Basic Linux Commands for Everyday Work: ls, cd, cat, less, tail, grep and find

ls, cd, cat, less, tail, grep, and find – all with practical, real-world examples.

The examples assume a typical Linux server (Debian, Ubuntu, Rocky, Alma, etc.) and a regular user with SSH access. You can open a terminal or SSH session and try the commands as you read.

1. Listing Files with ls

The ls command lists files and directories. It is usually the first command you run after logging in.

Basic usage

ls
ls /var
ls /etc/nginx

These examples show the contents of your current directory, /var, and /etc/nginx.

Long listing with permissions and sizes

ls -l
ls -lh
ls -lha

• -l — long format (permissions, owner, size, date).
• -h — human-readable sizes (KB, MB, GB).
• -a — show hidden files (starting with a dot).

Practical example: check permissions on a web directory.

ls -lha /var/www/html

This helps you quickly see which user owns the files and what permissions are set – critical when debugging“403 Forbidden” or “Permission denied” errors.

2. Moving Around with cd

The cd (change directory) command moves you between directories.

Basic navigation

cd /var/log
cd /etc
cd /home/username

Return to your home directory:

cd
cd ~

Move up one directory level:

cd ..
cd ../..

Practical example: quickly jump to a project folder.

cd ~/projects/myapp
ls

A common pattern is to combine cd and ls: change directory, then list contents to orient yourself.

3. Viewing Files with cat

The cat command (“concatenate”) prints the contents of files to the terminal. It is great for small files or quick checks.

Show the entire file

cat /etc/hostname
cat /etc/os-release

Practical example: check a simple configuration file.

cat /etc/timezone

Use cat when the file is short. For logs or long configs, it is better to use less or tail.

Combine multiple files

cat part1.txt part2.txt > full_document.txt

This concatenates two files into a new file. As a sysadmin, you might use this to merge configuration snippets or notes.

4. Scrolling Through Files with less

The less command is a powerful file viewer. It does not load the whole file into memory at once, which makes it perfect for large logs and long configuration files.

Basic usage

less /var/log/syslog
less /var/log/auth.log
less /etc/nginx/nginx.conf

Inside less, useful keys:

• Up/Down or j/k — scroll line by line.
• Space — next page.
• b — previous page.
• /pattern — search forward for “pattern”.
• n — next search match.
• Shift + G — jump to end of file.
• g — jump to start of file.
• q — quit.

Practical example: search for a specific IP in a log file.

less /var/log/auth.log

Once inside less, search for an IP:

/192.168.1.100
n

This is a very common pattern when investigating failed logins or suspicious activity.

5. Watching Logs in Real Time with tail

The tail command shows the last lines of a file. With the -f option, it can follow the file in real time as new lines are written.

Show the last lines of a file

tail /var/log/syslog
tail -n 50 /var/log/auth.log

• -n 50 — show the last 50 lines instead of the default 10.

Follow a log file in real time

sudo tail -f /var/log/nginx/access.log
sudo tail -f /var/log/nginx/error.log

This is extremely useful when you are testing a web application. You can keep tail -f running in one terminal, refresh your browser, and watch new log lines appear live.

Follow multiple files:

sudo tail -f /var/log/nginx/access.log /var/log/nginx/error.log

This shows both logs in one stream, with each line prefixed by the file name.

6. Searching Inside Files with grep

The grep command searches for text patterns inside files or input streams. It is one of the most important tools for log analysis and troubleshooting.

Basic usage

grep "error" /var/log/syslog
grep "Failed password" /var/log/auth.log

This prints all lines containing the word error or the phrase Failed password.

Case-insensitive search

grep -i "error" /var/log/syslog

• -i — ignore case (matches error, Error, ERROR, …).

Show line numbers

grep -n "listen" /etc/nginx/nginx.conf

• -n — show line numbers, useful when you edit the file in a text editor later.

Search recursively in directories

grep -R "my_database" /etc
grep -R "example.com" /var/www

• -R — search recursively in all files and subdirectories.

Practical example: find all web configs that mention a specific domain.

grep -R "myproject.example.com" /etc/nginx

This quickly shows you which config files are related to that domain, useful when cleaning up old vhosts or debugging.

7. Finding Files and Directories with find

The find command searches the filesystem for files and directories based on many criteria: name, type, size, owner, modification time and more.

Find by name

find /etc -name "nginx.conf"
find /var/www -name "index.php"
find /home -name "*.log"

• "*.log" — matches all files ending in .log.

Find only directories or only files

find /var/www -type d -name "backup"
find /var/www -type f -name "*.php"

• -type d — only directories.
• -type f — only regular files.

Find recently modified files

# Files changed in the last 10 minutes
find /var/log -mmin -10

# Files changed in the last day
find /var/www -mtime -1

• -mmin -10 — modified within the last 10 minutes.
• -mtime -1 — modified in the last 24 hours.

Practical example: find large log files eating disk space.

find /var/log -type f -size +100M -exec ls -lh {} \;

• -size +100M — files larger than 100 MB.
• -exec ls -lh {} \; — for each result, run ls -lh to show a readable size.

8. Combining Commands: Real-World Scenarios

The real power of the Linux shell appears when you combine commands using pipes and filters. Here are a few realistic scenarios using ls, cd, cat, less, tail, grep, and find.

Scenario 1: Investigate failed SSH logins

1. Go to the log directory:

cd /var/log

2. Check the last 50 authentication log lines:

sudo tail -n 50 auth.log

3. Filter only failed logins:

sudo grep "Failed password" auth.log

4. See which IP addresses are failing frequently:

sudo grep "Failed password" auth.log | awk '{print $11}' | sort | uniq -c | sort -nr | head

Even if you don’t use awk yet, the key idea is that grep isolates interesting lines, and you can then process them further or feed them into tools like fail2ban.

Scenario 2: Find and inspect a web vhost configuration

1. Search for a domain in Nginx configs:

sudo grep -R "myproject.example.com" /etc/nginx

2. Open the matching config with less:

sudo less /etc/nginx/sites-available/myproject.conf

3. Inside less, search for the root directive:

/root
n

Now you know which directory serves the site, so you can cd into it and inspect files:

cd /var/www/myproject
ls -lha

Scenario 3: Quickly inspect large logs

Step 1: see the last lines:

sudo tail -n 100 /var/log/nginx/error.log

Step 2: follow new entries while reproducing the issue:

sudo tail -f /var/log/nginx/error.log

Step 3: search for a specific keyword with grep:

sudo grep "PHP Fatal error" /var/log/nginx/error.log | less

Here grep extracts only “PHP Fatal error” lines, and piping into less makes it easier to scroll through the results.

9. Mini Cheat Sheet

• ls -lha — detailed list of files, including hidden ones, with human-readable sizes.
• cd /path/to/dir — change to directory; cd alone returns to your home.
• cat file — quickly show a small file.
• less file — scroll through a large file, search with /pattern.
• tail -n 50 file — last 50 lines of a file.
• tail -f file — follow a log in real time.
• grep "text" file — show only lines containing text.
• grep -R "text" /path — search text in all files under a path.
• find /path -name "pattern" — find files or directories matching a name.
• find /path -type f -size +100M — find files larger than 100 MB.

Conclusion

Mastering these seven commands — ls, cd, cat, less, tail, grep, and find — gives you a strong foundation for working with Linux systems every day. They help you navigate the filesystem, inspect and monitor logs, search for problems, and understand what is happening on your servers.

The best way to learn is to practice. Take a real server (or a virtual lab), open a terminal, and try the examples from this article. Over time, these commands will become second nature and your troubleshooting speed will improve dramatically.