The Linux shell becomes powerful when its small utilities are combined with pipes and redirection. The command ls lists directory contents and accepts flags such as -l for long format, -a for hidden dotfiles, -h for human-readable sizes, -R for recursion, and -t for sorting by modification time. Two other commands make searching trivial: grep filters lines by pattern with options like -i (case-insensitive), -r (recursive), -n (line numbers), -v (invert match), and -E (extended regex); find walks the directory tree, supporting filters by name glob, type, modification time, size, and permission, and can chain a custom action through -exec. Together, ls, grep, and find form the foundation of nearly every sysadmin investigation.
Two classic stream processors handle structured text. sed is a line-oriented editor usually invoked for substitution with s/old/new/, with g for global replacement on each line, -i for in-place editing, -n '/5,10p' for printing selected ranges, and /pattern/d for deleting matching lines. awk treats input as records made of fields: awk '{print \$1, \$3}' file prints columns 1 and 3, -F: customizes the delimiter (useful for /etc/passwd), and the built-in variables NR, NF, and FS expose record number, field count, and field separator. Combining sed and awk with other small tools — head, tail (with -f for live following), cat, tee, sort, uniq -c, wc -l, cut -d: -f1, tr for character translation, and xargs for building commands from streams — turns short pipelines like cat access.log | awk '{print \$1}' | sort | uniq -c | sort -rn into full-featured reporting tools.
The plumbing between these commands is redirection and pipes. The pipe | sends stdout of one process into stdin of the next, while > and >> redirect stdout (overwrite or append), < feeds a file into stdin, 2> and 2>&1 capture stderr, and &> covers both streams. The special file /dev/null, sometimes called the bit bucket, discards anything written to it and returns end-of-file when read; redirecting both streams there (command > /dev/null 2>&1) is the idiomatic way to silence a noisy command or to test success silently inside an if statement. Archiving files into a single transportable bundle is the job of tar: tar -czf archive.tar.gz dir/ creates a gzip-compressed archive, -xzf extracts one (optionally into a target via -C), and -tzf lists contents, with c, x, t, z, j, f, and v as the most common flags for create, extract, list, gzip, bzip2, file, and verbose, respectively.
Files can also be referenced from multiple locations through links. A hard link created with ln file hard points to the same inode as the original, so both names refer to identical on-disk data and the file survives deletion of either name; hard links, however, cannot span filesystems or link to directories. A symbolic link created with ln -s file sym is a small file holding a path string — a "shortcut" — which can cross filesystems and point to directories but breaks if its target is removed. ls -li shows inode numbers, confirming whether two names share storage; stat file exposes inode, link count, and metadata directly.