One-Liners

# List .log files older than 7 days under /var/log. To delete them, check the list first, then swap -print for -delete.
find /var/log -name '*.log' -mtime +7 -print

# Search every file in this tree for TODO, showing filename and line number
grep -rn 'TODO' .

# Replace allow=1 with allow=2 in place, keeping config.ini.bak (-i.bak works on GNU and macOS sed; no backup: GNU sed -i, macOS sed -i '')
sed -i.bak 's/allow=1/allow=2/' config.ini

# Print only the second column of a CSV (splits on commas, so "quoted,commas" will bite you)
awk -F, '{print $2}' data.csv

# Count duplicate lines and show the most common ones first
sort names.txt | uniq -c | sort -rn

# Show a config file without the comment lines and blank lines
grep -vE '^\s*(#|$)' app.conf

# List files in this tree modified in the last 24 hours (swap to -mtime +7 for "older than a week")
find . -type f -mtime -1 -print

# Make every .sh script in the tree executable in one pass — {} batches them into a single chmod
find . -type f -name '*.sh' -exec chmod +x {} +

# Collapse duplicate lines to one distinct value each — sort | uniq folded into one flag
sort -u names.txt

# Add up every number in the first column of a file and print the total
awk '{s+=$1} END {print s}' nums.txt

# Count the lines in a file
wc -l names.txt

# Show what changed between two files: minus lines left, plus lines arrived
diff -u old.conf new.conf

# What kind of file this is, from the bytes, not the extension
file mystery.bin

# Make a unique temp file and print its path. The file is empty until you write to it.
mktemp

# Follow a log as it grows. Ctrl-C stops the follow. The file stays.
tail -n 40 -f app.log

# Lines that appear in both lists (comm only works on sorted input, so each side is sorted on the way in)
comm -12 <(sort inventory.txt) <(sort monitored.txt)

# Lines in the first list that are missing from the second (swap to -13 for the other way round)
comm -23 <(sort inventory.txt) <(sort monitored.txt)

# Compare two commands' output without temp files: here, which files differ between two directories by name
diff <(ls old) <(ls new)

# Match two CSVs on their first column; headers are dropped first, otherwise "host" gets sorted in with the data
join -t, <(tail -n +2 hosts.csv | sort -t, -k1,1) <(tail -n +2 owners.csv | sort -t, -k1,1)

# Fold a list onto one line with commas between items, e.g. to pass hosts to a tool that wants a,b,c
comm -12 <(sort inventory.txt) <(sort monitored.txt) | paste -sd, -

# Find the line for a process by name without grep matching itself (the bracket trick)
ps aux | grep '[s]leep 3333'

# Get just the PID of whatever matches a full command line
pgrep -f 'sleep 3333'

# Pause a process without killing it (stays alive but frozen — resume with kill -CONT <pid>)
kill -STOP <pid>

# See which process is listening on port 3000 (name and PID)
lsof -i :3000

# Kill whatever is squatting on port 3000, no questions asked
kill -9 $(lsof -t -i:3000)

# Kill every process whose full command line matches a pattern
pkill -f 'sleep 3333'

# Show the ten processes eating the most memory right now
ps aux | sort -rk 4 | head -10

# Top CPU eaters by PID and command, sorted by the process table itself (macOS/BSD: -r sorts by CPU; on Linux use --sort=-pcpu)
ps -eo pcpu,pid,comm -r | head -5

# Inventory every TCP port currently listening, with the owning process (-n -P keep IPs and ports numeric)
lsof -iTCP -sTCP:LISTEN -n -P

# Human-readable size of every item in the current directory, biggest first
du -sh * | sort -rh

# Same idea, one level deep: which subdirectory is the space hog
du -h -d 1 . | sort -rh | head -20

# Disk free space in human units, one line per mount
df -h

# Find every file over 100MB under the current tree (dry run — nothing is deleted)
find . -type f -size +100M

# Check whether you're running out of inodes, not disk space (df -h lies to you here)
df -i

# How much disk images, containers, volumes and build cache use, and how much a prune could free
docker system df

# No dry run for prune, so look first. In Docker 29's default view, images without U (in use) in EXTRA have no container, running or stopped, and would go with -a. So would untagged images, which only show with -a.
docker image ls -a

# Remove every image no container uses, except ones labelled keep=true
docker image prune -a --filter 'label!=keep=true'

# Show the last 10 minutes of a container's log and keep following it (Ctrl-C to stop)
docker logs --since 10m -f web

# One snapshot of CPU, memory and process count, then exit (no live screen); leave off the names for all running containers
docker stats --no-stream --format 'table {{.Name}}\t{{.CPUPerc}}\t{{.MemUsage}}\t{{.PIDs}}' web

# State, start time, restart count and restart policy for several containers, one line each
docker inspect --format '{{.Name}} {{.State.Status}} started={{.State.StartedAt}} restarts={{.RestartCount}} policy={{.HostConfig.RestartPolicy.Name}}' web <container>

# Tarball a directory but never pack the junk: logs and node_modules are excluded at creation
tar -czf site-backup.tar.gz --exclude='*.log' --exclude='node_modules' site/

# Stream a gzip tarball to stdout — pipe it over ssh or straight into a second tar to list what's inside
tar -czf - site/ | tar -tz

# Peek inside a .tar.gz without unpacking it (drop the z for plain .tar)
tar -tzf site-backup.tar.gz

# Get just the HTTP status code from a URL — 200, 404, 500 — and nothing else
curl -so /dev/null -w '%{http_code}\n' https://example.com

# Fetch your public IP address as plain text
curl -s ifconfig.me

# Resolve a hostname to its IP addresses, short and clean
dig +short example.com

# Mirror a directory from one machine to another, resumable, with a progress bar
rsync -avz --partial --progress src/ user@host:/srv/src/

# Jump through a bastion host to reach a machine that isn't publicly reachable
ssh -J user@jumphost user@target

# Reuse one SSH connection for the next 10 minutes so logins stop costing 3 seconds each
ssh -o ControlMaster=auto -o ControlPath=/tmp/ssh-%r@%h:%p -o ControlPersist=10m user@host

# Is a host:port reachable? Exit 0 means open, 1 means refused — wire it straight into an if
nc -z -w 2 example.com 443; echo $?

# Smoke-test an endpoint in one line: HTTP status and total time, body thrown away
curl -s -o /dev/null -w 'HTTP %{http_code} in %{time_total}s\n' https://example.com

# When does a site's TLS certificate expire? Handshake noise dropped, only the dates printed
echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null | openssl x509 -noout -dates

# Reach a host behind a bastion in one command, ignoring every config file (-F none), user given per hop
ssh -F none -J lab@bastion.example.com lab@target.example.com hostname

# Print the settings ssh would use for this host after every Host block is applied, without connecting
ssh -G target | grep -i proxy

# Does the host answer and does key login work? Exit 0 means yes. With ProxyJump, put BatchMode and ConnectTimeout in the bastion's Host block too.
ssh -o ConnectTimeout=5 -o BatchMode=yes target true && echo ok

# The quoted part runs on the target; everything after the closing quote runs on your machine
ssh target 'cat /etc/os-release' | grep '^PRETTY'

# Is a multiplexed master connection open for this host? Then close it (needs ControlPath in your config)
ssh -O check target && ssh -O exit target

# See the whole branch landscape: one line per commit, graph lines, branch labels
git log --oneline --graph --all --decorate

# Jump back to the branch you were just on (like cd -, but for git)
git checkout -

# Stash your uncommitted work with a reminder of why
git stash push -m "wip before pull"

# Put your stashed work back and drop the stash entry in one move
git stash pop

# Undo the last commit but keep every change staged, ready to recommit
git reset --soft HEAD~1

# Preview which untracked files a `git clean -fd` would delete (dry run)
git clean -fdn

# Delete every branch that's fully merged, except the one you're on and main/master
git branch --merged | grep -vE '^\*|main|master' | xargs -n 1 git branch -d

# Who wrote this line and when — with whitespace-only churn ignored (-w)
git blame -w -- index.html

# What did the last three commits change, as files touched and +/- line counts
git diff --stat HEAD~3

# Which commits added or removed this exact string (it counts occurrences, so edits that keep the count are skipped)
git log -S 'MAX_RETRIES' --oneline

# Which commits added or removed a line matching a regex, including edits that only changed a value
git log -G 'MAX_RETRIES[[:space:]]*=[[:space:]]*[0-9]+' --oneline

# Full history of one file, including the commits from before it was renamed
git log --follow --oneline -- src/settings.py

# Search the files in every commit for a pattern (it reads each commit's whole tree, so it is slow on big repos)
git grep -n 'MAX_RETRIES' $(git rev-list --all)

# Find a commit you lost to git reset: the reflog lists every commit HEAD has pointed at recently
git reflog -n 5

# Look at the commit first (use the ID from the reflog; HEAD@{1} moves whenever HEAD does, even after git stash)
git show --stat 821878c

# If it's the one, give it a branch name (fails rather than overwrites if "rescue" already exists)
git branch rescue 821878c

# Pretty-print and validate JSON from an API (bad JSON exits nonzero)
curl -s https://api.github.com/repos/git/git | jq .

# Pull one field out of a JSON response as plain text, no quotes
curl -s https://api.github.com/repos/git/git | jq -r '.stargazers_count'

# List one field from every element in a JSON array
jq -r '.[] | .name' issues.json

# Keep only the array elements that match a condition, then take a field
jq '.[] | select(.state == "open") | .name' issues.json

# Print each array element on one compact line — one JSON object per line, ready for grep
jq -c '.[]' issues.json

# Discover a JSON object's shape: list all its keys
jq -r 'keys[]' issues.json

# Supply a fallback value when a field is missing or null
jq -r '.mirror // "https://fallback.example"' config.json

# Tally JSON objects per value of a field — counts by state, no for loop
jq 'group_by(.state) | map({(.[0].state): length}) | add' orders.json

# List your 20 most recent history entries by number
fc -l -20

# Rerun the previous command as root because you forgot sudo
sudo !!

# Insert the last argument of the previous command at the cursor (Esc then . in bash/zsh)

# e.g. after `mkdir -p /long/path/x`, type `cd` then Esc-.
cd <Esc-.>

# Search your history interactively as you type (bash and zsh)

# Ctrl-R, then type a fragment; press Ctrl-R again to cycle older matches

# Repeat the last command that started with "git" (full word match, use !-1 for anything)
!git

# Redo the last command and fix a typo in it (finds/replace across the whole line)
^chaown^chown