc/

Making a File Immutable

One of the most common uses of chattr is making a file immutable so it cannot be modified, deleted, or renamed.

Create a test file and set the immutable flag with +i:

Terminal
touch ~/demo.txt
sudo chattr +i ~/demo.txt

We use sudo because changing the immutable flag requires elevated privileges.

Verify the change:

Terminal
lsattr ~/demo.txt

output

----i---------e----- /home/user/demo.txt

The i flag now appears in the output. If you try to remove the file, the operation will fail:

Terminal
rm ~/demo.txt

output

rm: cannot remove '/home/user/demo.txt': Operation not permitted

To remove the immutable flag when you need to edit or delete the file again:

Terminal
sudo chattr -i ~/demo.txt

After clearing the flag, you can modify or remove the file normally.

Setting Append-Only Mode

The a (append-only) attribute is useful for log files. It allows new data to be appended but prevents existing content from being overwritten or truncated.

Create a test file and enable append-only mode:

Terminal
touch /tmp/app.log
sudo chattr +a /tmp/app.log

After setting this flag, you can still append to the file:

Terminal
echo "new entry" | sudo tee -a /tmp/app.log

But attempting to overwrite it will fail:

Terminal
echo "overwrite" | sudo tee /tmp/app.log

output

tee: /tmp/app.log: Operation not permitted

This restriction applies to new write attempts. As the chattr manual notes, existing open file descriptors are not affected retroactively.

To remove the append-only flag:

Terminal
sudo chattr -a /tmp/app.log

Combining Multiple Attributes

You can set or remove multiple attributes in a single command. For example, to make a file immutable and disable atime updates:

Terminal
sudo chattr +iA todo.txt

Verify:

Terminal
lsattr todo.txt

output

----i------A--e----- todo.txt

To remove both at once:

Terminal
sudo chattr -iA todo.txt

Using the `=` Operator

The = operator replaces the current user-settable attributes with exactly the ones you specify. For example, to leave a file with only the A flag set:

Terminal
sudo chattr =A todo.txt

This clears other changeable flags such as i or a and keeps A. Filesystem-managed flags such as e may still appear in lsattr output.

Applying Attributes Recursively

The -R flag applies attribute changes to a directory and everything inside it. Start with a test directory before you use it on system paths:

Terminal
mkdir -p ~/demo-config/subdir
touch ~/demo-config/app.conf ~/demo-config/subdir/site.conf
sudo chattr -R +i ~/demo-config/

Every file and subdirectory under ~/demo-config/ is now immutable. To reverse it:

Terminal
sudo chattr -R -i ~/demo-config/

Warning

Be careful with recursive immutable flags. If you apply them to a system directory such as /etc/nginx/, package managers and configuration tools will fail to update files there. Remove the flag before running updates.

Quick Reference

Task	Command
View attributes	`lsattr file`
View attributes recursively	`lsattr -R /path/`
Make file immutable	`sudo chattr +i file`
Remove immutable flag	`sudo chattr -i file`
Set append-only	`sudo chattr +a file`
Remove append-only	`sudo chattr -a file`
Disable atime updates	`sudo chattr +A file`
Skip dump backups	`sudo chattr +d file`
Apply recursively	`sudo chattr -R +i /dir/`
Set exact attributes	`sudo chattr =A file`

Troubleshooting

“Operation not permitted” when setting attributes
Only root can set the i and a flags. Run the command with sudo.

“Operation not permitted” even with sudo
Some filesystems and mount setups do not support these file attribute flags. Verify the filesystem type with df -T /path/to/file and confirm it supports chattr.

Cannot delete or modify a file unexpectedly
Someone may have set the immutable flag. Check with lsattr file and look for the i flag. Remove it with sudo chattr -i file.

Package updates fail with “Operation not permitted”
If you applied chattr +i recursively to a system directory like /etc/, package managers will not be able to update configuration files. Remove the flag with sudo chattr -R -i /etc/directory/ before running updates.

Conclusion

The chattr and lsattr commands give you filesystem-level control over how files can be modified, deleted, or backed up. For related file permission management, see the chmod and chown guides.

Linux Commands on Linuxize

npm Command: Install and Manage Node.js Packages

Syntax #

Initialize a Project #

Install Packages #

Install Global Packages #

Install a Specific Version #

Update and Inspect Packages #

Remove Packages #

Run Scripts #

List Installed Packages #

Run a Package Without Installing It #

Quick Reference #

Troubleshooting #

FAQ #

Conclusion #

Fix "sudo: command not found" on Linux

Quick Reference #

Confirm the Real Cause #

Install sudo on Debian, Ubuntu, and Derivatives #

Install sudo on Fedora, RHEL, and Derivatives #

Install sudo on Arch Linux #

Install sudo on Alpine Linux #

Add Your User to the sudo Group #

Fix a Broken PATH #

Troubleshooting #

FAQ #

Conclusion #

dpkg Command in Linux: Install and Manage Debian Packages

Syntax #

Install a Package #

Remove a Package #

List Installed Packages #

List Files Installed by a Package #

Find Which Package Owns a File #

Show Package Details #

Inspect a .deb File Without Installing #

Extract a Package Without Installing #

Export and Restore Package Selections #

Reconfigure an Installed Package #

Fix Broken Package State #

Troubleshooting #

Quick Reference #

Conclusion #

iptables Command in Linux: Manage Firewall Rules

Tables and Chains #

iptables Syntax #

List Rules #

Add and Remove Rules #

Allow and Block Specific IPs #

Allow Established Connections #

Set a Default Policy #

Flush Rules #

Save and Restore Rules #

Troubleshooting #

Quick Reference #

FAQ #

Conclusion #

ripgrep Command in Linux: Fast Recursive Search

Installing ripgrep #

Syntax #

Basic Search #

Filtering by File Type #

Case-Insensitive Search #

Fixed String Search #

Counting and Listing Matches #

Context Lines #

Multiple Patterns #

Whole-Word Match #

Invert Match #

Searching Hidden Files and Ignoring .gitignore #

Replacing Output #

Showing Only the Match #

ripgrep Configuration File #

Troubleshooting #

Options Reference #

Quick Reference #

Conclusion #

whois Command in Linux: Query Domain Registration Info

whois Syntax #

Syntax

Initialize a Project

Install Packages

Install Global Packages

Install a Specific Version

Update and Inspect Packages

Remove Packages

Run Scripts

List Installed Packages

Run a Package Without Installing It

Quick Reference

Troubleshooting

FAQ

Conclusion

Quick Reference

Confirm the Real Cause

Install sudo on Debian, Ubuntu, and Derivatives

Install sudo on Fedora, RHEL, and Derivatives

Install sudo on Arch Linux

Install sudo on Alpine Linux

Add Your User to the sudo Group

Fix a Broken PATH

Troubleshooting

FAQ

Conclusion

Syntax

Install a Package

Remove a Package

List Installed Packages

List Files Installed by a Package

Find Which Package Owns a File

Show Package Details

Inspect a .deb File Without Installing

Extract a Package Without Installing

Export and Restore Package Selections

Reconfigure an Installed Package

Fix Broken Package State

Troubleshooting

Quick Reference

Conclusion

Tables and Chains

iptables Syntax

List Rules

Add and Remove Rules

Allow and Block Specific IPs

Allow Established Connections

Set a Default Policy

Flush Rules

Save and Restore Rules

Troubleshooting

Quick Reference

FAQ

Conclusion

Installing ripgrep

Syntax

Basic Search

Filtering by File Type

Case-Insensitive Search

Fixed String Search

Counting and Listing Matches

Context Lines

Multiple Patterns

Whole-Word Match

Invert Match

Searching Hidden Files and Ignoring .gitignore

Replacing Output

Showing Only the Match

ripgrep Configuration File

Troubleshooting

Options Reference

Quick Reference

Conclusion

whois Syntax

Install whois

Look Up a Domain

Look Up an IP Address

Look Up an AS Number

Pick a Specific WHOIS Server

Limit the Recursion

Filter the Output