System Administration Commands

System administration commands are essential for maintaining Linux systems, diagnosing failures, and automating routine

System administration commands are essential for maintaining Linux systems, diagnosing failures, and automating routine work. They give operators a direct way to inspect resources, manage services, control processes, adjust permissions, and investigate network or disk issues. While command names may vary slightly between distributions, most core tools follow familiar Unix conventions.
Before troubleshooting a problem, establish a clear picture of the host and its resource usage.

  • uname -a displays the kernel version, hostname, architecture, and other system details.
  • uptime shows how long the machine has been running, along with load averages and logged-in users.
  • free -h presents memory and swap usage in a human-readable format.
  • df -h reports filesystem capacity and current disk utilization.
  • du -sh /var/log calculates the total size of a directory.
  • lsblk -f lists block devices, mount points, and filesystem types.

A quick initial check can combine several of these commands:

uname -a
uptime
free -h
df -h
lsblk -f

Load averages, available memory, and filesystem capacity often reveal the direction of an investigation. A full root filesystem or unusually high memory pressure can explain services that are slow or unresponsive.

Managing Processes

Process tools help identify running programs, monitor resource consumption, and terminate tasks safely.

  • ps aux lists all processes with user, PID, CPU usage, memory usage, and command line.
  • top provides a live system overview; htop offers a more colorful, interactive alternative when installed.
  • pgrep -a nginx finds processes by name and displays their full command lines.
  • kill -15 PID sends SIGTERM, asking a process to shut down gracefully.
  • kill -9 PID sends SIGKILL, which forcibly stops the process without cleanup.
  • nohup allows a command to continue after the terminal closes.

For example:

ps aux | grep nginx
pgrep -a nginx
kill -15 1234

Prefer SIGTERM when possible. A process may need time to close connections, release locks, and remove temporary files. Use SIGKILL only when the process fails to stop or is demonstrably stuck. To run a long task in the background, redirect its output so it does not block the terminal:

nohup ./worker.sh > worker.log 2>&1 &

Managing Users and Permissions

Linux supports multiple users and groups, so access should be granted only as required.

  • useradd -m -s /bin/bash alice creates a user, home directory, and login shell.
  • passwd alice sets or changes the user’s password.
  • usermod -aG sudo alice adds the user to the administrative sudo group.
  • userdel -r alice removes the user and associated home-directory data.
  • chmod changes file or directory permissions.
  • chown changes the owning user and group.
  • sudo command runs a command with elevated privileges.

Example:

sudo useradd -m -s /bin/bash alice
sudo passwd alice
sudo usermod -aG sudo alice
sudo chown -R alice:alice /data

Numeric permissions such as 750 mean that the owner can read, write, and traverse; the group can read and traverse; and other users receive no access. Symbolic modes such as chmod u+x script.sh are often easier to interpret. Group names differ by distribution, so confirm the appropriate administrative group before adding a user.

Avoid working as root for routine tasks. Run individual commands through sudo when elevated access is necessary, and use sudo -v to refresh credentials when working through a long sequence of administrative operations.

Controlling Services with systemd

Most modern Linux distributions use systemd to manage services.

systemctl status nginx
sudo systemctl start nginx
sudo systemctl stop nginx
sudo systemctl restart nginx
sudo systemctl enable --now nginx

enable --now both enables automatic startup at boot and starts the service immediately. After changing unit files, run sudo systemctl daemon-reload before applying the changes.

Service logs are available through journalctl:

journalctl -u nginx
journalctl -u nginx -n 50
journalctl -u nginx -f

The final command follows new log entries in real time. To inspect the current boot, use journalctl -b. For broader troubleshooting, journalctl -xe combines detailed output with relevant systemd messages.

Host-level commands include shutdown -h now, reboot, and systemctl poweroff. Schedule shutdowns in advance when possible, and notify affected users before taking a shared system offline.

Diagnosing Network Issues

Network troubleshooting usually involves checking addresses, routes, listening ports, and application responses.

  • ip addr show displays interfaces and assigned IP addresses.
  • ip route show presents the routing table.
  • ss -tulnp lists listening TCP and UDP sockets and their owning processes.
  • ping -c 4 8.8.8.8 tests basic IP connectivity.
  • traceroute host helps identify where a network path is interrupted.
  • curl -I https://example.com retrieves HTTP response headers.
  • dig host queries DNS records.

Useful combinations include:

ip addr show
ip route show
ss -tulnp
curl -I https://example.com

If a local service cannot be reached, first confirm that it is running and listening on the expected interface and port. Then test the service locally, inspect the firewall, and verify any reverse proxy or load-balancer configuration. A successful ping does not guarantee that application ports are reachable.

On systems using ufw, allow required services by name when supported:

sudo ufw allow OpenSSH
sudo ufw allow 22/tcp
sudo ufw status verbose

Working with Disks and Filesystems

Disk administration covers device inspection, partitioning, formatting, mounting, and backup.

  • lsblk shows disks and partitions.
  • fdisk -l displays partition tables.
  • mkfs.ext4 /dev/sdb1 creates an ext4 filesystem.
  • mount /dev/sdb1 /mnt/data mounts a filesystem.
  • umount /mnt/data unmounts it.
  • tar -czf backup.tar.gz /data creates a compressed archive.
  • rsync -avz /data/ user@host:/backup/ synchronizes files to another host.

Example:

sudo mkfs.ext4 /dev/sdb1
sudo mount /dev/sdb1 /mnt/data
rsync -avz /data/ user@192.168.1.10:/backup/

Formatting and partitioning commands are destructive. Confirm the device identifier with lsblk before running them, and never format a device containing needed data. Add persistent mount information to /etc/fstab only after testing the mount manually.

For backups, verify that files were actually created and periodically restore a sample. A backup command that exits successfully is not proof that the archive is complete or usable.

Reviewing Logs During Troubleshooting

Logs provide evidence about service failures, kernel warnings, authentication events, and hardware problems.

  • dmesg -T | tail -20 shows recent kernel messages with readable timestamps.
  • journalctl -xe displays detailed systemd logs and errors.
  • tail -f /var/log/syslog follows a traditional log file.
  • grep -i "failed" /var/log/syslog filters lines containing a specific error term.

Useful targeted searches include:

journalctl -u nginx --since "30 minutes ago"
journalctl -k -b | grep -i error
grep -i "failed" /var/log/syslog

Start with the service-specific journal, then expand the search to system and kernel logs. Timestamps are essential when correlating an application error with a network outage, resource shortage, or hardware event.

Updating Packages

Package managers differ between Linux distributions:

  • Debian and Ubuntu: apt update, apt upgrade, and apt install nginx
  • RHEL, Fedora, and CentOS: dnf update, dnf install nginx, or the equivalent yum commands
  • Arch Linux: pacman -Syu and pacman -S nginx

For Debian-based systems:

sudo apt update
sudo apt upgrade
sudo apt install -y nginx

apt update refreshes package metadata but does not upgrade installed packages. Review pending changes before running a broad upgrade, especially on production servers. Production automation should also account for configuration-file prompts, service restarts, and application compatibility.

Practical Administration Habits

Good system administration combines command-line knowledge with disciplined habits:

  • Verify targets before deleting files, formatting disks, stopping services, or rebooting.
  • Use least privilege and avoid permanent root sessions.
  • Back up configuration files before editing them.
  • Read the manual with man command or command --help when an option is unfamiliar.
  • Capture routine checks in scripts and schedule them through cron or systemd timers.
  • Document changes, including the command, time, affected host, and result.
  • Test backups rather than assuming successful completion guarantees recoverability.

With these commands and practices, administrators can move from basic system inspection to focused troubleshooting while maintaining safer and more repeatable Linux operations.