$ Linux One Liners
Back to cert prep

Practice area

LPIC-1 101: GNU and Unix Commands

Use core command-line tools to inspect files, transform text, manage processes, and explain output under exam-style pressure.

Linux One Liners is an independent study and practice resource. It is not affiliated with, endorsed by, or approved by LPI, The Linux Foundation, CompTIA, or any certification provider. This site does not provide exam dumps or real exam questions.

Source status

Source status: LPI LPIC-1 overview verified July 3, 2026. Current version 5.0; exams 101-500 and 102-500.

This page paraphrases study areas into command practice. It does not copy official objective text wholesale and is not an exam dump.

Plain-English goal

Practice area: shell commands, text filters, file operations, streams, processes, priorities, regex, and editing. Exam/domain: 101-500.

read the situation

Command, output, and next step

Command anatomy

find /var -xdev -type f -mtime -7 -size +10M -printf '%TY-%Tm-%Td %s %p\n' 2>/dev/null | sort -r | head -20
find
walk a directory tree
-xdev
stay on one filesystem when present
-type f
limit the result to files
-size/-mtime/-perm
filter by size, age, or mode
-printf
choose the fields you need to read

Annotated output

root 524288000 2026-07-03 /var/log/journal/2f/system.journal
www-data 248512000 2026-07-02 /var/log/nginx/access.log
deploy 146800640 2026-07-01 /var/tmp/app-export.tar

What to notice

owner
who owns the file
bytes
how large it is before human formatting
date
whether this is recent growth
path
the exact file, not the directory guess

Safe vs unsafe move

Common wrong move

Deleting the largest file without proving its mount point, owner, or whether a service still has it open.

Next safe command

du -xhd1 /var | sort -h

Troubleshooting ladder

  1. Name the symptom.
  2. Inspect read-only state.
  3. Find the owner, service, file, device, mount, or route.
  4. Read the decisive output field.
  5. Choose the next narrow command.
  6. Avoid broad or destructive changes.
  7. Make the smallest justified change if required.
  8. Verify and record what changed.

How to get help

  1. Know the commandUse command --help, then man command for the full reference.
  2. Know the conceptUse apropos keyword or man -k keyword to discover command names.
  3. Maybe a shell builtinUse type command, command -V command, then help command.
  4. Service behaviorUse systemctl status service and journalctl -u service before restarting.
  5. Package ownershipUse dpkg -S, rpm -qf, or the distro package tool for the installed file.

Study plan

  1. Rehearse everyday shell movement and file operations, including globbing, quoting, hidden files, and safe previews before removal.
  2. Build text pipelines one stage at a time: search, cut fields, sort, count, and summarize without losing the original evidence.
  3. Practice process inspection before signaling: PID, PPID, state, command arguments, CPU, memory, job control, and priority.
  4. Use regex and vi basics enough to edit a config in a terminal without breaking syntax.

Command labs

Run these in a lab shell or disposable machine first. The point is to explain the output, not just memorize the command.

Find files by attributes

find /var -xdev -type f -mtime -7 -size +10M -printf '%TY-%Tm-%Td %s %p\n' 2>/dev/null | sort -r | head -20

Recent large files should be sorted by date with byte counts and full paths.

Annotated output 
root 524288000 2026-07-03 /var/log/journal/2f/system.journal
www-data 248512000 2026-07-02 /var/log/nginx/access.log
deploy 146800640 2026-07-01 /var/tmp/app-export.tar

What to notice: owner, bytes, date, path.

Next safe command: du -xhd1 /var | sort -h

Count repeated log patterns

grep -iE 'error|failed|denied' /var/log/syslog 2>/dev/null | cut -d' ' -f5- | sort | uniq -c | sort -nr | head

Repeated messages should be grouped and counted so the noisy issue is obvious.

Annotated output 
3 nginx[2310]: open() "/srv/app/current/.env" failed (13: Permission denied)
2 sshd[2249]: Failed password for invalid user deploy from 203.0.113.44
1 app[412]: ERROR db timeout user=ana

What to notice: count, service/process, message, object, next-check.

Next safe command: grep -Rni -C2 'Permission denied' /var/log 2>/dev/null | head -80

Inspect process tree

ps -eo pid,ppid,stat,pcpu,pmem,comm,args --sort=-pcpu | head -25

High-CPU processes should include PID, parent PID, state, and command arguments.

Annotated output 
PID  PPID STAT %CPU %MEM COMMAND   COMMAND
421  1    S    87.4 12.1 python3   python3 worker.py
2310 1    S     3.2  1.4 nginx     nginx: worker process
944  1    Ss    0.5  0.8 sshd      /usr/sbin/sshd -D

What to notice: PID/PPID, STAT, CPU/MEM, command/args.

Next safe command: systemctl status worker.service --no-pager

command families

Commands to practice

  • pwd
  • ls
  • cp
  • mv
  • rm
  • find
  • grep
  • sed
  • awk
  • sort
  • uniq
  • cut
  • wc
  • xargs
  • ps
  • kill
  • nice
  • renice
  • vi

Related command pages

Related drills

Flashcards

Why sort before head in a ranking pipeline?

head should receive already-ranked rows; otherwise it only shows the first original lines.

What does xargs help with?

It turns input rows into command arguments, but it must be used carefully with spaces and destructive commands.

Why inspect PPID before killing a process?

The parent process can explain whether a process is supervised or part of a larger service tree.

What is the difference between grep -n and grep -C?

-n shows line numbers; -C adds context lines around matches.

command purpose

When does `grep -n -C2` beat a plain `grep`?

Use it when the matching line is not enough. `-n` gives a line number and `-C2` shows nearby context so you can decide the next narrow command.

Log triage: read the evidence around the match before editing files or restarting services.

expected output field

In `sort | uniq -c | sort -nr`, which field proves the repeat count?

The first numeric column from `uniq -c` is the count. The final `sort -nr` ranks the largest repeated messages first.

Use this to separate the loudest repeated failure from one-off log noise.

dangerous wrong move

Why is `rm -rf /var/log` the wrong answer to repeated log errors?

It destroys evidence and does not fix the service or file that produced the errors. Read the repeated message and inspect the named object instead.

Deletion is not troubleshooting.

next diagnostic step

A grep match names `/srv/app/current/.env`. What should come next?

Run `namei -l /srv/app/current/.env` to inspect each path component before changing permissions.

The failure may be directory traversal, not the final file mode.

help command

You forgot what `grep -C` does. What local help should you use first?

Run `grep --help` for a quick flag reminder, then `man grep` if you need the full reference.

Cert practice should teach how to recover from memory gaps.

safe first command

Before sending a kill signal, which process field should you inspect?

Inspect PID, PPID, state, CPU, memory, and command arguments with `ps`. PPID often reveals a supervisor or parent service.

A process tree explains whether killing one child will actually solve anything.

flag meaning

Why preview `xargs` targets with `echo`?

It proves which arguments would be passed before a destructive command receives them.

This is especially important when filenames contain spaces or surprising characters.

cert objective link

What skill connects grep pipelines, ps output, and xargs safety?

Reading command output before chaining actions. The LPIC topic is command fluency, but the real habit is safe interpretation.

Pipelines are only useful if each stage preserves the evidence you need.

Quick quiz

Check the reasoning locally in your browser. Answers are not sent anywhere.

Which pipeline counts repeated matching log messages?
Show answer

Answer: grep pattern file | sort | uniq -c | sort -nr

Why: The pipeline searches, groups, counts, and ranks repeated lines.

  • rm -rf /var/log: That destroys or removes state before the evidence is understood.
  • chmod 777 file: That changes access broadly before proving which path component or owner is wrong.
  • systemctl reboot: That changes runtime state before reading the output that explains the failure.
Which command should you inspect before sending kill signals?
Show answer

Answer: ps

Why: ps shows process identity and state.

  • mkfs: That destroys or removes state before the evidence is understood.
  • passwd: That does not answer the question the output is asking you to prove first.
  • tar -x: That does not answer the question the output is asking you to prove first.
What is a safer first step before xargs rm?
Show answer

Answer: xargs echo or print the target list

Why: Preview the argument list before destructive action.

  • run it with sudo immediately: That raises privilege before you have proved the target and effect.
  • hide errors: That does not answer the question the output is asking you to prove first.
  • delete recursively: That destroys or removes state before the evidence is understood.

unit quiz

Unit quiz: GNU and Unix command reasoning

Ten local-only questions covering safe first commands, output interpretation, dangerous wrong moves, and next diagnostic steps. Answers are not sent anywhere.

Which first command keeps a disk-full file search scoped to one filesystem?
Show answer

Answer: find /var -xdev -type f -printf '%s %p\n' | sort -nr | head

Why: The `-xdev` search stays on the `/var` filesystem and lists evidence before cleanup.

  • find / -type f -delete: Why wrong: Deletes files before proving owner or safety.
  • chmod -R 777 /var: Why wrong: Changes permissions broadly and does not find large files.
  • systemctl restart nginx: Why wrong: Changes runtime state and does not answer the storage question.
What does `grep -n` add when reading logs?
Show answer

Answer: line numbers

Why: Line numbers let you reopen the exact area around a match.

  • recursive search: Why wrong: Recursive search is `-R`.
  • case-insensitive matching: Why wrong: Case-insensitive matching is `-i`.
  • context before and after: Why wrong: Context is `-C`, `-A`, or `-B`.
A command pipeline ends with `head -20`. What is the safety reason?
Show answer

Answer: It bounds the first readout so you inspect a sample.

Why: `head` keeps the first read manageable. It does not modify source data.

  • It deletes all but twenty files.: Why wrong: `head` prints lines; it does not delete files.
  • It restarts after twenty seconds.: Why wrong: There is no restart behavior.
  • It hides permission errors permanently.: Why wrong: Errors may be redirected elsewhere, but `head` is not a permission fix.
Which command helps prove a permission problem is in a parent directory?
Show answer

Answer: namei -l /path/to/file

Why: `namei -l` walks each path component and shows mode/owner evidence.

  • cat /path/to/file: Why wrong: `cat` only proves whether your current user can read the file.
  • rm -rf /path: Why wrong: That deletes data.
  • tar -czf backup.tgz /path: Why wrong: That archives data but does not explain traversal permissions.
What is the safest interpretation of `sort -nr | head` in a disk command?
Show answer

Answer: largest numeric rows first

Why: `sort -nr` sorts numerically in reverse order, then `head` prints the top rows.

  • oldest files first: Why wrong: Age sorting needs timestamp fields and a matching key.
  • most secure files first: Why wrong: Security is not implied.
  • recursive deletion preview: Why wrong: There is no deletion preview here.
Which flag is usually used with `grep` to search files recursively?
Show answer

Answer: -R

Why: `-R` recursively searches directories.

  • -n: Why wrong: `-n` prints line numbers.
  • -C2: Why wrong: `-C2` prints context.
  • -v: Why wrong: `-v` inverts matches.
What dangerous move should you avoid after seeing one permission error?
Show answer

Answer: chmod -R 777

Why: Recursive world-writable permissions change too much before proving the failing component.

  • namei -l: Why wrong: This is an inspection command.
  • stat -c '%A %U:%G %n': Why wrong: This reads owner and mode.
  • id: Why wrong: This reads user/group context.
Why use `2>/dev/null` in some inspection commands?
Show answer

Answer: to suppress expected permission noise

Why: It hides noisy errors from unreadable paths so the evidence list stays readable.

  • to delete stderr logs: Why wrong: It redirects the current command's stderr only.
  • to run as root: Why wrong: It does not change privileges.
  • to make the command faster always: Why wrong: It may not affect speed.
Which next step best follows a grep match showing `Permission denied` on `/srv/app/current/.env`?
Show answer

Answer: namei -l /srv/app/current/.env

Why: Trace the path components before changing ownership or modes.

  • chown -R www-data:www-data /srv: Why wrong: Too broad and not evidence-led.
  • reboot: Why wrong: Runtime state change before diagnosis.
  • apt upgrade: Why wrong: Package upgrades do not explain this file path.
What should a useful one-liner teach besides syntax?
Show answer

Answer: risk, expected output, when not to use it, and the next safe command

Why: The page should preserve context so the command is not copied blindly.

  • only the shortest possible command: Why wrong: Shortness alone is not safety.
  • how to skip output reading: Why wrong: Output reading is the core skill.
  • how to avoid documentation: Why wrong: Local help and docs are part of command reasoning.

interactive shell

Pipeline output playground

Pick a pipeline and compare how each stage changes the same small log sample.

Input sample

Jul 03 10:01 app[412]: INFO started worker
Jul 03 10:03 app[412]: ERROR db timeout user=ana
Jul 03 10:04 app[412]: ERROR db timeout user=ana
Jul 03 10:07 app[510]: WARN retrying request user=bo
Jul 03 10:08 app[510]: ERROR permission denied user=bo

Pipeline

grep ERROR app.log

Output

Jul 03 10:03 app[412]: ERROR db timeout user=ana
Jul 03 10:04 app[412]: ERROR db timeout user=ana
Jul 03 10:08 app[510]: ERROR permission denied user=bo

Filtering first leaves only error rows.

Self-test before moving on