# Linux Administration Cross-Distribution Cheat Sheet

Author: Perplexity Computer
Audience: daily Linux administration across Arch, RedHat-family, Debian-family, and Alpine systems
Format: searchable Markdown and PDF quick reference

Quick map

• Package management: install, remove, upgrade, search, inspect, verify, cache, repositories.
• System monitoring: CPU, memory, load, uptime, logs, units, hardware, kernel, containers.
• Process control: inspect, signal, priority, sessions, services, timers, OpenRC equivalents.
• Network: interfaces, routes, DNS, sockets, firewall, packet capture, VPN/service checks.
• User management: users, groups, sudo/doas, passwords, SSH keys, permissions.
• Disk and storage: block devices, filesystems, mounts, LVM, swap, quotas, usage.
• Cross-distro productivity: aliases, functions, environment variables, and shell conventions.

Package management

The package-manager rows compare Arch pacman, RedHat-family dnf, Debian-family apt, and Alpine apk; command names and core package operations are aligned with the official Arch pacman documentation, Debian APT manuals, Red Hat DNF command list, and Alpine Package Keeper documentation. See the source list at the end for canonical URLs.

Daily package operations

| Task | Arch, pacman | RedHat, dnf | Debian, apt | Alpine, apk |
|---|---|---|---|---|
| Refresh metadata | sudo pacman -Sy | sudo dnf makecache | sudo apt update | sudo apk update |
| Upgrade system | sudo pacman -Syu | sudo dnf upgrade | sudo apt upgrade | sudo apk upgrade |
| Full resolver upgrade | sudo pacman -Syu | sudo dnf distro-sync | sudo apt full-upgrade | sudo apk upgrade -a |
| Install package | sudo pacman -S pkg | sudo dnf install pkg | sudo apt install pkg | sudo apk add pkg |
| Install multiple | sudo pacman -S a b c | sudo dnf install a b c | sudo apt install a b c | sudo apk add a b c |
| Remove package | sudo pacman -R pkg | sudo dnf remove pkg | sudo apt remove pkg | sudo apk del pkg |
| Remove with unused deps | sudo pacman -Rs pkg | sudo dnf remove pkg | sudo apt autoremove pkg | sudo apk del pkg |
| Remove config too | sudo pacman -Rns pkg | sudo dnf remove pkg | sudo apt purge pkg | sudo apk del pkg |
| Autoremove orphans | sudo pacman -Rns $(pacman -Qdtq) | sudo dnf autoremove | sudo apt autoremove | sudo apk del --purge $(apk info -o 2>/dev/null) |
| Search repositories | pacman -Ss term | dnf search term | apt search term | apk search term |
| Show package info | pacman -Si pkg | dnf info pkg | apt show pkg | apk info pkg |
| List installed | pacman -Q | dnf list --installed | apt list --installed | apk info |
| Installed package info | pacman -Qi pkg | dnf repoquery --info --installed pkg | dpkg -s pkg | apk info -a pkg |
| Check if installed | pacman -Q pkg | rpm -q pkg | dpkg -s pkg | apk info -e pkg |
| List package files | pacman -Ql pkg | rpm -ql pkg | dpkg -L pkg | apk info -L pkg |
| Who owns file | pacman -Qo /path/file | rpm -qf /path/file | dpkg -S /path/file | apk info -W /path/file |
| Package provides file | pkgfile file or pacman -F file | dnf provides '*/file' | apt-file search file | apk search -x file |
| Reinstall package | sudo pacman -S pkg | sudo dnf reinstall pkg | sudo apt install --reinstall pkg | sudo apk fix pkg |
| Download only | sudo pacman -Sw pkg | dnf download pkg | apt download pkg | apk fetch pkg |
| Install local package | sudo pacman -U ./pkg.pkg.tar.zst | sudo dnf install ./pkg.rpm | sudo apt install ./pkg.deb | sudo apk add --allow-untrusted ./pkg.apk |
| Clean cache | sudo pacman -Sc | sudo dnf clean all | sudo apt clean | sudo apk cache clean |
| Dry run | pacman -S --print pkg | dnf install --assumeno pkg | apt -s install pkg | apk add --simulate pkg |
| Assume yes | sudo pacman -S --noconfirm pkg | sudo dnf -y install pkg | sudo apt -y install pkg | sudo apk add pkg |

Package database and repair

| Task | Arch | RedHat | Debian | Alpine |
|---|---|---|---|---|
| Verify package files | pacman -Qk pkg | rpm -V pkg | debsums pkg | apk fix --simulate pkg |
| Verify all packages | pacman -Qk | rpm -Va | sudo debsums -s | apk fix --simulate |
| Dependency check | pacman -Dk | dnf repoquery --unsatisfied | sudo apt-get check | apk fix --simulate |
| List explicit packages | pacman -Qqe | dnf repoquery --userinstalled | apt-mark showmanual | apk info -e |
| Mark manual | sudo pacman -D --asexplicit pkg | sudo dnf mark install pkg | sudo apt-mark manual pkg | add to /etc/apk/world |
| Mark dependency | sudo pacman -D --asdeps pkg | sudo dnf mark remove pkg | sudo apt-mark auto pkg | remove from /etc/apk/world if appropriate |
| List orphans | pacman -Qdtq | dnf repoquery --unneeded | apt autoremove --dry-run | apk info -o |
| Lock package | add IgnorePkg=pkg in /etc/pacman.conf | sudo dnf versionlock add pkg | sudo apt-mark hold pkg | pin in repository or world constraints |
| Unlock package | remove IgnorePkg | sudo dnf versionlock delete pkg | sudo apt-mark unhold pkg | remove pin or constraint |

Repository and source management

| Task | Arch | RedHat | Debian | Alpine |
|---|---|---|---|---|
| Main repo config | /etc/pacman.conf and /etc/pacman.d/mirrorlist | /etc/yum.repos.d/*.repo | /etc/apt/sources.list, /etc/apt/sources.list.d/*.list | /etc/apk/repositories |
| List repos | grep -E '^\[|^Server' /etc/pacman.conf /etc/pacman.d/mirrorlist | dnf repolist --all | apt-cache policy | cat /etc/apk/repositories |
| Enable repo | edit config or include repo file | sudo dnf config-manager --set-enabled repo | add .list or .sources, then apt update | uncomment repo, then apk update |
| Disable repo | edit config | sudo dnf config-manager --set-disabled repo | remove/comment source, then apt update | comment repo, then apk update |
| List upgrades | pacman -Qu | dnf check-update | apt list --upgradable | apk version -l '<' |
| Show package versions | pacman -Ss '^pkg$' | dnf list --showduplicates pkg | apt-cache policy pkg | apk policy pkg |

Package manager safety notes

• Arch partial upgrades: avoid pacman -Sy pkg as a normal habit; prefer pacman -Syu pkg so local metadata and packages move together.
• Debian scripts: prefer apt-get and apt-cache in automation because apt is optimized as a human-facing interface.
• RedHat modules: on RHEL-family systems, check dnf module list when versions are controlled by module streams.
• Alpine world file: /etc/apk/world is the desired top-level package set, so keep it clean when building minimal containers.

System monitoring

Most monitoring commands are distribution-neutral; package names may differ, but procps, iproute2, util-linux, systemd, and OpenRC tools cover the common base. The ps, free, ip, ss, and systemctl command behavior is documented in the official Linux/systemd manual pages listed in the source section.

Instant health checks

| Task | Command | Notes |
|---|---|---|
| Load, uptime, users | uptime; w | Fast first look at load average and interactive sessions. |
| CPU and memory summary | top or htop | htop is usually extra package; top is baseline. |
| Memory details | free -h | Use available, not raw free, for practical memory headroom. |
| Kernel and OS | uname -a; cat /etc/os-release | Useful for support and playbook branching. |
| System boot time | who -b or uptime -s | Works across most modern systems. |
| Failed systemd units | systemctl --failed | For systemd hosts. |
| OpenRC services | rc-status -a | For Alpine/OpenRC hosts. |
| Last boot logs | journalctl -b -p warning..alert | systemd journal warning and worse. |
| Kernel ring buffer | dmesg -T --level=err,warn | Hardware, driver, OOM, and storage clues. |
| Hardware summary | lscpu; lsblk; lspci; lsusb | Install pciutils or usbutils if missing. |
| Container context | systemd-detect-virt; grep -E '/docker|/lxc|/kubepods' /proc/1/cgroup | Helps avoid host/container confusion. |

CPU, memory, and I/O

| Goal | Command |
|---|---|
| CPU per process | ps -eo pid,ppid,user,stat,pcpu,pmem,etime,comm --sort=-pcpu | head |
| Memory per process | ps -eo pid,ppid,user,stat,pmem,rss,vsz,comm --sort=-rss | head |
| Process tree | ps -ejH or pstree -a |
| VM stats | vmstat 1 |
| Per-disk I/O | iostat -xz 1 |
| Per-process I/O | pidstat -d 1 or iotop |
| Slab/cache | slabtop |
| NUMA summary | numactl --hardware |
| OOM clues | journalctl -k -g 'Out of memory|oom-killer' |

Logs

| Runtime | Commands |
|---|---|
| systemd journal | journalctl -xe, journalctl -u nginx -f, journalctl --since '1 hour ago' |
| Kernel journal | journalctl -k -b, dmesg -Tw |
| OpenRC logs | tail -f /var/log/messages, rc-service svc status |
| Traditional auth logs | Debian/Arch: /var/log/auth.log; RedHat: /var/log/secure; Alpine may use /var/log/messages unless syslog is configured. |
| Follow multiple logs | tail -F /var/log/{syslog,auth.log,kern.log} |
| Grep compressed logs | zgrep -i 'error' /var/log/syslog* |

Service manager comparison

| Task | systemd | OpenRC, common on Alpine |
|---|---|---|
| Status | systemctl status svc | rc-service svc status |
| Start | sudo systemctl start svc | sudo rc-service svc start |
| Stop | sudo systemctl stop svc | sudo rc-service svc stop |
| Restart | sudo systemctl restart svc | sudo rc-service svc restart |
| Reload | sudo systemctl reload svc | sudo rc-service svc reload |
| Enable at boot | sudo systemctl enable svc | sudo rc-update add svc default |
| Disable at boot | sudo systemctl disable svc | sudo rc-update del svc default |
| List services | systemctl list-units --type=service | rc-status -a |
| View logs | journalctl -u svc | service log file or syslog |

Process control

Inspect processes

| Goal | Command |
|---|---|
| Full process list | ps auxww |
| POSIX full list | ps -ef |
| Parent/child tree | ps axjf |
| Process by name | pgrep -a nginx |
| Process by port | sudo ss -ltnp 'sport = :443' |
| Open files | sudo lsof -p PID |
| Current working dir | readlink -f /proc/PID/cwd |
| Environment | tr '\0' '\n' < /proc/PID/environ |
| Limits | cat /proc/PID/limits |
| Cgroup | cat /proc/PID/cgroup |
| Threads | ps -eLf | grep PROCESS |

Signals and priority

| Goal | Command |
|---|---|
| Graceful stop | kill -TERM PID |
| Hard kill | kill -KILL PID |
| Reload daemon | kill -HUP PID |
| Kill by name | pkill -TERM name |
| Kill by full command | pkill -f 'pattern' |
| Show signal names | kill -l |
| Start low priority | nice -n 10 command |
| Change priority | sudo renice -n 5 -p PID |
| Set CPU affinity | taskset -cp 0-3 PID |
| Trace syscalls | strace -fp PID |
| Trace network/files | strace -e trace=network,file -fp PID |

Job control inside a shell

| Goal | Command |
|---|---|
| Background current job | Ctrl-Z, then bg |
| Bring back foreground | fg %1 |
| List jobs | jobs -l |
| Disown long task | disown -h %1 |
| Start immune to hangup | nohup command & |
| Multiplex terminal | tmux new -s admin |

Network administration

Interface and address basics

| Goal | Command |
|---|---|
| Show addresses | ip -br addr |
| Show links | ip -br link |
| Bring link up/down | sudo ip link set dev eth0 up / sudo ip link set dev eth0 down |
| Add temporary address | sudo ip addr add 192.0.2.10/24 dev eth0 |
| Delete address | sudo ip addr del 192.0.2.10/24 dev eth0 |
| Watch netlink changes | ip monitor all |
| Show routes | ip route show |
| Default route | ip route get 1.1.1.1 |
| Add route | sudo ip route add 203.0.113.0/24 via 192.0.2.1 |
| Delete route | sudo ip route del 203.0.113.0/24 |

DNS and name resolution

| Goal | Command |
|---|---|
| Resolve name | getent hosts example.com |
| DNS query | dig +short example.com A |
| Reverse lookup | dig +short -x 8.8.8.8 |
| Check resolver config | cat /etc/resolv.conf |
| systemd-resolved status | resolvectl status |
| Query specific server | dig @1.1.1.1 example.com |

Sockets, ports, and connectivity

| Goal | Command |
|---|---|
| Listening TCP/UDP | sudo ss -lntup |
| All TCP connections | ss -tan |
| Process using port | sudo ss -ltnp 'sport = :8080' |
| Test TCP port | nc -vz host 443 |
| HTTP status | curl -I https://example.com |
| TLS certificate | openssl s_client -connect host:443 -servername host </dev/null |
| Path MTU hint | tracepath host |
| Trace route | traceroute host or mtr host |
| Packet capture | sudo tcpdump -ni eth0 host 1.1.1.1 |
| Capture pcap | sudo tcpdump -ni eth0 -w capture.pcap port 443` |

# Detect distro family once per shell.
detect_distro() {
  if [ -r /etc/os-release ]; then
    . /etc/os-release
    case " ${ID:-} ${ID_LIKE:-} " in
      *arch*) echo arch ;;
      *rhel*|*fedora*|*centos*) echo redhat ;;
      *debian*|*ubuntu*) echo debian ;;
      *alpine*) echo alpine ;;
      *) echo unknown ;;
    esac
  else
    echo unknown
  fi
}

DISTRO_FAMILY="${DISTRO_FAMILY:-$(detect_distro)}"

pkg_update() {
  case "$DISTRO_FAMILY" in
    arch)   sudo pacman -Syu "$@" ;;
    redhat) sudo dnf upgrade "$@" ;;
    debian) sudo apt update && sudo apt upgrade "$@" ;;
    alpine) sudo apk update && sudo apk upgrade "$@" ;;
    *) echo "Unsupported distro: $DISTRO_FAMILY" >&2; return 1 ;;
  esac
}

pkg_install() {
  case "$DISTRO_FAMILY" in
    arch)   sudo pacman -S "$@" ;;
    redhat) sudo dnf install "$@" ;;
    debian) sudo apt install "$@" ;;
    alpine) sudo apk add "$@" ;;
    *) echo "Unsupported distro: $DISTRO_FAMILY" >&2; return 1 ;;
  esac
}

pkg_remove() {
  case "$DISTRO_FAMILY" in
    arch)   sudo pacman -Rns "$@" ;;
    redhat) sudo dnf remove "$@" ;;
    debian) sudo apt purge "$@" ;;
    alpine) sudo apk del "$@" ;;
    *) echo "Unsupported distro: $DISTRO_FAMILY" >&2; return 1 ;;
  esac
}

pkg_search() {
  case "$DISTRO_FAMILY" in
    arch)   pacman -Ss "$@" ;;
    redhat) dnf search "$@" ;;
    debian) apt search "$@" ;;
    alpine) apk search "$@" ;;
    *) echo "Unsupported distro: $DISTRO_FAMILY" >&2; return 1 ;;
  esac
}

pkg_info() {
  case "$DISTRO_FAMILY" in
    arch)   pacman -Si "$@" ;;
    redhat) dnf info "$@" ;;
    debian) apt show "$@" ;;
    alpine) apk info -a "$@" ;;
    *) echo "Unsupported distro: $DISTRO_FAMILY" >&2; return 1 ;;
  esac
}

svc() {
  action="$1"; name="$2"
  [ -n "$action" ] && [ -n "$name" ] || {
    echo "usage: svc {status|start|stop|restart|reload|enable|disable} service" >&2
    return 2
  }

  if command -v systemctl >/dev/null 2>&1 && [ -d /run/systemd/system ]; then
    case "$action" in
      status|start|stop|restart|reload) sudo systemctl "$action" "$name" ;;
      enable|disable) sudo systemctl "$action" "$name" ;;
      *) echo "unknown action: $action" >&2; return 2 ;;
    esac
  elif command -v rc-service >/dev/null 2>&1; then
    case "$action" in
      status|start|stop|restart|reload) sudo rc-service "$name" "$action" ;;
      enable) sudo rc-update add "$name" default ;;
      disable) sudo rc-update del "$name" default ;;
      *) echo "unknown action: $action" >&2; return 2 ;;
    esac
  else
    echo "No supported service manager found" >&2
    return 1
  fi
}

# Safer shell defaults.
alias cp='cp -iv'
alias mv='mv -iv'
alias rm='rm -Iv'
alias mkdir='mkdir -pv'

# Listings and navigation.
alias ll='ls -alFh --group-directories-first 2>/dev/null || ls -alFh'
alias la='ls -A'
alias l='ls -CF'
alias ..='cd ..'
alias ...='cd ../..'

# Process and monitoring.
alias psg='ps auxww | grep -i --color=auto'
alias psa='ps -eo pid,ppid,user,stat,pcpu,pmem,etime,comm --sort=-pcpu | head -40'
alias memtop='ps -eo pid,ppid,user,stat,pmem,rss,vsz,comm --sort=-rss | head -40'
alias ports='sudo ss -lntup'
alias now='date -Is'
alias path='printf "%s\n" ${PATH//:/ }'

# Logs.
alias jerr='journalctl -p err..alert -xb'
alias jk='journalctl -k -b'
alias jf='journalctl -f'
alias dmsg='dmesg -Tw'

# Disk.
alias duh='du -h --max-depth=1 2>/dev/null | sort -h'
alias dfh='df -hT'
alias mounts='findmnt'
alias biggest='find . -xdev -type f -printf "%s %p\n" 2>/dev/null | sort -n | tail -20'

# Network.
alias ipa='ip -br addr'
alias ipl='ip -br link'
alias ipr='ip route'
alias sst='ss -tan'
alias ssl='sudo ss -lntup'

# Locale and time.
export LANG="${LANG:-C.UTF-8}"
export LC_ALL="${LC_ALL:-}"
export TZ="${TZ:-Europe/Kiev}"

# Editor and pager.
export EDITOR="${EDITOR:-vim}"
export VISUAL="${VISUAL:-$EDITOR}"
export PAGER="${PAGER:-less}"
export LESS='-FRSX --mouse'
export MANPAGER='less -R'

# History.
export HISTSIZE=200000
export HISTFILESIZE=400000
export HISTCONTROL=ignoreboth:erasedups
export HISTTIMEFORMAT='%F %T '

# Safer command behavior.
export SYSTEMD_PAGER=''
export GPG_TTY="$(tty 2>/dev/null || true)"

# Go, Python, and local bin conventions.
export GOPATH="${GOPATH:-$HOME/go}"
export PYTHONUNBUFFERED=1
export PATH="$HOME/.local/bin:$HOME/bin:$GOPATH/bin:$PATH"

# Make and enter directory.
mkcd() { mkdir -p -- "$1" && cd -- "$1"; }

# Extract common archive types.
extract() {
  [ -f "$1" ] || { echo "not a file: $1" >&2; return 1; }
  case "$1" in
    *.tar.bz2) tar xjf "$1" ;;
    *.tar.gz)  tar xzf "$1" ;;
    *.tar.xz)  tar xJf "$1" ;;
    *.tar.zst) tar --zstd -xf "$1" ;;
    *.tar)     tar xf "$1" ;;
    *.zip)     unzip "$1" ;;
    *.gz)      gunzip "$1" ;;
    *.bz2)     bunzip2 "$1" ;;
    *.xz)      unxz "$1" ;;
    *) echo "unknown archive: $1" >&2; return 2 ;;
  esac
}

# Quick HTTP timing.
curltime() {
  curl -o /dev/null -sS -w \
    'dns=%{time_namelookup} connect=%{time_connect} tls=%{time_appconnect} ttfb=%{time_starttransfer} total=%{time_total}\n' \
    "$@"
}

# Show a compact incident snapshot.
snapshot() {
  echo "== host =="; hostnamectl 2>/dev/null || uname -a
  echo "== os =="; cat /etc/os-release 2>/dev/null
  echo "== load =="; uptime
  echo "== memory =="; free -h
  echo "== disk =="; df -hT
  echo "== top cpu =="; ps -eo pid,ppid,user,stat,pcpu,pmem,etime,comm --sort=-pcpu | head
  echo "== listening =="; ss -lntup 2>/dev/null
}

uptime
free -h
ps -eo pid,ppid,user,stat,pcpu,pmem,rss,etime,comm --sort=-pcpu | head -25
vmstat 1
iostat -xz 1
journalctl -p warning..alert --since '30 minutes ago'

df -hT
df -hi
sudo du -xhd1 / | sort -h
sudo lsof +L1
journalctl --disk-usage
sudo journalctl --vacuum-time=14d

systemctl status service
journalctl -u service -b --no-pager
systemctl cat service
systemd-analyze verify /etc/systemd/system/service.service
sudo ss -lntup | grep -E ':PORT\b'

rc-service service status
rc-service service start
tail -n 200 /var/log/messages

ip -br addr
ip route get 1.1.1.1
getent hosts target.example
dig +short target.example
nc -vz target.example 443
tracepath target.example
sudo tcpdump -ni any host target.example