Advanced Linux Terminal

Once basic terminal navigation, files, permissions, streams, users, packages, and shell execution are familiar, the next step is learning how to search, transform, automate, inspect, and control a Linux system from the command line.

This chapter focuses on:

• grep and regular expressions;
• sed;
• awk;
• password aging with chage;
• find, locate, which, man, and --help;
• process and network inspection;
• scheduling with cron and at;
• firewall configuration with UFW.

These tools are fundamental for backend engineering, DevOps, SysOps, infrastructure, server administration, debugging, and automation.

Important: Advanced terminal commands frequently operate over large file trees, user accounts, running processes, scheduled jobs, and network access. Test commands in a controlled environment before using them on production systems.

Searching Text With grep

grep searches text for lines that match a pattern.

Basic example:

grep "hello" test.txt

The same idea can be expressed through a pipe:

cat test.txt | grep "hello"

When reading a file directly, the first form is simpler:

grep "hello" test.txt

Useful grep Patterns

Count matching lines:

grep -c "hello" test.txt

Lines beginning with hello:

grep '^hello' test.txt

Lines ending with hello:

grep 'hello$' test.txt

Case-insensitive search:

grep -i 'linuxacademy' test.txt

Invert the match:

grep -v '^#' test.txt

Match either lowercase or uppercase first character:

grep '[lL]inuxacademy' test.txt

Extended regular expressions:

grep -E 'hello.*world' test.txt

Case-insensitive extended expression:

grep -Ei 'hello.*world' test.txt

Logical OR:

grep -Ei 'hello|world' test.txt

Historically, egrep was commonly used for extended regular expressions. Modern usage generally prefers:

grep -E

instead of:

egrep

Regular Expressions Overview

Regular expressions describe text patterns.

Common symbols include:

Example:

grep -E '^(error|warning):' application.log

Regular expressions are used by many Linux tools, not only grep.

sed - Stream Editor

sed is a stream editor used for operations such as:

• searching;
• substitution;
• insertion;
• deletion;
• filtering.

General syntax:

sed [OPTIONS] 'SCRIPT' INPUT_FILE

Replace the First Match on Each Line

sed 's/unix/linux/' file.txt

This prints transformed output.

It does not modify the file unless an in-place option is used.

Replace the Second Match

sed 's/unix/linux/2' file.txt

Replace All Matches on Each Line

sed 's/unix/linux/g' file.txt

Replace From the Third Match Onward

sed 's/unix/linux/3g' file.txt

Replace on a Specific Line

sed '3s/unix/linux/' file.txt

Replace Within a Line Range

sed '1,3s/unix/linux/' file.txt

From line 2 to the end:

sed '2,$s/unix/linux/' file.txt

Print Only Matching/Replaced Lines

sed -n 's/unix/linux/p' file.txt

Delete Lines

Delete line 3:

sed '3d' file.txt

Delete the last line:

sed '$d' file.txt

Delete a range:

sed '2,3d' file.txt

Delete from line 3 to the end:

sed '3,$d' file.txt

Delete lines containing a pattern:

sed '/unix/d' file.txt

In-Place Editing

When you intentionally want to modify the file:

sed -i 's/unix/linux/g' file.txt

For important data, create a backup first:

cp file.txt file.txt.backup
sed -i 's/unix/linux/g' file.txt

Or use GNU sed backup suffix syntax:

sed -i.bak 's/unix/linux/g' file.txt

awk - Pattern Scanning and Data Processing

awk is a small programming language designed for text and structured field processing.

It can:

• scan input line by line;
• split lines into fields;
• match patterns;
• perform actions;
• calculate values;
• generate reports;
• use variables;
• use conditions and loops.

General form:

awk 'PATTERN { ACTION }' FILE

Print Every Line

awk '{print}' employee.txt

Print Lines Matching a Pattern

awk '/manager/ {print}' employee.txt

Fields

By default, whitespace separates fields.

For a line like:

ajay manager account 45000

the fields are:

$1 = ajay
$2 = manager
$3 = account
$4 = 45000
$0 = entire line

Print name and salary:

awk '{print $1, $4}' employee.txt

Important awk Built-In Variables

NR

Current record/line number:

awk '{print NR, $0}' employee.txt

NF

Number of fields in the current record.

Print the first and last fields:

awk '{print $1, $NF}' employee.txt

FS

Input field separator.

Example CSV-like separator:

awk -F',' '{print $1, $3}' file.csv

OFS

Output field separator:

awk 'BEGIN {OFS=" | "} {print $1, $4}' employee.txt

RS

Input record separator.

The default is a newline.

ORS

Output record separator.

The default is a newline.

More awk Examples

Print lines 3 through 6:

awk 'NR==3,NR==6 {print NR, $0}' employee.txt

Print the second field:

awk '{print $2}' employee.txt

Print non-empty lines:

awk 'NF > 0' employee.txt

Find the longest line length:

awk '{if (length($0) > max) max = length($0)} END {print max}' employee.txt

Count lines:

awk 'END {print NR}' employee.txt

Print lines longer than 25 characters:

awk 'length($0) > 25' employee.txt

chage - Password Aging

chage manages password-expiration and account-aging information.

Inspect a user:

sudo chage -l student

Common options include:

Examples:

Set account expiration:

sudo chage -E 2027-01-31 student

Maximum password age of 90 days:

sudo chage -M 90 student

Remove account expiration:

sudo chage -E -1 student

Force a password change at next login:

sudo chage -d 0 student

Set a warning five days before expiration:

sudo chage -W 5 student

Account policy is an administrative and security decision. Do not apply expiration rules blindly.

Finding Files and Commands

find

General form:

find START_PATH EXPRESSIONS

Find by name:

find /home/developer -name 'test7000'

Find Go files:

find ./project -name '*.go'

Always quote wildcard patterns so that the shell does not expand them before find receives them.

Limit Search Depth

Maximum depth:

find ./project -maxdepth 2 -name '*.go'

Minimum depth:

find ./project -mindepth 2 -name '*.go'

Search Only Files

find ./project -type f -name 'abc*'

Only directories:

find ./project -type d -name 'abc*'

Search by Other Properties

Empty objects:

find ./project -empty

Files owned by a user:

find ./project -user developer

Files with exact permissions:

find ./project -perm 664

Files newer than another file:

find ./project -newer reference.file

find -exec

Run a command on results:

find ./project -type f -name '*.txt' -exec grep 'error' {} \;

Delete matching files interactively:

find ./project -type f -name 'sample.txt' -exec rm -i {} \;

Be extremely careful when combining find with deletion or permission changes.

First inspect the result:

find ./project -type f -name '*.tmp' -print

Only after confirming the target set should you consider a modifying command.

locate

locate searches an indexed database rather than walking the filesystem in real time.

Example:

locate test7000

Limit results:

locate -n 20 '*.html'

Ignore case:

locate -i 'readme.md'

Because locate depends on an index, very recent filesystem changes may not appear until the database is refreshed.

which, command -v, man, and --help

Locate a command found through $PATH:

which go

A shell-friendly alternative:

command -v go

Read manual pages:

man find

Command help:

find --help

These tools should become part of your normal workflow.

Do not memorize every option.

Learn how to discover the option you need.

Processes and Network Inspection

ps

Inspect running processes:

ps aux

Search within them:

ps aux | grep postgres

kill

Send the default termination signal:

kill PID

Example:

kill 1512

A forceful termination:

kill -9 1512

SIGKILL (-9) should not be the first choice.

It prevents the target process from performing normal cleanup.

Try normal termination first.

Listening Ports and Sockets

The original guide uses netstat.

It may still be available through the net-tools package:

sudo netstat -plntu

On modern Linux systems, ss is generally preferred:

sudo ss -plntu

Inspect port 80:

sudo ss -plnt | grep ':80'

lsof

Inspect processes using a port:

sudo lsof -i :5432

Extract a PID using awk:

sudo lsof -i :5432 | grep LISTEN | awk '{print $2}'

When scripting, prefer robust machine-readable output when a tool provides it instead of depending heavily on column formatting.

Network Interfaces

The original guide uses:

ifconfig

On modern Linux, use:

ip addr

or:

ip a

Routes:

ip route

The legacy ifconfig command may still exist when net-tools is installed.

/etc/hosts

Local hostname mappings are stored in:

/etc/hosts

Inspect:

cat /etc/hosts

Edit only when required:

sudo nano /etc/hosts

Incorrect entries can break local name resolution.

Memory Inspection

Display memory usage:

free -m

Human-readable format:

free -h

Linux intentionally uses available memory for filesystem caching.

High cache usage does not automatically mean the machine has a memory problem.

The original guide demonstrates manually dropping kernel caches through /proc/sys/vm/drop_caches.

That should not be used as routine memory optimization.

For normal development and administration, allow the Linux kernel to manage caches unless you are performing a controlled benchmark or diagnostic procedure and understand why cache dropping is necessary.

Scheduling Repeated Work With cron

Cron executes commands on recurring schedules.

Edit your user crontab:

crontab -e

General syntax:

MINUTE HOUR DAY_OF_MONTH MONTH DAY_OF_WEEK COMMAND

Visual form:

* * * * * command
│ │ │ │ │
│ │ │ │ └── day of week
│ │ │ └──── month
│ │ └────── day of month
│ └──────── hour
└────────── minute

Cron Examples

Every day at 03:00:

0 3 * * * /path/to/backup.sh

Five minutes after midnight every day:

5 0 * * * /path/to/command

At 14:15 on the first day of every month:

15 14 1 * * /path/to/script.sh

At 22:00 Monday through Friday:

0 22 * * 1-5 /path/to/script.sh

Every two hours at minute 23:

23 */2 * * * /path/to/script.sh

Sunday at 04:05:

5 4 * * 0 /path/to/command

Cron Special Strings

Example:

@daily /path/to/backup.sh

Removing Cron Jobs

List jobs:

crontab -l

Edit selectively:

crontab -e

Remove all jobs for the current user:

crontab -r

Warning: crontab -r removes the entire crontab. Prefer crontab -e when you only need to remove one entry.

One-Time Scheduling With at

at schedules a command for one future execution.

Install when needed:

sudo apt update
sudo apt install at

Schedule a command for 09:00:

echo "command_to_be_run" | at 09:00

One hour from now:

at now + 1 hour

At 13:00 two days from now:

at 1pm + 2 days

Inspect available jobs:

atq

Remove a scheduled job:

atrm JOB_ID

Use:

man at

for supported time formats.

UFW - Uncomplicated Firewall

UFW provides a simpler interface for Linux firewall configuration.

Install:

sudo apt update
sudo apt install ufw

Check status:

sudo ufw status

Verbose status:

sudo ufw status verbose

Default Policy

A common server policy is:

sudo ufw default deny incoming
sudo ufw default allow outgoing

This blocks unsolicited incoming connections unless explicitly allowed.

SSH Safety

Before enabling a firewall on a remote machine, make sure your SSH access is allowed.

Standard SSH:

sudo ufw allow ssh

Equivalent default port:

sudo ufw allow 22/tcp

If SSH runs on a custom port:

sudo ufw allow 2222/tcp

Critical: Enabling a firewall on a remote server without allowing the management connection can lock you out of the machine.

Allow HTTP

sudo ufw allow 80/tcp

HTTPS:

sudo ufw allow 443/tcp

Port Ranges

TCP:

sudo ufw allow 1000:2000/tcp

UDP:

sudo ufw allow 1000:2000/udp

Allow a Specific Source Address

sudo ufw allow from 192.168.1.50

Allow a source only to SSH:

sudo ufw allow from 192.168.1.50 to any port 22 proto tcp

Allow a subnet:

sudo ufw allow from 192.168.1.0/24

Deny Traffic

sudo ufw deny 80/tcp

Use deny rules deliberately and understand rule ordering.

Delete Rules

Delete by rule expression:

sudo ufw delete allow 80/tcp

Or list numbered rules:

sudo ufw status numbered

Then remove one:

sudo ufw delete RULE_NUMBER

Enable and Disable

Enable:

sudo ufw enable

Disable:

sudo ufw disable

Reset all UFW rules:

sudo ufw reset

reset removes your existing UFW configuration. Use it only when that is intentional.

Combining Advanced Tools

The real value of terminal knowledge appears when commands are combined.

Example:

sudo lsof -i :5432 \
    | grep LISTEN \
    | awk '{print $2}'

Conceptually:

inspect sockets
      ↓
filter listening entry
      ↓
extract PID field

Another example:

find ./logs -type f -name '*.log' \
    -exec grep -H 'ERROR' {} \;

Another:

grep -E '^ERROR|^WARN' application.log \
    | awk '{print $1, $2, $0}'

This is the Unix philosophy in practice:

Build larger workflows by combining small tools.

Advanced Command Checklist

You should become comfortable with:

grep
grep -E
regular expressions
sed
awk
NR
NF
FS
OFS
chage
find
locate
which
command -v
man
--help
ps
kill
ss
netstat
lsof
ip
free
cron
crontab
at
atq
atrm
ufw

You do not need to memorize every syntax form.

You need to understand what class of problem each tool solves and how to find its documentation.

Final Perspective

Advanced terminal work is not about typing complicated commands to look experienced.

It is about understanding how Linux represents:

text
files
processes
users
time
network sockets
permissions
system state

and then using small tools to inspect and manipulate those objects precisely.

A strong engineer should eventually be able to enter a remote Linux machine with nothing more than a shell and begin answering questions such as:

What process is running?
Which port is it using?
Who owns the file?
Where is the executable?
Which lines match this pattern?
Which files changed?
What job runs at 03:00?
Which firewall rule blocks the connection?

That ability is one of the foundations of backend, infrastructure, DevOps, SysOps, and cloud engineering.