Linux is a versatile operating system, packed with powerful tools and commands to streamline tasks, troubleshoot issues, and manage systems efficiently.

Whether you’re a seasoned sysadmin or a curious beginner, having a handy cheatsheet can save time and make your Linux experience more productive.

In this post, I will explore interesting and useful Linux commands and update this post regularly.


Table Of Contents
  1. which
  2. whereis
  3. history
  4. Grep multiple Patterns
  5. Clear Content of a File without deleting it
  6. Display System Shutdown and run-level Changes
  7. Analyze Log Files
  8. needs-restarting
  9. Determine the Public IP Address used for Internet Access directly on the Console
  10. Determine which IP Address is used to access a Remote Host in case multiple IPs assigned on the Network Interface
  11. Links


which

The which command in Linux is a simple utility that shows the location of an executable file for a given command in your system’s PATH. It helps users identify which version of a command or program will be executed when they run it in the shell.

which searches through the directories listed in the PATH environment variable and returns the full path of the first matching executable it finds.

# which zypper


Check the location of multiple commands:

# which zypper vi


-a (all matches): Lists all matching executables in the PATH, not just the first one.


which only works for executables in the PATH. If a command is not in the PATH or is an alias, function, or shell built-in, which will not detect it.



whereis

The whereis command in Linux is a utility used to locate the binary, source code, and manual pages for a given command. Unlike the which command previously, which only looks for executables in your PATH, whereis performs a broader search in predefined directories to provide more comprehensive information.

# whereis zypper


Different output when using the which vs. whereis command for the zypper tool.

# whereis -a zypper


Search for a command’s binary only:

# whereis -b zypper


Find only the manual pages:

# whereis -m zypper


The whereis command searches predefined directories for:

  • Binaries in directories like /bin, /usr/bin, and others.
  • Source files in standard source directories.
  • Manual pages in directories like /usr/share/man.


whereis does not search the entire file system (e.g., for custom installations) and is not aware of shell aliases or functions.



history

The history command in Linux is a powerful utility that allows users to view and manage the command history of their terminal sessions.

The following command lists the last 15 entries.

# history 15


Every command executed in the terminal is stored in a history file, and the history command provides a way to access this list. Users can recall previously used commands, re-execute them, or even search through past commands for efficiency. This command is especially useful for users who frequently work in the terminal, as it saves time and reduces the need to manually retype lengthy or complex commands.


More about the history command in my following post.

Enable Timestamps for Linux History Command

Grep multiple Patterns

You can use the -e option to specify multiple patterns. Here we will finally get all lines they either match for both patterns or just one of it.

command | grep -e "pattern1" -e "pattern2"


Or by using the \| operator within a single pattern to search for multiple patterns. Here we will finally also get all lines they either match for both patterns or just one of it.

# command | grep "pattern1\|pattern2"


The -E option enables extended regular expressions, which allows you to use | for OR operations without escaping it. Here we will finally also get all lines they either match for both patterns or just one of it.

# command | -E "pattern1|pattern2"


To display all lines they match two patterns we can use. Here we finally get all lines the match both patterns.

# command | grep "pattern1" | grep "pattern2"



You can search for multiple patterns across multiple files by specifying the filenames or using wildcards.

# grep -e "pattern1" -e "pattern2" file1.txt file2.txt

This will search for error or warning in all .log files in the current directory.
# grep -e "error" -e "warning" *.log


If your grep supports -P (Perl regex), you can use lookaheads to output only when two patterns exist.

command | grep -P '^(?=.*pattern1)(?=.*pattern2)'


Limit the output to a specific amount of lines. This will show the first 15 matching rows.

command | grep -e "pattern1" -e "pattern2"  | head -n 15


Limit the output to a specific amount of lines. This will show the last 5 matching rows.

command | grep -e "pattern1" -e "pattern2"  | tail -n 5

Clear Content of a File without deleting it

Therefore we can use the truncate command in Linux.

The truncate -s 0 command is used in Unix-like operating systems to shrink or extend the size of a file to a specified size. In this case, -s 0 sets the file size to 0 bytes, effectively emptying the file without deleting it.

# truncate -s 0 my-file.txt

Display System Shutdown and run-level Changes

You can use the last -x command to display the system’s shutdown and run-level changes (in addition to regular user logins/logouts) from the /var/log/wtmp file.

# last -x

Analyze Log Files


Display first entries

While the cat command shows the entire file by default, you can combine it with other commands to show just the first entries.

# head -n 20 filename.txt  # Shows first 20 lines

# cat filename.txt | head -n 10  # Pipes cat output to head

Display last entries

While the cat command shows the entire file by default, you can combine it with other commands to show just the last entries.

# tail -n 20 filename.txt  # Shows last 20 lines

# cat filename.txt | tail -n 10  # Pipes cat output to tail

# tail -f filename.txt  # Shows last 10 lines and follows new additions in real time
-f, --follow  output appended data as the file grows

View Log Files in compressed .xz Format

If your system has log files compressed in .xz format (e.g., /var/log/messages.xz), you can view them using the xzcat tool like shown below.

sudo xzcat /var/log/messages.xz | head -n 10

needs-restarting

The needs-restarting command in Linux is used to determine whether a system reboot is required usually after updates or package changes.

It’s part of the yum-utils package (for RHEL-based systems like RHEL, CentOS, AlmaLinux, Rocky and SUSE).

# needs-restarting


# needs-restarting

-r, --reboothint    # Only report whether a full reboot is required (returns 1) or not (returns 0).
-s, --services         # List the affected systemd services only.

Determine the Public IP Address used for Internet Access directly on the Console

We can also check from the Linux command line which public IP address our virtual machine is using for outbound internet access by executing the following command.

# dig TXT +short o-o.myaddr.l.google.com @ns1.google.com


dig ==> The DNS lookup utility (stands for Domain Information Groper).
TXT ==> Specifies the DNS record type to query — in this case, a TXT record (often used for arbitrary human-readable or system info).
+short ==> Tells dig to return a simplified, short output (just the answer, no headers or additional sections).
o-o.myaddr.l.google.com ==> The domain you’re querying. Google provides a special hostname here that returns your public IP in a TXT record.
@ns1.google.com ==> Specifies the DNS server to query directly — here, Google’s authoritative name server (ns1.google.com).

Determine which IP Address is used to access a Remote Host in case multiple IPs assigned on the Network Interface

To determine which IP address a Linux system will use to access a remote host (when multiple IPs are assigned to one interface), you can use the following command. This is the simplest and most accurate method.

Below for example the Linux host have assigned two different IP addresses on the same network interface (eth0), first the primary IP address 10.0.0.130 and secondary the IP address 10.0.0.131.

By running the command below, I will use for the remote IP the IP address of my domain controller 10.0.0.70, the src field in the output tells us which IP will be used to reach 10.0.0.70, here the first (primary) assigned IP address on the eth0 interface 10.0.0.130.

# ip route get <remote-ip>


The primary vs. secondary distinction is mainly for configuration order, not routing priority.
Linux uses the IP that best matches the routing and subnet involved in the connection.

If both IPs are in the same subnet, the first assigned (primary) IP is often used by default.

Links

whereis(1) – Linux man page
https://linux.die.net/man/1/whereis

which(1) – Linux man page
https://linux.die.net/man/1/which

history(3) — Linux manual page
https://www.man7.org/linux/man-pages/man3/history.3.html