Advanced Command-Line Navigation & File System Operations

Understanding the Linux Ecosystem

Understanding the Linux Architecture (architecture)

Think of Linux as a three-story building where each floor serves a specific purpose:

The Three Pillars of Linux

Component	Description	Your Interaction
Kernel	The core that manages hardware and system resources	You rarely interact directly
Shell	The command interpreter (your command-line interface)	This is where you'll work
Filesystem	How files and directories are organized	What you'll navigate daily

Pillar 1: The Linux Kernel - The Silent Guardian

What is the Kernel?

The kernel is the heart of Linux - a sophisticated program that acts as a bridge between your applications and the computer's hardware. Think of it as the building manager who handles all the behind-the-scenes operations.

Core Kernel Responsibilities

Function	Description	Real-World Example
Process Management	Controls which programs run and when	Opening multiple browser tabs
Memory Management	Allocates RAM to different programs	Switching between applications
Device Drivers	Communicates with hardware components	Recognizing USB drives
File System Interface	Manages how data is stored and retrieved	Saving a document
Network Stack	Handles internet and network connections	Browsing websites
Security & Permissions	Controls access to system resources	User login authentication

Why You "Rarely Interact Directly"

The kernel operates in kernel space - a protected area where only the kernel can execute code. This design provides:

• System Stability: Prevents user programs from crashing the entire system
• Security: Protects critical system functions from malicious code
• Resource Management: Ensures fair allocation of system resources

Hands-On: Exploring Kernel Information

# Check your kernel version and build information

uname -a

Output

# See current date and time

date

Output

# Display the current logged-in user

whoami

Output

# Show system uptime and load

uptime

Output

# View detailed kernel information

cat /proc/version

Output

# See what kernel modules are currently loaded

lsmod | head -10

Output

# Check kernel boot messages (system startup log)

dmesg | grep -i "linux version"

Output

Pillar 2: The Shell - Your Command Center

What is the Shell?

The shell is your command interpreter - the interface where you communicate with Linux using text commands. It's like having a conversation with your computer in a language it understands.

Popular Shell Types

Shell Components Deep Dive

1. Command Prompt Anatomy
   

   username@hostname:current_directory$

   username: Your account name
   hostname: Computer name
   current_directory: Where you are in the filesystem
   $: Regular user (# for root/admin)
2. Command Structure
   

   command [options] [arguments]
       │       │         │
       │       │         └── What to act upon
       │       └── How to modify behavior
       └── What action to take

Pillar 3: The Filesystem - Your Digital Filing Cabinet

Understanding Linux Filesystem Hierarchy

Linux organizes everything as files in a tree-like structure starting from the root directory (/). This is fundamentally different from Windows' drive letters (C:, D:, etc.).

The Linux Directory Tree

/                           ← Root directory (everything starts here)
├── bin/                    ← Essential user command binaries
├── boot/                   ← Boot loader files
├── dev/                    ← Device files (hardware interfaces)
├── etc/                    ← System configuration files
├── home/                   ← User home directories
│   ├── user1/
│   └── user2/
├── lib/                    ← Essential shared libraries
├── media/                  ← Mount point for removable media
├── mnt/                    ← Temporary mount point
├── opt/                    ← Optional application software
├── proc/                   ← Virtual filesystem (process info)
├── root/                   ← Root user's home directory
├── run/                    ← Runtime variable data
├── sbin/                   ← System administration binaries
├── srv/                    ← Service data
├── sys/                    ← Virtual filesystem (system info)
├── tmp/                    ← Temporary files
├── usr/                    ← User utilities and applications
│   ├── bin/                ← User command binaries
│   ├── lib/                ← Libraries for user programs
│   └── local/              ← Local software installations
└── var/                    ← Variable data (logs, databases)
    ├── log/                ← System and application logs
    └── www/                ← Web server files

Key Directory Purposes Explained

Popular Linux Distributions Comparison

The Linux Boot Process Explained

Brief Explanation

• Power On: The process starts as soon as you turn on the computer.
• BIOS/UEFI: The motherboard firmware initializes the hardware and checks everything is OK (POST – Power-On Self-Test).
• Bootloader (e.g., GRUB): The bootloader finds and loads the Linux kernel into memory. Here, you may see a menu to select which OS or kernel to boot.
• Kernel: The Linux kernel initializes your system's CPU, memory, devices, and mounts the filesystem.
• Init System (systemd, SysVinit): The init process (called systemd on most modern systems) starts all the necessary services and brings the system to a usable state.
• User Login: Finally, the login prompt appears, and you can log in to use your computer.

Mastering the Linux Directory Tree

Linux organizes everything in a hierarchical tree structure. Think of it as an upside-down tree with roots at the top (/) and branches extending downward. Understanding this structure is crucial for navigation and security.

Key Directory Purposes Explained

Exploring Key Directories

Root Directory (/) - Your Starting Point

cd /
ls -la

cd /

Purpose: Navigate to the root directory

• cd = Change Directory command
• / = Root directory (the top-level directory of the entire file system)

ls -la

Purpose: List all files and directories with detailed information

• ls = List command (shows directory contents)
• l = Long format (shows detailed information like permissions, size, date)
• a = All files (includes hidden files that start with a dot)

Output

ls -la /etc/ | head -10

Output

Explanation → ls -la /etc/ | head -10

/etc - Configuration Command Center

Purpose: Show the first 10 items in the /etc directory with details

• ls -la /etc/ = List all files in /etc directory with long format
• | = Pipe (sends output to next command)
• head -10 = Show only the first 10 lines

cat /etc/os-release

Output

Explanation → cat /etc/os-release

Purpose: Display operating system version and information

• cat = Display file contents
• /etc/os-release = Standard file containing OS identification data

cat /etc/passwd | head -5 

Output

Explanation → cat /etc/passwd | head -5

Purpose: Display the first 5 user accounts from the system

• cat /etc/passwd = Display the password/user database file
• | = Pipe output to next command
• head -5 = Show only first 5 lines

ls -la /var/

Output

Explanation → ls -la /var/

/var - The Dynamic Data Hub

Purpose: List all contents of the /var directory with detailed information

• ls -la = List all files/directories with long format details
• /var/ = Variable data directory (logs, temporary files, databases, etc.)

du -sh /var/log/*            

Output

Explanation → du -sh /var/log/*

Purpose: Show disk usage size of each log file/directory

• du = Disk Usage command
• s = Summary (total size for each item, not subdirectories)
• h = Human-readable format (KB, MB, GB instead of bytes)
• /var/log/* = All files and directories inside /var/log/

tail -n 10 /var/log/auth.log

Output

Explanation → tail -n 10 /var/log/auth.log

Purpose: Display the last 10 lines of the authentication log

• tail = Show end of file
• n 10 = Show last 10 lines (you can change the number)
• /var/log/auth.log = Authentication and authorization log file

ls -la /tmp/

Output

Explanation → ls -la /tmp/

/tmp - The Wild West Directory

Purpose: List all files and directories in the temporary folder with detailed information

• ls -la = List all files (including hidden) with long format
• /tmp/ = Temporary directory where programs store temporary files

df -h /tmp                       

Output

Explanation → df -h /tmp

Purpose: Check available disk space for the /tmp directory

• df = Display filesystem disk space usage
• h = Human-readable format (shows GB, MB instead of bytes)
• /tmp = Check specifically the /tmp filesystem

sudo find /tmp -type f -mtime -1 

Output

Explanation → find /tmp -type f -mtime -1

Purpose: Find all regular files in /tmp that were modified within the last 24 hours

• find = Search for files and directories
• /tmp = Search location (temporary directory)
• type f = Only find regular files (not directories or special files)
• mtime -1 = Modified time less than 1 day ago (within last 24 hours)

Directory Permissions Decoder

Understanding permission strings is crucial for security:

-rw-r--r-- 1 user user 1024 Aug 15 10:30 filename.txt
│└┬┘└┬┘└┬┘ │  │    │     │      │           │
│ │  │  │  │  │    │     │      │           └─ Filename
│ │  │  │  │  │    │     │      └─ Modification timestamp
│ │  │  │  │  │    │     └─ File size (bytes)
│ │  │  │  │  │    └─ Group owner
│ │  │  │  │  └─ User owner
│ │  │  │  └─ Number of hard links
│ │  │  └─ Other permissions (read, write, execute)
│ │  └─ Group permissions (read, write, execute)
│ └─ Owner permissions (read, write, execute)
└─ File type indicator

Directory Permissions Quick Reference

Know Your Location with pwd

The pwd (Print Working Directory) command is your GPS in the Linux filesystem:

pwd    

Output

pwd -P                     

Output

pwd -L                      

Output

Master Directory Changes with cd = Change Directory

The cd command is used to navigate between directories (folders) in the Linux/Unix file system. It changes your current working directory to a different location.

Basic Syntax

cd [directory_path]

Common Uses and Examples:

1. Navigate to Home Directory

# Go to your home directory
cd                                                
# Also goes to home directory 
cd ~                                                              
# Another way to go home
cd $HOME                                           

2. Navigate to Specific Directory

# Go to Documents folder
cd /home/user/Documents 
# Go to system configuration directory
cd /etc                         
# Go to log files directory
cd /var/log                                 

3. Navigate Using Relative Paths

# Go to Documents in current directory
cd Documents                                                        
# Go up one directory level
cd ../                                                             
# Go up two directory levels
cd ../../ 
# Go to folder in current directory
cd ./folder                                            

4. Navigate to Previous Directory

# Go back to previous directory you were in
cd -                                                                                      

5. Navigate to Root Directory

# Go to root directory (top of file system)
cd /                                                                                                 

Special Directory Symbols:

• . = Current directory
• .. = Parent directory (one level up)
• ~ = Home directory
• / = Root directory
• - = Previous directory

Practical Examples:

# Start in /home/user

# Shows: /home/user
pwd 
# Now in: /home/user/Documents
cd Documents
# Now in: /home/user/Downloads
cd ../Downloads
# Now in: /tmp
cd /tmp
# Back to: /home/user/Downloads
cd - 
# Back to: /home/user (home)
cd 
# Now in: / (root)
cd /

Advanced Navigation Techniques

# Move through multiple levels (Relative path navigation)
cd documents/projects/current 
# Start from root (# Absolute path navigation)
cd /var/www/html/assets 
# Now in: /home/user/Downloads
cd /var/www/html/assets 
# Auto-completes to Documents/
cd Doc<TAB>
# First subdirectory containing projects
cd */projects

Supercharge Navigation with CDPATH

CDPATH is an environment variable that creates directory shortcuts, allowing you to jump to frequently-used directories from anywhere in the file system without typing full paths.

How CDPATH Works

When you use cd with a relative path, the shell searches these locations in order:

1. Current directory (.)
2. Each directory listed in CDPATH
3. Finds the first match and changes to that directory

Set up directory shortcuts for instant teleportation:

Path Breakdown:

• . = Current directory (always search here first)
• ~ = Home directory
• ~/projects = Your projects folder
• /var/www = Web server files
• /opt = Optional software directory

# Set CDPATH environment variable
export CDPATH=".:~:~/projects:/var/www:/opt"
# Works from anywhere if ~/projects exists
cd projects        
# Jumps to /var/www/html if it exists
cd html 
# Could jump to /var/logs if configured
cd logs 
# Make it permanent by adding to ~/.bashrc
echo 'export CDPATH=".:~:~/projects:/var/www:/opt"' >> ~/.bashrc

Practical Examples

The ls Command: Your File System X-Ray (List Directory Contents)

The ls command displays the contents of directories, showing files and subdirectories. It's one of the most fundamental and frequently used commands in Linux/Unix systems.

Basic Listing Operations

ls                  

Output

ls -l                            

Output

ls -a                                 

Output

ls -la                              

Output

ls -lah                            

Output

Flag description

• -l = long format (detailed information)
• -a = all files (including hidden)
• -h = human-readable file sizes (must be used with -l)

Advanced Listing Techniques

# Sort by modification time (newest first)
ls -lt
# Sort by file size (largest first)
ls -lS        
# Reverse sort order
ls -lr
# Show inode numbers
ls -li 
# Recursive listing
ls -lR 
# Color-coded output
ls --color=always

Understanding ls -la Output Anatomy:

-rwxr-xr--  1 alice dev 1.2K Nov 15 10:30 script.sh
│           │   │    │    │   │            │
│           │   │    │    │   │            └─ Filename
│           │   │    │    │   └─ Modification timestamp
│           │   │    │    └─ File size
│           │   │    └─ Group owner
│           │   └─ User owner
│           └─ Number of hard links
└─ Permissions (type + rwx for owner, group, others)

File Creation and Management

The Versatile touch Command

The touch command in Unix/Linux systems is used to create empty files or update timestamps of existing files.

What it does:

• Creates new empty files if they don't exist
• Updates the access and modification timestamps of existing files to current time
• Does NOT modify the content of existing files

Basic syntax:

touch filename

# Create empty files
touch newfile.txt
# Create Multiple files
touch file1.txt file2.txt file3.txt  
# Updates access/modify time
touch existing_file.txt  
# Set specific timestamps (# YYYYMMDDhhmm format)
touch -t 202311151030 dated_file.txt 
# Human-readable date
touch -d "2023-11-15 10:30" another_file.txt

The cp Command: Copying with Precision

The cp command in Unix/Linux systems is used to copy files and directories from one location to another.

What it does:

• Copies files or directories
• Creates duplicate of the original (original stays intact)
• Can copy to same directory with different name (duplicating)
• Can copy to different directory

Basic syntax:

cp source destination

# Simple copy
cp source.txt destination.txt          
# Copy to directory
cp source.txt /backup/   

# Advanced copying options
# Preserve permissions, timestamps
cp -p source.txt backup.txt  
# Recursive (for directories)
cp -r directory/ /backup/ 
# Interactive (prompt before overwrite)
cp -i source.txt existing.txt
# Verbose (show what's copied)
cp -v *.txt /backup/
# Update (copy only if newer)
cp -u source.txt dest.txt

Sample Output for cp -i

cp: overwrite 'existing.txt'? y   

Sample Output for cp -v

'document1.txt' -> '/backup/document1.txt'
'document2.txt' -> '/backup/document2.txt'
'notes.txt' -> '/backup/notes.txt'

Flag description

• p = Preserve original properties
• r = Recursive (go deeper)
• i = Interactive (ask me first)
• v = Verbose (tell me what you're doing)
• u = Update (only if newer)

The mv Command: Moving and Renaming

The mv command in Unix/Linux systems is used to move or rename files and directories.

What it does:

• Moves files/folders from one location to another
• Renames files/folders (moving within the same directory)
• Cuts and pastes (unlike cp which copies)

Basic syntax:

mv source destination

# Rename files and directories
# Rename file
mv oldname.txt newname.txt           
# Rename directory
mv old_directory new_directory  

# Move files and directories
# Move file
mv file.txt /destination/directory/
# Move multiple files
mv *.log /var/log/archive/
# Move directory
mv directory/ /new/location/ 
# Interactive and verbose options
# Prompt before overwrite
mv -i important.txt /backup/ 
# Show move operations
mv -v *.txt ~/documents/

Flag description

• i = Interactive (ask me first before overwriting)
• v = Verbose (tell me what you're doing)

The rm Command: Deletion with Caution

The rm command in Unix/Linux systems is used to remove (delete) files and directories.

What it does:

• Deletes files permanently
• Removes directories when used with proper flags
• Files are typically gone forever (no recycle bin)

Basic syntax:

rm filename

# Basic file removal
# Remove single file
rm unwanted.txt           
# Remove multiple files
rm file1.txt file2.txt
# Remove files by pattern
rm *.tmp 

# Directory removal
# Remove directory recursively
rm -r directory_name/ /
# Remove directory recursively
rm -r directory_name/ /
# Force removal (no prompts)
rm -rf directory_name/

# Safe removal practices
# Interactive removal
rm -i suspicious.txt
# Interactive + verbose
rm -iv *.tmp  
# Prompt once for 3+ files
rm -I directory/

Flag description

• -r = recursive (remove directories and their contents)
• -f = force (no prompts, ignore non-existent files)
• -i = interactive (prompt before each removal)
• -v = verbose (show what's being removed)
• -I = prompt once for multiple files (capital i)

Sample Output for rm -i

rm: remove regular file 'suspicious.txt'? y   

File Operations Safety Matrix

The cat command in Unix/Linux systems is used to display, concatenate, and create file contents.

What it does:

• Displays file contents on the screen
• Concatenates (joins) multiple files together
• Creates new files when used with redirection
• Reads and outputs file contents to standard output

Basic syntax:

cat filename

Display Content with cat

# Display entire file contents
# Show complete file
cat filename.txt            
# Concatenate multiple files
cat file1.txt file2.txt
# Number all lines
cat -n filename.txt
# Number only non-blank lines
cat -b filename.txt 
# Show all characters (including hidden)
cat -A filename.txt

Flag description

• n = Number all lines
• b = Number only non-blank lines
• A = Show all characters (including hidden ones)

Peek at Files with head and tail

The head command in Unix/Linux systems is used to display the first few lines of a file or input.

What it does:

• Shows the beginning of files
• Displays first 10 lines by default
• Quick preview of file contents
• Reads and outputs file contents to standard output

Basic syntax:

head filename

The head Command - File Beginnings

head filename.txt

Output

head -n 5 filename.txt  

Output

head -c 100 filename.txt

Output

head -n -5 filename.txt

Output

Flag description

• n NUMBER = Show first NUMBER lines
• c NUMBER = Show first NUMBER characters (bytes)
• n -NUMBER = all Not including the end

The tail Command - File Endings

The tailThe tail command in Unix/Linux systems is used to display the last few lines of a file or input.

What it does:

• Shows the end of files
• Displays last 10 lines by default
• Monitor file changes in real-time (with f)
• Works with text files and command output

Basic syntax:

tail filename

tail filename.txt 

Output

tail -n 12 filename.txt   

Output

tail -c 50 filename.txt

Output

tail -n +5 filename.txt

Output

# Follow file changes
tail -f /var/log/syslog

Output

tail -F /var/log/syslog

Output

Flag description

• n NUMBER = Show last NUMBER lines
• c NUMBER = Show last NUMBER characters (bytes)
• f = Follow (monitor file for new content)
• F = Follow with retry (handles file rotation)
• +NUMBER = Start from line NUMBER to end

Interactive Viewing with less

The less command in Unix/Linux systems is used to view and navigate through file contents one screen at a time.

What it does:

• Displays file contents with pagination
• Interactive navigation through large files
• Search functionalitywithin files
• Memory efficient - doesn't load entire file at once
• Read-only viewer - cannot edit files

Basic syntax:

less filename

# Open file for interactive browsing
less filename.txt           
# Start in follow mode
less +F /var/log/syslog
# Start at end of file
less +G filename.txt
# No Line Wrapping
less -N filename.txt 
# Show all characters (including hidden)
less -S filename.txt
# Don't Clear Screen
less -X filename.txt    

Flag description

• N = Show line numbers
• S = Don't wrap long lines (horizontal scrolling)
• i = Ignore case in searches
• X = Don't clear screen when exiting
• +F = Follow (live monitoring)
• +G = Go to end (G is the "go to end" key in less)
• N = Numbers (show line numbers)

Essential less Navigation Commands:

File Type Identification with file

The file command in Unix/Linux systems is used to determine the type and format of files by examining their contents.

What it does:

• Identifies file types regardless of file extension
• Analyzes file content rather than just the filename
• Detects file formats (text, binary, images, executables, etc.)
• Shows file characteristics like encoding, architecture, etc.

Basic syntax:

file filename

file filename.txt

Output

file projects

Output

file unknown_data.bin

Output

file *

Output

Flag description

• b = Brief (show only file type, not filename)
• i = Show MIME (Multipurpose Internet Mail Extensions) type instead of description
• L = Follow symbolic links
• z = Look inside compressed files

Understanding Hidden Files

In Linux, any file or directory starting with a dot (.) is hidden from standard directory listings. This feature reduces clutter but can also conceal malicious files.

# Find hidden files recursively

find . -name ".*" -type f  

Output

find . -name ".*" -type d 

Output

find /home -name ".*" -exec ls -la {} \;

Output

Critical Hidden Files for Security

Understanding Links: Hard vs. Symbolic

Symbolic Links (Symlinks)

Symbolic links are shortcuts that point to other files or directories:

ln -s /path/to/original /path/to/link 

ln -s /var/log/apache2 web_logs

ln -s ../shared-config.txt config.txt

# Identify symbolic links

# List only symlinks
ls -la | grep "^l" 

file file.txt

Output

readlink file.txt

Output

Flag description

• -s = symbolic/soft link (creates a pointer, not a copy)

Hard Links

Hard links create multiple directory entries for the same file:

ln original.txt hardlink.txt

ln /path/to/file /another/path/link 

ls -li original.txt hardlink.txt 

Output

find . -samefile original.txt

Output

Flag description

• ls -i = show inode numbers
• ls -l = symbolic/soft link (creates a pointer, not a copy)
• find -samefile = locate all hard links to a file

Hard Link vs Symbolic Link Comparison:

The find Command: Your File System Detective

The find command is one of the most powerful tools in Linux, enabling complex searches across your entire system.

Basic Search Patterns

# Search by filename

# Case-sensitive search
find . -name "*.txt"  

Output

find . -iname "*.TXT" 

Output

find /home -name "config*"

Output

find . -name "*.log" -o -name "*.tmp" 

Output

Search by File Type

find /var -type f -name "*.log"

Output

Flag description

• type d = Search for regular files only
• name "*.log" = Match files ending with .log extension

find /usr -type d -name "*bin*" 

Output

Flag description

• type d = Search for directories only
• name "*bin*" = Match directories containing "bin"

find /dev -type l 

Output

Flag description

• type l = Search for symbolic links only

find . -type f -executable

Output

Flag description

• type f = Search for regular files only
• executable = Match files that are executable by current user

find . -type f -readable

Output

Flag description

• type f = Search for regular files only
• readable = Match files that are readable by current user

Time-Based Searches (Critical for Forensics)

# Modified in last 7 days
find /var -type f -mtime -7 

Output

Flag description

• type f = Search for regular files only
• mtime -7 = Modified within the last 7 days (less than 7 days ago)

find /tmp -type f -mtime +1

Output

Flag description

• type f = Search for regular files only
• mtime +30 = Modified more than 30 days ago

find . -type f -mmin -60

Output

Flag description

• type f = Search for regular files only
• mmin -60 = Modified within the last 60 minutes

# Accessed in last 24 hours

find /home -type f -atime -1

Output

Flag description

• type f = Search for regular files only
• atime -1 = Accessed within the last 24 hours (1 day)

find . -type f -atime +90

Output

Flag description

• type f = Search for regular files only
• atime +90 = Not accessed for more than 90 days

# Created after date

find . -type f -newerct "2025-08-27"

Output

Flag description

• type f = Search for regular files only
• newerct "2023-11-01" = Created after the specified date (November 1, 2023)

Time Flag Summary:

Modification Time:

• mtime -N = Modified less than N days ago
• mtime +N = Modified more than N days ago
• mmin -N = Modified less than N minutes ago

Access Time::

• atime -N = Accessed less than N days ago
• atime +N = Not accessed for more than N days

Creation Time:

• newerct "date" = Created after specified date
• newermt "date" = Modified after specified date

Size-Based Searches

# Files larger than 10MB
find /var -type f -size +10M 

Output

Flag description

• type f = Search for regular files only
• size +100M = Files larger than 100 megabytes

find . -type f -size -1k  

Output

Flag description

• type f = Search for regular files only
• size -1k = Files smaller than 1 kilobyte (1024 bytes)

find /tmp -type f -size +1k -size -10M

Output

Flag description

• type f = Search for regular files only
• size +1k = Files larger than 1 gigabyte
• size -10MB = Files smaller than 2 gigabyte
• Combined effect: Files between 1GB and 2GB in size

find . -empty

Output

Flag description

• empty = Find empty files (0 bytes) and empty directories (no contents)

Size Unit Suffixes:

Available size units:

• c = bytes
• w = 2-byte words
• k = kilobytes (1024 bytes)
• M = megabytes (1024 KB)
• G = gigabytes (1024 MB)
• T = terabytes (1024 GB)

Size Operators:

Size prefixes:

• +N = Greater than N units
• -N = Less than N units
• N = Exactly N units

Lightning-Fast Searches with locate

The locate command uses a pre-built database for instant filename searches:

# Update file database

sudo updatedb

locate nginx.conf

Output

locate -i pdf

Output

locate -l 5 "*.txt"

Output

Flag description

• -i = ignore case (case-insensitive search)
• -l NUMBER = limit results to specified number of entries

Content Searching with grep

grep (Global Regular Expression Print) is a powerful command-line text search utility in Linux that searches for patterns within files or input streams and prints matching lines.

Basic Syntax

grep [OPTIONS] PATTERN [FILE...]

Basic Text Searching

# Find "error" in syslog
grep "error" /var/log/syslog
# Case-insensitive search
grep -i "warning" /var/log/messages  
# Show line numbers
grep -n "TODO" script.sh   
# Count occurrences
grep -c "failed" auth.log

Flag description

• -i = ignore case (case-insensitive search)
• -n = show line numbers
• -c = count matches (shows number, not the actual lines)

Recursive Directory Searching

# Search recursively
grep -r "password" /etc/   
# Recursive with line numbers
grep -rn "TODO" ~/projects/ 
# Recursive, case-insensitive
grep -ri "copyright" /usr/src/
# Search only Python files
grep -r --include="*.py" "import" . 
# Exclude log files
grep -r --exclude="*.log" "error" . 

Flag description

• -i = ignore case (case-insensitive search)
• -r = Search recursively through all subdirectories
• -n = Display line numbers where matches are found

Additional Recursive Flags:

File Filtering:

• -include="pattern" = Only search files matching pattern
• -exclude="pattern" = Skip files matching pattern
• -exclude-dir="pattern" = Skip directories matching pattern

Advanced grep Techniques

# Show 3 lines before/after match
grep -C 3 "error" logfile.txt 
# 2 before, 1 after
grep -B 2 -A 1 "warning" log.txt
# Invert match (exclude lines)
grep -v "INFO" application.log 
# Extended regex
grep -E "(error|warning|critical)" log.txt  
# Fixed string (no regex)
grep -F "literal.string" file.txt

Flag description

• -C 3 = Show 3 lines of context (both before and after each match)
• -B 2 = Show 2 lines before each match
• -A 1 = Show 1 line after each match
• -v 1 = Invert match (show lines that do NOT contain the pattern)
• -E = Use extended regular expressions (same as egrep)
• -F = Treat pattern as fixed string (no regular expression interpretation)

Search Command Comparison Matrix

Filesystem Analysis with df

The df (disk free) command shows filesystem disk space usage:

df

Output

df -h 

Output

df -H

Output

df -T

Output

df -i   

Output

Flag description

• -h = human-readable (1024-byte units: 1K = 1024 bytes)
• -H = human-readable (1000-byte units: 1K = 1000 bytes)
• -T = show filesystem type
• -i = show inode information instead of block usage

Focused Filesystem Monitoring

# Root filesystem only
df -h /

Output

df -h /home /var 

Output

df -h | grep -E "(/$|/home|/var)"\

Output

# Highlight filesystems >80% inode usage
df -i | awk '$5+0 > 80 {print}'

Output

Explanation → df -i | awk '$5+0 > 80 {print}'

Purpose: Shows filesystems where inode usage is over 80% (helps identify partitions running out of available file slots).

• i = Show inode information instead of block usage
• | = Pipe (sends output to next command)
• $5 = References the 5th field (Use% column - inode usage percentage)
• +0 = Converts the string to numeric value (removes the % symbol)
• > 80 = Condition to check if usage is greater than 80%
• {print} = Action to print the entire line when condition is true

Directory Usage Analysis with du

The du (disk usage) command analyzes directory space consumption:

# Summarize directory size
du -sh /var/log

Output

# Top 10 largest subdirectories

du -h /var/log/ | sort -hr | head -10

Output

# All files and dirs with sizes
du -ah . | head -20

Output

# Depth 1 only (immediate subdirs)
du -d 1 -h /usr

Output

Flag description

• s = Summarize (show only total size, not individual subdirectories)
• h = Human-readable format (KB, MB, GB, etc.)
• a = Show all files and directories (not just directories)
• d 1 = Maximum depth of 1 level (show only immediate subdirectories)

Critical Disk Usage Thresholds

Essential Monitoring Commands

# Update every 5 seconds

watch -n 5 'df -h'    

watch -n 10 'du -sh /var/log'

# Interactive disk usage analyzer
ncdu /

find /tmp -type f -mtime +7 -delete

journalctl --vacuum-time=30d 

apt-get autoremove && apt-get autoclean