One-Liners

61 COMMANDS · ALL TESTED · ZERO MYSTERY FLAGS

Every command here is one you’ll eventually need at 11pm with a failing deploy on the other screen — written as a single copy-pasteable line, with a plain-words comment saying exactly what it does. Nothing exotic: these are the moves the old hands actually type, not a collection of flags somebody discovered once and never used again. Skim a category before you need it, and future-you gets to look like they memorized the man page.

The comment line above each command is the contract — if the comment says it kills a process on port 3000, that’s what it does, no more. Most of these are destructive in obvious ways (delete, kill, reset): read the comment, run the dry-run variant first when there is one (find ... -print instead of -delete, git clean -n instead of -f, du before rm), and only then swap in the version that changes the world. Commands assume bash or zsh on a Unix box; where macOS and Linux differ (they mostly disagree about sed -i and sort -h), the note says so.

//files-text

# Delete every .log file older than 7 days under /var/log (swap -print for -delete to actually do it)
find /var/log -name '*.log' -mtime +7 -print

# Search every file in this tree for TODO, showing filename and line number
grep -rn 'TODO' .

# Replace allow=1 with allow=2 in a file in place (macOS needs the .bak; on Linux use -i '' style: sed -i 's/.../.../' file)
sed -i.bak 's/allow=1/allow=2/' config.ini

# Print only the second column of a CSV (splits on commas, so "quoted,commas" will bite you)
awk -F, '{print $2}' data.csv

# Count duplicate lines and show the most common ones first
sort names.txt | uniq -c | sort -rn

# Show a config file without the comment lines and blank lines
grep -vE '^\s*(#|$)' app.conf

List files in this tree modified in the last 24 hours (swap to -mtime +7 for "older than a week")
find . -type f -mtime -1 -print

Make every .sh script in the tree executable in one pass — {} batches them into a single chmod
find . -type f -name '*.sh' -exec chmod +x {} +

Collapse duplicate lines to one distinct value each — sort | uniq folded into one flag
sort -u names.txt

Add up every number in the first column of a file and print the total
awk '{s+=$1} END {print s}' nums.txt

//processes-system

# Find the line for a process by name without grep matching itself (the bracket trick)
ps aux | grep '[s]leep 3333'

# Get just the PID of whatever matches a full command line
pgrep -f 'sleep 3333'

# Pause a process without killing it (stays alive but frozen — resume with kill -CONT <pid>)
kill -STOP <pid>

# See which process is listening on port 3000 (name and PID)
lsof -i :3000

# Kill whatever is squatting on port 3000, no questions asked
kill -9 $(lsof -t -i:3000)

# Kill every process whose full command line matches a pattern
pkill -f 'sleep 3333'

# Show the ten processes eating the most memory right now
ps aux | sort -rk 4 | head -10

Top CPU eaters by PID and command, sorted by the process table itself (macOS/BSD: -r sorts by CPU; on Linux use --sort=-pcpu)
ps -eo pcpu,pid,comm -r | head -5

Inventory every TCP port currently listening, with the owning process (-n -P keep IPs and ports numeric)
lsof -iTCP -sTCP:LISTEN -n -P

//disks-filesizes

# Human-readable size of every item in the current directory, biggest first
du -sh * | sort -rh

# Same idea, one level deep: which subdirectory is the space hog
du -h -d 1 . | sort -rh | head -20

# Disk free space in human units, one line per mount
df -h

# Find every file over 100MB under the current tree (dry run — nothing is deleted)
find . -type f -size +100M

# Check whether you're running out of inodes, not disk space (df -h lies to you here)
df -i

//tar-archives

Tarball a directory but never pack the junk: logs and node_modules are excluded at creation
tar -czf site-backup.tar.gz --exclude='*.log' --exclude='node_modules' site/

Stream a gzip tarball to stdout — pipe it over ssh or straight into a second tar to list what's inside
tar -czf - site/ | tar -tz

Peek inside a .tar.gz without unpacking it (drop the z for plain .tar)
tar -tzf site-backup.tar.gz

//network-curl

# Get just the HTTP status code from a URL — 200, 404, 500 — and nothing else
curl -so /dev/null -w '%{http_code}\n' https://example.com

# Fetch your public IP address as plain text
curl -s ifconfig.me

# Resolve a hostname to its IP addresses, short and clean
dig +short example.com

# Mirror a directory from one machine to another, resumable, with a progress bar
rsync -avz --partial --progress src/ user@host:/srv/src/

# Jump through a bastion host to reach a machine that isn't publicly reachable
ssh -J user@jumphost user@target

# Reuse one SSH connection for the next 10 minutes so logins stop costing 3 seconds each
ssh -o ControlMaster=auto -o ControlPath=/tmp/ssh-%r@%h:%p -o ControlPersist=10m user@host

Is a host:port reachable? Exit 0 means open, 1 means refused — wire it straight into an if
nc -z -w 2 example.com 443; echo $?

Smoke-test an endpoint in one line: HTTP status and total time, body thrown away
curl -s -o /dev/null -w 'HTTP %{http_code} in %{time_total}s\n' https://example.com

When does a site's TLS certificate expire? Handshake noise dropped, only the dates printed
echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null | openssl x509 -noout -dates

//git

# See the whole branch landscape: one line per commit, graph lines, branch labels
git log --oneline --graph --all --decorate

# Jump back to the branch you were just on (like cd -, but for git)
git checkout -

# Stash your uncommitted work with a reminder of why
git stash push -m "wip before pull"

# Put your stashed work back and drop the stash entry in one move
git stash pop

# Undo the last commit but keep every change staged, ready to recommit
git reset --soft HEAD~1

# Preview which untracked files a `git clean -fd` would delete (dry run)
git clean -fdn

# Delete every branch that's fully merged, except the one you're on and main/master
git branch --merged | grep -vE '^\*|main|master' | xargs -n 1 git branch -d

Who wrote this line and when — with whitespace-only churn ignored (-w)
git blame -w -- index.html

What did the last three commits change, as files touched and +/- line counts
git diff --stat HEAD~3

//jq-json

# Pretty-print and validate JSON from an API (bad JSON exits nonzero)
curl -s https://api.github.com/repos/git/git | jq .

# Pull one field out of a JSON response as plain text, no quotes
curl -s https://api.github.com/repos/git/git | jq -r '.stargazers_count'

# List one field from every element in a JSON array
jq -r '.[] | .name' issues.json

# Keep only the array elements that match a condition, then take a field
jq '.[] | select(.state == "open") | .name' issues.json

# Print each array element on one compact line — one JSON object per line, ready for grep
jq -c '.[]' issues.json

# Discover a JSON object's shape: list all its keys
jq -r 'keys[]' issues.json

# Supply a fallback value when a field is missing or null
jq -r '.mirror // "https://fallback.example"' config.json

Tally JSON objects per value of a field — counts by state, no for loop
jq 'group_by(.state) | map({(.[0].state): length}) | add' orders.json

//history-shell-tricks

# List your 20 most recent history entries by number
fc -l -20

# Rerun the previous command as root because you forgot sudo
sudo !!

# Insert the last argument of the previous command at the cursor (Esc then . in bash/zsh)

# e.g. after `mkdir -p /long/path/x`, type `cd` then Esc-.
cd <Esc-.>

# Search your history interactively as you type (bash and zsh)

# Ctrl-R, then type a fragment; press Ctrl-R again to cycle older matches

# Repeat the last command that started with "git" (full word match, use !-1 for anything)
!git

# Redo the last command and fix a typo in it (finds/replace across the whole line)
^chaown^chown