System info & monitoring

df, du, free, uname, uptime, date, who.

When you land on a server, a handful of commands tell you what it is, how it is doing, and who is on it. These are your orientation and troubleshooting toolkit — the first things you run when a box is slow, full, or behaving strangely, and the quickest way to get your bearings on an unfamiliar host.

df and du — disk space

A full disk breaks everything, so these two are essential. df ("disk free") shows how full each filesystem is — df -h in human-readable units is the one you want, and you read the "Use%" column. du ("disk usage") shows how much space files and directories take; du -sh * summarizes each item in the current directory, which is how you hunt down what is eating the disk once df tells you a partition is full.

$ df -h
Filesystem      Size  Used Avail Use% Mounted on
/dev/sda1        50G   47G  2.1G  96% /            # 96% — nearly full!
/dev/sdb1       100G   12G   83G  13% /var/log
$ du -sh /var/log/* | sort -rh | head -3     # what is biggest under /var/log?
8.2G  /var/log/journal
1.1G  /var/log/nginx
412M  /var/log/app

free — memory

free -h shows memory usage in human-readable units: total, used, free, and — the number people misread — "available", which is the memory actually available for new programs (Linux uses spare RAM for cache, so "free" looks low but "available" is the real figure). It also shows swap. When a server feels sluggish, free tells you whether it is out of memory.

$ free -h
               total        used        free      shared  buff/cache   available
Mem:            7.7Gi       2.1Gi       1.2Gi       112Mi       4.4Gi       5.3Gi
Swap:           2.0Gi          0B       2.0Gi
#   the number that matters for "can I run more?" is "available" (5.3Gi), not "free"

uname, uptime, date — what and how long

uname -a prints the kernel and system identity (useful for knowing the OS and kernel version — which, from the security course, tells you what to patch). uptime shows how long the machine has been running and the load average (three numbers: 1, 5, and 15-minute average of how busy the CPU queue is). date prints or sets the current time. These orient you the moment you connect.

$ uname -a
Linux web-01 5.15.0-89-generic #99-Ubuntu SMP x86_64 GNU/Linux
$ uptime
 10:42:15 up 37 days,  4:20,  2 users,  load average: 0.15, 0.22, 0.19
#                                                       └ 1m   └ 5m   └ 15m load
$ date
Fri Jul  3 10:42:15 UTC 2026

who, w, id, history — people and identity

who lists who is logged in; w adds what each of them is doing. id shows your user, groups, and UID (the identity that decides your permissions). history prints the commands you have run — handy for recall, and also a record worth remembering exists (an attacker’s commands land here too, until they clear it). Together these answer "who am I, who else is here, and what has been done?"

$ whoami
deploy
$ id
uid=1000(deploy) gid=1000(deploy) groups=1000(deploy),27(sudo)
$ who
deploy   pts/0        Jul  3 10:14 (10.0.1.5)
admin    pts/1        Jul  3 10:40 (10.0.1.9)
$ history | tail -3
  511  df -h
  512  du -sh /var/log/*
  513  systemctl restart nginx