Advanced CLI Operations | Advanced Linux Administration

# Classic pipe: stdout flows left-to-right ps aux | grep 'nginx' | awk '{print $2, $11}' # stderr bypasses the pipe by default — errors appear on terminal find /etc -name '*.conf' | wc -l # Permission errors go to terminal # Merge stderr into stdout before piping find /etc -name '*.conf' 2>&1 | grep -v 'Permission denied' | wc -l # Pipe to tee: write to file AND continue the pipeline journalctl -u nginx | tee /tmp/nginx.log | grep 'error'

# Create a named pipe (FIFO) mkfifo /tmp/grid-feed # Terminal 1 — writer: continuously send data into the FIFO tail -f /var/log/syslog > /tmp/grid-feed # Terminal 2 — reader: consume from the FIFO and filter grep --line-buffered 'CRIT' /tmp/grid-feed | tee /var/log/critical-events.log # Inspect the pipe file — notice the 'p' type in ls output ls -la /tmp/grid-feed # prw-r--r-- 1 user user 0 Apr 9 09:00 /tmp/grid-feed # Remove when done rm /tmp/grid-feed

# Syntax: <(command) provides output as a readable pseudo-file # diff expects two file arguments — we feed it two live command outputs diff <(cat /etc/passwd) <(getent passwd) # Compare sorted package list from two different hosts via SSH diff <(ssh node-a 'dpkg -l | sort') <(ssh node-b 'dpkg -l | sort') # comm needs two sorted files — use process substitution comm -23 <(sort /tmp/hosts-a.txt) <(sort /tmp/hosts-b.txt) # Output process substitution >(command): redirect into a command's stdin tee >(grep ERROR > /var/log/errors.log) >(grep WARN > /var/log/warnings.log) < /var/log/app.log

# && — create dir AND copy only if mkdir succeeds mkdir -p /opt/sector/config && cp /etc/app.conf /opt/sector/config/ # || — restart service if status check fails systemctl is-active nginx || systemctl start nginx # Chain: install, then enable, then start — stop at first failure apt-get install -y nginx && systemctl enable nginx && systemctl start nginx # ; — run cleanup regardless of what happened above cp /tmp/deploy.sh /opt/ ; rm -f /tmp/deploy.sh # Combine: try primary, fall back, then log result either way systemctl start app-primary || systemctl start app-backup ; echo "startup attempted"

# Check the exit code of the last command ls /etc/nginx echo $? # 0 — directory exists, ls succeeded ls /etc/nonexistent echo $? # 2 — no such file or directory # grep: exit 0 if match found, exit 1 if no match, exit 2 on error grep 'root' /etc/passwd echo $? # 0 — found grep 'zzz_no_such_user' /etc/passwd echo $? # 1 — not found (not an error — just no match) # In a script: test exit codes explicitly if systemctl is-active --quiet nginx; then echo "nginx is running" else echo "nginx is DOWN — alerting ops" fi

# Subshell: cd change is isolated — parent stays in /etc pwd # /etc (cd /tmp && ls) # runs in child, lists /tmp pwd # /etc — unchanged # Group: cd change persists in current shell { cd /tmp && ls; } # runs in current shell pwd # /tmp — changed! # Subshell: redirect combined output of multiple commands (echo "=== /etc/hosts ===" && cat /etc/hosts) > /tmp/report.txt # Group: redirect combined output while preserving shell state { date; uptime; who; } > /tmp/status.txt

# Redirect stdout only — errors still appear on terminal find / -name 'shadow' > /tmp/shadow-results.txt # Redirect stderr only — output still appears on terminal find / -name 'shadow' 2> /tmp/errors.txt # Redirect both to the same file (bash 4+ shorthand) find / -name 'shadow' >/tmp/all.txt 2>&1 find / -name 'shadow' &>/tmp/all.txt # bash shorthand, same result # Discard stderr entirely find / -name 'shadow' 2>/dev/null # Here-string: pass a string directly as stdin base64 <<<"sector-alpha-credentials"

# Launch a background job with & tar czf /backup/sector-$(date +%F).tar.gz /opt/sector/ & # [1] 14823 # List running jobs jobs # [1]+ Running tar czf /backup/sector-... & # Suspend the foreground process (press Ctrl+Z interactively) # [1]+ Stopped tar czf /backup/sector-... &

# Start a job, suspend it, resume in background rsync -av /data/ backup-node:/data/ # starts running # Press Ctrl+Z to suspend # [1]+ Stopped rsync -av /data/ ... bg %1 # resume in background disown %1 # detach — safe to close terminal # Useful pattern: launch, disown, walk away ./full-audit.sh > /var/log/audit.log 2>&1 & disown # no job number needed — acts on most recent

# Common signals # SIGTERM (15) — graceful termination request kill 14823 # SIGTERM is the default kill -15 14823 # explicit SIGTERM # SIGKILL (9) — force kill, no cleanup possible kill -9 14823 # SIGHUP (1) — reload config without restarting (many daemons) kill -1 $(cat /var/run/nginx.pid) # SIGUSR1 (10) — user-defined, used by some apps for log rotation kill -10 $(pgrep nginx) # killall: signal all processes with a given name killall -TERM python3 # pkill: signal by pattern match (more flexible) pkill -f 'worker_process'

# Start a new named screen session screen -S deploy-session # Detach from screen (keep it running): Ctrl+A then d # List active screen sessions screen -ls # There is a screen on: 18293.deploy-session (Detached) # Reattach to a session by name screen -r deploy-session # Reattach if session is already attached (take over) screen -d -r deploy-session # Kill a screen session cleanly (from inside: Ctrl+A then :quit) screen -S deploy-session -X quit

# Install tmux (Ubuntu 22.04) apt-get install -y tmux # Start a new named session tmux new -s ops # Detach: Ctrl+B then d # List sessions tmux ls # Reattach to a session tmux attach -t ops # Create a new window: Ctrl+B then c # Switch to window 0: Ctrl+B then 0 # Split vertically: Ctrl+B then % # Split horizontally: Ctrl+B then "

#!/bin/bash # ops-layout.sh — Launch a 3-pane ops workspace in tmux SESSION="sector-ops" # Kill existing session if it exists, then create fresh tmux kill-session -t $SESSION 2>/dev/null tmux new-session -d -s $SESSION -n "monitor" # Window 1: split into three panes tmux send-keys -t $SESSION:0 'htop' Enter tmux split-window -h -t $SESSION:0 tmux send-keys -t $SESSION:0 'journalctl -f -u nginx' Enter tmux split-window -v -t $SESSION:0.1 tmux send-keys -t $SESSION:0 'watch -n 2 ss -tuln' Enter # Window 2: command prompt tmux new-window -t $SESSION -n "cmd" # Attach to the session tmux attach -t $SESSION

# Basic: pipe filenames to rm via xargs find /tmp -name '*.tmp' | xargs rm -f # Safe: use null delimiter to handle filenames with spaces find /tmp -name '*.tmp' -print0 | xargs -0 rm -f # -P: run N processes in parallel (here: 4 simultaneous greps) find /var/log -name '*.log' -print0 | xargs -0 -P 4 grep -l 'CRITICAL' # -I {}: place each input item at a specific position in the command cat /tmp/host-list.txt | xargs -I{} ssh {} 'uptime' # -n 1: pass one argument at a time echo "alpha bravo charlie" | xargs -n 1 echo "Host:"

# watch: run a command every N seconds and display the output watch -n 2 'ss -tuln' # refresh every 2 seconds watch -n 1 'ps aux --sort=-%cpu | head -10' # top 10 CPU consumers # -d: highlight differences between refreshes watch -d -n 2 'cat /proc/net/dev' # spot network counter changes # Practical: monitor disk I/O while a backup runs watch -n 1 'iostat -xz 1 1 | grep -v "^$"' # Combine watch with a pipeline for live log counting watch -n 5 'grep -c "ERROR" /var/log/app.log'

# awk: process text by fields, separated by whitespace by default # $1 = first field, $2 = second, $NF = last field, $0 = entire line # Extract PID and command name from ps aux ps aux | awk '{print $2, $11}' # Print lines where CPU usage (>column 3) exceeds 50% ps aux | awk '$3 > 50 {print $2, $3, $11}' # Change field separator: parse /etc/passwd (colon-delimited) awk -F: '{print $1, $3}' /etc/passwd # username, UID awk -F: '$3 >= 1000 {print $1}' /etc/passwd # human accounts (UID >= 1000) # Sum a column: total bytes received across all interfaces cat /proc/net/dev | awk 'NR > 2 {sum += $2} END {print "Total RX bytes:", sum}' # Print BEGIN and END blocks (run before/after processing) awk 'BEGIN {print "--- User Report ---"} $3 >= 1000 {print $1} END {print "---"}' -F: /etc/passwd

# Basic substitution: s/pattern/replacement/flags sed 's/error/ERROR/g' /var/log/app.log # replace all occurrences, output to stdout # In-place edit: modify the file itself (always keep a backup) sed -i.bak 's/Listen 80/Listen 8080/g' /etc/apache2/ports.conf # Delete lines matching a pattern sed -i '/^#/d' /etc/fstab.tmp # delete comment lines sed -i '/^$/d' /etc/fstab.tmp # delete blank lines # Address range: edit only lines 10-20 sed -n '10,20p' /var/log/syslog # print lines 10-20 # Insert a line BEFORE a pattern match sed -i '/^ServerName/i # Managed by ops-config v2.1' /etc/apache2/sites-enabled/000-default.conf # Append a line AFTER a pattern match sed -i '/^GRUB_TIMEOUT=/a GRUB_TIMEOUT_STYLE=countdown' /etc/default/grub

# Context lines: show N lines before, after, or both sides of match grep -B 3 'CRITICAL' /var/log/app.log # 3 lines Before the match grep -A 5 'CRITICAL' /var/log/app.log # 5 lines After the match grep -C 2 'CRITICAL' /var/log/app.log # 2 lines each side (Context) # Extended regex (no backslash escaping needed) grep -E '(ERROR|WARN|CRIT)' /var/log/syslog # Recursive: search all files in a directory tree grep -r 'PermitRootLogin yes' /etc/ssh/ # Count matches per file grep -rc 'failed' /var/log/auth.log* # Print only the matching part of the line grep -o '[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}' /var/log/nginx/access.log | sort | uniq -c | sort -rn | head -20 # Invert match: print lines that do NOT match grep -v 'DEBUG' /var/log/app.log | grep -v '^#'

# sort: alphabetic by default sort /etc/hosts sort -r /etc/hosts # reverse order sort -n /tmp/sizes.txt # numeric sort (not lexicographic) sort -k2 -n /tmp/data.txt # sort by field 2, numerically sort -t: -k3 -n /etc/passwd # sort by UID (field 3, colon-delimited) # uniq: remove adjacent duplicate lines (input MUST be sorted first) sort /tmp/ips.txt | uniq # unique IPs sort /tmp/ips.txt | uniq -c # count each unique line sort /tmp/ips.txt | uniq -d # only lines that appear more than once # cut: extract specific fields from delimited text cut -d: -f1 /etc/passwd # first field (username) cut -d: -f1,3 /etc/passwd # fields 1 and 3 (username, UID) cut -c1-20 /var/log/syslog # first 20 characters of each line # Classic pipeline: top 10 IP addresses hitting nginx awk '{print $1}' /var/log/nginx/access.log | sort | uniq -c | sort -rn | head -10

# Default value: use fallback if variable is unset or empty LOG_DIR=${LOG_DIR:-/var/log/sector} # use /var/log/sector if LOG_DIR is unset # Assign default and also set the variable : ${CONFIG_FILE:=/etc/sector/config.yml} # CONFIG_FILE is now set if it was empty # String manipulation without external tools FILENAME="sector-backup-2026-04-09.tar.gz" echo ${FILENAME%.tar.gz} # strip shortest suffix: sector-backup-2026-04-09 echo ${FILENAME#sector-} # strip prefix: backup-2026-04-09.tar.gz echo ${FILENAME^^} # uppercase: SECTOR-BACKUP-2026-04-09.TAR.GZ echo ${FILENAME,,} # lowercase # Substring extraction: ${var:offset:length} DATE="2026-04-09" echo ${DATE:0:4} # 2026 (year) echo ${DATE:5:2} # 04 (month) # Length of a variable's value echo ${#FILENAME} # 30

# Basic heredoc: content between EOF markers goes to stdin cat <<EOF This is line one. This is line two. Hostname: $(hostname) Date: $(date +%F) EOF # Write a config file using heredoc cat > /etc/sector/worker.conf <<EOF listen_port = 9000 log_level = INFO max_workers = 4 node_id = $(hostname -s) EOF # Quoted delimiter: NO variable expansion inside (literal) cat <<'EOF' This ${var} will not expand. Neither will $(this command). Useful for generating scripts that contain bash syntax. EOF # SSH: run multiline commands on a remote host ssh node-b <<'EOF' apt-get update -qq apt-get install -y fail2ban systemctl enable fail2ban EOF

# $() runs the command and replaces itself with the output TODAY="$(date +%F)" echo "Backup started: $TODAY" # Backup started: 2026-04-09 # Capture IP address of an interface MY_IP="$(ip -4 addr show eth0 | awk '/inet /{print $2}' | cut -d/ -f1)" echo "Node IP: $MY_IP" # Use output in a loop for pid in $(pgrep python3); do echo "Found python3 PID: $pid" done # Nest substitutions for complex expressions DISK_FREE="$(df -h / | awk 'NR==2 {print $4}')" echo "Root filesystem free: $DISK_FREE" # Avoid old backtick syntax -- use $() instead # Old (avoid): version=`python3 --version` # New (use): version=$(python3 --version) # $() is readable, nestable, and unambiguous

#!/bin/bash # cleanup.sh — demonstrates trap for reliable resource cleanup # Create a temp directory for this script's work WORKDIR="$(mktemp -d /tmp/sector-work.XXXXXX)" echo "Working in: $WORKDIR" # trap: run cleanup() on EXIT, SIGINT, SIGTERM cleanup() { echo "[trap] Cleaning up $WORKDIR" rm -rf "$WORKDIR" echo "[trap] Done" } trap cleanup EXIT INT TERM # Do work cp /etc/passwd "$WORKDIR/passwd-snapshot" grep -E '^[a-z]' "$WORKDIR/passwd-snapshot" > "$WORKDIR/users.txt" cat "$WORKDIR/users.txt" # When the script exits (normally or via Ctrl+C), cleanup() runs automatically

# Declare and populate an indexed array NODES=("web-01" "web-02" "db-01" "cache-01") # Access by index echo ${NODES[0]} # web-01 echo ${NODES[-1]} # cache-01 (last element) echo ${#NODES[@]} # 4 (count) # Iterate over all elements for node in "${NODES[@]}"; do echo "Checking: $node" ping -c 1 -W 1 "$node" >/dev/null 2>&1 && echo " UP" || echo " DOWN" done # Append to an array NODES+=("fw-01") # Build array from command output FAILED_SERVICES=($(systemctl list-units --state=failed --no-legend | awk '{print $1}')) echo "Failed services: ${#FAILED_SERVICES[@]}" for svc in "${FAILED_SERVICES[@]}"; do echo " - $svc" done

# coproc launches bc as a coprocess named CALC coproc CALC (bc -l) # Send expression to bc's stdin via the write file descriptor echo "scale=4; 355/113" >&${CALC[1]} # Read bc's output from the read file descriptor read result <&${CALC[0]} echo "pi approximation: $result" # 3.1415 # Send another expression echo "sqrt(2)" >&${CALC[1]} read result <&${CALC[0]} echo "sqrt(2) = $result" # 1.41421356... # Terminate the coprocess kill "$CALC_PID"

# Full auth.log pipeline -- run in a tmux window # Step 1: What are the top attacking IPs? grep 'Failed password' /var/log/auth.log | \ awk '{print $(NF-3)}' | \ sort | uniq -c | \ sort -rn | \ head -15 # Step 2: What usernames are being tried? grep 'Failed password' /var/log/auth.log | \ awk '{print $9}' | \ sort | uniq -c | \ sort -rn | \ head -10 # Step 3: Is it active right now? Watch in real-time tail -f /var/log/auth.log | grep --line-buffered 'Failed password'

# Find the 20 largest files in /var (where logs usually grow) find /var -type f -print0 | \ xargs -0 du -sh 2>/dev/null | \ sort -rh | \ head -20 # Disk usage summary by top-level directory under / du -sh //* 2>/dev/null | sort -rh | head -20 # Find files modified in the last 24 hours (new large files) find /var/log -mtime -1 -type f -print0 | \ xargs -0 du -sh 2>/dev/null | \ sort -rh # All of this in a tmux pane while running the backup in another pane

#!/bin/bash # Every production script starts with this set -euo pipefail # Now any unhandled failure exits the script immediately BACKUP_DIR="${BACKUP_DIR:-/var/backups/sector}" # safe default mkdir -p "$BACKUP_DIR" rsync -av /opt/sector/ "$BACKUP_DIR/" echo "Backup complete: $(date)" # only runs if rsync succeeded

#!/bin/bash # Run SSH commands on multiple nodes in parallel, then collect results set -euo pipefail NODES=("web-01" "web-02" "db-01") PIDS=() # Launch one background job per node for node in "${NODES[@]}"; do ssh "$node" 'uptime && df -h /' > "/tmp/report-$node.txt" 2>&1 & PIDS+=("$!") # $! = PID of the last background job done # Wait for ALL background jobs to finish, check exit codes for pid in "${PIDS[@]}"; do wait "$pid" || echo "WARNING: PID $pid failed" done # Collect and display results for node in "${NODES[@]}"; do echo "=== $node ===" cat "/tmp/report-$node.txt" done

# time: measure wall clock, user, and system time time find / -name '*.log' -size +100M 2>/dev/null # real = wall clock elapsed # user = CPU time in user space # sys = CPU time in kernel (system calls) # time a full pipeline time (grep 'Failed' /var/log/auth.log | awk '{print $(NF-3)}' | sort | uniq -c | sort -rn) # Bash's built-in TIMEFORMAT for custom output TIMEFORMAT='Elapsed: %Rs' time { rsync --dry-run -av /opt/ /tmp/test/; } # strace: see every system call a command makes strace -c -p $(pgrep nginx | head -1) # profile a running process strace -e trace=network curl https://example.com # trace only network syscalls