What Linux commands should I actually memorize versus just look up when needed?

Question

I manage a couple of Droplets and I can get by, but I find myself constantly Googling the same commands for things like finding what is using disk space, killing a process, checking open ports, that kind of thing.

Is there a core set of Linux commands worth actually memorizing so I am not tabbing to a search engine every time something breaks, versus stuff that is fine to look up in the moment?

Bobby · Answer

Hi there, Good instinct to draw this line. Some things genuinely need to be muscle memory, especially anything you would need during an actual incident when Googling costs you time you do not have. Worth memorizing cold: df -h # disk space by mount du -sh */ | sort -rh # what's actually taking up space top / htop # live process and resource view kill -9 # force kill a stuck process ss -tlnp # what's listening on which port systemctl status journalctl -u --since "1 hour ago" tail -f /var/log/nginx/error.log These cover the vast majority of “something is wrong, where do I even start” situations, and reaching for a search engine during an actual outage costs you real time. Fine to look up in the moment, since they are used less often and the syntax is easy to get slightly wrong from memory anyway: Complex find commands with multiple conditions, awk/sed one-liners for text processing, and anything involving iptables rules directly (most people use ufw day to day and only touch raw iptables rarely enough that memorizing the syntax is not worth it). For building the muscle memory on the core set, this interactive Linux terminal is a good way to actually practice the commands rather than just reading them, since typing them yourself sticks a lot better than skimming a cheat sheet.

alexdo · Answer

Heya, One correction and one addition, both in the memorize-coldcategory.The correction: I would not burn kill -9 into muscle memory as the default. SIGKILLcannot be caught by the process, so it skips every bit of cleanup, no flushingbuffers, no removing lock or PID files, no draining in-flight connections. Plainkill <pid> sends SIGTERM, which the process can handle and shut down properly. Makethat the reflex and keep -9 as the escalation for when SIGTERM has visibly notworked after a few seconds. The reflex you train is the one you will use at 3am onsomething that matters. The addition, for the disk space case specifically: du -sh */ misses hidden directories, since the glob skips dotfiles, and more importantly it misses the most confusing version of a full disk. If a process still holds a file open after it was deleted, usually a rotated log, the space stays allocated but du cannot see it. The symptom is df saying the disk is full while du insists it is not, which wastes a lot of time if you have not met it before. The command for it: lsof +L1 That lists files with no remaining directory entry that are still held open, NLINK 0. Restarting the holding process releases the space. Worth memorizing alongside df and du, because it is the one that explains why those two disagree. Regards

Become a contributor for community

DigitalOcean Documentation

Resources for startups and AI-native businesses

The developer cloud

Start building today

Report this

What Linux commands should I actually memorize versus just look up when needed?

Related questions

Docker Networking Explained: How Containers Talk to Each Other

How do I debug a broken deployment on a DigitalOcean Droplet when I have no idea what went wrong?

Any good resources to learn Linux commands in an interactive way?

What's the best way to get comfortable with the Linux command line as a beginner?

How to expose a Docker container to the internet on DigitalOcean?

How to talk with other users connected to the Server

uptime command in webapp shows [0,0,0]

Recent Ubuntu (22.04) and btrfs, snapper, TimeShift, question: Anyone have any experience or advice with these?

cron job not running as root user in digital ocean droplet

JSON response formatting

Why is the API down even after trying sudo reboot?

SSH Permission denied (publickey)

Report this

What Linux commands should I actually memorize versus just look up when needed?

Related questions

Docker Networking Explained: How Containers Talk to Each Other

How do I debug a broken deployment on a DigitalOcean Droplet when I have no idea what went wrong?

Any good resources to learn Linux commands in an interactive way?

What's the best way to get comfortable with the Linux command line as a beginner?

How to expose a Docker container to the internet on DigitalOcean?

How to talk with other users connected to the Server

uptime command in webapp shows [0,0,0]

Recent Ubuntu (22.04) and btrfs, snapper, TimeShift, question: Anyone have any experience or advice with these?

cron job not running as root user in digital ocean droplet

JSON response formatting

Why is the API down even after trying sudo reboot?

SSH Permission denied (publickey)