Linux SysAdmin Wiki Guide

System Information

Get OS version, kernel, and system boot messages.

# Kernel version, machine type, OS
uname -mrs
# Example output: Linux 5.14.0-284.30.1.el9_2.x86_64 x86_64

# Full OS release info (Ubuntu/Debian)
lsb_release -a

# RHEL / Rocky – check OS release
cat /etc/os-release

# Show all system info (Windows-style summary on Linux)
# Requires 'dmidecode'
systeminfo

# Show boot-time errors, warnings, critical messages
dmesg | egrep -i 'err|warn|critical'

# Follow a live application log
sudo tail -f /var/log/myapp

Hardware Information

Tools to inventory physical and virtual hardware components.

# Short hardware summary (most useful quick view)
sudo lshw -short

# Full hardware detail
lshw

# Export hardware info to HTML (useful for documentation)
sudo lshw -html > lshw.html

# List disk hardware only
lshw -C disk

# CPU details – sockets, cores, threads, cache, flags
lscpu

# PCI devices (NICs, HBAs, GPUs, controllers)
lspci

# PCI devices in tree format
lspci -t

# PCI devices with full verbose detail
lspci -v

# USB devices with verbose output
lsusb -v

💡 On VMware VMs, lspci will show VMXNET3 NICs, PVSCSI controllers, and VMCI devices — useful for confirming paravirtual hardware is in use.

SCSI & SATA Device Info

Useful for identifying disks, LUNs, and storage controllers.

# List all block devices (disks, partitions, LUNs) in tree format
lsblk

# Example output:
# NAME   MAJ:MIN RM  SIZE RO TYPE MOUNTPOINT
# sda      8:0    0   50G  0 disk
# ├─sda1   8:1    0    1G  0 part /boot
# └─sda2   8:2    0   49G  0 part /

# List SCSI devices with size info
lsscsi -s

# Install lsscsi if missing
yum install lsscsi -y       # RHEL/Rocky
apt install lsscsi -y       # Ubuntu

# SATA device info – geometry, speed, DMA settings
sudo hdparm /dev/sda

# Show disk geometry (cylinders, heads, sectors)
sudo hdparm -g /dev/sda

# Test raw read speed (non-destructive)
sudo hdparm -tT /dev/sda

DMI / BIOS Information

dmidecode reads hardware info from the system’s DMI/SMBIOS table. Useful for serial numbers, warranty info, and memory layout.

# Full DMI dump (paged)
sudo dmidecode -q | less

# Memory info – slots, size, speed, type (DDR4 etc.)
sudo dmidecode -t memory

# BIOS version and release date
sudo dmidecode -t bios

# CPU info – socket type, cores, speed
sudo dmidecode -t processor

# System info – manufacturer, model, serial number
sudo dmidecode -t system

💡 On VMware VMs, dmidecode -t system will show VMware as the manufacturer and the VM’s UUID — useful for cross-referencing with vCenter.

Hostname Configuration

# View current hostname
hostnamectl

# Set a new hostname (takes effect immediately, no reboot needed for most services)
hostnamectl set-hostname myserver.domain.com

# Verify the change
hostname

# Update /etc/hosts to reflect the new name (important for local resolution)
vi /etc/hosts
# Add or update:  127.0.0.1   myserver.domain.com  myserver

# Check network hostname config file (RHEL/CentOS)
vi /etc/sysconfig/network

⚠️ A reboot is recommended after a hostname change to ensure all services (e.g. rsyslog, NTP) pick up the new name.

# Reboot options
systemctl reboot
shutdown -r now
shutdown -r +5 "Rebooting in 5 minutes"

Disk Usage – df & du

df – Filesystem disk space usage

# Human-readable filesystem usage
df -h

# Human-readable with grand total
df -h --total

# Show filesystem type (ext4, xfs, nfs etc.)
df -hT

# Show inode usage (important if filesystem is "full" but df shows space)
df -i

# Check specific path's filesystem
df -H /var/log

du – Directory and file sizes

# Total size of a directory (human readable)
du -sh /var/log

# All files and subdirectories with grand total
du -ahc /var/log

# Top-level directories sorted by size (largest first) – great for finding what's eating space
du -h --max-depth=1 /var/log | sort -rh

# Display in GB
du -gsh /home/vmadmin

# Find the top 10 largest files from current directory
du -ah . | sort -rh | head -10

💡 If df shows a filesystem full but du shows free space, check for deleted-but-open files:

lsof | grep deleted

File Archiving – tar, zip, gzip

tar

# Create a .tar archive
tar -cvf archive.tar /path/to/files

# Create a compressed .tar.gz archive
tar -zcvf archive.tar.gz /path/to/files

# Extract a .tar archive
tar -xvf archive.tar

# Extract a .tar.gz archive
tar -xzvf archive.tar.gz

# Extract to a specific directory
tar -xzvf archive.tar.gz -C /target/directory

# List contents without extracting
tar -tzvf archive.tar.gz

# Append files to existing tar
tar -rvf archive.tar newfile.txt

zip / unzip

# Create a zip archive
zip archive.zip file1.txt file2.txt

# Zip a directory recursively
zip -r archive.zip /path/to/folder

# Unzip a file
unzip archive.zip

# Unzip to a specific directory
unzip archive.zip -d /target/directory

# View contents of zip without extracting
zipinfo archive.zip
less archive.zip

gzip

# Compress a file (removes original by default)
gzip myfile.txt
# Result: myfile.txt.gz

# Keep the original file
gzip -c myfile > myfile.gz

# Compress multiple files into one gzip
gzip -c demo1.txt demo2.txt > combined.gz

# Decompress
gzip -d filename.gz
gunzip filename.gz

# View contents without extracting
zcat filename.gz
zless filename.gz

# List compressed file info (ratio, size)
gzip -l filename.gz

# Compress all files in a directory (in-place)
gzip -r /path/to/directory

💡 For best compression ratio use tar -zcvf (gzip) for speed, or tar -jcvf (bzip2) / tar -Jcvf (xz) for smaller files at the cost of speed.

Create Dummy Files with dd

Useful for testing storage performance, filling disks to test alerts, or creating test files.

# Create a 1GB file filled with zeros
dd if=/dev/zero of=testfile.img bs=1G count=1

# Create a 500MB file
dd if=/dev/zero of=testfile.img bs=500M count=1

# Create a 1GB file with random data (better for compression testing)
dd if=/dev/urandom of=testfile.img bs=1G count=1

# Test raw disk write speed
dd if=/dev/zero of=/tmp/testfile bs=1G count=1 oflag=dsync

# Test raw disk read speed
dd if=/dev/sda of=/dev/null bs=1G count=1

# Show progress during dd (RHEL 8.3+ / Ubuntu 16+)
dd if=/dev/zero of=testfile.img bs=1G count=5 status=progress

⚠️ Be careful with dd — it has no safeguards. Double-check the of= (output file) target before running.

Find Modified Files by Date & Size

Timestamps explained

mtime flags

# Find files modified in last 15 days
find . -type f -mtime -15 -ls

# Find files modified in last 30 minutes
find . -type f -mmin -30 -ls

# Find directories modified in last 5 days
find . -type d -mtime -5 -ls

# Find files modified in last 24 hours
find . -newermt "-24 hours" -ls

# Find files modified since a specific date
find . -newermt "2024-01-01" -ls

# Find files changed (ctime) in last 20 minutes
find . -cmin -20 -ls

# Find files created today
find . -type f -ctime -1 -ls

# Find the top 5 largest files
find . -type f -exec ls -s {} ; | sort -n -r | head -5

# Find large files over 100MB
find / -type f -size +100M -ls

# Find files by name pattern
find /var/log -name "*.log" -type f

Find Recently Modified Files & Delete Old Files

⚠️ Always run with -print or -ls first to verify what will be deleted before using -exec rm.

# List files older than 20 days
find . -type f -mtime +20 -print

# Delete files older than 20 days
find . -type f -mtime +20 -exec rm -f {} ;
# or using xargs (faster for large numbers of files)
find . -type f -mtime +20 | xargs rm -f

# List .tar.gz files older than 10 days
find . -type f -name "*.tar.gz" -mtime +10 -print

# Delete .tar.gz files older than 10 days
find . -type f -name "*.tar.gz" -mtime +10 -exec rm -f {} ;

# Delete .zip files over 100MB
find / -type f -name "*.zip" -size +100M -exec rm -i {} ;

# Show .jpg files in /var/log older than 30 days (preview before delete)
find /var/log -type f -name "*.jpg" -mtime +30 -exec ls {} ;

# Delete .jpg files in /var/log older than 30 days
find /var/log -type f -name "*.jpg" -mtime +30 -exec rm {} ;

Find command breakdown:

Copy Files & Directories

Local copy with cp

# Copy a file
cp /var/logs/file.log /home/vmadmin/

# Copy preserving permissions, timestamps, owner
cp -p /var/logs/file.log /home/vmadmin/

# Copy directory recursively
cp -r /var/logs/ /home/vmadmin/

# Recursive, preserve all attributes, verbose
cp -aRv /var/logs/ /home/vmadmin/

# Do not overwrite if file already exists at destination
cp -n /var/logs/file.log /home/vmadmin/

# Copy only files matching a pattern
cp /var/logs/*.gz /home/vmadmin/

# Copy hidden files
cp -R /var/logs/.* /home/vmadmin/

cp flags:

Remote copy with scp

# Copy a file to a remote server
scp /local/file.txt user@192.168.1.100:/remote/path/

# Copy a file from a remote server
scp user@192.168.1.100:/remote/file.txt /local/path/

# Copy a directory recursively to remote
scp -r /local/directory user@192.168.1.100:/remote/directory

# Copy between two remote hosts
scp user1@host1:/path/file user2@host2:/path/

# Copy with a non-default SSH port
scp -P 2222 file.txt user@192.168.1.100:/remote/path/

# Preserve file timestamps and permissions
scp -p file.txt user@192.168.1.100:/remote/path/

💡 For large recurring transfers, consider rsync instead:

# rsync – only syncs changed files, much faster for repeat transfers
rsync -avz /local/directory/ user@192.168.1.100:/remote/directory/

Monitor Logs in Real Time

# Follow a log file live
tail -f /var/log/messages

# Follow showing last 50 lines
tail -n 50 -f /var/log/messages

# Watch a log file refreshing every 2 seconds (default)
watch tail -n 20 /var/log/vmware-network.log

# Watch with a custom interval (5 seconds)
watch -n 5 tail -n 20 /var/log/vmware-network.log

# Follow all systemd journal output (like tail -f for the whole system)
journalctl -f

# Follow journal for a specific service
journalctl -f -u NetworkManager
journalctl -f -u sshd

# Show journal from current boot only
journalctl -b

# Show last 100 journal lines
journalctl -n 100

# Show journal with priority (0=emerg to 7=debug)
journalctl -p err        # errors and above
journalctl -p warning    # warnings and above

Log Filtering & Analysis

# Show errors, warnings, critical from boot messages
dmesg | egrep -i 'err|warn|critical'

# Show yesterday's warnings and errors from a log
grep -i "`date --date='yesterday' '+%b %e'`" /var/log/messages | egrep -wi 'warning|error|critical'

# Show today's errors
grep -i "`date '+%b %e'`" /var/log/messages | egrep -wi 'error|critical'

# Filter out commented lines from a config file (see only active settings)
grep -v '^#' /etc/httpd/conf/httpd.conf | less
grep -v '^#' /etc/ssh/sshd_config | grep -v '^

VMware Tools & Utilities

Open VM Tools (RHEL / Rocky)

# Install open-vm-tools (replaces legacy VMware Tools ISO)
sudo yum install open-vm-tools -y

# Start and enable the service
sudo systemctl enable vmtoolsd --now

# Check status
sudo systemctl status vmtoolsd

# Verify version
vmware-toolbox-cmd -v

Install net-tools (for ifconfig, netstat, route)

# RHEL / Rocky / CentOS
yum install net-tools -y

# Ubuntu / Debian
apt install net-tools -y

⚠️ net-tools (ifconfig, netstat, route) is deprecated. Prefer ip, ss, and nmcli on modern systems.

Useful VMware-specific commands

# Check VMXNET3 NIC driver version
ethtool -i ens192 | grep driver

# Check if VMware balloon driver is loaded
lsmod | grep vmmemctl

# Check VM guest info
vmware-toolbox-cmd stat raw text session

# List VMware block devices
lsblk | grep -i sd

Antivirus – ClamAV (Ubuntu)

ClamAV is the standard open-source antivirus for Linux. Recommended for VMs exposed to user data or file uploads.

# Install ClamAV and firewall
sudo apt install clamav clamav-daemon ufw -y

# Update virus signatures (stop freshclam daemon first)
sudo systemctl stop clamav-freshclam
sudo freshclam
sudo systemctl start clamav-freshclam
sudo systemctl enable clamav-daemon

# Manual scan of a directory (verbose)
clamscan -r /home --verbose

# Scan and only show infected files
clamscan -r /home --quiet --infected

# Scan and move infected files to quarantine
clamscan -r /home --move=/quarantine

# Scan and log results
clamscan -r /home --log=/var/log/clamav/manual-scan.log

Schedule a daily scan (cron)

# Create a cron job to scan /home at 2am daily
echo '0 2 * * * root clamscan -r /home --quiet --infected --log=/var/log/clamav/daily.log' | sudo tee /etc/cron.d/clamav-daily

# View the cron job
cat /etc/cron.d/clamav-daily

# View scan logs
tail -f /var/log/clamav/daily.log

Quick Reference Cheat Sheet

| less 
# Search for a string across all logs in a directory 
grep -r "error" /var/log/ 
# Search case-insensitive grep -i "failed" /var/log/secure 
# Show line numbers with matches grep -n "refused" /var/log/messages 
# Count occurrences 
grep -c "error" /var/log/messages 
#Show last SSH login failures 
grep "Failed password" /var/log/secure | tail -20 
# Show failed sudo attempts grep "sudo" /var/log/secure | grep "incorrect"

Vim Quick Reference

Navigation

Search

Edit & Save

VMware Tools & Utilities

Open VM Tools (RHEL / Rocky)

Install net-tools (for ifconfig, netstat, route)

⚠️ net-tools (ifconfig, netstat, route) is deprecated. Prefer ip, ss, and nmcli on modern systems.

Useful VMware-specific commands

Antivirus – ClamAV (Ubuntu)

ClamAV is the standard open-source antivirus for Linux. Recommended for VMs exposed to user data or file uploads.

Schedule a daily scan (cron)

Quick Reference Cheat Sheet