Linux field reference for system, processes, systemd, logs, storage, networking, DNS, firewall, accounts and SSH.
System & load
cat /etc/os-releaseIdentifies distribution/version before distro-specific commands.
uname -aChecks kernel, architecture and build.
uptimeLoad averages are roughly 1, 5 and 15 minutes.
free -hFocus on available memory rather than free alone.
Processes
ps aux --sort=-%cpu | head -20Lists top CPU consumers at capture time.
ps aux --sort=-%mem | head -20Correlate with RSS/VSZ and application behavior.
tophtop is convenient when installed; top is more universal.
pstree -apHelps relate workers, parents and services.
systemd & logs
systemctl status nginx --no-pagerShows state, PID and recent journal lines.
systemctl --failedQuick starting point after reboot.
journalctl -u nginx --since '-2 hours' --no-pagerTargets a time window near the incident.
journalctl -b -p err..alert --no-pagerFilters errors from the current boot.
Storage & filesystems
df -hTAdds filesystem type to capacity view.
df -iA filesystem can be full due to inode
lsblk -fShows partitions, filesystems, UUIDs and mounts.
du -xhd1 /var 2>/dev/null | sort -h-x prevents crossing into other mounted filesystems.
Network
ip -br addrCompact interface/address view.
ip routeChecks default and specific routes.
ip neighModern ARP/ND neighbor view.
ss -lntupMaps sockets, ports and processes when permissions allow.
DNS & HTTP
resolvectl statusShows per-interface DNS with systemd-resolved.
dig +short exemple.frSimple lookup for A/AAAA/CNAME checks.
curl -I https://exemple.frChecks status, redirects and headers without full body.
curl -vkI https://exemple.fr-k disables validation; diagnostic only, not proof of valid TLS.
Firewall & network security
sudo nft list rulesetModern firewall view on many distributions.
sudo ufw status verboseCommon on Ubuntu when UFW is enabled.
sudo firewall-cmd --list-allUsed on distributions running firewalld.
ss -ant state establishedQuick view of established TCP connections.
Accounts, permissions & SSH
id utilisateurShows UID, GID and groups.
namei -l /var/www/html/index.phpShows each path component and permissions.
sudo ssh-keygen -lf /etc/ssh/ssh_host_ed25519_key.pubLets you compare the server host-key fingerprint.
sudo sshd -T | head -50Shows effective configuration rather than only the main file.
Key points
- Use sudo only when required.
- du, find and recursive scans can generate significant I/O.
- Before restarting critical services, capture status and logs.
- Firewall commands depend on the distribution and active firewall stack.