UNIX Shell Flashcards

Question

What is the find command in Unix?

Answer 1

find searches for files in directory hierarchy. find /path -name '*.log' (by name) + find . -type f (files only) + find . -type d (dirs only) + find . -mtime -7 (modified in last 7 days) + find . -size +100M (larger than 100MB) + find . -user john (owned by user) + find . -perm 755 (specific permissions) + find . -name '*.tmp' -delete (find and delete) + find . -exec command {} \ + (execute command on each)

Answer 2

more: oldest pager - shows file one screen at a time - can only scroll forward (spacebar) - press q to quit - limited features. less: newer - more powerful - scroll forward AND backward (arrow keys + PgUp/PgDn) - search with / + n for next match - G to end - g to beginning. less is more (pun intended). Always prefer less for viewing large files. tail -f for live log monitoring

Answer 3

sed (Stream Editor) processes text line by line applying editing commands. Most common: sed 's/old/new/g' file (substitute all occurrences) + sed 's/old/new/' file (substitute first occurrence per line) + sed -i 's/old/new/g' file (in-place edit) + sed -n '5,10p' file (print lines 5-10) + sed '/pattern/d' file (delete matching lines) + sed '5d' file (delete line 5). Powerful for batch text transformations in scripts

Answer 4

awk is a powerful text processing language. Processes text line by line splitting into fields. $1 $2 etc = field values. $0 = entire line. awk '{print $1}' file (print first field) + awk -F: '{print $1}' /etc/passwd (use : delimiter - print usernames) + awk '{sum += $1} END {print sum}' file (sum numbers) + awk 'NR==5' file (print line 5) + awk '/pattern/ {print $2}' file (print field for matching lines)

Answer 5

Files: ls -la + cd + pwd + mkdir -p + cp -r + mv + rm -rf + touch + cat + less. Search: grep -r -i -v -n + find -name -type -mtime -size -exec. Text: sed 's/old/new/g' + awk -F: '{print $1}' + cut -d: -f1 + sort + uniq + wc -l + head -n + tail -f. System: ps aux + top + kill -9 + df -h + du -sh + free -h + uname -a. Network: ping + ssh + curl + wget + netstat/ss. rm -rf * = DESTRUCTIVE = no undo

Answer 6

A pipe (|) connects the standard output (stdout) of one command to the standard input (stdin) of the next. Creates a pipeline of commands. Example: ps aux | grep java | wc -l (count Java processes). Data flows left to right. Each command in pipeline runs in own process concurrently. Can chain unlimited commands. Named pipes (FIFOs) persist in filesystem (mkfifo). Pipes = fundamental Unix philosophy

Answer 7

Redirect input/output from/to files instead of terminal. > redirect stdout to file (overwrite). >> redirect stdout to file (append). < redirect stdin from file. 2> redirect stderr to file. 2>&1 redirect stderr to same place as stdout. &> redirect both stdout + stderr. /dev/null discards output. Examples: command > output.txt 2>&1 (capture all output) + sort < unsorted.txt > sorted.txt

Answer 8

A filter is a program that reads from stdin - transforms data - writes to stdout. Designed to work in pipelines. Common filters: cat + grep + head + tail + sort + uniq + cut + awk + sed + tr + wc. Complex pipelines combine filters: cat /etc/passwd | cut -d: -f1 | sort | uniq. Filters are reusable components. Unix philosophy: small programs that do one thing well combined via pipes to solve complex problems

Answer 9

Command substitution captures the output of a command and uses it as an argument. Modern syntax: $(command). Legacy syntax: `command` (backticks). Examples: files=$(ls *.log) + echo "Today is $(date)" + for user in $(cat users.txt) + do + rm $(cat files_to_delete). $(command) preferred over backticks (easier to nest + more readable). Used in scripts to capture command output into variables

Answer 10

* (wildcard - matches any characters) + ? (wildcard - matches single character) + [ ] (character class - [abc] or [a-z]) + | (pipe) + > < >> (redirection) + & (background process) + + (command separator) + $ (variable prefix) + # (comment) + \ (escape character) + ' ' (strong quoting - literal) + " " (weak quoting - allows $ expansion) + ~ (home dir) + . (current dir or hidden file prefix) + .. (parent dir)

Answer 11

Single quotes ('strong quoting'): everything inside is literal - no variable expansion - no command substitution - no special chars interpreted. echo '$HOME' prints literally $HOME. Double quotes ('weak quoting'): allows variable expansion ($VAR) + command substitution ($(cmd)) but prevents word splitting and globbing. echo "$HOME" prints /home/user. No quotes: all expansions + word splitting + globbing occur

Answer 12

Pipe |: stdout of left -> stdin of right. > overwrite stdout. >> append stdout. 2> redirect stderr. 2>&1 merge stderr to stdout. < stdin from file. /dev/null = discard. Filter = reads stdin -> transforms -> writes stdout (grep + sed + awk + cut + sort + uniq). Command substitution: $(command) captures output. Quotes: single = literal (no expansion). Double = allows $VAR and $(cmd). * = any chars wildcard. ? = single char wildcard

Answer 13

A shell script is a text file containing shell commands executed in sequence. First line (shebang): #!/bin/bash specifies interpreter. Must be executable: chmod +x script.sh. Run: ./script.sh or bash script.sh. Scripts automate: system administration + deployment + data processing + build pipelines + scheduled tasks (cron). Bash is most common scripting shell. Python preferred for complex logic

Answer 14

Shell variables store values for use in scripts. Assign: VAR=value (no spaces around =). Use: $VAR or ${VAR}. Export to child processes: export VAR=value. Special variables: $0 (script name) + $1 $2... (positional args) + $@ (all args) + $# (number of args) + $? (last exit code) + $$ (current PID) + $! (last background PID). Unset: unset VAR. Declare read-only: readonly VAR=value

Answer 15

-v (verbose): prints each line of the script BEFORE substitution - shows the script as written. -x (xtrace): prints each command AFTER substitution - shows expanded commands with actual values of variables. Both are for debugging. Use: #!/bin/bash -x or bash -x script.sh or set -x inside script. Combine: -xv shows both. Most useful for debugging: -x shows exactly what commands ran with what arguments

Answer 16

Environment variables are global variables available to all processes and child processes. Set + export: export VAR=value. Common vars: PATH (directories to search for commands) + HOME (user home dir) + USER (current username) + SHELL (current shell) + PWD (current directory) + LANG (locale) + PS1 (shell prompt). View all: env or printenv. Add to PATH: export PATH=$PATH:/new/dir. Set in .bashrc or .bash_profile for persistence

Answer 17

if/elif/else: if [ condition ] + then ... elif [ condition ] + then ... else ... fi. for loop: for i in {1..10} + do ... done or for file in *.txt + do. while loop: while [ condition ] + do ... done. case: case $var in pattern) ... + + esac. until: until [ condition ] + do. Test conditions: -f (file exists) + -d (dir exists) + -z (empty string) + -n (non-empty) + -eq -ne -lt -gt (numeric comparisons) + = != (string comparisons)

Answer 18

Functions in Bash group reusable commands. Define: function_name() { commands + } or function function_name { commands + }. Call: function_name arg1 arg2. Access args inside function: $1 $2 etc (local to function). Return value: return exit_code (0=success). Capture output: result=$(my_function). Local variables: local var=value. Functions must be defined before calling. Can source function libraries: source functions.sh

Answer 19

Every Unix command returns an exit status (return code). 0 = success. Non-zero = failure (1 = general error - 2 = misuse - 126 = not executable - 127 = command not found - 130 = Ctrl+C). Check last status: $?. Use in scripts: if command + then (runs if exit 0) + command || echo 'failed' + set -e (exit script on any error). Best practice: always check exit status in scripts

Answer 20

set -e: exit script immediately if any command returns non-zero exit code (fail fast). set -u: treat unset variables as error (catches typos in variable names). set -o pipefail: pipe returns exit code of first failed command (without this - pipe exit = last command). Best practice: put all three at top of scripts: set -euo pipefail. Prevents silent failures that can cause data loss or security issues

Answer 21

Cron is Unix job scheduler for running commands/scripts at scheduled times. Edit crontab: crontab -e. Format: minute hour day month weekday command. Example: 0 2 * * * /backup.sh (run at 2am daily). * = every unit. Shortcuts: @daily + @hourly + @reboot. crontab -l lists scheduled jobs. /etc/cron.d/ for system-level crons. Output goes to email by default - redirect: 0 2 * * * /backup.sh >> /var/log/backup.log 2>&1

Answer 22

.bash_profile: executed for login shells (SSH login + console login). Load once per session. Set environment variables here (export PATH...). .bashrc: executed for interactive non-login shells (opening a terminal in GUI + bash subshells). Load each time new terminal opened. Put aliases + functions + PS1 prompt here. Common practice: source .bashrc from .bash_profile to ensure consistency. zsh uses .zshrc

Answer 23

Shebang: #!/bin/bash. Variables: VAR=value (no spaces) - $VAR - export VAR. Special: $0 (script) + $1..$9 (args) + $? (exit code) + $$ (PID). Debugging: -x (shows expanded) + -v (shows as-written). Best: set -euo pipefail at top. Exit 0=success nonzero=fail. Control: if [] + then + for in + do + while [] + do + case. Cron: min hour day month weekday command. .bashrc = interactive shells. .bash_profile = login shells. Function: name() { local var + }

Answer 24

View processes: ps aux (all processes) + top (interactive - press k to kill - q to quit) + htop (better top). Kill processes: kill PID (SIGTERM - graceful) + kill -9 PID (SIGKILL - force) + killall processname + pkill pattern. Background/foreground: command & (background) + Ctrl+Z (suspend) + bg (resume in background) + fg (bring to foreground) + jobs (list background jobs). nohup command & = run after logout

Answer 25

Signals are software interrupts sent to processes. Common signals: SIGTERM (15 - graceful termination - default kill) + SIGKILL (9 - immediate kill - cannot be caught or ignored) + SIGHUP (1 - hangup - reload config for daemons) + SIGINT (2 - Ctrl+C interrupt) + SIGSTOP (19 - pause process) + SIGCONT (18 - continue paused). Send: kill -SIGNAL PID or kill -15 PID. trap SIGNAL in scripts to handle signals

Answer 26

kill PID (equivalent to kill -15 or kill -SIGTERM): sends SIGTERM - process receives signal and can clean up (close files - save state - graceful shutdown) before exiting. kill -9 PID (SIGKILL): OS immediately terminates the process - cannot be caught - ignored or blocked - no cleanup chance. Always try kill (SIGTERM) first - give process time - then kill -9 if unresponsive. kill -9 may leave resources in inconsistent state

Answer 27

A daemon is a background process that runs continuously without a controlling terminal. Names typically end in 'd': sshd + httpd + nginx + mysqld + crond + systemd. Start/stop: systemctl start/stop/status service (systemd) + service name start/stop (older). Enable at boot: systemctl enable service. Logs: journalctl -u service (systemd). Daemons respond to SIGHUP to reload config without restart. Parent of orphaned daemons = init/systemd (PID 1)

Answer 28

ps: static snapshot of current processes. ps aux shows all processes (a=all users - u=user format - x=processes without terminal). Output: PID + USER + CPU% + MEM% + command. top: real-time continuously updated process viewer. Press: k (kill) + r (renice) + q (quit) + P (sort by CPU) + M (sort by memory). htop = improved top with color + mouse support + easier navigation. Use ps for scripting - top/htop for interactive monitoring

Answer 29

ps aux = all processes snapshot. top/htop = real-time monitor. kill PID = SIGTERM (graceful). kill -9 PID = SIGKILL (force - no cleanup). Ctrl+C = SIGINT (interrupt). Ctrl+Z = SIGSTOP (suspend). bg = resume background. fg = bring foreground. jobs = list background. nohup = run after logout. Daemon = background service (sshd - nginx - crond). systemctl start/stop/enable/status. SIGHUP = reload config (kill -1). Signals: 1=HUP - 2=INT - 9=KILL - 15=TERM

Answer 30

Add user: useradd username or adduser username (interactive). Set password: passwd username. Modify user: usermod -aG groupname username (add to group). Delete user: userdel -r username (remove home dir). View users: cat /etc/passwd (format: user:x:UID:GID:comment:home:shell). Switch user: su - username (login shell) + sudo command (run as root). User info: id username + who (logged in users) + w (who + what they're doing)

Answer 31

Create group: groupadd groupname. Add user to group: usermod -aG groupname username (must logout/login for effect) or gpasswd -a user group. Remove from group: gpasswd -d user group. View groups: cat /etc/group + groups username + id username. Primary group: first group in id output. Supplementary groups: additional groups. Group permissions apply to all users in group. chgrp changes file group

Answer 32

sudo executes commands as root (or other user). sudo command (run as root). sudo -u username command (run as specific user). sudo -i (interactive root shell). sudo -l (list allowed commands). Configured in /etc/sudoers (edit with visudo for syntax checking). Add user to sudo: usermod -aG sudo username (Debian/Ubuntu) or wheel group (RHEL/CentOS). Log all sudo usage: /var/log/auth.log. Better than logging in as root directly

Answer 33

chmod changes file permissions. Symbolic: chmod u+x file (add execute for owner) + chmod go-rw file (remove read/write for group+others) + chmod a+r file (add read for all). Numeric (octal): r=4 w=2 x=1. chmod 755 = rwxr-xr-x. chmod 644 = rw-r--r--. chmod 600 = rw-------. chmod 777 = rwxrwxrwx (insecure). chmod -R 755 dir (recursive). umask sets default permissions (022 = 755 for dirs - 644 for files)

Answer 34

chown changes file owner and/or group. chown user file + chown user:group file + chown :group file (group only). chown -R user:group dir (recursive). chgrp changes group only: chgrp group file. Only root can change file owner. File owner can change group to one they belong to. Used in deployment scripts to set correct ownership for web server files (chown -R www-data:www-data /var/www)

Answer 35

Users: useradd + passwd + usermod + userdel. /etc/passwd = user database. /etc/shadow = passwords (hashed). /etc/group = groups. sudo = run as root (configured in /etc/sudoers - edit with visudo). chmod: rwx=421. 755=rwxr-xr-x (typical dir). 644=rw-r--r-- (typical file). 600=rw------- (private key). chmod u+x = add execute. chown user:group file. chown -R recursive. id = show current user + groups. su - = switch user (login shell)

Answer 36

SSH (Secure Shell) for encrypted remote access. Connect: ssh user@hostname or ssh -p 2222 user@host (custom port). Key-based auth (passwordless): ssh-keygen (generate key pair) -> ssh-copy-id user@host (copy public key to server). Keys stored: ~/.ssh/ (id_rsa private - id_rsa.pub public - authorized_keys - known_hosts). SSH tunnel: ssh -L localPort:remoteHost:remotePort user@sshServer. Config file: ~/.ssh/config

Answer 37

scp (secure copy over SSH): scp file user@host:/path + scp user@host:/path/file . + scp -r dir user@host:/path (recursive). rsync (efficient sync): rsync -avz source/ user@host:/dest (archive + verbose + compress) + rsync --delete (delete files not in source). rsync only transfers changed parts (efficient for large syncs). sftp (interactive FTP over SSH): sftp user@host -> put/get commands

Answer 38

ping host (ICMP reachability + latency). traceroute host (path + hops). nc (netcat) -zv host port (test if port open). nmap -p 80 host (port scan). curl -I http://host (HTTP headers). telnet host port (old but useful for port testing). ss -tlnp (listening TCP ports). netstat -tlnp (listening ports - older). ss -s (socket statistics). lsof -i :8080 (process using port 8080)

Answer 39

SSH: ssh user@host + key auth: ssh-keygen -> ssh-copy-id. ~/.ssh/config for shortcuts. SCP: scp file user@host:/path. rsync: rsync -avz src/ user@host:/dest (efficient - only transfers changes). Check connectivity: ping + traceroute + nc -zv host port + curl -I http://host. Check ports: ss -tlnp + lsof -i :8080. DNS: dig hostname + nslookup hostname. IP config: ip addr show or ifconfig. Routes: ip route show or netstat -r

Answer 40

grep 'pattern' file: search single file. grep -r 'pattern' dir/: recursive search. grep -rn 'pattern' dir/: with line numbers. grep -rl 'pattern' dir/: filenames only. grep -i 'pattern': case insensitive. egrep or grep -E 'pattern1|pattern2': extended regex. grep -v 'pattern': invert (exclude). ag (silver searcher) and ripgrep (rg): faster alternatives. find + grep combo: find . -name '*.java' -exec grep -l 'pattern' {} \ +

Answer 41

sort file (alphabetical) + sort -n (numeric) + sort -r (reverse) + sort -k2 (by field 2) + sort -t: -k3 (delimiter : field 3) + sort -u (unique - remove dups). uniq (remove adjacent duplicates - needs sorted input): uniq -c (count occurrences) + uniq -d (only duplicates). Pipeline: cat file | sort | uniq -c | sort -rn (count occurrences sorted by frequency). cut -d: -f1,3 /etc/passwd (extract fields 1 and 3)

Answer 42

View: cat (small files) + less (large files - searchable) + head -20 file (first 20 lines) + tail -20 file (last 20) + tail -f file (live follow). Edit: vi/vim (modal editor - i=insert - Esc=normal - :w save - :q quit - :wq save+quit - :q! force quit - dd delete line - yy copy line - p paste - /search). nano (simpler - Ctrl+X exit). sed -i for non-interactive editing. diff file1 file2 shows differences. patch applies diff

Answer 43

xargs reads stdin and builds + executes commands. Converts stdin to command arguments. Example: find . -name '*.tmp' | xargs rm (delete all .tmp files). echo 'file1 file2' | xargs touch. ls *.log | xargs grep 'ERROR'. -n 1 processes one item at a time. -P 4 runs 4 processes in parallel. -I {} placeholder: find . -name '*.java' | xargs -I {} cp {} /backup/. Solves 'argument list too long' errors from wildcards

Answer 44

tee reads from stdin and writes to BOTH stdout AND a file simultaneously. command | tee file.txt (writes to file AND shows on screen). command | tee -a file.txt (append mode). Useful for: seeing output while also saving to log + splitting pipeline output. Example: make build 2>&1 | tee build.log (captures build output while showing it). Without tee you have to choose: see it OR save it. With tee: do both

Answer 45

diff: compares two files showing differences. diff file1 file2 (default output) + diff -u file1 file2 (unified format - most readable - used for patches) + diff -r dir1 dir2 (compare directories). patch: applies a diff to original file to create modified version. patch original.txt changes.patch. Used in: software development (patch files) + git diff shows unified diff. vimdiff = visual side-by-side diff in vim

Answer 46

grep -rn (recursive + line numbers). awk -F: '{print $1}' (field separator + print field). sed 's/old/new/g' (global substitute) + sed -i (in-place edit). sort | uniq -c | sort -rn (frequency count). cut -d: -f1 (extract field). head/tail -n + tail -f (live follow). xargs: pipe to command args (find . -name '*.tmp' | xargs rm). tee: write to file AND stdout simultaneously. vi: i=insert Esc=normal :wq=save+quit dd=delete line /=search

Answer 47

APT (Debian/Ubuntu): apt update (refresh package list) + apt install package + apt remove + apt upgrade + apt search. YUM/DNF (RHEL/CentOS/Fedora): yum install + dnf install + yum update + yum remove + yum search. Zypper (openSUSE). Pacman (Arch). For Python: pip. Node: npm. Most scripts use apt-get for Debian or yum for RHEL for maximum compatibility. Package managers resolve dependencies automatically

Answer 48

df -h: shows disk filesystem usage (human-readable GB/MB). df -i: shows inode usage. du -sh /path: disk usage of directory (summary + human). du -sh *: usage of each item in current directory. du -sh /* | sort -rh: find largest directories. Useful for: finding which directories consume most space + checking if disk is full. /dev/full vs /dev/null. lsblk: list block devices. fdisk -l: partition info

Answer 49

System logs in /var/log/: syslog/messages (general system) + auth.log (authentication) + kern.log (kernel) + nginx/access.log + mysql/error.log. View logs: tail -f /var/log/syslog (live). journalctl (systemd logs): journalctl -u nginx (specific service) + journalctl -f (follow) + journalctl --since '1 hour ago'. logrotate: rotates + compresses + deletes old logs automatically (/etc/logrotate.d/). grep errors: grep -i error /var/log/syslog

Answer 50

Package mgmt: apt install (Ubuntu/Debian) + yum/dnf install (RHEL/CentOS). Disk: df -h (filesystem usage) + du -sh dir/ (directory size) + du -sh * | sort -rh (find large dirs). Logs: /var/log/ + tail -f syslog + journalctl -u service -f. Process: systemctl start/stop/status/enable. Cron: crontab -e (min hour day month weekday cmd). SSH key setup: ssh-keygen -> ssh-copy-id. Environment: export PATH=$PATH:/new/path in .bashrc

UNIX Shell Flashcards

(74 cards)