What's this?

commandlinefu.com is the place to record those command-line gems that you return to again and again.

Delete that bloated snippets file you've been using and share your personal repository with the world. That way others can gain from your CLI wisdom and you from theirs too. All commands can be commented on, discussed and voted up or down.

Get involved!

You can sign-in using OpenID credentials, or register a traditional username and password.

First-time OpenID users will be automatically assigned a username which can be changed after signing in.

UpGuard checks and validates configurations for every major OS, network device, and cloud provider.

Stay in the loop…

Follow the Tweets.

Every new command is wrapped in a tweet and posted to Twitter. Following the stream is a great way of staying abreast of the latest commands. For the more discerning, there are Twitter accounts for commands that get a minimum of 3 and 10 votes - that way only the great commands get tweeted.

» http://twitter.com/commandlinefu
» http://twitter.com/commandlinefu3
» http://twitter.com/commandlinefu10

Subscribe to the feeds.

Use your favourite RSS aggregator to stay in touch with the latest commands. There are feeds mirroring the 3 Twitter streams as well as for virtually every other subset (users, tags, functions,…):

Subscribe to the feed for:



May 19, 2015 - A Look At The New Commandlinefu
I've put together a short writeup on what kind of newness you can expect from the next iteration of clfu. Check it out here.
March 2, 2015 - New Management
I'm Jon, I'll be maintaining and improving clfu. Thanks to David for building such a great resource!

Top Tags



Commands tagged sort from sorted by
Terminal - Commands tagged sort - 154 results
find /proc/*/fd -xtype f -printf "%l\n" | grep -P '^/(?!dev|proc|sys)' | sort | uniq -c | sort -n
2015-08-18 17:58:21
User: flatcap
Functions: find grep sort uniq
Tags: sort uniq find grep

List all open files of all processes.


find /proc/*/fd

Look through the /proc file descriptors


-xtype f

list only symlinks to file


-printf "%l\n"

print the symlink target


grep -P '^/(?!dev|proc|sys)'

ignore files from /dev /proc or /sys


sort | uniq -c | sort -n

count the results


Many processes will create and immediately delete temporary files.

These can the filtered out by adding:

... | grep -v " (deleted)$" | ...
sort -s -b -t' ' -k 4.9,4.12n -k 4.5,4.7M -k 4.2,4.3n -k 4.14,4.15n -k 4.17,4.18n -k 4.20,4.21n access.log*
2015-07-16 00:22:03
User: sesom42
Functions: sort
Tags: sort log apache

Sort Apache access logs by date and time using sort key field feature

find . -printf '%.5m %10M %#9u %-9g %TY-%Tm-%Td+%Tr [%Y] %s %p\n'|sort -nrk8|head
du -hs * |egrep -i "^(\s?\d+\.?\d+G)"
2014-12-09 15:23:21
User: krizzo
Functions: du egrep
Tags: size sort du

This will list all the files that are a gigabyte or larger in the current working directory. Change the G in the regex to be a M and you'll find all files that are a megabyte up to but not including a gigabyte.

ls | tr '[[:punct:][:space:]]' '\n' | grep -v "^\s*$" | sort | uniq -c | sort -bn
2014-10-14 09:52:28
User: qdrizh
Functions: grep ls sort tr uniq
Tags: sort uniq ls grep tr

I'm sure there's a more elegant sed version for the tr + grep section.

tcpdump -tnn -c 2000 -i eth0 | awk -F "." '{print $1"."$2"."$3"."$4}' | sort | uniq -c | sort -nr | awk ' $1 > 10 '
2014-09-26 01:15:23
User: hochmeister
Functions: awk sort tcpdump uniq

capture 2000 packets and print the top 10 talkers

zcat error.log.gz | sed 's^\[.*\]^^g' | sed 's^\, referer: [^\n]*^^g' | sort | uniq -c | sort -n
2014-09-24 05:26:24
User: zanhsieh
Functions: sed sort uniq zcat
Tags: sort sed uniq zcat

credit shall fall to this for non-gzipped version:


find . -name "*.pdf" -print0 | xargs -r0 stat -c %y\ %n | sort|awk '{print $4}'|gawk 'BEGIN{ a=1 }{ printf "mv %s %04d.pdf\n", $0, a++ }' | bash
2014-09-23 06:40:45
Functions: awk find gawk printf stat xargs
Tags: sort awk find xargs

Caution: distructive overwrite of filenames

Useful for concatenating pdfs in date order using pdftk

mco ping | head -n -4 | awk '{print $1}' | sort
sort in-file.txt | uniq -u > out-file.txt
ls -1 | xargs ruby -e'puts ARGV.shuffle'
dpkg-query -W --showformat='${Installed-Size}\t${Package}\n' | sort -nr | less
ls --color=never -1| grep -E "[0-9]{4}"|sed -re "s/^(.*)([0-9]{4})(.*)$/\2 \1\2\3/" | sort -r
dpkg-query -Wf '${Installed-Size}\t${Status}\t${Package}\n' | sort -n | grep installed
netstat -ntu | awk ' $5 ~ /^(::ffff:|[0-9|])/ { gsub("::ffff:","",$5); print $5}' | cut -d: -f1 | sort | uniq -c | sort -nr
2013-09-10 19:28:06
User: mrwulf
Functions: awk cut netstat sort uniq

Same as the rest, but handle IPv6 short IPs. Also, sort in the order that you're probably looking for.

sudo netstat -plntu --inet | sort -t: -k2,2n | sort --stable -t. -k 1,1n -k 2,2n -k 3,3n -k 4,4n | sort -s -t" " -k1,1
2013-08-13 09:21:26
User: thechile
Functions: netstat sort sudo

bit of a contrived example and playing to my OCD but nice for quick scripted output of listening ports which is sorted by port, ip address and protocol.

find . -type f -print0 | xargs -0 stat -c'%Y :%y %12s %n' | sort -nr | cut -d: -f2- | head
2013-08-03 09:53:46
User: HerbCSO
Functions: cut find sort stat xargs

Goes through all files in the directory specified, uses `stat` to print out last modification time, then sorts numerically in reverse, then uses cut to remove the modified epoch timestamp and finally head to only output the last 10 modified files.

Note that on a Mac `stat` won't work like this, you'll need to use either:

find . -type f -print0 | xargs -0 stat -f '%m%t%Sm %12z %N' | sort -nr | cut -f2- | head

or alternatively do a `brew install coreutils` and then replace `stat` with `gstat` in the original command.

dpkg-query --show --showformat='${Package;-50}\t${Installed-Size}\n' `aptitude --display-format '%p' search '?installed!?automatic'` | sort -k 2 -n | grep -v deinstall | awk '{printf "%.3f MB \t %s\n", $2/(1024), $1}'
2013-07-26 23:18:20
User: EvilDennisR
Functions: awk grep sort

The other commands were good, but they included packages that were installed and then removed.

This command only shows packages that are currently installed, sorts smallest to largest, and formats the sizes to be human readable.

find -printf "%C@ %p\n"|sort
2013-06-19 10:42:49
User: oivvio
Functions: find
Tags: sort find

This uses the ability of find (at least the one from GNU findutils that is shiped with most linux distros) to display change time as part of its output. No xargs needed.

awk '{print $1}' ~/.bash_history | sort | uniq -c | sort -rn | head -n 10
groups $(cut -f1 -d":" /etc/passwd) | sort
find -maxdepth 1 -type f -newermt "00:00" -printf "%f\n" | sort
2013-03-23 12:50:01
User: TetsuyO
Functions: find
Tags: sort find files

Finds files modified today since 00:00, removes ugly dotslash characters in front of every filename, and sorts them.

*EDITED* with the advices coming from flatcap (thanks!)

count=0;while IFS= read -r -d '' line; do echo "${line#* }"; ((++count==5)) && break; done < <(find . -type f -printf '%s %p\0' | sort -znr)
2013-03-19 17:19:26
User: sharfah
Functions: echo find read sort
Tags: sort find head,

This command is more robust because it handles spaces, newlines and control characters in filenames. It uses printf, not ls, to determine file size.

find . -type f -exec ls -s {} \; | sort -n -r | head -5
find /some/path -type f -printf '%f\n' | grep -o '\..\+$' | sort | uniq -c | sort -rn
2013-03-18 14:42:29
User: skkzsh
Functions: find grep sort uniq

Get the longest match of file extension (Ex. For 'foo.tar.gz', you get '.tar.gz' instead of '.gz')