Core Utilities

The core utilities are the vocabulary — roughly 150 commands (GNU coreutils plus tar, findutils, and friends) that every Linux carries and every real task composes. This chapter is a working reference: not every flag, but the shape of each tool — what it's for, the flags that earn their keep, and the idioms that combine them. Skim it once, keep it forever.

The file trio

cp -r src/ dest/        # recursive; -a = archive (perms+times)
cp -i file dest         # ask before clobbering
mv old new              # rename/move — free within a filesystem
mv -i file dir/         # safe move
rm -r dir/              # recursive delete — NO UNDO
rm -rf dir/             # force — the honest footgun
rm -i file              # ask each time — the habit worth keeping
mkdir -p a/b/c          # -p makes parents
rmdir emptydir          # only empty dirs — rm -r for real

cp -a preserves everything; mv between filesystems silently becomes copy+delete; rm -rf has no recovery — the three truths nobody forgets after learning them the hard way.

Navigation + inspection

ls -la                  # long + hidden — the working form
ls -lhS                 # human sizes, biggest first
ls -lt                  # newest first
ls -li                  # inode numbers
pwd; cd -; cd ~         # where am I; back; home
stat file               # the full inode record
file mystery            # WHAT is this — magic bytes, not extension
du -sh dir              # total size;  du -h --max-depth=1 for the map
du -h | sort -rh | head # where space went
df -h                   # filesystem free space
which cmd; type -a cmd  # where it lives; all resolutions

Find — the real search engine

find . -name '*.c'                    # by name
find . -iname 'readme*'               # case-insensitive
find / -type f -size +100M 2>/dev/null  # space hogs
find . -mtime -7                      # changed this week
find . -perm 777                      # by mode
find . -user alice -group devs        # by owner
find . -empty                         # empty files/dirs
find . -name '*.log' -delete          # act on results — careful!
find . -name '*.tmp' -exec rm {} +    # exec — {} is each path, + batches
find . -print0 | xargs -0 cmd         # the space-safe pipeline

find ... -exec vs | xargs: -exec {} + is the modern safe form; xargs without -0 breaks on spaces — always pair find -print0 | xargs -0 when filenames might be weird.

Archives — tar, plus the compressors

tar -cf archive.tar dir/      # create
tar -xf archive.tar           # extract
tar -tf archive.tar           # list contents
tar -czf a.tar.gz dir/        # gzip
tar -cjf a.tar.bz2 dir/       # bzip2
tar -cJf a.tar.xz dir/        # xz — best ratio
gzip file; gunzip file.gz     # standalone compressors
xz file; xz -d file.xz
zstd -19 file                 # modern fast+strong
zip -r a.zip dir/; unzip a.zip

The flags decompose: c/x/t mode, f file, z/j/J compressor. tar -tf before -xf — always look before you unpack.

dd — the block-level tool

dd if=/dev/sda of=disk.img bs=4M status=progress   # image a disk
dd if=linux.iso of=/dev/sdX bs=4M status=progress && sync  # bootable USB
dd if=/dev/zero of=file bs=1M count=100            # a 100MB file of zeros
dd if=/dev/urandom of=file bs=1M count=10          # random bytes
dd if=/dev/sda of=/dev/sdb bs=64K conv=noerror,sync # rescue a dying disk

if/of are raw devices as easily as files — dd writes boot sectors, wipes disks, images drives. Check of= twice; it overwrites without asking.

Text plumbing — the everyday filters

cat file; cat a b > combined        # concatenate (useless-cat is a meme for a reason)
head -20 file; tail -20 file        # ends
tail -f /var/log/syslog             # follow — the log-watcher
less file                           # the pager — /to-search, q to quit
wc -l file                          # lines/words/bytes
sort file; sort -n; sort -k2        # sort; numeric; by field
sort | uniq -c | sort -nr           # the histogram idiom
cut -d: -f1 /etc/passwd             # field extraction
cut -c1-80 file                     # by column
tr 'a-z' 'A-Z' < file               # translate chars
tr -d '\n' < file                   # delete chars
tee out.log                         # stdout → both screen AND file
xargs -n1 cmd < list                # build argv from stdin

The process watchers

ps aux                              # everything running
ps -ef | grep name                  # find a process
pgrep -l name                       # PIDs by name
top; htop                           # live views
free -h                             # memory
uptime                              # load averages
kill PID; kill -9 PID; killall name # signals
df -h; mount; umount                # filesystem plumbing

The toolkit map — the rest worth knowing

The complete toolkit — the reference table

The long tail is the point — the toolchain's ~150 core commands are chapter-10's vocabulary; the thousands beyond are the ecosystem the package manager reaches.

The composition idioms

The power isn't any tool — it's the pipes:

history | awk '{print $2}' | sort | uniq -c | sort -rn | head   # your top commands
find . -name '*.log' -exec wc -l {} + | sort -n | tail          # biggest logs
cat access.log | cut -d' ' -f1 | sort | uniq -c | sort -rn | head  # top IPs
ps aux --sort=-%mem | head -11                                   # RAM hogs

sort | uniq -c | sort -rn | head — the frequency-histogram idiom — solves a third of all quick analysis questions by itself.

Where utilities go wrong

Exercises

1. find /usr/bin -name '*zip*' — inventory the compressors.
2. history | awk '{print $2}' | sort | uniq -c | sort -rn | head — your actual most-used commands.
3. dd a 10MB file, tar it, xz it, unroll the whole chain.
4. find . -empty -delete on a scratch tree.
5. file five mystery files — extension vs magic bytes.

See also

• Linux · Filesystem · Shell · Text processing