Sysadmin Cards

This deck gathers a wide range of foundational Linux and Unix system administration topics into one place. The cards walk through everyday concerns like SSH configuration, DNS record types, system logging daemons, kernel tuning parameters, process control commands, terminal multiplexers, shell startup files, and common file and disk utilities. Together they offer a broad but practical tour of the commands and concepts a sysadmin reaches for daily.

It's well suited to anyone preparing for a sysadmin or DevOps interview, working through a Linux certification, or simply wanting to refresh rusty knowledge after time away from the command line. Beginners with some terminal exposure will find it a good checkpoint of core concepts, while more experienced admins can use it to verify gaps and revisit details they may not touch every day.

Because the material is made up of short, factual answers, the cards lend themselves well to spaced repetition rather than long cramming sessions. A handful of cards reviewed regularly will stick far better than dozens in a single sitting, and whenever possible, try out the commands or check the files on a real system. Seeing tmux, xargs, or du behave on your own terminal turns a memorized answer into genuine working knowledge.

The Secure Shell (SSH) is the workhorse for remote Linux administration, and almost every aspect of it can be customized. The per-user ~/.ssh/config file lets administrators define reusable shortcuts with options such as Hostname, User, Port, and IdentityFile, which makes recurring logins far more convenient than typing full connection strings. Authentication itself relies on asymmetric cryptography, with ssh-keygen -t ed25519 being the recommended way to generate modern key pairs. Once a key pair exists, ssh-copy-id installs the public key into the remote ~/.ssh/authorized_keys, which must be locked down to mode 600 for security. Locking accounts locally is done with passwd -l user, and reviewing who has been knocking on the door is possible through lastb, which reads /var/log/btmp.

For file transfers, SSH provides several options. scp -r copies directories recursively, while the interactive sftp shell supports commands like get -r and put. For transparent remote filesystems, sshfs mounts a remote directory via FUSE and can be unmounted with fusermount -u. SSH can also be hardened to disable password authentication entirely by setting PasswordAuthentication no in /etc/ssh/sshd_config, optionally combined with ChallengeResponseAuthentication no, followed by reloading the daemon. Other useful directives include PermitRootLogin prohibit-password to allow key-only root access, AllowUsers to whitelist specific accounts, and ClientAliveInterval to detect dead sessions. Configuration syntax can be validated safely with sshd -t.

SSH also enables sophisticated network plumbing. Local port forwarding via ssh -L localport:targethost:targetport user@sshhost tunnels traffic through an SSH server, while reverse forwarding with ssh -R exposes a local service on a remote host. Agent forwarding (ssh -A) lets remote servers use the local agent without copying private keys, ssh-add -l lists fingerprints loaded into the agent, and ssh-add ~/.ssh/id_ed25519 adds new ones. When connectivity requires an intermediate host, ProxyJump (ssh -J jumphost targethost) or the equivalent ProxyJump directive in ~/.ssh/config simplifies multi-hop logins. The ssh-keygen -R hostname command cleans stale entries from ~/.ssh/known_hosts, which is the file used to detect man-in-the-middle attempts. When a system has been cloned or restored from backup, regenerating host keys with rm /etc/ssh/ssh_host_* && ssh-keygen -A ensures each system has unique fingerprints before restarting sshd.

For dedicated file transfer services, FTP, SFTP, and FTPS each have distinct security characteristics. Plain FTP on port 21 is unencrypted, FTPS wraps FTP with TLS on port 21 (explicit) or 990 (implicit), and SFTP runs entirely over SSH on port 22 and is the preferred option because it encrypts both credentials and data and traverses most firewalls easily. Linux servers commonly use vsftpd (config in /etc/vsftpd.conf) or proftpd; enabling chroot_local_user=YES jails FTP users to their home directories, and systemctl restart vsftpd applies configuration changes. On the client side, FileZilla is a popular GUI that uses File > Site Manager (Ctrl+S) to save reusable connections, supports key authentication under SFTP/Key file mode, defaults to ASCII mode for text files (with Binary mode used for exact copies), and stores its config under ~/.config/filezilla/. Speed limits, concurrent transfer caps, and transfer-mode toggles are all found in Edit > Settings > Transfers, while Server > Force showing hidden files reveals dotfiles on the remote side. Right-clicking a failed item and choosing Process Queue resumes interrupted transfers.

DNS is the addressing layer of the internet, and Linux administrators must understand its record types. An A record maps a domain to an IPv4 address, AAAA to IPv6, and CNAME creates an alias pointing to another canonical name. Mail delivery relies on MX records pointing to the responsible mail servers, while NS records designate the authoritative nameservers and SOA marks the start of authority zone with administrative information. Reverse DNS uses PTR records to map IPs back to hostnames, which is critical for mail servers since many receivers reject mail from IPs lacking valid reverse entries. Email authentication is reinforced by TXT records carrying SPF (which mail servers may send for the domain), DKIM (cryptographic signatures), and DMARC (policy for handling failures).

For diagnosing DNS, dig is the preferred tool because it provides detailed query output, unlike the simpler nslookup. Common invocations include dig TYPE domain to query a specific type, dig @nameserver domain to query a specific resolver, dig +short for compact answers, dig +trace to walk the full resolution path from the root servers, and dig -x IP for reverse lookups. TTL controls how long a record is cached, with 300 to 3600 seconds typical for production records and lower values like 60 to 300 seconds advisable 24 to 48 hours before a migration to speed propagation. Global propagation can be checked via online services such as dnschecker.org or whatsmydns.net, which query multiple geographic locations.

Local name resolution happens before DNS. /etc/hosts provides static hostname-to-IP mappings useful for overrides or local-only entries, while /etc/resolv.conf configures the resolver's nameservers and search domains. /etc/nsswitch.conf defines the order in which resolution sources are consulted (files, dns, ldap, and so on), and getent hosts hostname performs lookups using the configured chain, while getent passwd username retrieves user information from all sources. On systems using systemd-resolved, resolvectl status shows per-interface DNS settings and search domains, while resolvectl flush-caches clears cached entries. Caches on other operating systems can be cleared with ipconfig /flushdns on Windows or sudo dscacheutil -flushcache && sudo killall -HUP mDNSResponder on macOS.

Modern Linux distributions manage services through systemd, and a small set of systemctl verbs covers most needs. systemctl start, stop, and restart control running state, while reload asks a service to re-read configuration without a full restart when supported. systemctl enable adds a unit to the boot sequence, disable removes it, and systemctl --failed lists units that failed to start. Inspecting a unit is done with systemctl status for state, PID, and recent logs; systemctl cat for the full definition including drop-ins; systemctl show for key/value properties (optionally filtered with -p); and systemctl list-dependencies for the dependency graph. Local overrides can be created with systemctl edit name.service, which writes a snippet under /etc/systemd/system/name.service.d/, and after any unit file change, systemctl daemon-reload refreshes systemd's view. systemctl mask links a unit to /dev/null, preventing manual or dependency-driven starts until unmasked, and systemd-analyze blame lists units sorted by startup time while systemd-analyze critical-chain reveals which dependencies delayed boot.

Logging in systemd environments centers on journald, which stores entries in binary form accessible via journalctl. Common filters include -u name for a specific unit, -f to follow new entries live, -p err to restrict by priority, -k for kernel messages, -b for the current boot and -b -1 for the previous one, and --since "..." --until "..." for arbitrary time ranges. journalctl -xe shows recent entries with extra explanatory text, ideal for troubleshooting failures, while journalctl -o json-pretty outputs logs as formatted JSON, and journalctl > logs.txt or journalctl --output=export exports to file. Disk usage can be checked with journalctl --disk-usage and old entries trimmed with journalctl --vacuum-time=2weeks. The traditional alternative rsyslog writes plain text logs to /var/log; both can coexist. logrotate, configured under /etc/logrotate.conf and /etc/logrotate.d/, rotates, compresses, and prunes log files; logrotate -f forces an immediate run, and -d performs a dry run.

Scheduled tasks come in several flavors. User cron jobs are edited with crontab -e and listed with crontab -l, while /etc/crontab is the system crontab with an extra user column. Cron expressions encode minute, hour, day-of-month, month, and day-of-week, so */5 * * * * means every five minutes and 0 2 * * 0 is 02:00 every Sunday. Because cron runs with a minimal environment, commands can be tested with env -i /bin/sh -c 'command'. anacron complements cron on systems that are not always on, executing missed jobs when the system returns. For one-off scheduling, at 03:00 queues commands for later execution, atq lists them, and atrm JOBID removes one. systemd also offers timers (systemctl list-timers) and one-shot scheduling via systemd-run --on-active=5m command, which creates a transient service and timer. Boot targets in systemd define the runlevel: systemctl set-default multi-user.target switches to text mode and systemctl isolate switches at runtime, while systemctl rescue enters single-user/rescue mode. Boot parameters are visible in /proc/cmdline, kernel modules in lsmod, and module info via modinfo module_name; initramfs is regenerated with update-initramfs -u and GRUB config with update-grub on Debian/Ubuntu. Kernel messages come from dmesg, with dmesg -w for real-time watching, dmesg -T for human-readable timestamps, and dmesg -C to clear the ring buffer.

User account information is split across three traditional files: /etc/passwd (usernames, UIDs, GIDs, home, shell), /etc/shadow (password hashes and aging, readable only by root), and /etc/group (groups and members). useradd -m -s /bin/bash username creates a user with a home directory and Bash shell; new homes are templated from /etc/skel/. usermod -aG group user appends supplementary groups without removing existing memberships, and id username prints numeric IDs and groups. Password operations include passwd -e or chage -d 0 to expire immediately, chage -l to view aging, and passwd -l to lock an account. pwck and grpck verify the integrity of these files, and /etc/login.defs sets defaults for UID ranges, password aging, and umask. Active sessions are reviewed with last (recent logins from /var/log/wtmp), who (currently logged-in users), and w (logged-in users plus their processes and load averages).

Standard POSIX permissions revolve around chmod, chown, and umask. chmod 755 gives the owner full access and read/execute to group and others; chmod 640 gives owner read/write, group read, and no access to others. umask subtracts bits from defaults, so 022 means new files emerge as 644 and directories as 755. Two special bits matter: the sticky bit (chmod 1777 /tmp) prevents users from deleting others' files in a world-writable directory, and SGID on a directory (chmod g+s) makes new files inherit the directory's group. Hard links point to the same inode and continue to work even if the original name is deleted, while symbolic links point to a path and can cross filesystems. Recursive ownership changes use chown -R user:group /path. SUID binaries are security-relevant and can be audited with find / -perm -4000 -type f 2>/dev/null; world-writable directories with find / -type d -perm -0002 -ls 2>/dev/null; and orphaned files with find / -nouser -o -nogroup 2>/dev/null.

Beyond POSIX bits, ACLs provide finer-grained access control: getfacl filename lists ACLs and setfacl -m u:username:rwx filename grants them. A trailing + in ls -l output indicates an ACL is set, and setfacl -b removes all extended entries. Default ACLs on directories (setfacl -d -m) propagate to new entries. Extended attributes (getfattr -d, lsattr) hold metadata such as security labels and capabilities. chattr +i and chattr -i toggle immutability, and chattr +a sets append-only mode for log files. Linux capabilities allow fine-grained privilege grants without full root, set with setcap cap_net_bind_service+ep /path/to/binary and inspected with getcap. rsync -aAXH --delete src/ dest/ preserves ACLs, xattrs, and hardlinks during synchronization (run as root).

Mandatory access control systems add another layer. SELinux's mode is checked with getenforce (Enforcing, Permissive, Disabled), temporarily relaxed with setenforce 0, and contexts restored with restorecon -Rv /path. AppArmor profiles are viewed with aa-status, which shows loaded profiles and their enforce/complain modes. Sudoers rules are edited with visudo for syntax safety, and a user can review what they may run with sudo -l. fail2ban watches logs and updates firewall rules to block IPs exhibiting brute-force patterns. Shell resource limits are inspected with ulimit -a, raised for the session with ulimit -n 65535, and set permanently in /etc/security/limits.conf. Temporary sysctl changes use sysctl -w key=value, persistent settings live in /etc/sysctl.conf or files under /etc/sysctl.d/, and sysctl --system reloads everything.

Linux exposes block devices through a virtual filesystem populated by udev, the kernel's device manager that creates entries under /dev dynamically as hardware appears and disappears. lsblk and lsblk -f present a tree of block devices with their sizes, types, UUIDs, filesystem types, and mountpoints. blkid returns UUIDs, labels, and filesystem types for a device; stat filename reports detailed inode and timestamp information for a file. Filesystems are mounted based on /etc/fstab, which describes source, target, type, options, and dump/pass fields; mount -a mounts everything listed that is not already mounted, while findmnt -o TARGET,SOURCE,FSTYPE,OPTIONS shows the current mount table. Disk usage is summarized with df -h (per filesystem) or df -Th (with type), while du -h lists sizes recursively and du -sh gives a single total for a directory. SMART health is checked with smartctl -a /dev/sdX, software RAID status with cat /proc/mdstat, and chroot changes a process's apparent root directory for recovery or isolation scenarios.

Two journaling filesystems dominate Linux today. ext4 (created with mkfs.ext4) is versatile, supports shrinking, and exposes parameters via tune2fs -l. The default 5% reserved block percentage can be reduced with tune2fs -m 1; these blocks exist to keep root functional when the disk fills. e2fsck -n and fsck -n perform read-only integrity checks. XFS excels at large files and parallel I/O but cannot shrink; it is created with mkfs.xfs, diagnosed with xfs_info and xfs_repair -n, and defragmented online with xfs_fsr. Both are production-ready, with the choice depending on workload patterns. For backup and migration, rsync -a --delete src/ dest/ synchronizes two trees and removes files in the destination that no longer exist in the source, --dry-run previews changes, and -aAXH preserves ACLs, extended attributes, and hardlinks. tar -czf archive.tgz /dir creates a compressed archive, tar -tzf lists contents without extracting, tar -xzf path/inside -C /restore extracts specific files, and --listed-incremental=snapshot.file enables incremental backups. find . -exec command {} + applies a command to many files at once, and xargs builds and executes command lines from standard input, often used to bridge long find output with utilities like rm.

LVM adds a layer of flexibility on top of block devices. Physical Volumes (PVs) are aggregated into Volume Groups (VGs), which are divided into Logical Volumes (LVs) used as if they were partitions. lvextend -r -L +5G /dev/vg/lv extends an LV and resizes the underlying filesystem in one step; for XFS, an online grow requires xfs_growfs MOUNTPOINT after the LV grows. Snapshots are created with lvcreate -s -L 2G -n snap /dev/vg/lv, and merging a snapshot back uses lvconvert --merge /dev/vg/snap, usually requiring the origin to be inactive (unmounted or the system rebooted).

Partitions are managed with fdisk or parted; parted -l lists all block devices with their tables. parted /dev/sdX resizepart PARTNUM END resizes a partition, after which the filesystem is grown (resize2fs for ext4, xfs_growfs for XFS). GPT supports disks larger than 2 TB and up to 128 partitions, while MBR is legacy with a 4-partition limit; gdisk can convert between them (after a backup). UEFI systems require an EFI System Partition (FAT32, typically mounted at /boot/efi). SSDs benefit from TRIM, which informs the drive of freed blocks: fstrim -v /mountpoint runs it manually, while periodic fstrim.timer automates it, or discard can be added as a mount option. Special mounts include bind mounts (mount --bind /src /tgt), which can be made read-only with mount -o remount,ro,bind /tgt, and loop devices, which let a file be mounted as a block device, as with mount -o loop image.iso /mnt/iso. losetup -l lists active loop devices.

Modern Linux networking is configured with the ip family of commands. ip addr shows interfaces with their addresses and state; ip addr add IP/PREFIX dev IFACE assigns one, ip addr del removes a specific address, and ip addr flush dev IFACE removes all. ip link shows link state, while ip link set dev eth0 up or down enables or disables an interface, and ip link set dev eth0 mtu 9000 sets the MTU (with 9000 enabling jumbo frames). Interface error and drop counters are listed with ip -s link. The routing table is inspected with ip route (or the legacy netstat -rn), static routes added with ip route add NETWORK via GATEWAY dev IFACE and removed with ip route del. ip route get DEST shows which interface and source IP will be used. The neighbor table (ARP for IPv4, NDP for IPv6) is shown with ip neigh and flushed with ip neigh flush dev IFACE or ip neigh flush all. Interface details including link speed, duplex, and driver info come from ethtool eth0, with autonegotiation forced via ethtool -s eth0 autoneg off speed 1000 duplex full.

Higher-level network configuration varies by distribution. Ubuntu's Netplan stores YAML in /etc/netplan/, applied with netplan apply. Debian's classic /etc/network/interfaces remains in use on some systems. NetworkManager, common on desktops, is driven by nmcli: nmcli connection show lists profiles, nmcli connection up "name" activates one, nmcli device status shows devices, and nmcli connection modify "name" ipv4.addresses IP/PREFIX ipv4.gateway GW ipv4.method manual sets a static address. systemd-networkd is a lean alternative. Virtual constructs include VLANs (ip link add link eth0 name eth0.100 type vlan id 100), bonding or teaming for failover or bandwidth aggregation, and bridges (ip link add br0 type bridge plus ip link set eth0 master br0); brctl is the legacy bridge tool now superseded. The loopback interface lo carries IP 127.0.0.1 for local-only communication.

Firewall management in Linux offers several layers. iptables -L -n -v lists rules with counters and no DNS resolution; rules based on the recent match module enable rate-limiting SSH via iptables -A INPUT -p tcp --dport 22 -m state --state NEW -m recent --set. nftables is the modern unified replacement, with nft list ruleset dumping all current rules. Ubuntu's ufw allow 22/tcp creates a high-level rule to permit SSH, while ufw provides additional rule management. fail2ban watches logs and dynamically updates firewall rules to block brute-force attempts. Port knocking is another defense, requiring a specific sequence of connection attempts before opening ports. For listening ports, ss -tlnp shows TCP listeners with process names and PIDs, ss -tan state established filters established connections, ss -s summarizes protocol counts, and ss -tulpn includes UDP sockets. lsof -i :PORT finds the process on a given port, as does fuser -v 80/tcp, and lsof +D /path enumerates open files under a directory (useful for spotting deleted files still held open by processes).

Connectivity diagnostics start with ping -c 4 host for basic reachability. traceroute shows the network path; tracepath does the same without root and discovers MTU along the way. mtr -rw host runs a report-mode traceroute with packet loss and latency. Port reachability can be tested with nc -zv host 443 (and nc -l 8080 listens and prints received data). Without netcat, timeout 3 bash -c 'cat < /dev/null > /dev/tcp/host/port' && echo open works using bash's built-in TCP. nmap -sT -p 80,443 host performs a TCP connect scan on selected ports, and nmap -p- scans all 65535 ports. tcpdump -i IFACE port 80 captures packets live, -w capture.pcap writes them to a file for later analysis with tcpdump -nn -r capture.pcap. curl -I https://host fetches only HTTP headers, curl -L follows redirects, curl -X POST -H "Content-Type: application/json" -d '{"key":"value"}' sends JSON, and openssl s_client -connect host:443 -servername host shows TLS certificate details for the negotiated host. wget -r -l 2 downloads recursively with depth limits and wget -c resumes partial downloads. /etc/services maps service names to port numbers, and /etc/protocols maps protocol names to numbers.

The two leading open-source web servers on Linux are nginx and Apache. nginx configuration lives in /etc/nginx/nginx.conf with site definitions under sites-available/ and sites-enabled/; syntax is validated with nginx -t and reloaded without dropping connections via nginx -s reload or systemctl reload nginx. Apache, common on Debian/Ubuntu, is managed with a2ensite sitename to enable a virtual host, a2dissite to disable it, and a2enmod modname to enable a module. Configuration is tested with apache2ctl -t or apachectl configtest and reloaded with apachectl graceful. Logs are typically in /var/log/apache2/ on Debian/Ubuntu or /var/log/httpd/ on RHEL/CentOS, while nginx writes to /var/log/nginx/access.log and /var/log/nginx/error.log.

SSL/TLS underpins secure web delivery. certbot --nginx -d domain.com obtains and configures a Let's Encrypt certificate automatically; certbot renew renews any due certificates, with --dry-run simulating renewal. Certificates live under /etc/letsencrypt/live/domain/ as symlinks to the current files. openssl is the swiss-army knife: openssl x509 -enddate -noout -in cert.pem shows expiry; echo | openssl s_client -connect host:443 -servername host 2>/dev/null | openssl x509 -noout -dates gives a quick expiry check from the CLI. CSR creation uses openssl req -new -key private.key -out request.csr, and a self-signed certificate is created with openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout key.pem -out cert.pem. Verifying that a certificate and key match requires comparing their moduli: openssl x509 -modulus -noout -in cert.pem against openssl rsa -modulus -noout -in key.pem. acme.sh is a shell-script alternative to certbot. SNI allows multiple SSL sites on one IP by sending the hostname during the handshake, HSTS tells browsers to always use HTTPS, and OCSP stapling caches revocation status for faster handshakes.

For FTP services, vsftpd and proftpd are the typical server choices. The main vsftpd config is /etc/vsftpd.conf; restarting uses systemctl restart vsftpd, and chroot_local_user=YES jails users to their homes. proftpd offers per-directory configs and virtual users. SFTP, running over SSH on port 22, is generally preferred because it is encrypted and firewall-friendly, unlike FTP on port 21. FileZilla is a popular GUI client with a Site Manager (Ctrl+S) for reusable connections; the Quickconnect bar handles one-off sessions. Transfer modes are Auto, ASCII (text files with line-ending conversion), and Binary (exact copy); settings are in Edit > Settings > Transfers. Hidden files are revealed via Server > Force showing hidden files, and the queue can be cleared, paused, or resumed after failure through Transfer > Process Queue. View > Directory Comparison and View > Synchronized Browsing make it easy to spot and transfer differences between local and remote. Site entries can be exported and imported via File > Export/Import. Errors such as "Connection timed out" usually indicate firewall blocking or a wrong host/port, while "ECONNREFUSED" means the host is reachable but the service is not listening.

Hetzner's konsoleH is a web control panel for shared hosting that bundles many everyday sysadmin tasks. Domains are managed under Domain Administration (DNS settings, addons, parked domains, subdomains); emails under Email (accounts, aliases, forwardings, catch-all, autoresponders, spam filter, webmail); databases under Databases (MySQL creation and phpMyAdmin access); FTP under FTP Accounts (including restricted subdirectory accounts); SSL under SSL (Let's Encrypt activation); and scheduled tasks under Webspace > Cronjobs. PHP version and php.ini directives are tuned under PHP Settings, directory protection under Webspace, and access/error logs under Webspace > Logs or Statistics. Apache custom error pages and HTTPS redirects are typically implemented via .htaccess, for example with RewriteEngine On, RewriteCond %{HTTPS} off, and RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]. Hetzner's Robot, in contrast, manages dedicated servers and cloud infrastructure rather than shared hosting.

Process inspection starts with ps (for example, ps aux --sort=-%mem for top memory users and ps -ejH for hierarchy) and pstree -p for a tree view. pgrep returns PIDs matching a name, pkill kills by name or attribute (regex, UID), and killall kills by exact name match. nohup runs commands immune to SIGHUP so they continue after logout, while screen and tmux are terminal multiplexers that keep sessions alive across disconnections. htop offers an interactive, colorful process view with search and tree features beyond top. nice -n 10 command starts a command with lower CPU priority, and renice newvalue -p PID adjusts the priority of a running process. strace -p PID attaches to a running process and prints syscalls (used cautiously due to performance impact). watch command runs a command repeatedly (default every 2 seconds) for live monitoring, and uptime shows time since boot, user count, and load averages (interpreted as high when equal to or above nproc cores).

Memory is summarized with free -h, with detailed stats in /proc/meminfo. Active swap is shown by swapon -s or cat /proc/swaps, and swap behavior is governed by vm.swappiness (0 to 100, with higher values meaning more aggressive swapping). When memory pressure exhausts RAM, the OOM killer terminates processes, evidenced in dmesg | grep -i oom. A process's likelihood of being killed is its oom_score (0 to 1000), and it can be protected with echo -1000 > /proc/PID/oom_score_adj. Kernel memory overcommit is controlled via vm.overcommit_memory, where 2 enforces strict accounting (which can break some applications). sync && echo 3 > /proc/sys/vm/drop_caches clears the page cache, dentries, and inodes for benchmarking. The /proc filesystem exposes per-process information: /proc/PID/status for state and resources, /proc/PID/cmdline for command-line arguments, /proc/PID/environ for environment variables, /proc/PID/maps for memory mappings, /proc/PID/fd/ for open file descriptors, and readlink -f /proc/PID/exe for the binary path. lsof | grep deleted lists files that have been unlinked but are still held open and recoverable via /proc/PID/fd/.

Performance monitoring spans many tools. vmstat 1 streams process, memory, CPU, and IO statistics every second. iostat -xz 1 (sysstat) shows extended per-device IO statistics including latency and utilization. sar -u shows historical CPU utilization when sysstat data collection is enabled. mpstat reports per-CPU breakdown; pidstat -p PID 1 shows per-process CPU, memory, and IO stats. stress-ng --cpu 4 --timeout 60s stress-tests with four workers for a minute, and perf record -g command profiles with call graphs, viewable in perf report. ncdu /path is an interactive TUI for browsing disk usage, while iotop shows per-process IO. Network monitoring is covered by iftop (per-connection bandwidth), vnstat and vnstat -d (hourly/daily/monthly totals), and iperf3 (bandwidth testing, run as iperf3 -s on one end and iperf3 -c server on the other). glances -w starts a web interface, and Prometheus node_exporter (default port 9100) exposes metrics for scraping. collectl and nmon are alternative comprehensive monitors. Hardware inventory tools include lscpu, lspci, lsusb, lshw -short, dmidecode -t memory, and cat /etc/os-release or lsb_release -a for OS info. CPU vulnerabilities can be reviewed via grep . /sys/devices/system/cpu/vulnerabilities/*.

Docker containers are managed from the CLI. docker build -t repo/name:tag . builds and tags an image, and docker push uploads it after login. docker run starts a container; docker logs -f follows its logs; docker exec -it container /bin/bash opens an interactive shell; and docker cp container:/path /host/path copies files out. docker stats streams live CPU, memory, and IO usage per container; docker inspect dumps JSON configuration; docker system df reports storage usage; and docker system prune and docker image prune remove unused data and untagged images. Multi-container setups use Compose files started with docker compose up -d. System time is managed with timedatectl: status shows local time, RTC, NTP, and timezone; set-timezone Region/City changes the timezone; and timesync-status reports systemd-timesyncd state. With chrony, chronyc sources lists configured time sources and chronyc tracking shows offset and frequency correction. Other convenience commands include ulimit -a for shell resource limits, cat /proc/loadavg for load averages and process counts, and wall "message" to broadcast to all logged-in users.