The Linux Sysadmin Command Map: 39 Safe Starting Points

The fastest way to make an incident harder is to start changing things before you know which system, path, process, or package you are looking at. This map puts inspection first. It then names the small set of mutations that belong in a disposable directory or an approved change window.

The lab behind this guide used the official debian:13.6 image at digest sha256:34cd9e9fd437c0a095ec39cb2e73422c9f30821b0d0848ed74fd0d43bae4d958 and alpine:3.24.1 at digest sha256:28bd5fe8b56d1bd048e5babf5b10710ebe0bae67db86916198a6eec434943f8b. Debian used /bin/sh → Dash 0.5.12-12; Alpine used BusyBox ash 1.37.0. The GNU Coreutils manual and BusyBox applet list explain why a familiar command can have different flags or be missing in a small image.

How to read the map

GNU means the GNU or named upstream implementation normally supplied by a Debian package. BusyBox means the applet is available in a BusyBox build such as Alpine’s; a vendor can compile a smaller BusyBox. yes does not mean the command is installed in every base image. The task verification record records the exact base-image result and exit code.

Inspection — start here

These commands read state. Capture their output with the hostname, timestamp, working directory, and command line so another operator can reproduce the observation.

Treat environment output as sensitive. Do not paste tokens, credentials, or full production paths into an incident channel.

Files — inspect, then change one named path

The first five file commands are read-only. find is recursive by default, so bound it to a known root and depth. GNU find and BusyBox find do not have identical predicates; check --help before copying a long expression.

Caution: The next three commands mutate or remove entries. Run them only in a directory you own, name every path, and preview with ls or stat first. Never turn a printed path into an unreviewed recursive rm.

The lab created source, copied it to copy, printed its size, then removed only those two files and the printed temporary directory. It did not run a recursive removal against a host path.

Processes — observe before signalling

ps, pgrep, and top show snapshots. kill -0 asks the kernel whether a signal could be delivered; it does not deliver a signal.

Caution: top -b -n 1 samples processes and repeated polling can add load. nice changes the priority of the command it starts. Do not use a priority change or a real signal on a production process without an owner, expected effect, and rollback.

Storage — compare scope and units

All four commands below are read-only. df reports filesystem accounting; du walks a directory tree. Their scopes can disagree when mounts, deleted-open files, sparse files, or container layers are involved.

Do not “fix” a full filesystem by deleting the largest path until you have aligned the mount namespace, filesystem, units, and ownership.

Networking — identify first, generate traffic deliberately

ip, ss, and getent inspect local addresses, sockets, and name-service results. wget --help only checks the interface. ping below sends one packet to loopback in the lab; a remote target creates network traffic and may trigger alerts.

Caution: A connectivity probe is not free. Use an approved destination, a bounded count and timeout, and never use an unbounded download while diagnosing a service.

Logs — know which store you are reading

dmesg reads the kernel ring buffer and can be denied by kernel policy. journalctl reads a systemd journal only; its absence is not a broken command if the host uses another init or logging stack. logread needs a BusyBox syslogd buffer, and tail reads a text log only when that path exists.

Do not restart a service just to create a log line. Preserve the original timestamps and query filters in the evidence.

Users — identity and account data

These commands read identity state. Account databases can contain personal or operational information; restrict the output to the records needed for the question.

Packages — inspect the local database, do not update it by accident

Package metadata commands below are read-only. apt-cache and apk policy can report only what their local indexes know; refreshes and installations are separate, state-changing operations.

Avoid running apt update, apk update, apt install, or apk add merely to make a diagnostic command available. Record the missing tool, then decide whether installing it in a disposable copy is worth changing the evidence.

A repeatable first pass

For an unfamiliar host, save a bounded report in an access-controlled location:

pwd
cat /etc/os-release
uname -a
id
df -hT /
du -sh /var 2>/dev/null
ps 2>/dev/null || true
ip addr 2>/dev/null || true

Then choose one narrow branch from the map. A command’s exit status is part of the result: 127 usually means the command was not found, while a permission error or an empty log store is a different operational fact.

The map is a starting point, not a promise that every flag is portable. Read the installed implementation’s manual, keep inspection ahead of mutation, and write down the exact command, shell, release, exit status, and bounded output before someone acts on it.