Bash One-Liners Worth Remembering

It’s 2 AM. Your container is leaking memory, a logfile just ate half your disk, and you need to find which process is holding that socket open. You don’t have time to fire up a script or remember whether it’s ps aux | grep or pgrep. You need a one-liner—something you can paste into your terminal, get an answer, and move on.

Here are the ones that actually earn their place in your .bash_history.

File Operations

Find all files modified in the last 24 hours (useful for auditing what changed):

find /var/log -type f -mtime -1 -exec ls -lh {} \;

Recursively rename file extensions from .log to .bak:

find . -name "*.log" -type f -exec sh -c 'mv "$1" "${1%.log}.bak"' _ {} \;

Delete files older than 30 days (e.g., old backups):

find /backups -type f -mtime +30 -delete

List files sorted by size, largest first:

ls -lhS | grep -v '^d' | head -20

Find empty directories and delete them:

find . -type d -empty -delete

Process & System

Find what’s eating your CPU right now:

ps aux --sort=-%cpu | head -6

Find the top memory hogs:

ps aux --sort=-%mem | head -6

Kill all processes matching a pattern (replace nginx with whatever):

pkill -f nginx

Watch a command’s output refresh every 2 seconds (no need for watch if you’ve got tail):

while true; do clear; your-command; sleep 2; done

Show how many connections are in ESTABLISHED state right now:

netstat -an | grep ESTABLISHED | wc -l

Networking

Test if a port is open on a host without netcat:

(echo > /dev/tcp/192.168.1.100/22) 2>/dev/null && echo "Port 22 open" || echo "Port 22 closed"

Find your external IP from the CLI:

curl -s https://icanhazip.com

Show all active TCP connections with their state:

ss -tan | grep ESTAB

Find what process is listening on a specific port (e.g., port 8080):

lsof -i :8080

Text Processing

Count unique lines in a file (removes duplicates, then counts):

sort file.txt | uniq -c

Sort and deduplicate a file in place:

sort -u file.txt -o file.txt

Extract IP addresses from a logfile:

grep -oE '\b([0-9]{1,3}\.){3}[0-9]{1,3}\b' logfile.log | sort | uniq -c

Remove blank lines from a file:

sed '/^$/d' file.txt

Print every Nth line (e.g., every 10th line):

sed -n '0~10p' file.txt

Count occurrences of a word in a file (case-insensitive):

grep -io "error" logfile.log | wc -l

Disk & Space

Find the top 10 largest directories:

du -sh */ | sort -hr | head -10

Check inode usage on your filesystem:

df -i

Find which inode is consuming space (slow on huge trees, but works):

find . -type f -printf '%s %p\n' | sort -rn | head -10

Get a breakdown of disk usage by directory (one level deep):

du -sh */ | sort -hr

The trick with one-liners isn’t memorizing them—it’s knowing they exist. Save this article in a bookmark, grep your .bash_history, or alias the ones you run weekly. Your 2 AM self will thank you when you’re not digging through man pages at the worst possible time.