Essential CLI: The SysAdmin's Daily Toolkit¶
When production is wobbling, CLI is your fastest path to truth. This is the daily toolkit I reach for in high-traffic Linux environments, plus the panel-specific shortcuts that save minutes (and sometimes reputations).
Note
Examples assume root or sudo -i. In panel environments, prefer the panel’s native service scripts where they exist (they often do extra housekeeping vs a raw systemctl restart).
System Health¶
uptime¶
Why use this? Instant read on load averages and how long the box has been stable (or not).
Pro-Tip (panel users): If load is high, correlate quickly with panel daemons:
- Enhance: journalctl -u orchd is a first stop for platform-side signals.
- cPanel: use the cPanel restart scripts for services when you take action, not just raw systemd.
top¶
Why use this? Fast, always-there process triage: CPU hogs, runaway memory, I/O wait symptoms.
Pro-Tip (panel users): If you see web stack workers spiking:
- cPanel: restart Apache via /scripts/restartsrv_httpd (keeps cPanel expectations aligned).
- Plesk: service restarts can be done via plesk bin service --restart <service>.
htop¶
Why use this? Human-friendly top with tree view and easy sorting (great under pressure).
Pro-Tip (panel users): On minimal installs it may not exist; install it once and forget:
- Debian/Ubuntu: apt install htop
- RHEL-based: dnf install htop
If you’re inside Enhance customer context, you may be operating as the website user, which is exactly where you want to be for app-level triage.
free -m¶
Why use this? Clear memory picture. “Free RAM” is not the goal. Available is what matters.
Pro-Tip (panel users): If memory pressure is real, check what’s swapping and who is responsible before restarting anything. Panels tend to amplify memory issues via stacked services (web, mail, DB).
vmstat¶
Why use this? Quick pulse on CPU, run queue, swapping, and I/O wait without heavy tooling.
Pro-Tip (panel users): If you see sustained wa (I/O wait), jump straight to storage checks (df, du) and noisy logs. In Plesk, domain logs often live under vhosts paths, so disk spikes can be log-driven.
Storage and Filesystems¶
df -hT¶
Why use this? Disk-full incidents are classic. This shows usage and filesystem type in one shot.
Pro-Tip (panel users):
- cPanel: know your log hotspots; cPanel-specific logs commonly live under /usr/local/cpanel/logs/.
- aaPanel: site logs commonly land under /www/wwwlogs/ and can bloat fast.
du¶
Why use this? Finds what’s eating disk right now. Critical during “disk 100%” firefights.
# biggest directories in current path (stays on same filesystem)
du -xhd1 . | sort -h
# quick size of a suspect path
du -sh /var/log
Pro-Tip (panel users):
- Enhance: website logs exist but are short-lived and stored under /var/local/enhance/webserver_logs/{uuid}.log.
- Plesk: web logs can be under /var/www/vhosts/<domain>/statistics/logs/ depending on stack and config.
lsblk -f¶
Why use this? Maps disks, partitions, mounts, and filesystems. Essential during storage incidents.
Pro-Tip (panel users): If you’re adding storage to fix a full disk, remember that panel services may assume specific paths. Move or mount carefully and validate with a controlled restart sequence.
Process and Service Control¶
systemctl¶
Why use this? The modern way to check and manage services on systemd systems.
Pro-Tip (panel users):
- cPanel: prefer /usr/local/cpanel/scripts/restartsrv_<service> because it can do more than systemctl in a cPanel-managed environment.
- Plesk: plesk bin service --restart <service> keeps it consistent with Plesk service management.
ps¶
Why use this? When you need exact command lines, parents, and ownership fast.
Pro-Tip (panel users): In multi-tenant hosting, always confirm the user behind a process before acting. Killing the wrong PHP pool can become an avoidable outage.
kill¶
Why use this? Stop a runaway process when it’s actively harming stability.
Warning
Use -KILL as last resort. It bypasses cleanup and can corrupt state (databases, mail queues, caches).
Pro-Tip (panel users): If the runaway process is a managed service, restart via panel-native tooling (cPanel restartsrv, Plesk plesk bin service, aaPanel service controls) instead of playing whack-a-mole.
Log Analysis¶
tail¶
Why use this? Live view into what is breaking right now.
Pro-Tip (panel users): Common places to tail during incidents:
- cPanel Exim: /var/log/exim_mainlog (plus reject/panic logs).
- Plesk panel logs: commonly under /var/log/sw-cp-server/ and /var/log/plesk/.
- Enhance control-plane: journalctl -u orchd (and on source servers journalctl -u appcd).
- aaPanel web logs: /www/wwwlogs/error_log and /www/wwwlogs/access_log.
grep¶
Why use this? Fast pattern match across massive logs. The classic “find the needle now”.
# find 500 errors in a log
grep -n " 500 " /var/log/nginx/access.log | tail -n 50
# case-insensitive search
grep -Rni "permission denied" /var/log | head
Pro-Tip (panel users):
- Enhance: website log path uses the website UUID: /var/local/enhance/webserver_logs/{uuid}.log.
- cPanel: if you need cPanel/WHM UI traffic logs, start under /usr/local/cpanel/logs/.
journalctl¶
Why use this? The truth for systemd services. Great for “service is up but broken” cases.
Pro-Tip (panel users):
- Enhance: backup and orchestration signals often show in journalctl -u orchd (and appcd on source servers).
- aaPanel: avoid running disruptive bt actions inside the panel’s own terminal since you can lock yourself out. Use SSH.
Network and Connectivity¶
ss¶
Why use this? Modern replacement for netstat. Shows listeners and active sockets fast.
Pro-Tip (panel users): If ports look correct but the panel is unreachable, check panel-specific service state (Plesk service, aaPanel bt status, cPanel cpsrvd) before you assume firewall.
ip¶
Why use this? Reliable interface, address, and routing inspection.
Pro-Tip (panel users): Panel migrations and clustered setups (especially Enhance) can have multiple service roles. Validate routing before chasing app ghosts.
dig¶
Why use this? DNS verification, instantly. Essential for mail delivery, SSL validation, and domain cutovers.
Pro-Tip (panel users): When debugging mail deliverability, align DNS results with the panel’s mail stack logs (Exim on cPanel, mail logs paths differ on Plesk by OS and config).
curl¶
Why use this? Confirms HTTP status, headers, redirects, and TLS behavior without a browser.
Pro-Tip (panel users): If the site works externally but not locally, test loopback too: curl -I http://127.0.0.1 and check the web server logs where your panel stores them (cPanel typical Apache logs vs Plesk vhosts logs).
Permissions and Ownership¶
chmod¶
Why use this? Fixes execution and access issues. Mis-set perms cause 403s, broken scripts, and failed backups.
# common safe defaults for a web root
find /var/www/html -type d -exec chmod 755 {} \;
find /var/www/html -type f -exec chmod 644 {} \;
Warning
Recursive permission changes can break apps. Don’t run chmod -R blindly on a production account.
Pro-Tip (panel users):
- Plesk: if a subscription’s docroot perms are mangled, plesk repair fs -y <domain> is the structured fix path.
- Enhance: backups run as the website user, so root-owned files inside a site can cause failures.
chown¶
Why use this? Ownership mistakes are silent killers, especially in shared hosting.
Warning
chown -R is dangerous. One wrong path and you just rewired your server’s security model.
Pro-Tip (panel users):
- cPanel: incorrect ownership inside /home/<user>/public_html is a common self-inflicted outage pattern. Confirm user and group before changing anything.
- Enhance: validate you’re operating as the website user when debugging app-level permissions (su - <customer_username>).
Sticky bit¶
Why use this? Protects shared writable directories like /tmp so users cannot delete each other’s files.
Pro-Tip (panel users): If a panel service starts failing mysteriously after “hardening”, double-check /tmp and other shared dirs. Overzealous permission tightening is a classic cause of cascading failures.
Panel Specifics: cPanel/WHM, Plesk, Enhance, aaPanel¶
cPanel: /usr/local/cpanel/scripts/restartsrv_*¶
Why use this? It’s the panel-aware way to restart services when WHM is unhappy or you need CLI control.
# restart Apache (httpd)
/scripts/restartsrv_httpd
# restart Exim
/usr/local/cpanel/scripts/restartsrv_exim
Pro-Tip (panel users): cPanel documents this pattern: /usr/local/cpanel/scripts/restartsrv_<service>.
cPanel Mail: Exim queue basics¶
Why use this? If mail is delayed, bouncing, or flooding, queue visibility is step one.
Pro-Tip (panel users): Exim queue management commands are covered in cPanel’s docs, and the primary logs live under /var/log/exim_*.
Plesk: plesk bin service¶
Why use this? Plesk-managed service control with consistent naming and behavior.
# restart DNS service in Plesk
plesk bin service --restart dns
# restart nginx (example)
plesk bin service --restart nginx
Pro-Tip (panel users): This is straight from Plesk CLI documentation for service management.
Plesk: plesk repair fs¶
Why use this? Fixes permissions and filesystem structure issues for system files and virtual hosts in a supported way.
# diagnose a domain
plesk repair fs -n -verbose example.com
# repair a domain
plesk repair fs -y example.com
Pro-Tip (panel users): Use repair mode intentionally. It can reconfigure components and increase load on busy servers.
Enhance: journalctl -u orchd and website logs¶
Why use this? Enhance runs core services under systemd, and orchd is a key control-plane signal source.
# control panel server
journalctl -u orchd --since "60 min ago" --no-pager
# source server (where apps run)
journalctl -u appcd --since "60 min ago" --no-pager
Pro-Tip (panel users):
- Enhance documentation calls out these units for log viewing.
- Website access logs are stored at /var/local/enhance/webserver_logs/{uuid}.log (UUID is visible in the website management URL).
Enhance: enter a website container context (customer SSH model)¶
Why use this? App troubleshooting is cleaner when you’re operating in the website user context.
Pro-Tip (panel users): This is the documented workflow for entering the website container/user context in Enhance.
aaPanel: bt¶
Why use this? bt is aaPanel’s built-in CLI for core panel operations like start/stop/restart.
Warning
Do not run bt stop/restart from aaPanel’s embedded terminal if you’re not prepared to lose access. Use SSH for safety.
Pro-Tip (panel users): aaPanel documents these bt command mappings directly.
aaPanel: log locations that matter¶
Why use this? When you need the actual file, not a UI view.
Pro-Tip (panel users): aaPanel’s docs list /www/wwwlogs/error_log and /www/wwwlogs/access_log as standard log locations.
Summary: the 60-second incident flow¶
- Load + memory:
uptime,top,free -m - Disk:
df -hT,du -xhd1 - Logs:
journalctl -u <service>,tail -f,grep - Network:
ss -lntp,dig,curl -I - Fix: restart via panel-native tooling where applicable (cPanel
restartsrv_*, Pleskplesk bin service, aaPanelbt, Enhancejournalctlsignals)
Related Articles¶
- How to connect to your server via SSH
- How to read and rotate log files safely (logrotate basics)
- Service restart playbooks for cPanel, Plesk, Enhance, and aaPanel
- DNS troubleshooting: SPF, DKIM, DMARC and email deliverability