25 Bash One-Liners Every Developer Should Know

2026-06-25 — 8 min read

You've used this command before. Was the flag before or after the pattern? You Google it, find a Stack Overflow thread from 2011, and twenty minutes later you're still not sure if the macOS version works the same way.

This is that reference page — organized by what you're actually trying to do, with enough explanation that the command sticks.

1. Finding Files & Text

List files modified in the last 24 hours

find . -type f -mtime -1

The -1 means "less than 1 day old." Use +7 for "older than 7 days." Combine with -name "*.log" to filter by extension.

Find large files eating your disk

find . -type f -size +50M -exec ls -lh {} \;

The -exec ls -lh shows human-readable sizes alongside paths. Swap 50M for 1G to find gigabyte files. Add | sort -k5 -h to sort by size.

Search all files for a pattern

grep -rn "TODO\|FIXME\|HACK" --include="*.py" .

-r recurses, -n shows line numbers. The \| is OR in basic grep — use | in grep -E. Add --color=always to highlight matches.

Find which files contain a function name

grep -rl "handlePayment" . --include="*.js"

-l prints only filenames. Good for orientation — use it before opening anything to know where the code actually lives.

Count occurrences across a codebase

grep -r "console.log" . --include="*.js" | wc -l

Useful before a cleanup pass to set a baseline, then again after to confirm progress.

2. Processing Text

Top 10 most frequent lines in a file

sort access.log | uniq -c | sort -rn | head -10

uniq -c prefixes each line with its count. This pattern works on anything: error logs, IP addresses, user agents. One of the most reusable pipelines in bash.

Sum a column of numbers

awk '{sum += $1} END {print sum}' numbers.txt

$1 is the first whitespace-delimited field. Use $2, $3, etc. for other columns. Add printf "%.2f\n", sum to format decimals.

Replace text across multiple files

find . -name "*.yaml" | xargs sed -i.bak 's/old-url/new-url/g'

The .bak extension creates backups before editing — essential on macOS where sed -i alone fails. Test first by dropping -i.bak to preview the output.

Extract a CSV column and find unique values

cut -d',' -f3 data.csv | sort | uniq

-d',' sets the delimiter, -f3 extracts field 3. Add | wc -l to count distinct values. For quoted CSVs with embedded commas, use awk -F',' instead.

Count lines in each file, ranked

wc -l *.py | sort -rn

A quick way to find which files are growing too large before a refactor review. Replace *.py with **/*.go using find . -name "*.go" | xargs wc -l if you need recursion.

3. System & Processes

What is running on a port

lsof -i :3000

Shows the process name, PID, and user. On Linux you may need sudo. Use ss -tlnp | grep :3000 as an alternative if lsof isn't installed.

Kill whatever is on a port

kill $(lsof -t -i:3000)

lsof -t returns only the PID. The $() passes it to kill. Use kill -9 only if the process ignores SIGTERM — it skips cleanup handlers.

Top memory consumers

ps aux --sort=-%mem | head -10

Replace %mem with %cpu for CPU hogs. On macOS, use ps aux -m | head -10 instead — the --sort flag syntax differs.

Directory sizes, sorted

du -sh */ | sort -h

-s summarizes (don't recurse into subdirs), -h is human-readable. sort -h understands K/M/G suffixes. Run from your home directory to find where your disk went.

Filesystems above 60% full

df -h | awk 'NR>1 && $5+0 > 60 {print $5, $6}'

$5+0 strips the % sign and converts to a number. NR>1 skips the header row.

4. Networking & HTTP

Check response time and status code

curl -w "\n%{http_code} in %{time_total}s\n" -o /dev/null -s https://example.com

-o /dev/null discards the body, -s silences the progress bar, -w formats the output. Add %{size_download} to also log response size.

Pretty-print a JSON API response

curl -s https://api.github.com/users/torvalds | python3 -m json.tool

python3 -m json.tool is available everywhere Python is — no extra install needed. If you have jq: curl -s URL | jq . is faster and lets you filter fields.

Monitor an endpoint while deploying

watch -n 3 'curl -s -o /dev/null -w "%{http_code}" http://localhost:3000/health'

Refreshes every 3 seconds. Watch the status code flip from 000 (connection refused) to 200 as the service starts. Press Ctrl-C when it's up.

Check if a remote port is open

nc -zv hostname 443

-z scans without sending data, -v gives verbose output. Returns immediately. Useful for diagnosing firewall rules before debugging your app.

Download a list of URLs in parallel

cat urls.txt | xargs -P4 -I{} curl -sO {}

-P4 runs 4 downloads at once. -I{} substitutes each line as {}. Adjust -P based on your bandwidth and the server's rate limits.

5. Git

Visual branch history

git log --oneline --graph --all --decorate

The most underused git command. Shows branch topology inline with commit messages. Run it after a merge or rebase to confirm the history looks right.

What changed in the last commit

git diff HEAD~1 --stat

--stat shows files and line change counts. Drop it for the full diff. Use HEAD~3 to look back 3 commits.

Your commits this week

git log --author="$(git config user.name)" --since="7 days ago" --oneline

git config user.name pulls your name from git config automatically. Useful for writing a standup or weekly summary without opening GitHub.

Find when a line was introduced (the pickaxe)

git log -S "search_term" --oneline

The -S flag finds commits where the string was added or removed — not just touched. Essential for debugging: "when was this function added and who wrote it?"

Delete branches already merged to main

git branch --merged main | grep -v "^\*\|^  main$" | xargs git branch -d

--merged main lists branches fully merged into main. The grep -v excludes main itself and the currently checked-out branch. Run git fetch -p first to prune remote-tracking refs.

---

That covers the patterns I reach for most often. Bookmark this or curl it — no JavaScript, no tracking, always loads fast.

Next: shell aliases that collapse the ones you use every day into two keystrokes.