This cheat sheet covers essential Linux commands for the LPIC-1 and LPIC-2 exams, organized by domain. Use it as a quick reference during study and lab practice.
System Architecture
| Command | Description | Common Flags | Example |
|---|
uname -a | Show all system information | -r (kernel release), -m (architecture) | uname -r → 6.1.0-16-amd64 |
lscpu | Display CPU architecture info | — | lscpu | grep "Model name" |
lsblk | List block devices | -f (filesystem), -m (permissions) | lsblk -f |
dmidecode | Read hardware info from BIOS | -t processor, -t memory | dmidecode -t memory |
lspci | List PCI devices | -v (verbose), -nn (numeric IDs) | lspci -nn | grep VGA |
lsusb | List USB devices | -v (verbose), -t (tree) | lsusb -t |
lsmod | List loaded kernel modules | — | lsmod | grep ^usb |
modinfo | Show module information | -p (parameters), -d (description) | modinfo -p e1000 |
Boot Process and GRUB
| Command | Description | Common Flags | Example |
|---|
grub-install | Install GRUB to disk | --target=x86_64-efi, --boot-directory | grub-install --target=x86_64-efi /dev/sda |
grub-mkconfig | Generate GRUB config | -o /boot/grub/grub.cfg | grub-mkconfig -o /boot/grub/grub.cfg |
update-grub | Debian shortcut for grub-mkconfig | — | update-grub |
dmesg | Print kernel ring buffer | -T (human timestamps), -w (follow) | dmesg -T | grep error |
journalctl -xb | View boot logs (systemd) | -b -1 (previous boot), -p err (errors) | journalctl -b -p err |
systemd-analyze blame | Show boot time per service | — | systemd-analyze blame | head -10 |
Package Management (Debian/Ubuntu)
| Command | Description | Common Flags | Example |
|---|
apt-get update | Refresh package index | — | apt-get update |
apt-get install | Install package with deps | --no-install-recommends, -y | apt-get install -y nginx |
apt-get remove | Remove package | --purge (remove config) | apt-get remove --purge apache2 |
apt-get upgrade | Upgrade all packages | --dry-run (simulate) | apt-get upgrade --dry-run |
dpkg -i | Install .deb package | — | dpkg -i package.deb |
dpkg -r | Remove installed package | -P (purge) | dpkg -r nginx |
dpkg -l | List installed packages | — | dpkg -l | grep nginx |
dpkg -L | List files in a package | — | dpkg -L nginx-common |
dpkg --configure -a | Fix partly-installed packages | — | dpkg --configure -a |
apt-cache search | Search package database | — | apt-cache search web server |
apt-cache policy | Show package version info | — | apt-cache policy nginx |
Package Management (RHEL/Fedora)
| Command | Description | Common Flags | Example |
|---|
dnf install | Install package | -y | dnf install -y nginx |
dnf remove | Remove package | — | dnf remove nginx |
dnf update | Update all packages | — | dnf update |
dnf search | Search packages | — | dnf search web server |
dnf groupinstall | Install a group of packages | — | dnf groupinstall "Web Server" |
rpm -ivh | Install RPM package | -U (upgrade), -e (erase) | rpm -ivh package.rpm |
rpm -qa | Query all installed RPMs | -qi (info), -ql (file list) | rpm -qa | grep nginx |
rpm -V | Verify installed package | — | rpm -V nginx |
GNU and Unix Commands
| Command | Description | Common Flags | Example |
|---|
grep | Search lines matching pattern | -r (recursive), -i (case), -v (invert), -E (extended regex) | grep -ri "error" /var/log/ |
sed | Stream editor for text transform | -i (in-place), s/old/new/g (substitute) | sed -i 's/foo/bar/g' file.txt |
awk | Pattern scanning and processing | -F (field separator) | awk '{print $1, $3}' file.txt |
find | Search for files | -name, -type, -mtime, -exec | find /var -name "*.log" -mtime +7 |
sort | Sort lines of text | -u (unique), -n (numeric), -r (reverse) | sort -u file.txt |
wc | Word/line/byte count | -l (lines), -w (words) | wc -l /var/log/syslog |
cut | Extract fields from lines | -d (delimiter), -f (fields) | cut -d: -f1 /etc/passwd |
tr | Translate/delete characters | -d (delete), -s (squeeze) | tr '[:upper:]' '[:lower:]' < file |
tee | Read stdin and write to file + stdout | -a (append) | echo "text" | tee -a file.log |
xargs | Build and execute command lines | -n (max args), -I (replace str) | find . -name "*.tmp" | xargs rm |
tar | Archive utility | -c (create), -x (extract), -z (gzip), -f (file), -v (verbose) | tar -czvf archive.tar.gz /path/ |
gzip/gunzip | Compress/decompress files | -k (keep original), -v (verbose) | gzip -k file.txt |
bzip2 | Block-sorting file compressor | -k, -z, -d | bzip2 -z file.txt |
xz | LZMA2 compressor (highest ratio) | -z, -d, -k | xz -z file.tar |
Filesystems and Storage
| Command | Description | Common Flags | Example |
|---|
mount | Mount a filesystem | -t (type), -o (options) | mount -t ext4 /dev/sdb1 /mnt |
umount | Unmount a filesystem | -l (lazy), -f (force) | umount -l /mnt |
df -h | Show disk usage (human-readable) | -T (type), -i (inodes) | df -hT |
du -sh | Show directory size | -a (all), --max-depth=N | du -sh /var/log/ |
fsck | Check/repair filesystem | -f (force), -y (auto-yes) | fsck -f /dev/sdb1 |
mkfs.ext4 | Create ext4 filesystem | -L (label), -m (reserved blocks %) | mkfs.ext4 -L data /dev/sdb1 |
e2label | Show/change ext label | — | e2label /dev/sdb1 mydata |
tune2fs | Adjust ext filesystem params | -l (list), -c (max mount count) | tune2fs -l /dev/sdb1 |
blkid | Show block device attributes | — | blkid /dev/sdb1 |
parted | Partition disk (GPT) | mklabel gpt, mkpart | parted /dev/sdb mklabel gpt |
fdisk | Partition disk (MBR) | -l (list) | fdisk -l |
LVM (Logical Volume Manager)
| Command | Description | Example |
|---|
pvcreate /dev/sdb1 | Create a physical volume | pvcreate /dev/sdb1 /dev/sdc1 |
pvs | List physical volumes | pvs |
pvdisplay | Show detailed PV info | pvdisplay /dev/sdb1 |
vgcreate vg_data /dev/sdb1 | Create a volume group | vgcreate vg_data /dev/sdb1 /dev/sdc1 |
vgs | List volume groups | vgs |
vgdisplay | Show detailed VG info | vgdisplay vg_data |
vgextend vg_data /dev/sdd1 | Add PV to VG | vgextend vg_data /dev/sdd1 |
lvcreate -L 50G -n lv_data vg_data | Create a logical volume | lvcreate -L 50G -n lv_data vg_data |
lvcreate -l 100%FREE -n lv_data vg_data | Use all remaining free space | lvcreate -l 100%FREE -n lv_root vg_system |
lvs | List logical volumes | lvs |
lvextend -L +10G /dev/vg_data/lv_data | Extend LV by 10G | lvextend -L +10G /dev/vg_data/lv_data |
lvreduce -L -5G /dev/vg_data/lv_data | Reduce LV by 5G | lvreduce -L -5G /dev/vg_data/lv_data |
After extending an LV, resize the filesystem:
- ext4:
resize2fs /dev/vg_data/lv_data
- XFS:
xfs_growfs /mount/point
RAID (mdadm)
| Command | Description | Example |
|---|
mdadm --create /dev/md0 --level=5 --raid-devices=3 /dev/sd[bcd]1 | Create RAID 5 | mdadm --create /dev/md0 --level=5 --raid-devices=3 /dev/sdb1 /dev/sdc1 /dev/sdd1 |
mdadm --detail /dev/md0 | Show detailed RAID info | mdadm --detail /dev/md0 |
mdadm --manage /dev/md0 --add /dev/sde1 | Add disk to array | mdadm --manage /dev/md0 --add /dev/sde1 |
mdadm --manage /dev/md0 --fail /dev/sdb1 | Fail a disk | mdadm --manage /dev/md0 --fail /dev/sdb1 |
mdadm --manage /dev/md0 --remove /dev/sdb1 | Remove a disk | mdadm --manage /dev/md0 --remove /dev/sdb1 |
cat /proc/mdstat | Check RAID status | cat /proc/mdstat |
Shell Scripting
| Concept | Syntax | Example |
|---|
| Shebang | #!/bin/bash | #!/bin/bash |
| Variable | VAR=value | NAME="John" |
| Variable use | $VAR or ${VAR} | echo "Hello, $NAME" |
| Command substitution | $(cmd) or `cmd` | DATE=$(date +%Y-%m-%d) |
| Arithmetic | $((expr)) | TOTAL=$((COUNT + 1)) |
| If statement | if [ cond ]; then ... fi | if [ "$NAME" = "root" ]; then echo "admin"; fi |
| For loop | for i in LIST; do ... done | for file in *.txt; do echo "$file"; done |
| While loop | while [ cond ]; do ... done | while read line; do echo "$line"; done < file |
| Case statement | case $VAR in pattern) ...;; esac | case $OPT in -h) usage;; *) error;; esac |
| Function | func() { ... } | usage() { echo "Usage: $0 [-h]"; } |
| Exit status | $? | cmd; if [ $? -eq 0 ]; then echo OK; fi |
| Test operators | -f (file), -d (dir), -z (empty), -n (non-empty) | [ -f /etc/passwd ] && echo exists |
User and Group Management
| Command | Description | Common Flags | Example |
|---|
useradd | Create user | -m (home), -s (shell), -G (groups) | useradd -m -s /bin/bash -G sudo jdoe |
usermod | Modify user | -aG (append groups), -L (lock), -U (unlock) | usermod -aG docker jdoe |
userdel | Delete user | -r (remove home + mail) | userdel -r jdoe |
groupadd | Create group | -g (GID) | groupadd -g 1001 developers |
groupdel | Delete group | — | groupdel developers |
passwd | Change password | -l (lock), -u (unlock), -d (delete) | passwd jdoe |
chage | Change password aging | -l (list), -d (last day), -E (expire) | chage -d 0 jdoe |
id | Show user identity | — | id jdoe |
who | Show logged-in users | -a (all details) | who -a |
w | Show who is logged in + activity | — | w |
last | Show last logins | -n 10 (limit) | last -n 10 |
Process Management
| Command | Description | Common Flags | Example |
|---|
ps aux | List all processes | -ef (full), --forest (tree) | ps aux --sort=-%mem | head -10 |
top | Interactive process viewer | -u user, -p PID | top -u www-data |
htop | Enhanced process viewer (if installed) | — | htop |
kill PID | Send SIGTERM to process | -9 (SIGKILL), -15 (SIGTERM), -1 (SIGHUP) | kill -9 1234 |
killall | Kill by process name | -9, -15, -I (case-insensitive) | killall -9 nginx |
pkill | Kill by name or pattern | -u user, -f (full command) | pkill -u jdoe -f "node app" |
pgrep | List PID by name | -u, -l (show name) | pgrep -l nginx |
nice | Start with priority | -n (nice value, -20 to 19) | nice -n 10 backup.sh |
renice | Change priority | -n (priority), -p (PID) | renice -n 5 -p 1234 |
nohup | Run immune to hangups | — | nohup backup.sh & |
bg/fg | Background/foreground jobs | — | Ctrl+Z, then bg |
jobs | List background jobs | -l (with PIDs) | jobs -l |
Networking
| Command | Description | Common Flags | Example |
|---|
ip addr | Show/manipulate network interfaces | add, del | ip addr show eth0 |
ip link | Manage network interfaces | set up, set down | ip link set eth0 up |
ip route | Show/manage routing table | add, del | ip route add default via 10.0.0.1 |
ip neigh | Show ARP cache | — | ip neigh |
ss -tlnp | List TCP listening sockets | -u (UDP), -a (all), -s (stats) | ss -tlnp | grep :80 |
ping | Test network reachability | -c (count), -i (interval) | ping -c 4 google.com |
traceroute | Trace route to host | -n (numeric), -w (wait) | traceroute -n google.com |
nc (netcat) | TCP/UDP swiss army knife | -l (listen), -z (scan), -v (verbose) | nc -zv 10.0.0.1 22-443 |
nmap | Network exploration | -sS (SYN scan), -sn (ping sweep) | nmap -sn 10.0.0.0/24 |
dig | DNS lookup tool | +short, -x (reverse) | dig +short example.com |
nslookup | Legacy DNS lookup | — | nslookup example.com |
host | Simplified DNS lookup | — | host example.com |
curl | HTTP/HTTPS client | -I (headers), -v (verbose) | curl -I https://example.com |
wget | File download utility | -O (output), -q (quiet) | wget -O file.zip https://url/file.zip |
System Security
| Command | Description | Example |
|---|
chmod 755 file | Change file permissions (rwxr-xr-x) | chmod 750 /root |
chown user:group file | Change file owner/group | chown -R jdoe:www-data /var/www |
setfacl -m u:jdoe:rw file | Set ACL entry | setfacl -m g:developers:rx /project |
getfacl file | View ACLs | getfacl /etc/shadow |
chattr +i file | Set immutable flag | chattr +i /etc/hosts |
lsattr file | List file attributes | lsattr /etc/hosts |
iptables -L | List iptables rules | iptables -A INPUT -p tcp --dport 22 -j ACCEPT |
nft list ruleset | List nftables rules | nft add rule inet filter input tcp dport 443 accept |
getenforce | Get SELinux mode | setenforce 1 (enforcing) |
sestatus | SELinux status | sestatus | grep ^SELinux |
ls -Z | Show SELinux context | ps -eZ | grep httpd |
restorecon -Rv /path | Restore default SELinux contexts | restorecon -Rv /var/www |
setsebool -P httpd_can_network_connect on | Set SELinux boolean | setsebool -P httpd_can_sendmail on |
sealert -a /var/log/audit/audit.log | Analyze SELinux denials | sealert -a /var/log/audit/audit.log |
openssl enc -aes-256-cbc -salt -in file -out file.enc | Encrypt file | openssl enc -d -aes-256-cbc -in file.enc -out file |
gpg --symmetric --cipher AES256 file | GPG symmetric encryption | gpg --decrypt file.gpg |
ssh-keygen -t ed25519 | Generate SSH key | ssh-keygen -t rsa -b 4096 |
ssh-copy-id user@host | Copy SSH key to host | ssh-copy-id -i ~/.ssh/id_ed25519 user@host |
System Monitoring
| Command | Description | Example |
|---|
free -h | Show memory usage | free -h |
vmstat 2 10 | Virtual memory stats (every 2s, 10 times) | vmstat -s (summary) |
iostat -x 2 | I/O stats (extended, every 2s) | iostat -x | grep sda |
mpstat -P ALL 2 | Per-CPU usage (every 2s) | mpstat -P ALL |
sar -u 2 10 | CPU stats (every 2s, 10 times) | sar -r (memory), sar -b (I/O) |
uptime | Show system uptime and load | uptime |
lsof | List open files | lsof -i :80, lsof -u jdoe |
fuser -v /path | Show processes using file/socket | fuser 80/tcp |
Test Your Knowledge with Practice Exams
Ready to put this knowledge to the test? Our LPI practice portal includes 200+ realistic questions covering LPIC-1, LPIC-2, LPIC-3, and DevOps Tools Engineer certifications. Study mode, timed exams, domain breakdowns, and weak-area analysis included.
Start Free Preview →
Related Articles