Linux Systems Administration: Processes, Networking, Services, and Diagnostics

A solid grasp of system monitoring, process lifecycle control, modern network diagnostics, systemd service management, and shell job control is essential for Linux server operations. This guide covers daily sysadmin commands, modern replacements for legacy tools, and hardware/performance diagnostics.

⚡ Quick Dive

Essential Systems Administration Cheat Sheet

Category Command Action Example
Process ps aux | grep <name> Find running processes with full argument list ps aux | grep nginx
Process htop / top Interactive real-time process and CPU/RAM monitor htop
Process kill -15 <PID> Gracefully terminate process (SIGTERM) kill -15 2840
Process pkill -f <name> Kill processes matching command-line pattern pkill -f "python server.py"
Memory free -h Display available physical and swap memory free -h
Services systemctl status <srv> Check systemd service health and recent logs systemctl status docker
Logs journalctl -u <srv> -f Follow live log output of a specific systemd unit journalctl -u nginx -f
Network ip a / ip r Inspect network interfaces and routing table ip a
Network ss -tulpn List all active listening TCP/UDP ports and sockets sudo ss -tulpn
Network curl -Iv <url> Fetch HTTP headers and TLS handshake details curl -Iv https://example.com
Open Files lsof -i :<port> Identify process listening on a specific port sudo lsof -i :80
Schedule crontab -l List user scheduled cron jobs crontab -l

Core Unix Signals Reference

Signal Number Default Action Meaning & Behavior
SIGHUP 1 Terminate Hangup; reload daemon configuration without dropping connections
SIGINT 2 Terminate Terminal interrupt signal (sent by pressing Ctrl + C)
SIGQUIT 3 Dump Core Quit from keyboard (Ctrl + \), generates core dump
SIGKILL 9 Force Exit Immediate kernel kill; cannot be caught, handled, or ignored
SIGTERM 15 Terminate Standard graceful termination request (allows saving state & cleanup)
SIGSTOP 19 Pause Uncatchable pause signal (Ctrl + Z sends SIGTSTP 20)
SIGCONT 18 Continue Resume execution of previously stopped process

📖 Extended Guide

1. Process Management & Lifecycle Control

Process Inspection: ps, top, htop, and btop

  • ps aux (BSD style) / ps -ef (System V style):
    • USER: Process owner
    • PID: Process Identification Number
    • %CPU / %MEM: Resource utilization
    • VSZ / RSS: Virtual memory vs. resident physical RAM
    • STAT: State (R running, S sleeping, D uninterruptible disk sleep, Z zombie)
# Find high CPU consuming processes
ps aux --sort=-%cpu | head -n 10

# Find high memory consuming processes
ps aux --sort=-%mem | head -n 10

Process Signals: kill, pkill, and killall

Always attempt graceful termination (SIGTERM 15) before resorting to uncatchable forced termination (SIGKILL 9):

# 1. Gracefully terminate process
kill 1234
# Equivalent to:
kill -15 1234
kill -SIGTERM 1234

# 2. Force terminate stuck unresponsive process
kill -9 1234

# 3. Reload daemon config safely without stopping
sudo kill -HUP $(pidof nginx)

# 4. Terminate all matching processes by name
killall node

# 5. Pattern match on full command line
pkill -9 -f "celery worker"

2. System Hardware, Memory & Performance Metrics

# 1. Memory diagnostics with buffer/cache breakdown
free -h -w

# 2. System uptime and 1, 5, 15-minute load averages
uptime

# 3. Virtual memory statistics & I/O wait monitoring (1-second intervals)
vmstat 1 5

# 4. Storage I/O utilization per device
iostat -xz 1 3

# 5. Kernel ring buffer (hardware faults, OOM kills)
sudo dmesg -T --level=err,warn

# 6. Kernel & OS architecture details
uname -a

[!TIP] Understanding Load Averages: On a system with $N$ CPU cores, a load average of $N$ means 100% utilization. If load average > $N$, processes are queuing and waiting for CPU or disk I/O time.

3. Modern Service Management: systemd & journalctl

systemd is the standard init system and service manager across modern Linux distros (replacing legacy init.d and service scripts).

Managing Services with systemctl

# Start, stop, restart, reload
sudo systemctl start nginx
sudo systemctl stop nginx
sudo systemctl restart nginx
sudo systemctl reload nginx   # zero-downtime config reload

# Check active health and latest logs
systemctl status nginx

# Boot persistence
sudo systemctl enable nginx    # Start on boot
sudo systemctl disable nginx   # Do not start on boot
sudo systemctl is-active nginx # Script-friendly exit status

# Mask a service to prevent it from ever starting
sudo systemctl mask apache2

Log Inspection with journalctl

# Follow logs for a specific service in real-time
sudo journalctl -u nginx -f

# View errors only (-p err) since current boot (-b)
sudo journalctl -p err -b

# Filter logs by timeframe
sudo journalctl -u my-app --since "2026-08-29 08:00:00" --until "1 hour ago"

# View logs without pagination
journalctl -u docker --no-pager -n 50

4. Modern Networking & Diagnostics

Legacy Tool Modern Replacement Purpose
ifconfig ip a / ip link Interface addresses and link status
route / netstat -r ip r IP routing table
netstat -tulpn ss -tulpn Active listening sockets and connections
nslookup dig DNS resolution queries and record lookup

Practical Networking Commands

# 1. Inspect listening TCP/UDP ports with associated processes
sudo ss -tulpn

# 2. Inspect active outbound TCP connections
ss -tun state established

# 3. Test TCP port connectivity to remote host without telnet
nc -zv 192.168.1.50 443
# OR
curl -v telnet://192.168.1.50:443

# 4. Perform DNS query with full record breakdown
dig +short A google.com
dig @8.8.8.8 MX example.com

# 5. Network trace and packet loss diagnostics
mtr --report -c 10 1.1.1.1

Firewall Management with ufw

# Check status and active rules
sudo ufw status verbose

# Allow SSH and HTTPS
sudo ufw allow 22/tcp
sudo ufw allow 443/tcp

# Allow traffic from specific subnet only
sudo ufw allow from 10.0.0.0/24 to any port 3306

# Enable firewall
sudo ufw enable

5. Shell Environment, Background Jobs, and Automation

Environment Variables

# Export variable for current shell and child processes
export NODE_ENV="production"

# View all active environment variables
printenv

# Inspect single variable
echo "$PATH"

Shell Job Control (&, bg, fg, jobs, nohup)

# Run command in background
python3 worker.py &

# View background jobs in current shell
jobs -l

# Bring job 1 to foreground
fg %1

# Send suspended job (Ctrl+Z) into background
bg %1

# Run process immune to terminal hangup / disconnection
nohup ./long_task.sh > output.log 2>&1 &

# Disown running job so it persists after closing terminal
disown -h %1

Scheduled Jobs with crontab

Cron format: minute hour day_of_month month day_of_week command

# Edit user's crontab safely
crontab -e

# Example cron entries:
# Run database backup every day at 2:30 AM
30 2 * * * /usr/local/bin/db_backup.sh >> /var/log/backup.log 2>&1

# Run health check every 5 minutes
*/5 * * * * /opt/scripts/healthcheck.sh
⌂ All Guides