Best Linux Sysadmin Tools: 20 Utilities Every Administrator Should Know

Key takeaways

• Master the built-in tools first: systemctl, journalctl, ss, ip, df, top and dnf appear in daily work and in RHCSA practice.
• Automate with Ansible: it is agentless and is the base of RHCE.
• Monitoring needs a choice: Zabbix, Nagios and Prometheus with Grafana are the common open-source options.
• Security basics are firewalld, SELinux and regular scans of your own systems with nmap.
• CentOS Linux is end-of-life, so use RHEL, Rocky Linux, AlmaLinux or CentOS Stream for practice.

Which tools should a Linux sysadmin learn first?

Start with what ships in the box. Most troubleshooting needs systemctl, journalctl, ss, ip, df and du, top and your package manager. Third-party tools come second. For practice use Red Hat Enterprise Linux (the free developer subscription is available from Red Hat), Rocky Linux or AlmaLinux. CentOS Linux reached end-of-life, so do not build a new lab on it. CentOS Stream is a different, continuing project.

Quick comparison

Automation and configuration

Ansible

Ansible pushes tasks over SSH using YAML playbooks, with no agent on managed hosts. Try ansible all -m ping -i inventory to test connectivity. It is the core of the RHCE exam, and the Ansible documentation is the reference to learn from.

Puppet

Puppet uses agents that pull a desired state from a server. It suits large fleets that need continuous enforcement.

Cockpit and Webmin

Cockpit is the web console in the RHEL family, useful for services, storage, networking and logs. Webmin is a long-standing web admin tool. Web tools are friendly, but learn the commands underneath, because exams and incidents use the terminal.

Monitoring and metrics

Zabbix and Nagios check hosts and services and send alerts. Prometheus collects metrics and pairs with Grafana for dashboards. Monit watches a process and restarts it if it fails. Pick one primary monitoring system and learn it well instead of installing all of them.

Performance and resources

• htop shows live CPU, memory and processes, and lets you sort and kill.
• vmstat 2 and iostat -x 2 reveal memory pressure and disk waits.
• sar (from sysstat) keeps history so you can see what happened last night.
• nmon gives a compact performance view.
• lsof -i :80 shows what holds a port, and lsof +L1 finds deleted files still using space.

Networking and security

• ss -tulpn lists listening ports and their processes, and has replaced older netstat for most work.
• ip addr and ip route show interfaces and routes. Use nmcli to change NetworkManager settings.
• tcpdump -i eth0 port 53 captures DNS traffic for diagnosis.
• nmap on your own servers shows what is exposed. Scan only systems you own or manage with permission. See the Nmap reference guide.
• firewall-cmd --list-all shows firewalld zones and services.
• sestatus and ausearch -m avc -ts recent show SELinux state and denials. Never fix problems by disabling SELinux without understanding the denial.

Logs, files and sessions

journalctl -u sshd --since "1 hour ago" reads systemd logs for one service. rsync -avh --progress /data/ backup:/data/ copies efficiently. tmux keeps sessions alive if your SSH connection drops.

Which tools matter for RHCSA?

RHCSA is a practical exam on the command line, so the built-in tools matter most: systemctl, journalctl, ss, nmcli, firewall-cmd, SELinux commands, LVM tools, dnf and basic scripting. Ansible moves up to the RHCE exam. Related reading: Linux system admin interview questions, network engineer tools and network tools for monitoring.

Common mistakes

• Installing a heavy monitoring stack before you understand top and journalctl.
• Disabling SELinux or the firewall to "make it work".
• Running tools as root on production without testing first.
• Using CentOS Linux 7 or 8 for new labs.

Next steps

Next steps: to practise these tools in a guided lab, see our RHCSA EX200 course and the Linux automation with Ansible course.