Guide to Linux System Command Mastery
by Sheryl Calish

An introduction to system commands for newcomers to Linux

In "Guide to Linux File Command Mastery," we covered the basic information needed to take advantage of the most essential and commonly used Linux file commands. In this article, I'll do the same with Linux system commands.

As we learned in the previous article, everything is treated as a file in the Linux/UNIX world, including system administration commands. For the sake of organization only, we dealt with file commands in the first part of this series and will present the most useful system diagnostic and maintenance commands in this article.

As is the case with file commands, some of the administrative commands are sufficiently simple and straightforward to cover thoroughly here. Others are so complex that it is feasible only to describe their functions so that, if you need them, you will be aware of their existence and purpose. A thorough discussion on the philosophy behind the use of each command is beyond the scope of this article, but we will cover the most necessary and useful commands used for monitoring and managing the printer services, file systems, disks, and processes.

More on Superuser

Many of the commands discussed here can be executed by regular users on their own files and processes. Some commands, however, like fdisk, require root privileges to run.

For the sake of your system integrity, it is recommended that you avoid logging directly into your system as "root." Rather, it is usually preferable to log in as a regular user and then execute the su or sux command from an X window to conduct your system administration functions. (Sux provides you with the X window environment along with the root privileges.) You can always tell when you are logged in as root, as your bash prompt changes to "#."

The superuser can selectively assign privileges that would normally be reserved for root or another user to a different, regular user using sudo. The real and effective user and group identification numbers, uid and gid, can be defined by the root user to match those of the desired user. That desired user could be, but is not necessarily, the user who is being given permission to run the command.

In other words, the superuser may allow another user to execute a command, but might also determine that any files that are produced as a result of the process belong to root-or whoever else the superuser specifies. Sudo privileges, once assigned, require only that users authenticate with their own passwords, not the root password.

General-Purpose Commands

Uname, diff, date, sort, and uniq would, technically speaking, be considered file commands, but as they are frequently used in system administration for diagnostic and maintenance routines, it makes better sense to explain them here.

Uname

Uname provides general system information. When the -a option is specified, all the information available is displayed:

$ uname -a
Linux linux 2.4.18-4GB #1 Wed Mar 27 13:57:05 UTC 2002 i686 unknown

Here we see, from left to right, general system information. Each piece of information has its own option, in parentheses below, which can be displayed separately:

• The operating system name is Linux(-s).
• The network nodename for this machine is linux (-n).
• The operating system release is 4.5.18-4GB (-r).
• The operating system version is #1 Wed Mar 27 13:57:05 UTC 2002 (-v).
• The machine type is i686 (-m).
• The processor type (-p) is unknown in this case.

Similarly, stty displays information about your terminal settings:

$ stty -a
speed 38400 baud; rows 40; columns 103; line = 0;
intr = ^C; quit = ^\; erase = ^?; kill = ^U; eof = ^D;
eol = <undef>; eol2 = <undef>; start = ^Q; stop = ^S;
susp = ^Z; rprnt = ^R; werase = ^W; lnext = ^V;
flush = ^O; min = 1; time = 0; -parenb -parodd cs8 -hupcl
-cstopb cread -clocal -crtscts -ignbrk -brkint -ignpar -parmrk -inpck 
-istrip -inlcr -igncr icrnl ixon -ixoff -iuclc -ixany -imaxbel
opost -olcuc -ocrnl onlcr -onocr -onlret -ofill -ofdel nl0
cr0 tab0 bs0 vt0 ff0 isig icanon iexten echo echoe echok
-echonl -noflsh -xcase -tostop -echoprt echoctl echoke

Lines two and three show the special characters and the key sequences that will invoke each at the command line. For example, "^Z," CNTRL-Z, sends a terminal stop signal on this system. The quit signal is sent with "^\," CNTRL-\, and we could change this to "^X" as follows:

$ stty quit ^X

In this case, you would actually enter the carat symbol, not the CNTRL key. This change will take effect in the current window only. To make the change permanent, enter this statement in your .bashrc file.

Diff and Date. Diff, as its name suggests, compares two files. It returns the line(s) that make the files differ along with some cryptic output on how to make them the same:

$ diff test.out test2.out
0a1
> Another test.

Here we are being told we need to add the line "Another test." to test.out to make it look like test2.out. The first character, "0," is the line number to edit in test.out; the "a" indicates that the line should be added to test.out to match the first line, "1," of test2.out. The second character could also be a "c" if we had needed to change test.out, or a "d" if we had to delete something from test.out.

You might want to make one file look like another to provide a patch to some code. Frequently, diff is also used as an analysis tool to verify that the output of a program or a script-a sed script, for instance-has produced the desired output.

The date command can be used to display or set the date. If a user has superuser privileges, he or she can set the date by supplying a numeric string with the following command:

$ date 0101010004

This would set the date to January 1 (0101), 1 a.m. (0100), 2004.

However, any user can display the date in the desired format. Notice that a plus sign, "+," is required before the format sequence. If the expected output of this command is not produced, try enclosing it in single quotes:

$ date +'%H%M%S'
204748

You can include spaces with the sequence, in which case you would need to use double quotes:

$ date +"%H %M %S"
20 47 51

There are more than 30 different format sequences listed on the man page for date, these can be combined as desired to achieve your final output format.

The output of date can also be manipulated for use within a script, such as:

$ date -d '2 day'
Thu Jan 29 19:02:02 EST 2004

The -d option directs date to display the time described in the following string. In the above example, we have asked for the date two days from now (January 27, 2004). We could also ask for the date three days previously, with:

$ date -d '-3 day'
Sun Jan 25 20:56:59 EST 2004

Another example of the versatility of date is the ability to append strings to its output, providing a handy way to generate a unique filename.

$ ls -l | cat > $(date +ls_%d%b%y%H%M.out)
$ ls ls_*.out
ls_04Feb041633.out

Here we piped the output of a long file listing to cat, which redirected our output to a file named ls_04Feb041609.out. Notice that we used a variable for the file name, which is indicated by the dollar sign "$." This, in turn, was generated by appending "ls_" and ".out" to the date formatted as day of the month (%d), the locale's abbreviated month name (%b), the last two digits of the year (%y), the hour (%H), and the minutes (%M).

Sort and Uniq. You can sort lines of text files from a pipe or from a file specified on the command line. Unless otherwise directed, sort operates on the first column of a multicolumn output. Numeric columns are sorted alphabetically, by default, unless the -n option is used.

Sort columns can be designated in two different formats. If the -k option is used, the column positions are numbered beginning with one. You could, instead, use the +POS1 format, which begins column numbering with zero for the first column. The following two commands produce the same output:

$ ls -l *.out | sort +5 -7

$ ls -l *.out | sort -k 6,8
-rw-r--r--    1 bluher   users    375 Dec  5  2002 fdisk.out
-rw-r--r--    1 bluher   users   2447 Dec 28 20:15 ls.out
-rw-r--r--    1 bluher   users    590 Jan  4 21:24 greps.out
-rw-r--r--    1 bluher   users     78 Jan  4 21:25 sgrep.out
...

By default the column delimiters of a sort command are blanks and tabs. An alternative delimiter can be specified with the -t SEP option, where SEP would be the separator you specify. The default order of a sort, from lowest to highest, can be reversed with the -r option.

Sort is useful for a host of different tasks. For example, it could be used to order the output of files such as /etc/passwd, or as we shall see below, the output of du. When used with the -m option, sort merges files without actually sorting them. If you want them sorted, however, they should be sorted before they are merged.

Sort is frequently used with the uniq command, which will remove duplicate lines from a sorted file. The uniq command is often follows the sort command in a pipe and can also be used to count the number of occurrences of a line with the -c option, or to report only the duplicate lines with the -d option:

$ sort -m test.out test2_sort.out | uniq -c
      1 Another test.
      1 Testing testing
      2 This is a test.

Here we merged two files, test.out and test2_sort.out. Then we piped the output to uniq using the -c option so that the final result is an alphabetized list, with duplicate lines removed and a report of the frequency of each.

Printer Control

In most cases, use of the printer commands is relatively obvious. A job is sent to the printer by specifying the filename after the lpr command. If a filename is not provided, standard input is assumed. You can obtain a status report on jobs sent to the printer with the lpq command. Lprm removes jobs from the line printer spooling queue when you specify the job number.

$ lpr grep2.out
$ lpq
Printer: lp@linux 'lpdfilter drv=upp method=auto color=yes'
 Queue: 1 printable job
 Server: pid 1929 active
 Unspooler: pid 1930 active
 Status: waiting for subserver to exit at 21:24:14.637
 Rank   Owner/ID        Class Job Files        Size Time
active bluher@linux+928   A   928 grep2.out     779 21:24:14
done   bluher             A   877 (STDIN)    117258 13:09:53
$ lprm 928
Printer lp@linux:
  checking perms 'cfA928linux.local'
  dequeued 'cfA928linux.local'

Here, after we sent a job to the printer, we queried its status. Lpq showed us a job that had already completed, number 877, and the job we just sent, number 928. We removed the active job from the queue with the command lprm 928.

Disk Information

Whether you are maintaining your own system or supporting an enterprise with many users, monitoring disk space is one of a system administrator's more important functions. The du, df, and fdisk commands provide different views of available disk space.

The du command provides an estimate of file space usage for each directory. By default, the unit of measurement is the number of blocks, the size of which is normally determined when your system is installed.

In the examples below, the system was set up with 1,024 byte blocks. If no directory is specified, du begins calculations with the current directory. The -h option provides the sizes in human readable form:

$ du -h Documents
105k    Documents/jj
573k    Documents/John
682k    Documents

Output can be modified with the -a option, which instructs du to display block counts for files and directories. The option, --block-size=SIZE, instructs du to display output by the number of blocks of the size specified by SIZE in bytes.

$ du --block-size=512 Documents
209     Documents/jj
1146    Documents/John
1363    Documents

By default, du also prints information recursively for each subdirectory. This can be limited by using the max-depth=N option, where N equals the maximum number of levels to be reported:

$ du --max-depth=2 .

$ du --max-depth=2 | sort -n
4       ./.xemacs
4       ./public_html
105     ./Documents/jj
573     ./Documents/Ian
682     ./Documents
2420    ./jdevhome/system
8350    ./jdevhome/system9.0.3.1035
13483   ./jdevhome/mywork
24252   ./jdevhome
...

While du reports on space usage for directories and subdirectories, df reports disk space usage for mounted file systems:

$ df
Filesystem     1k-blocks      Used Available Use% Mounted on
/dev/hda6        4195632   1983656   2211976  48% /
/dev/hda5          14607      3778     10075  28% /boot
/dev/hda9         937372    494028    443344  53% /home
/dev/hda8        6297248   3876880   2420368  62% /opt
shmfs             256220         0    256220   0% /dev/shm

Here, df is reporting the status of five file systems. As with du, df allows the -h option for human readable output:

$ df -h
Filesystem            Size  Used Avail Use% Mounted on
/dev/hda6             4.0G  1.9G  2.1G  48% /
/dev/hda5              14M  3.7M  9.8M  28% /boot
/dev/hda9             915M  476M  440M  52% /home
/dev/hda8             6.0G  3.7G  2.3G  62% /opt
shmfs                 250M     0  250M   0% /dev/shm

The df command also allows you to specify the block size with the -block-size=SIZE option.

The fdisk command is the partition table manipulator for Linux. Unlike du and df, the command cannot be run without root privileges. It can be used simply for reporting purposes if the -l option is specified. It gives a complete view of your entire partition table, not just the extended Linux partitions you see with df:

# fdisk -l

Disk /dev/hda: 240 heads, 63 sectors, 1940 cylinders
Units = cylinders of 15120 * 512 bytes

   Device Boot    Start       End    Blocks   Id  System
/dev/hda1             1       286   2162128+   c  Win95 FAT32 (LBA)
/dev/hda2   *       288      1940  12496680    5  Extended
/dev/hda5           288       289     15088+  83  Linux
/dev/hda6           290       844   4195768+  83  Linux
/dev/hda7           845       983   1050808+  82  Linux swap
/dev/hda8           984      1816   6297448+  83  Linux
/dev/hda9          1817      1940    937408+  83  Linux

Process Monitoring

On busy multiuser systems, process monitoring is also an important function of a Linux system administrator. To that end, ps and top are two of the most useful commands.

The ps command provides a snapshot of the currently running processes.

Another Anatomy Lesson

Here is the simplest form of ps:

$ ps
  PID TTY          TIME CMD
 3884 pts/1    00:00:00 bash
 3955 pts/2    00:00:00 more
 3956 pts/5    00:00:05 sqlplus

• The PID is the identification number for the process.
• TTY is the terminal console to which the process belongs.
• The TIME column is the total CPU time used by the process.
• The CMD column lists the command line being executed.

Use ps with -ef options to return a full listing of all the processes for all users on the system. The results of this ps command are easier to see if you pipe the results into grep. For instance:

$  ps -ef | grep oracle
UID        PID  PPID  C STIME TTY         TIME CMD
oracle    1633     1  0 13:58 ?       00:00:00 ora_pmon_ora1
oracle    1635     1  0 13:58 ?       00:00:00 ora_dbw0_ora1
oracle    1637     1  0 13:58 ?       00:00:01 ora_lgwr_ora1
oracle    1639     1  0 13:58 ?       00:00:02 ora_ckpt_ora1
oracle    1641     1  0 13:58 ?       00:00:02 ora_smon_ora1
oracle    1643     1  0 13:58 ?       00:00:00 ora_reco_ora1
oracle    1645     1  0 13:58 ?       00:00:00 ora_cjq0_ora1
oracle    1647     1  0 13:58 ?       00:01:18 ora_qmn0_ora1
oracle    1649     1  0 13:58 ?       00:00:00 ora_s000_ora1
oracle    1651     1  0 13:58 ?       00:00:00 ora_d000_ora1

Note that when you pipe the output of ps to the grep command, the column headings don't normally appear as they do when the ps command is used by itself. For the sake of instruction, the headings are positioned over the output to make their connection clear.

• Although uid usually refers to a numeric identification, the username is specified under the first column, labeled UID.
• PPID is the identification number for the parent process. For the Oracle processes, this is 1-which is the id of the init process, the parent process of all processes, because Oracle is set up on this system to be started as a part of the login process.
• The column labeled C is a factor used by the CPU to compute execution priority.
• STIME refers to the start time of the process.
• The question marks indicate that these processes don't[ belong to any TTY because they were started by the system.

Here is another example of the ps command with some different options. Notice that many of the columns are the same as they were when ps was executed with -ef:

$ ps aux
USER     PID %CPU %MEM   VSZ  RSS TTY     STAT START   TIME COMMAND
bluh    4024  0.0  0.2  2240 1116 pts/1   S    20:59   0:00 su bluher
bluh    4025  0.0  0.3  2856 1668 pts/1   S    20:59   0:00 bash
bluh    4051  0.0  0.2  2488 1504 pts/1   R    21:01   0:00 ps aux
bluh    4052  0.0  0.1  1636  600 pts/1   S    21:01   0:00 grep bluher

Besides providing important diagnostic information, the ps command is frequently used to find the PID of a runaway process. Say, for example, one of your users has entered a Cartesian join in a SQL*Plus session. You can execute the following ps command to find the PID:

$  ps -ef | grep bluher
...
bluher   4068  4064  0 21:14 pts/6    00:00:00 less
bluher   4112  3945  0 21:28 pts/5    00:08:42 sqlplus
...

Then you can kill it with:

$ kill 4112

Regular users can see all system processes, but they can only kill processes that they own.

Ps only gives you a snapshot of the current processes. For an ongoing look at the most active processes, use top. Top provides process information in real time. It also has an interactive state that allows users to enter commands, such as n followed by a number such as 5 or 10. The result will be to instruct top to display the 5 or 10 most active processes. Top runs until you press "q" to quit top.

Here is a partial display of top:

 8:14pm  up 51 min,  7 users,  load average: 0.02, 0.03, 0.05
96 processes: 87 sleeping, 2 running, 0 zombie, 7 stopped
CPU states:  6.4% user,  3.5% system,  0.0% nice, 89.9% idle
Mem:  512440K av, 392288K used, 120152K free, 0K shrd, 55668K buff
Swap: 1050800K av, 0K used, 1050800K free   236128K cached

  PID USER     PRI  NI  SIZE  RSS SHARE STAT %CPU %MEM   TIME COMMAND
 1289 root      18   0 78008  11M  1796 R     3.7  2.2   0:49 X
 1965 bluher    20   0 12244  11M 10456 S     1.9  2.3   0:01 kdeinit
 1986 bluher    18   0   996  996   768 R     1.5  0.1   0:00 top
 1803 bluher    20   0 16960  16M 13508 S     0.9  3.3   0:03 kdeinit
 1804 bluher    20   0 16964  16M 13508 S     0.9  3.3   0:03 kdeinit
 1800 bluher    19   0 12260  11M 10076 S     0.1  2.3   0:04 kdeinit
    1 root      20   0   220  220   188 S     0.0  0.0   0:04 init
...

Shutting Down

It seems appropriate to end this discussion with the shutdown command. As with many of the commands discussed in this and the last article, there is usually a GUI alternative method to shut down your system. However, in the event that you need to do so manually, you can shut down immediately with:

$ shutdown -h now

You could manually reboot the system with:

$ shutdown -r now

Notice that both of these commands require a time. You can either specify "now" or use the -t option with the time in seconds.

We have covered a lot of material in these two articles, but by no means have we covered all that is possible with Linux. There are more commands than we have covered, and many more options for the commands we have looked at. Herein, however, we hope you will have found at least the minimal tools needed to begin administering a Linux system.