Super Useful Linux One-Liners

Here is a collection of super useful bash one-liners that resolve a hole world of issues you may encounter as a linux admin.

Bash one liners are a great way to get the most out of your terminal. With just a few characters you can do things like list all the files in a directory, create or delete directories, or copy files..

In this article, we’ll showcase some of our favourite bash one liners and show you how to use them.

Test If a Service is RUNNING or NOT_RUNNING

This command will check for the existence of a process named cbagentd. If it’s running, pgrep will succeed (return an exit code of 0), triggering the && echo "RUNNING" part. If it’s not running, pgrep will fail (return a non-zero exit code), triggering the || echo "NOT_RUNNING" part.

pgrep cbagentd &>/dev/null && echo "RUNNING" || echo "NOT_RUNNING"

Or you can expand the command like this (both commands achieve the same result)

ps -aux | grep /opt/carbonblack/psc/bin/cbagentd | grep -v grep && echo "RUNNING" || echo "NOT_RUNNING"

To adapt the command for their own needs, users can replace cbagentd with the name of the process you want to check.

Here’s how they can do it:

1. Identify the process name: You need to know the exact name of the process they want to monitor. You can use commands like ps aux or top to find this information.
2. Replace cbagentd: In the command pgrep cbagentd &>/dev/null && echo "RUNNING" || echo "NOT_RUNNING", replace cbagentd with the actual process name.

Example:

Let’s say you wants to check if the Apache web server (httpd) is running. You would modify the command like this:

pgrep httpd &>/dev/null && echo "RUNNING" || echo "NOT_RUNNING" 

This command will now check for the httpd process and output “RUNNING” or “NOT_RUNNING” accordingly.

Important Notes:

• Process names are case-sensitive: Make sure to use the correct capitalization for the process name.
• Partial matches: pgrep will match any process name that contains the provided string. If you need to be more specific, consider using regular expressions with pgrep.
• Full command line matching: If you need to match the entire command line of a process, use the -f option with pgrep. For example, pgrep -f "python3 my_script.py".

List Username and Sort by ID

This Bash One-Liner lists the users on your system and displays their Username and UserID. This is extremely useful when querying user accounts and amending permissions.

getent passwd | awk -F: '{print $1, $3}' | sort -k2n

The command first retrieves user information from the system’s password database. Then, it extracts the username and user ID from each entry. Finally, it sorts the output numerically based on the user ID, presenting a clean and organized list of users and their IDs.

Find out the Top 10 Most Used Commands.

Credit to TheGeekStuff for this one.

his command analyzes your Bash history to find the 15 most frequently used commands.

cat ~/.bash_history | tr "\|\;" "\n" | sed -e "s/^ //g" | cut -d " " -f 1 | sort | uniq -c | sort -n | tail -n 15

Example Output

This command processes your Bash history, cleans it up, extracts the command names, counts their occurrences, and then displays the 15 most frequently used commands. This can be useful for understanding your command-line usage patterns and identifying your most common tasks.

     10 webstorm64.exe
     11 nano
     13 history
     14 sudo
     15 cdk
     16 cat
     26 ssh
     36 ./ecs-connect.sh
     37 Webstorm64.exe
     45 pwd
     80 ls
    122 yarn
    150 cd
    164 export
    468 git

Edit a File in Place

There are many use cases for editting existing files in place, you will need to master this command if you write infrastructure as code. You can litterally edit anything you want from a single command.

To test this, create 2 files with some basic content

sed -i 's#ORIGINAL_VALLUE#NEW_VALUE#g' myfile1 myfile2

Here is an example:

root@ubuntu1:~# cat my*
hello world
testing123

root@ubuntu1:~# sed -i 's#hello#I love cats#g' myfile1 myfile2
root@ubuntu1:~# cat my*
I love cats world
testing123

Find Errors and Failures in Journalctl With Ease

If you have ever used journalctl you will know that the output is very verbose and to be honest, not that useful. It can be very hard to find the information you need especially if the log is huge. Try this cool onliner to break through all the noise.

journalctl --no-pager --since today \
--grep 'fail|error|fatal' --output json|jq '._EXE' | \
sort | uniq -c | sort --numeric --reverse --key 1

Here is an example:

root@ubuntu1:~# journalctl --no-pager --since today \
--grep 'fail|error|fatal' --output json|jq '._EXE' | 
sort | uniq -c | sort --numeric --reverse --key# "/usr/lib/systemd/systemd" 
 "/usr/bin/udevadm"<br>      4 "/usr/libexec/udisks2/udisksd"<br>      4 "/usr/bin/login"<br>root@ubuntu1:~#

Display Disk Partitions in JSON

lsblk --json | jq -c '.blockdevices[]|[.name,.size]'

root@ubuntu1:~# lsblk --json | jq -c '.blockdevices[]|[.name,.size]'
["loop0","63.2M"]
["loop1","48M"]
["loop2","135.7M"]
["sda","25G"]
["sr0","1024M"]

Find Duplicate files using file hash

This is a super simple way to search for duplicate files. It does so using by obtaining the hash of the files and comparing them. Each file found has an exact duplicate even if the file name is different. I use this command frequently to sort my music collection out, making sure I don’t have lots of duplicates.

find -not -empty -type f -printf "%s
" |  sort -rn |  uniq -d |  xargs -I{} -n1  find -type f -size {}c -print0 |  xargs -0  md5sum |  sort |  uniq -w32 --all-repeated=separate

Here is an example querying /etc

root@ubuntu1:/etc# find -not -empty -type f -printf "%s
" |  sort -rn |  uniq -d |  xargs -I{} -n1  find -type f -size {}c -print0 |  xargs -0  md5sum |  sort |  uniq -w32 --all-repeated=separate
0045f30dc1f17bb71be8f965442b1dc1  ./default/grub
0045f30dc1f17bb71be8f965442b1dc1  ./default/grub.ucf-dist

272913026300e7ae9b5e2d51f138e674  ./magic
272913026300e7ae9b5e2d51f138e674  ./magic.mime

370468e5f19a306e29d39fbf7b72cf08  ./vmware-tools/poweroff-vm-default
370468e5f19a306e29d39fbf7b72cf08  ./vmware-tools/poweron-vm-default
370468e5f19a306e29d39fbf7b72cf08  ./vmware-tools/resume-vm-default
370468e5f19a306e29d39fbf7b72cf08  ./vmware-tools/suspend-vm-default

Get Detailed Linux Distribution Information

Sometimes uname -a doesn’t give you everything you need

echo /etc/*_ver* /etc/*-rel*; cat /etc/*_ver* /etc/*-rel*

root@ubuntu1:/etc# echo /etc/*_ver* /etc/*-rel*; cat /etc/*_ver* /etc/*-rel*
/etc/debian_version /etc/lsb-release /etc/os-release
bookworm/sid
DISTRIB_ID=Ubuntu
DISTRIB_RELEASE=22.10
DISTRIB_CODENAME=kinetic
DISTRIB_DESCRIPTION="Ubuntu 22.10"
PRETTY_NAME="Ubuntu 22.10"
NAME="Ubuntu"
VERSION_ID="22.10"
VERSION="22.10 (Kinetic Kudu)"
VERSION_CODENAME=kinetic
ID=ubuntu
ID_LIKE=debian
HOME_URL="https://www.ubuntu.com/"
SUPPORT_URL="https://help.ubuntu.com/"
BUG_REPORT_URL="https://bugs.launchpad.net/ubuntu/"
PRIVACY_POLICY_URL="https://www.ubuntu.com/legal/terms-and-policies/privacy-policy"
UBUNTU_CODENAME=kinetic
LOGO=ubuntu-logo
root@ubuntu1:/etc#

Find The Exact Date Of Your OS build

This is really useful if you use immutable instances, such as AWS instances or containers

fs=$(df / | tail -1 | cut -f1 -d' ') && tune2fs -l $fs | grep created

root@ubuntu1:/etc# fs=$(df / | tail -1 | cut -f1 -d' ') && tune2fs -l $fs | grep created
Filesystem created:       Sun Dec  4 08:46:38 2022

Monitor Open Netstat Connections

This handy one-liner lists all open netstat connections, this is useful when checking the connectivity of your server.

watch -n 1 "netstat -tpanl | grep ESTABLISHED"

Every 1.0s: netstat -tpanl | grep ESTABLISHED       ubuntu1: Sun Dec  4 20:12:26 2022

tcp6       0      0 192.168.2.39:22         192.168.2.213:58634     ESTABLISHED 937/s
shd: richard [

Watch CPU Processes

watch -n 1 'ps -eo pid,ppid,cmd,%mem,%cpu --sort=-%mem | head'

Every 1.0s: ps -eo pid,ppid,cmd,%mem,%cpu --sor...  ubuntu1: Sun Dec  4 20:17:16 2022

    PID    PPID CMD                         %MEM %CPU
   1154       1 /usr/lib/snapd/snapd         3.1  3.2
    419       1 /sbin/multipathd -d -s       2.7  0.0
    657       1 /usr/bin/python3 /usr/share  2.1  0.0
   1994       1 /usr/libexec/packagekitd     2.0  0.0
    379       1 /lib/systemd/systemd-journa  1.3  0.0
      1       0 /sbin/init                   1.3  0.4
    637       1 /usr/libexec/udisks2/udisks  1.2  0.0
    660       1 /usr/sbin/ModemManager       1.1  0.0
    937     936 sshd: richard [priv]         1.0  0.0