Top 25 Linux Commands

#1pwd

READ-ONLYSAME ON BOTH

Shows the folder you are in right now. Stands for print working directory.

Example

pwd /var/www/html/moodle

What the output means

You are inside the moodle folder, which is inside html, inside www, inside var.
A path starting with / is the full address from the very top of the disk.

MOODLE NOTERun pwd before any command that changes files. Being in the wrong site's folder is an easy way to edit the wrong Moodle.

↑ Back to top

#2cd

READ-ONLYSAME ON BOTH

Moves you into another folder. Stands for change directory. It changes nothing on the server, only where you are standing.

Common uses

`cd /var/www/html`	Go to that exact folder (full path)
`cd moodle`	Go into `moodle` inside the folder you're in now
`cd ..`	Go up one level
`cd ~`	Go to your home folder (plain `cd` does the same)
`cd -`	Go back to the last folder you were in

What the output means

No output means it worked. The folder name in your prompt changes.
No such file or directory means a typo, or that folder isn't there. Use ls to check.

Where they differ: your prompt and login name

Amazon Linux 1

Ubuntu 24.04

↑ Back to top

#3ls

READ-ONLYSAME ON BOTH

Lists what's in a folder. Stands for list. Add -l for details and -h for easy-to-read sizes.

Common uses

`ls`	Names only
`ls -lh`	Details, with sizes like 4.0K and 2.1M
`ls -la`	Also show hidden files (names starting with a dot)
`ls -lht`	Newest first. Great for log folders
`ls -lh /var/log`	List a different folder without moving there

Example

ls -lh drwxr-xr-x 5 apache apache 4.0K Oct 30 09:12 admin -rw-r----- 1 apache apache 1.2K Oct 30 09:12 config.php -rw-r--r-- 1 apache apache 12K Oct 30 09:12 index.php

What the output means (one line, left to right)

`d` or `-`	d = a folder. - = a file.
`rwxr-xr-x`	Permissions: who can read, write, or run it. (Full story under `chmod`.)
`apache apache`	The owner, then the group.
`1.2K`	Size.
`Oct 30 09:12`	Last changed.
`config.php`	The name.

Where they differ: the web server's user name

Amazon Linux 1

Web files are owned by apache

Ubuntu 24.04

Web files are owned by www-data

MOODLE NOTEls -l config.php in the Moodle folder shows who owns it. If the owner is wrong for that server (see the box above), Moodle may not load or may not be able to save files.

↑ Back to top

2 · Reading files

#4cat

READ-ONLYSAME ON BOTH

Prints a whole file to the screen at once. Best for short files. For long files, use less instead, or the text flies past.

Common uses

`cat /etc/os-release`	Which Linux is this server? (see below)
`cat -n file.txt`	Same, with line numbers down the left side

Example: which Linux am I on?

cat /etc/os-release

What the output means: the first lines tell you

Amazon Linux 1

NAME="Amazon Linux AMI"
VERSION="2018.03"

Ubuntu 24.04

NAME="Ubuntu"
VERSION="24.04.x LTS (Noble Numbat)"

No such file or directory = wrong name or path.
Permission denied = you need admin rights. Put sudo in front (see #21).

MOODLE NOTEMoodle's config.php holds the database password. Avoid cat config.php when sharing your screen. Use grep to show just the line you need.

↑ Back to top

#5less

READ-ONLYSAME ON BOTH

Opens a file one screen at a time so you can scroll and search. It only reads; you can't change the file from here.

Example

less /etc/os-release

Keys to use once it's open

`Space` / `b`	Down one screen / back one screen
`↑` `↓`	One line at a time
`g` / `G`	Jump to the start / the end (newest lines in a log)
`/word` then `Enter`	Search forward for "word"
`n` / `N`	Next match / previous match
`q`	Quit and go back to the prompt

What the output means

The file fills the screen. A : at the bottom means there's more; press Space.
(END) at the bottom means you've reached the last line. Press q to leave.

Where they differ: the Apache error log

Amazon Linux 1

sudo less /var/log/httpd/error_log

Ubuntu 24.04

sudo less /var/log/apache2/error.log

MOODLE NOTEWhen a Moodle page shows a white screen or "error," the real reason is usually in the Apache error log. Open it with less, press G to jump to the newest lines, and read upward.

↑ Back to top

#6tail

READ-ONLYSAME ON BOTH

Shows the last lines of a file. With -f it keeps watching and prints new lines as they're added. Perfect for logs.

Common uses

`tail file`	Last 10 lines
`tail -n 50 file`	Last 50 lines
`tail -f file`	Follow: keep watching for new lines. Press `Ctrl+C` to stop.

Example: watch the Apache error log live

Amazon Linux 1

sudo tail -f /var/log/httpd/error_log

Ubuntu 24.04

sudo tail -f /var/log/apache2/error.log

[Sun Nov 01 10:12:03.512 2026] [php7:error] [pid 2481] [client 203.0.113.9:51544] PHP Fatal error: Allowed memory size of 134217728 bytes exhausted in /var/www/html/moodle/lib/dml/moodle_database.php on line 1234

What the output means (one log line, left to right)

`[Sun Nov 01 10:12:03…]`	When it happened.
`[php7:error]`	Which part reported it, and how serious. The name in front varies by server setup.
`[pid 2481]`	The ID number of the Apache process that hit it.
`[client 203.0.113.9…]`	The visitor's IP address.
`PHP Fatal error: …`	The actual problem, and the file and line where it happened. Here: PHP ran out of memory.

MOODLE NOTEBest trick for "it's broken when I click X": start tail -f on the error log, then click X in Moodle. The error appears the moment it happens. Ctrl+C to stop watching.

↑ Back to top

#7grep

READ-ONLYSAME ON BOTH

Finds lines that contain some text and shows only those lines. Works on one file, a whole folder, or the output of another command.

Common uses

`grep "text" file`	Lines in `file` containing `text` (exact case)
`grep -i "text" file`	Ignore upper/lower case
`grep -n "text" file`	Show line numbers too
`grep -c "text" file`	Just count matching lines
`grep -rn "text" folder/`	Search every file in a folder and its subfolders

Example: which site does this Moodle folder belong to?

grep -n wwwroot config.php 7:$CFG->wwwroot = 'https://school.example.com';

What the output means

7 is the line number in the file (from -n). After the colon is the matching line itself.
No output means no line matched. Not an error.

The pipe |: feed one command into another

The | key sends one command's output into grep so you can filter it.

history | grep config.php 212 sudo cp -p config.php config.php.bak-2026-10-30 215 sudo nano config.php

Shows only your past commands that mention config.php.

Where they differ: count PHP fatal errors in the Apache error log

Amazon Linux 1

sudo grep -c "Fatal" /var/log/httpd/error_log

Ubuntu 24.04

sudo grep -c "Fatal" /var/log/apache2/error.log

MOODLE NOTEOther handy config.php lines to grep: dbhost (which RDS database server this site uses), dbname (which database on it), and dataroot (where its moodledata folder is).

↑ Back to top

3 · Finding things and checking space

#8find

READ-ONLYSAME ON BOTH

Searches folders for files by name, size, or age, and lists every match with its full path. Pattern: find WHERE WHAT.

Common uses

`find . -name "*.log"`	Files ending in `.log` here and below (`.` = this folder)
`find /var/log -mtime -1`	Changed in the last day
`find . -mmin -60`	Changed in the last 60 minutes
`sudo find / -xdev -size +500M`	Files bigger than 500 MB on the main disk (`-xdev` = don't wander onto other disks)

Example: where are the Moodle sites on this server?

sudo find /var/www -name config.php -path '*moodle*' /var/www/html/moodle/config.php /var/www/html/moodle2/config.php

What the output means

One line per match: the full path to each file it found.
No output means nothing matched.
Permission denied lines mean it couldn't look in some folders. Add sudo in front.

⚠ CAREFULfind only looks, unless you add -delete or -exec. Those make it change or remove every match, with no undo. Always run it without them first and read the list.

MOODLE NOTEYour Moodle folders may not have "moodle" in the name. If the example finds nothing, drop the -path part, then grep each config.php for wwwroot to see which site it is.

↑ Back to top

#9df

READ-ONLYSAME ON BOTH

Shows how full each disk is. Stands for disk free. The first thing to check when something "suddenly stopped working."

Common uses

`df -h`	Every disk, with easy sizes (G, M)
`df -h /var/www`	Just the disk that folder lives on
`df -i`	Count of files instead of space (see Moodle note)

Example

df -h Filesystem Size Used Avail Use% Mounted on /dev/xvda1 30G 27G 2.6G 92% / /dev/xvdf 100G 61G 40G 61% /data tmpfs 2.0G 0 2.0G 0% /dev/shm

What the output means (one row = one disk)

`Filesystem`	The disk's device name. Ignore `tmpfs` rows; those are memory, not disk.
`Size Used Avail`	Total, used, and still free.
`Use%`	The number to watch. Over 85% plan a fix; at 100% things break.
`Mounted on`	Where that disk shows up. `/` is the main disk.

Where they differ: the main disk's name

Amazon Linux 1

Often /dev/xvda1, or /dev/nvme0n1p1 on newer instance types

Ubuntu 24.04

Usually shows as /dev/root

The name doesn't matter much. Go by Mounted on.

MOODLE NOTEA full disk causes failed uploads, failed backups, and errors on every page that writes a cache file. Check the disk that holds moodledata. Rare twist: Moodle can create so many small cache files that the disk runs out of file slots while space remains. If you see "No space left on device" but df -h looks fine, run df -i and check IUse%.

↑ Back to top

#10du

READ-ONLYSAME ON BOTH

Shows how much space folders and files use. Stands for disk usage. Use it after df says a disk is full, to find out what filled it.

Common uses

`du -sh folder`	Total size of one folder (`-s` = just the total)
`sudo du -sh * \| sort -h`	Size of each item here, smallest to largest
`sudo du -h -d 1 /var \| sort -h`	Size of each folder one level inside `/var`

Example: what's big in moodledata?

cd /var/www/moodledata sudo du -sh * | sort -h 48M sessions 640M cache 980M trashdir 3.1G temp 22G filedir

What the output means

Size on the left, name on the right. With sort -h, the biggest is at the bottom.
On big folders it can take a minute. It's only reading, so let it finish.

MOODLE NOTE Your moodledata path is in config.php (grep dataroot config.php). Inside it:

filedir: every uploaded file. Usually the biggest. Never delete from here by hand; Moodle's database points to these files.
temp, cache, trashdir: working space Moodle cleans up through its scheduled tasks (cron). If they keep growing, check that cron is running.

↑ Back to top

4 · Working with files

#11cp

CHANGES THINGSSAME ON BOTH

Copies a file or folder. Pattern: cp FROM TO. The original stays where it was.

Common uses

`cp file file.bak`	Make a backup copy next to the original. Do this before editing any config file.
`cp -p file file.bak`	Same, but keep the original's owner, permissions, and date
`cp -r folder folder-copy`	Copy a whole folder (`-r` is required for folders)
`cp -i file other`	Ask before overwriting `other` if it exists

Example: back up Moodle's config before editing it

sudo cp -p config.php config.php.bak-$(date +%F) ls -l config.php* -rw-r----- 1 apache apache 1.2K Oct 30 09:12 config.php -rw-r----- 1 apache apache 1.2K Oct 30 09:12 config.php.bak-2026-11-01

What the output means

cp itself prints nothing when it works. The ls afterward proves the copy is there.
$(date +%F) fills in today's date, so each backup gets its own name.
-p kept the owner as apache. Without it, a sudo cp copy is owned by root.
omitting directory means you tried to copy a folder without -r.

⚠ CAREFULIf the destination already exists, cp replaces it silently. Use -i when you're not sure.

MOODLE NOTELeave the dated .bak copy in place until you're sure the change works. If Moodle breaks, copy it back: sudo cp -p config.php.bak-2026-11-01 config.php.

↑ Back to top

#12mv

CHANGES THINGSSAME ON BOTH

Moves a file or folder, or renames it. Pattern: mv FROM TO. Unlike cp, the original is gone from its old spot.

Common uses

`mv old.txt new.txt`	Rename a file
`mv file.txt /tmp/`	Move it into another folder (keeps its name)
`mv folder newname`	Rename a folder (no `-r` needed)
`mv -i old new`	Ask before overwriting `new` if it exists

Example

mv site-backup.sql backups/ ls backups/ site-backup.sql

What the output means

mv prints nothing when it works. Check with ls.
The trailing / on backups/ makes it clear you mean "into that folder." Without it, if backups didn't exist, you'd have renamed the file to backups.

⚠ CAREFULLike cp, mv silently replaces a file that already has the new name.

MOODLE NOTEDon't move or rename a Moodle site's folder or its moodledata folder on a live site. config.php and the Apache site settings both point to those exact paths, so the site breaks until they're updated too.

↑ Back to top

#13rm

CHANGES THINGSSAME ON BOTH

Deletes files or folders. Stands for remove. There is no trash can and no undo.

Common uses

`rm file.txt`	Delete one file
`rm -i *.log`	Ask yes/no for each matching file
`rm -r folder`	Delete a folder and everything inside it
`rm -rf folder`	Same, and never ask. The most dangerous command on this page.

Example: the safe habit, look first, then delete

ls old-*.sql old-2025-01.sql old-2025-02.sql rm old-*.sql

What the output means

Run ls with the exact same pattern first. What ls lists is exactly what rm will delete.
rm prints nothing when it works.
Is a directory means it's a folder; you'd need -r. Stop and double-check first.

Where they differ: when logged in as root

Amazon Linux 1

As root (sudo -i), rm, cp, and mv ask before deleting or overwriting.

Ubuntu 24.04

No question asked. It just does it.

Don't rely on being asked. With sudo rm neither system asks.

⚠ CAREFULNever run rm -rf with / or * unless you've just checked pwd and run ls on the same thing. A stray space (rm -rf / tmp instead of /tmp) can wipe the server.

MOODLE NOTETo free space in Moodle, use Moodle itself: purge caches, and delete old course backups from inside Moodle. Removing files from moodledata/filedir with rm leaves Moodle pointing at files that no longer exist.

↑ Back to top

#14mkdir

CHANGES THINGSSAME ON BOTH

Makes a new, empty folder. Stands for make directory. The safest command in this section: it never overwrites anything.

Common uses

`mkdir backups`	Make `backups` in the current folder
`mkdir -p a/b/c`	Make the whole chain of folders at once; no error if they already exist

Example

sudo mkdir -p /var/www/moodledata2 ls -ld /var/www/moodledata2 drwxr-xr-x 2 root root 4.0K Nov 1 12:05 /var/www/moodledata2

What the output means

mkdir prints nothing when it works.
ls -ld shows the folder itself, not what's inside it. Here the new folder belongs to root, because sudo made it.
File exists means it's already there (use -p to skip that error).

Where they differ: who should own a web folder

Amazon Linux 1

Hand it to Apache: sudo chown apache:apache folder

Ubuntu 24.04

Hand it to Apache: sudo chown www-data:www-data folder

MOODLE NOTEA new moodledata folder made with sudo mkdir is owned by root, so Moodle can't write to it. Change the owner as shown above (more under chown, #16).

↑ Back to top

#15chmod

CHANGES THINGSSAME ON BOTH

Changes who is allowed to read, write, or run a file. Stands for change mode. It doesn't change what's inside the file.

How to read permissions (from ls -l)

type

owner

group

everyone else

r = read w = write (change) x = run it (for folders: go inside) - = not allowed
The example above reads: owner can read and write; group can read; everyone else gets nothing.

The number version: add them up for each of the 3 groups

`4` read `2` write `1` run	So `7` = rwx, `6` = rw-, `5` = r-x, `4` = r--, `0` = ---
`644`	`rw-r--r--` Normal file: owner edits, others read
`640`	`rw-r-----` Private file: everyone else locked out
`755`	`rwxr-xr-x` Normal folder or script
`777`	`rwxrwxrwx` Anyone can change it. Almost never the right fix.

Common uses

`chmod 640 file`	Set exact permissions with numbers
`chmod u+x script.sh`	Add "run" for the owner (user), leave the rest alone
`chmod -R 755 folder`	Apply to a folder and everything inside it (careful: files and folders all get the same)

Example: lock down Moodle's config file

sudo chmod 640 config.php ls -l config.php -rw-r----- 1 apache apache 1.2K Oct 30 09:12 config.php

What the output means

chmod prints nothing when it works. ls -l shows the new permissions.
Operation not permitted means you don't own the file. Put sudo in front.

⚠ CAREFULchmod -R 777 "fixes" permission errors by letting anyone change everything. It's a security hole. The right fix is almost always the correct owner (chown), not wider permissions.

MOODLE NOTEMoodle's code folder only needs to be read by the web server. moodledata must be writable by it. If Moodle says it can't write to moodledata, check the owner with ls -ld and fix it with chown.

↑ Back to top

#16chown

CHANGES THINGSSAME ON BOTH

Changes who owns a file or folder. Stands for change owner. Pattern: chown USER:GROUP file. Almost always needs sudo.

Common uses

`sudo chown user:group file`	Set the owner and group of one file
`sudo chown -R user:group folder`	A folder and everything inside it

Example: give moodledata to the web server

Amazon Linux 1

sudo chown -R apache:apache /var/www/moodledata

Ubuntu 24.04

sudo chown -R www-data:www-data /var/www/moodledata

ls -ld /var/www/moodledata drwxrwx--- 9 apache apache 4.0K Nov 1 12:20 /var/www/moodledata

What the output means

chown prints nothing when it works. ls -ld shows the new owner and group.
invalid user: 'www-data' means you used the Ubuntu name on Amazon Linux 1 (or the other way around). Swap the name.
On a big moodledata, -R can take a few minutes. Let it finish.

⚠ CAREFULCheck the path twice before chown -R. Running it on / or /var by mistake breaks the whole server and is very hard to undo.

MOODLE NOTEGet your real moodledata path from config.php first: grep dataroot config.php. The paths above are just examples.

↑ Back to top

#17nano

CHANGES THINGSSAME ON BOTH

A simple text editor that runs inside the terminal. Opening a file is safe; it only changes when you save.

Example

sudo nano config.php

Keys (^ on nano's bottom bar means the Ctrl key)

`Ctrl+O` then `Enter`	Save ("write Out"). Enter confirms the file name.
`Ctrl+X`	Exit. If you changed something it asks: `Y` save, `N` throw away changes.
`Ctrl+W`	Search ("Where is")
`Ctrl+K` / `Ctrl+U`	Cut a whole line / paste it back
`Ctrl+G`	Help

What you'll see

The file fills the screen. A shortcut bar sits at the bottom.
Modified at the top right means unsaved changes.
[ Read 32 lines ] at the bottom just means it opened fine.
Permission denied when saving means you forgot sudo. Exit without saving and reopen with sudo nano.

Where they differ: nano version

Amazon Linux 1

An old nano. Basic keys above all work. Undo may not be available, so the backup copy matters more.

Ubuntu 24.04

A modern nano. Also has Undo (Alt+U) and line numbers (Alt+N).

MOODLE NOTEBefore editing config.php, back it up with cp. After saving, check for typos with php -l config.php (read-only). No syntax errors detected means it's safe. One missing ; in config.php turns the whole site into a blank page.

↑ Back to top

5 · Server health

#18top

READ-ONLYSAME ON BOTH

A live screen of what's using the CPU and memory right now. Updates every few seconds. Press q to quit.

Example

top top - 12:20:01 up 41 days, 1 user, load average: 0.52, 0.71, 0.66 Tasks: 142 total, 1 running, 141 sleeping, 0 stopped, 0 zombie %Cpu(s): 6.3 us, 1.2 sy, 91.8 id, 0.5 wa, 0.2 st Mem: 3.8G total, 312M free, 2.1G used, 1.4G buff/cache PID USER %CPU %MEM TIME+ COMMAND 2481 apache 9.3 2.5 0:12.33 httpd 2490 apache 7.9 2.4 0:11.02 httpd 3120 apache 5.1 1.9 0:02.10 php

What the output means

`up 41 days`	Time since the last reboot.
`load average`	How busy the server has been over the last 1, 5, and 15 minutes. Compare to the number of CPUs (`nproc` tells you). Load below the CPU count = fine. Well above it = overloaded.
`id`	Idle CPU %. High = relaxed. Near 0 = maxed out.
`wa`	CPU waiting on the disk. High = disk is the bottleneck.
`st`	Stolen by AWS. High on a t2/t3 server usually means it's out of CPU credits.
`Mem`	Memory summary. `free` explains it better.
`%CPU %MEM`	Each program's share. The list is sorted with the busiest at the top.

Keys while it's running

`P` / `M`	Sort by CPU / by Memory (capital letters)
`1`	Show each CPU separately
`q`	Quit
`k`	Kills a program by its PID. The one key that changes things. Don't press it by accident; `Esc` cancels.

Where they differ: program names you'll see

Amazon Linux 1

Apache: httpd
The memory line looks a little different (older top).

Ubuntu 24.04

Apache: apache2
PHP-FPM (if used): php-fpm8.3

MOODLE NOTEWhen a Moodle site is slow, run top first. Lots of busy Apache/PHP entries = many users or a heavy cron run. Apache/PHP entries waiting but CPU mostly idle = the slowdown is probably the database; check the RDS instance in the AWS console. High wa = disk. High st = out of AWS CPU credits.

↑ Back to top

#19free

READ-ONLYSAME ON BOTH

Shows how much memory (RAM) the server has, and how much is still available.

Example

free -h total used free shared buff/cache available Mem: 3.8G 2.1G 312M 48M 1.4G 1.5G Swap: 0B 0B 0B

What the output means

`total`	All the RAM in the server.
`free`	Completely unused. Low is normal; Linux borrows spare memory to speed up the disk.
`buff/cache`	That borrowed memory. Linux gives it back the moment a program needs it.
`available`	The number to watch. What programs can really still get. Under about 10% of total = trouble ahead.
`Swap 0B`	No overflow space on disk. Normal on AWS servers unless you added it.

Where they differ: older format

Amazon Linux 1

Some servers show buffers and cached columns and a -/+ buffers/cache line instead of available. On that line, the free number means the same as available.

Ubuntu 24.04

Always shows the available column, as in the example.

MOODLE NOTEWhen memory runs out, Linux kills the biggest program to survive. That's usually an Apache or PHP process, and users see errors or blank pages. To check if that happened:

Amazon Linux 1

sudo grep -i "killed process" /var/log/messages

Ubuntu 24.04

sudo journalctl -k | grep -i "killed process"

↑ Back to top

#20ps

READ-ONLYSAME ON BOTH

Lists running programs (processes) once, like a snapshot of top. Best combined with grep or head.

Common uses

`ps aux`	Every process on the server (a long list)
`ps aux \| grep cron.php`	Just the ones mentioning `cron.php`. Is Moodle's cron running right now?
`ps aux --sort=-%mem \| head`	Top 10 memory users
`ps aux --sort=-%cpu \| head`	Top 10 CPU users

Example

ps aux | grep cron.php USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND apache 7713 38.0 4.1 612304 168220 ? R 12:20 0:41 php /var/www/html/moodle/admin/cli/cron.php me 9921 0.0 0.0 110512 972 pts/0 S+ 12:22 0:00 grep cron.php

What the output means

`USER`	Who the program runs as.
`PID`	Its ID number. Other commands use this to point at it.
`%CPU %MEM`	Its share of CPU and memory.
`RSS`	Memory it's really using, in KB. 168220 ≈ 165 MB.
`START`	When it started. A cron run that started hours ago is probably stuck.
`COMMAND`	The program itself.

The last line, grep cron.php, is your own search finding itself. Ignore it. If that's the only line, cron isn't running at this moment (normal between runs).
The header line is shown here to explain the columns; with | grep you won't see it.

Where they differ: count the Apache workers

Amazon Linux 1

ps aux | grep -c [h]ttpd

Ubuntu 24.04

ps aux | grep -c [a]pache2

The square brackets are a trick that stops grep from counting itself.

MOODLE NOTERough memory math: number of Apache (or PHP-FPM) workers × the RSS of one worker. If that's more than available memory, a busy day (exams, enrolment) can run the server out of memory. Tuning that limit belongs on the Apache and PHP-FPM sheets.

↑ Back to top

6 · Running the server

#21sudo

DEPENDSSAME ON BOTH

Runs one command as the administrator (root). Put it in front of any command that says Permission denied. It's only as safe as the command after it: sudo less just reads, sudo rm deletes anything.

Common uses

`sudo command`	Run that one command as root
`sudo !!`	Repeat your last command, this time with `sudo`. Handy after a `Permission denied`.
`sudo -u USER command`	Run as some other user instead of root (see Moodle note)
`sudo -i`	Become root until you type `exit`. Your prompt changes to end in `#`. Everything you type is then admin-level.

Example

less /var/log/messages /var/log/messages: Permission denied sudo !! sudo less /var/log/messages

What the output means

sudo !! first prints the command it's about to run, then runs it.
On AWS servers the default login (ec2-user or ubuntu) doesn't need a password for sudo.
is not in the sudoers file means that login isn't allowed to use sudo.
A prompt ending in # instead of $ means you're root. Type exit when done.

Where they differ: running Moodle's command-line scripts

Amazon Linux 1

sudo -u apache php admin/cli/purge_caches.php

Ubuntu 24.04

sudo -u www-data php admin/cli/purge_caches.php

Run from inside the Moodle folder. This one empties Moodle's caches (it changes things, but safely).

MOODLE NOTERun Moodle's admin/cli scripts as the web server user, as above, not as root. A script run as root can leave root-owned files in moodledata that Moodle then can't change, causing odd errors later.

↑ Back to top

#22service / systemctl

DEPENDSDIFFERENT ON EACH

Checks, starts, stops, and restarts the server programs that run in the background (services): Apache, PHP-FPM, cron. This is the biggest difference between the two systems: Amazon Linux 1 uses service; Ubuntu uses systemctl.

The commands side by side (Apache shown)

Task	Amazon Linux 1	Ubuntu 24.04
Is it running? READ-ONLY	`sudo service httpd status`	`systemctl status apache2`
Test config for typos READ-ONLY	`sudo apachectl configtest`	`sudo apachectl configtest`
Reload gently CHANGES THINGS	`sudo service httpd reload`	`sudo systemctl reload apache2`
Full restart CHANGES THINGS	`sudo service httpd restart`	`sudo systemctl restart apache2`
Stop / start CHANGES THINGS	`sudo service httpd stop` `sudo service httpd start`	`sudo systemctl stop apache2` `sudo systemctl start apache2`
Start at boot? READ-ONLY	`chkconfig --list httpd`	`systemctl is-enabled apache2`
Start at boot CHANGES THINGS	`sudo chkconfig httpd on`	`sudo systemctl enable apache2`

Service names

Program	Amazon Linux 1	Ubuntu 24.04
Apache	`httpd`	`apache2`
PHP-FPM (if used)	`php-fpm` (name can include the version)	`php8.3-fpm`
cron (runs Moodle's scheduled tasks)	`crond`	`cron`

What the output means: "Is it running?"

Amazon Linux 1

httpd (pid 2470) is running...
Good. is stopped = it's down.

Ubuntu 24.04

Active: active (running) since Sun 2026-11-01 08:02
Good. inactive (dead) or failed = it's down. The last lines show recent messages. Press q if it doesn't return to the prompt.

Syntax OK from configtest = safe to reload. Anything else = fix the file it names first.
reload, restart, stop, start usually print little or nothing. Check with the status command after.
Ubuntu also accepts sudo service apache2 restart, so that habit still works there.

⚠ CAREFULAlways run configtest before a reload or restart. If the config has a typo, a restart stops Apache and it won't come back up, taking every site on that server down.

MOODLE NOTEAfter changing Apache settings, prefer reload: it picks up the change without cutting off users in the middle of a quiz. Use restart only when reload isn't enough (for example, after updating Apache or PHP itself).

↑ Back to top

#23ssh

READ-ONLYSAME ON BOTH

Logs you in to a server's command line over the internet, securely. You run it on your own computer (Terminal on a Mac, PowerShell on Windows). Logging in changes nothing; what you do once you're in might.

Common uses

`ssh -i key.pem USER@ADDRESS`	Log in using your AWS key file
`exit`	Log out and go back to your own computer
`chmod 400 key.pem`	Lock down a key file so ssh will accept it (on your computer)

Where they differ: the user name

Amazon Linux 1

ssh -i key.pem ec2-user@203.0.113.10

Ubuntu 24.04

ssh -i key.pem ubuntu@203.0.113.10

What the output means

`Are you sure you want to continue connecting (yes/no)?`	First visit to this server. Type `yes`. Your computer remembers it after that.
`Permission denied (publickey)`	Wrong key file, or wrong user name (`ec2-user` vs `ubuntu`).
`UNPROTECTED PRIVATE KEY FILE`	Key file is too open. Run `chmod 400 key.pem` on your computer.
`Connection timed out`	Can't reach it: server is off, wrong address, or the AWS security group doesn't allow your IP on port 22.
`REMOTE HOST IDENTIFICATION HAS CHANGED`	The server at that address isn't the one your computer remembers. Normal if you replaced the server; otherwise stop and find out why.

Shortcut: name your servers

Add entries like this to the file ~/.ssh/config on your own computer:

Host client1 HostName 203.0.113.10 User ec2-user IdentityFile ~/.ssh/client1.pem

Then just type ssh client1.

MOODLE NOTEWith 25 servers, the ~/.ssh/config shortcut pays off fast: one entry per server, named after the client, so you never mix up addresses, keys, or ec2-user vs ubuntu.

↑ Back to top

7 · Help and memory

#24history

READ-ONLYSAME ON BOTH

Lists the commands you've typed on this server, numbered, oldest first. Your memory for "how did I do that last time?"

Common uses

`history \| tail -20`	Your last 20 commands
`history \| grep chown`	Only past commands containing `chown`
`HISTTIMEFORMAT="%F %T " history`	Same list, with the date and time of each command
`Ctrl+R`, then type	Search backward as you type; `Enter` runs the match, `Ctrl+C` cancels
`!388`	Run command number 388 again. Runs instantly, with no chance to check it first.

Example

history | grep chown 388 sudo chown -R apache:apache /var/www/moodledata 512 history | grep chown

What the output means

The number on the left is the command's place in your history. After it is exactly what you typed.
The last line is the search you just ran, so ignore it.
History belongs to one login on one server. Commands typed as root (after sudo -i) are in root's history, not yours.

⚠ CAREFULHistory doesn't care what a command does. !388 or Ctrl+R + Enter will just as happily rerun an rm or a restart. When in doubt, copy the command, read it, then run it.

MOODLE NOTEBefore doing a repair on one server, run history | grep on a server where you've fixed the same thing before. It's a record of exactly what worked, in your own words.

↑ Back to top

#25man

READ-ONLYSAME ON BOTH

Opens the built-in manual for a command. Stands for manual. Thorough but dense; often --help is quicker.

Common uses

`man ls`	The full manual for `ls`
`ls --help`	A shorter summary printed right to the screen (works for most commands)
`man -k disk`	Don't know the command's name? List every manual mentioning "disk"

What you'll see: the sections of a manual page

`NAME`	The command and a one-line description.
`SYNOPSIS`	How to type it. Parts in `[ ]` are optional; `...` means "you can give more than one."
`DESCRIPTION` / `OPTIONS`	What it does, and what each `-letter` option means.
`EXAMPLES`	Real uses, when the page has them. Search for it with `/EXAMPLES`.

It opens in the same viewer as less: Space to page down, /word to search, q to quit.
No manual entry for … means that page isn't installed. Try command --help instead.

MOODLE NOTEMoodle's command-line scripts don't have man pages, but most explain themselves with --help. From inside the Moodle folder on Amazon Linux 1: sudo -u apache php admin/cli/purge_caches.php --help (use www-data on Ubuntu).

↑ Back to top

1 · Getting around

#1pwd

#2cd

Amazon Linux 1

Ubuntu 24.04

#3ls

Amazon Linux 1

Ubuntu 24.04

2 · Reading files

#4cat

Amazon Linux 1

Ubuntu 24.04

#5less

Amazon Linux 1

Ubuntu 24.04

#6tail

Amazon Linux 1

Ubuntu 24.04

#7grep

Amazon Linux 1

Ubuntu 24.04

3 · Finding things and checking space

#8find

#9df

Amazon Linux 1

Ubuntu 24.04

#10du

4 · Working with files

#11cp

#12mv

#13rm

Amazon Linux 1

Ubuntu 24.04

#14mkdir

Amazon Linux 1

Ubuntu 24.04

#15chmod

#16chown

Amazon Linux 1

Ubuntu 24.04

#17nano

Amazon Linux 1

Ubuntu 24.04

5 · Server health

#18top

Amazon Linux 1

Ubuntu 24.04

#19free

Amazon Linux 1

Ubuntu 24.04

Amazon Linux 1

Ubuntu 24.04

#20ps

Amazon Linux 1

Ubuntu 24.04

6 · Running the server

#21sudo

Amazon Linux 1

Ubuntu 24.04

#22service / systemctl

Amazon Linux 1

Ubuntu 24.04

#23ssh

Amazon Linux 1

Ubuntu 24.04

7 · Help and memory

#24history

#25man