Bash One-Liners We Actually Use

The bash one-liners we actually use are boring on purpose: du -sh | sort -h when a disk fills, find -mtime for old files, ps --sort for memory hogs, ss -tlnp for ports, journalctl --since for log windows, jq for JSON, and curl -w for quick HTTP checks. Each solves a problem that recurs weekly. Nothing here is exotic.

Find what's eating disk

sudo du -sh /var/* 2>/dev/null | sort -h

Sums up sizes of immediate subdirectories of /var (or any directory), sorted by size. -h for human-readable; sort -h understands the suffixes. Always the first thing I run when a disk-full alert fires. Then I drill into the biggest one with the same pattern.

A faster alternative when the directory is huge:

sudo ncdu /var

If ncdu is installed, it's the right tool: interactive and navigable, so you drill down without re-running du at every level.

Find files older than N days

find /var/log -type f -mtime +30 -size +10M

Files older than 30 days and bigger than 10MB. Adjust thresholds. Combine with -delete once you trust it:

find /var/log -type f -mtime +30 -size +10M -delete

Top processes by memory

ps aux --sort=-%mem | head

Top entries by memory. Same flag with -%cpu for CPU. Old but solid, and present in most Linux images. --sort requires GNU procps (Linux), not BSD ps, and minimal BusyBox images lack it.

For sustained monitoring, top -o %MEM is interactive and lets you re-sort.

Watch a metric over time

watch -n 1 'kubectl get pods -A | grep -v Running'

Re-runs the inner command every second; shows you what's NOT running. Useful for watching a deploy progress, or for catching a pod that's flapping. -n 1 is the interval; -d (highlight differences) is nice when the output is long.

Filter logs by time window

journalctl -u myservice --since "10 min ago" --until "5 min ago"

journald is the right tool for systemd-managed services. The time arguments are flexible: "2026-04-29 14:00", "yesterday", "1 hour ago". The --until flank narrows the window. Retention, vacuuming and persistent storage are covered in our guide to journald log management on Linux.

For grepping inside that window:

journalctl -u myservice --since "10 min ago" | grep -i error

Pretty-print JSON

curl -s https://api.example.com/v1/things | jq .

jq . reads JSON on stdin and emits it pretty-printed. The . is the identity filter. jq is the right tool for any JSON wrangling beyond reading; learn it.

A common variant: extract a field across an array:

curl -s https://api.example.com/v1/things | jq -r '.items[].name'

-r strips quotes from string output. .items[].name iterates and pulls the name.

Find which process has a file open

sudo lsof | grep /path/to/file

Useful for "I can't unmount this disk, what's still holding it?" or "what process opened this socket?" lsof is slow but exhaustive. For fast process-specific lookup:

sudo lsof -p 12345

Lists all files (including network sockets) open by PID 12345.

What's listening on a port

sudo ss -tlnp | grep :443

ss, not netstat, which ships in the older net-tools package that many distributions no longer install by default. -t for TCP, -l for listening, -n for numeric ports, -p to show the process. Tells you exactly which process is listening on 443.

For the reverse direction, what a process is connected to:

sudo ss -tnp state established | grep -- 'pid=12345'

Tail multiple logs at once

sudo tail -f /var/log/syslog /var/log/nginx/access.log

Multiple files, single follow. Prefixes each line with the source file (when alternating). For Kubernetes:

kubectl logs -f -l app=myservice --all-containers --max-log-requests=20 --prefix

Tails logs from all pods matching app=myservice, prefixed with pod name. The --prefix is the part most people miss.

Search for a string across many files

grep -rIn 'TODO' --include='*.ts' .

-r recursive, -I skip binary files, -n line numbers, --include filter by glob. Faster than naive grep -r because it skips binaries.

For better defaults on a codebase, ripgrep (rg) is what I actually use:

rg -n TODO -t ts

Same result; faster; respects .gitignore. Install ripgrep everywhere you do dev work.

Replace text across many files

find . -name '*.md' -type f -exec sed -i.bak 's/oldterm/newterm/g' {} +

-i.bak makes backups and works on both GNU and BSD sed; a bare -i on macOS needs an explicit empty suffix, -i ''. The {} + form is faster than \; (one sed invocation for many files).

For complex multi-pattern edits, write a small Python script instead. sed-with-regex starts feeling fragile past simple substitutions.

Quick HTTP test from the shell

curl -sS -o /dev/null -w "%{http_code} %{time_total}s\n" https://api.example.com/health

Output: status code + time. Run in a loop for crude latency check:

for i in {1..10}; do
  curl -sS -o /dev/null -w "%{http_code} %{time_total}s\n" https://api.example.com/health
  sleep 1
done

Cheap "is this endpoint slow right now?" probe.

Decode base64 quickly

echo "aGVsbG8=" | base64 -d

Two-way: base64 encodes, base64 -d decodes. Inevitable when dealing with Kubernetes Secrets (which are base64-encoded by convention) or JWT tokens.

For JWTs specifically, split on . and decode the middle part:

TOKEN="eyJ...long.token...sig"
echo "$TOKEN" | cut -d. -f2 | base64 -d 2>/dev/null | jq .

Useful for "what's actually in this JWT?" debugging. JWT segments are unpadded base64url, so base64 -d may warn; the payload usually still prints.

Generate a strong random secret

openssl rand -hex 32

64-char hex string. Good for: API keys, signing secrets, anything where you want cryptographic randomness. -base64 for base64 output.

openssl rand -base64 24

SSH and run a command without a TTY

ssh prod 'df -h | grep -E "^/dev"'

Single quotes prevent local shell from expanding the command. Useful for cron-style remote checks.

Format a date or duration in shell

date -u +"%Y-%m-%dT%H:%M:%SZ"      # ISO 8601 UTC
date -u +%s                          # Epoch seconds
date -u -d "@1714564800"             # Convert epoch back (GNU date)

Date math:

date -u -d "yesterday" +"%Y-%m-%d"
date -u -d "now - 1 hour" +"%H:%M"

On macOS, gdate (from brew install coreutils) is the GNU equivalent. Pure macOS date has different syntax.

What I never use as a one-liner

Some patterns I see in "bash tricks" posts that I rarely or never write inline:

• Multi-line awk programs. Once awk gets past 2-3 actions, it's a script file, not a one-liner. Our first bash script tutorial covers the jump from one-liner to script.
• Bash regex backreferences. Too fragile. Use a real language.
• xargs -P for parallelism. Works but parallel or a small Python script is clearer.
• Recursive find -exec rm with complex predicates. Cleanup with this level of complexity should be a reviewed script, not a one-liner I type at 2am.

The principle: a one-liner you'd be comfortable typing fresh at 2am. If you'd want to read it carefully first, it's not really a one-liner anymore.

Questions people ask

How do I find what is using disk space on Linux?

Run sudo du -sh /var/* 2>/dev/null | sort -h to list the size of each subdirectory, largest last, then repeat the same command one level deeper on the biggest entry. sort -h understands the K, M and G suffixes that du -h prints.

How do I see which process is listening on a port?

Run sudo ss -tlnp | grep :443, replacing 443 with your port. -t limits output to TCP, -l to listening sockets, -n keeps ports numeric, and -p shows the owning process and PID, which needs root for other users' processes. ss replaces netstat from the older net-tools package.

How do I safely delete old log files with find?

Run the find command without -delete first, for example find /var/log -type f -mtime +30 -size +10M, and read the list. Only when it shows exactly what you expect, append -delete. -mtime +30 means modified more than 30 days ago. For journald logs, use journalctl --vacuum-time instead of deleting files by hand.

What I'd tell a team starting

ShellCheck even on one-liners. shellcheck - accepts stdin. Quick sanity check before running something destructive.

Always dry-run destructive operations. Run the find without -delete first; eyeball; then add -delete.

ss not netstat. ip not ifconfig. rg not grep -r. Modern tools are faster and clearer.

Save the patterns that work. Keep a ~/.shell-notes.md of one-liners that solved real problems. Future-you will thank you.

These aren't impressive. They're the patterns that survive being typed weekly without thinking. The exotic stuff gets retired; these stay.

Sources

• GNU Coreutils manual: du invocation
• ss(8) Linux manual page (iproute2)
• jq 1.8 Manual
• curl man page (including --write-out)