Hide

What's this?

commandlinefu.com is the place to record those command-line gems that you return to again and again.

Delete that bloated snippets file you've been using and share your personal repository with the world. That way others can gain from your CLI wisdom and you from theirs too. All commands can be commented on, discussed and voted up or down.


Get involved!

You can sign-in using OpenID credentials, or register a traditional username and password.

First-time OpenID users will be automatically assigned a username which can be changed after signing in.

Universal configuration monitoring and system of record for IT.
Hide

Stay in the loop…

Follow the Tweets.

Every new command is wrapped in a tweet and posted to Twitter. Following the stream is a great way of staying abreast of the latest commands. For the more discerning, there are Twitter accounts for commands that get a minimum of 3 and 10 votes - that way only the great commands get tweeted.

» http://twitter.com/commandlinefu
» http://twitter.com/commandlinefu3
» http://twitter.com/commandlinefu10

Subscribe to the feeds.

Use your favourite RSS aggregator to stay in touch with the latest commands. There are feeds mirroring the 3 Twitter streams as well as for virtually every other subset (users, tags, functions,…):

Subscribe to the feed for:

Hide

News

May 19, 2015 - A Look At The New Commandlinefu
I've put together a short writeup on what kind of newness you can expect from the next iteration of clfu. Check it out here.
March 2, 2015 - New Management
I'm Jon, I'll be maintaining and improving clfu. Thanks to David for building such a great resource!
Hide

Top Tags

Hide

Functions

Psst. Open beta.

Wow, didn't really expect you to read this far down. The latest iteration of the site is in open beta. It's a gentle open beta-- not in prime-time just yet. It's being hosted over at UpGuard (link) and you are more than welcome to give it a shot. Couple things:

  • » The open beta is running a copy of the database that will not carry over to the final version. Don't post anything you don't mind losing.
  • » If you wish to use your user account, you will probably need to reset your password.
Your feedback is appreciated via the form on the beta page. Thanks! -Jon & CLFU Team

Commands using tail from sorted by
Terminal - Commands using tail - 244 results
du . -mak|sort -n|tail -10
2010-12-03 19:28:55
User: georgesdev
Functions: du sort tail
1

du -m option to not go across mounts (you usually want to run that command to find what to destroy in that partition)

-a option to also list . files

-k to display in kilobytes

sort -n to sort in numerical order, biggest files last

tail -10 to only display biggest 10

ls -1t --group-directories-first /path/to/dir/ | tail -n 1
2010-12-02 12:25:16
User: fpunktk
Functions: ls tail
1

reverse the sorting of ls to get the newest file:

ls -1tr --group-directories-first /path/to/dir/ | tail -n 1

Problems:

If there are no files in the directory you will get a directory or nothing.

tail -f /var/www/logs/domain.com.log | grep "POST /scripts/blog-post.php" | grep -v 192.168. | awk '{print $1}' | xargs -I{} iptables -I DDOS -s {} -j DROP
2010-11-30 06:22:18
User: tehusr
Functions: awk grep iptables tail xargs
1

Takes IP from web logs and pipes to iptables, use grep to white list IPs.. use if a particular file is getting requested by many different addresses.

Sure, its already down pipe and you bandwidth may suffer but that isnt the concern. This one liner saved me from all the traffic hitting the server a second time, reconfigure your system so your system will work like blog-post-1.php or the similar so legitimate users can continue working while the botnet kills itself.

tail -f file |xargs -IX printf "$(date -u)\t%s\n" X
tail -f file | awk '{now=strftime("%F %T%z\t");sub(/^/, now);print}'
tail -f file | while read line; do printf "$(date -u '+%F %T%z')\t$line\n"; done
2010-11-24 05:50:12
User: derekschrock
Functions: file printf read tail
Tags: tail date
4

Should be a bit more portable since echo -e/n and date's -Ins are not.

tail -f file | while read line; do echo -n $(date -u -Ins); echo -e "\t$line"; done
2010-11-19 10:01:57
User: hfs
Functions: date echo file read tail
Tags: tail date
6

This is useful when watching a log file that does not contain timestamps itself.

If the file already has content when starting the command, the first lines will have the "wrong" timestamp when the command was started and not when the lines were originally written.

history | awk '{print $2,$3}' | sed s/sudo// | awk '{print $1}' | awk 'BEGIN {FS="|"}{print $1}' | sort | uniq -c | sort -n | tail | sort -nr
2010-11-17 12:15:04
User: b_t
Functions: awk sed sort tail uniq
0

Your version works fine except for someone who's interested in commands 'sudo' was prefixed to

i.e. in your command, use of sudo appears as number of times sudo was used.

Slight variation in my command peeks into what commands sudo was used for and counts the command

(ignores 'sudo')

history | awk '{print $2}' | awk 'BEGIN {FS="|"}{print $1}' | sort | uniq -c | sort -n | tail | sort -nr
grep 'model\|MHz' /proc/cpuinfo |tail -n 2
find /home/ -type f -exec du {} \; 2>/dev/null | sort -n | tail -n 10 | xargs -n 1 du -h 2>/dev/null
2010-11-10 07:24:17
User: mxc
Functions: du find sort tail xargs
Tags: disk usage
1

This combines the above two command into one. Note that you can leave off the last two commands and simply run the command as

"find /home/ -type f -exec du {} \; 2>/dev/null | sort -n | tail -n 10"

The last two commands above just convert the output into human readable format.

find / -type f -size +100M -exec du {} \; | sort -n | tail -10 | cut -f 2
find / -type f 2>/dev/null | xargs du 2>/dev/null | sort -n | tail -n 10 | cut -f 2 | xargs -n 1 du -h
2010-11-09 13:45:11
User: mxc
Functions: cut du find sort tail xargs
Tags: disk usage
1

Often you need to find the files that are taking up the most disk space in order to free up space asap. This script can be run on the enitre filesystem as root or on a home directory to find the largest files.

IP=$(nslookup `hostname` | grep -i address | awk -F" " '{print $2}' | awk -F# '{print $1}' | tail -n 1 ); R=3$((RANDOM%6 + 1)); PS1="\n\[\033[1;37m\]\u@\[\033[1;$R""m\]\h^$IP:\[\033[1;37m\]\w\$\[\033[0m\] "
2010-10-20 07:29:14
User: rubo77
Functions: awk grep nslookup tail
0

this adds a random color to your prompt and the external ip.

useful if you are using multiple mashines with the same hostname.

s=`head -$i fileName | tail -1`
tail -f /var/log/messages | while read line; do accu="$line"; while read -t 1 more; do accu=`echo -e "$accu\n$more"`; done; notify-send "Syslog" "$accu"; done
2010-10-10 16:28:08
User: hfs
Functions: read tail
1

The given example collects output of the tail command: Whenever a line is emitted, further lines are collected, until no more output comes for one second. This group of lines is then sent as notification to the user.

You can test the example with

logger "First group"; sleep 1; logger "Second"; logger "group"
curl --silent http://www.dudalibre.com/gnulinuxcounter?lang=en | grep users | head -2 | tail -1 | sed 's/.*<strong>//g' | sed 's/<\/strong>.*//g'
tail -f `ls -alst /var/log/maillog* | awk '{print $10} NR>0{exit};0'` | grep "criteria"
endnl () { [[ -f "$1" && -s "$1" && -z $(tail -c 1 "$1") ]]; }
2010-08-25 12:06:10
User: quintic
Functions: tail
Tags: tail
1

tail -c 1 "$1" returns the last byte in the file.

Command substitution deletes any trailing newlines, so if the file ended in a newline $(tail -c 1 "$1") is now empty, and the -z test succeeds.

However, $a will also be empty for an empty file, so we add -s "$1" to check that the file has a size greater than zero.

Finally, -f "$1" checks that the file is a regular file -- not a directory or a socket, etc.

while (true); do clear; uname -n; echo ""; df -h /; echo ""; tail -5 /var/log/auth.log; echo ""; vmstat 1 5; sleep 15; done
2010-08-23 04:37:58
User: roknir
Functions: df echo sleep tail uname vmstat
1

You can use this one-liner for a quick and dirty (more customizable) alternative to the watch command. The keys to making this work: everything exists in an infinite loop; the loop starts with a clear; the loop ends with a sleep. Enter whatever you'd like to keep an eye on in the middle.

tail -f /var/log/system.log | colorizer
git log --pretty=format:%H | tail -1
2010-08-17 13:47:42
Functions: tail
Tags: git commit
1

git log --format=%H | tail -1 doesn't work anymore

rsync -av --link-dest=$(ls -1d /backup/*/ | tail -1) /data/ /backup/$(date +%Y%m%d%H%M)/
2010-08-05 19:36:24
User: dooblem
Functions: date ls rsync tail
Tags: backup rsync
1

'data' is the directory to backup, 'backup' is directory to store snapshots.

Backup files on a regular basis using hard links. Very efficient, quick. Backup data is directly available.

Same as explained here :

http://blog.interlinked.org/tutorials/rsync_time_machine.html

in one line.

Using du to check the size of your backups, the first backup counts for all the space, and other backups only files that have changed.

sudo ls -l $(eval echo "/proc/{$(echo $(pgrep java)|sed 's/ /,/')}/fd/")|grep log|sed 's/[^/]* //g'|xargs -r tail -f
2010-07-30 18:20:00
User: vutcovici
Functions: echo eval grep ls sed sudo tail xargs
-1

Tail all logs that are opened by all java processes. This is helpful when you are on a new environment and you do not know where the logs are located. Instead of java you can put any process name. This command does work only for Linux.

The list of all log files opened by java process:

sudo ls -l $(eval echo "/proc/{$(echo $(pgrep java)|sed 's/ /,/')}/fd/")|grep log|sed 's/[^/]* //g'
git log --format=%H | tail -1
2010-07-20 08:12:05
User: l0b0
Functions: tail
Tags: git commit
0

Can anyone make a shorter one?

This doesn't work:

git log --reverse -1 --format=%H