Useful Server Management Commands: htop, df/du, journalctl, ufw, rsync, cron

Once you've learned the basic Linux commands, the next step is keeping the server healthy. A server administrator's daily work mostly comes down to answering a few questions: Why is the server slow? Why is the disk full? Why did the service stop? Are my backups being taken regularly? In this article we explain six tools that answer these questions, using real-world scenarios on Ubuntu 24.04.

htop: Why is the server slow?

top is available on every Linux system, but htop is far more readable: it offers colored bars, mouse selection, easy sorting and a process tree.

sudo apt install -y htop
htop

At the top of the screen you'll see:

• CPU bars: The utilization of each core. If all bars are constantly full, the CPU may not be keeping up.
• Mem and Swp: RAM and swap usage. If swap is constantly full, RAM is insufficient and the server slows down by writing to disk.
• Load average: The average load over the last 1, 5 and 15 minutes. Roughly speaking, values that consistently exceed the number of cores indicate work waiting in a queue.

Handy shortcuts:

Tip: You may see values above 100% in htop's CPU% column; this means the process is using more than one core.

For a quick look at the current RAM situation, free -h is enough. The available column shows the memory applications can actually use; a low value in the free column isn't a problem on its own, because Linux uses spare memory as cache.

df and du: Why is the disk full?

When the disk fills up, databases can't write, logs get cut off and websites start throwing errors. First look at the big picture:

df -h

If a partition's Use% column is above 90%, use du to find what's taking up the space:

sudo du -h --max-depth=1 / 2>/dev/null | sort -h

This command sorts the total size of each folder in the root directory from smallest to largest. Go into the largest folder and repeat the same command; you'll find the culprit in a few steps:

sudo du -h --max-depth=1 /var | sort -h
sudo du -h --max-depth=1 /var/log | sort -h

The most common causes and their fixes:

sudo journalctl --vacuum-size=200M   # systemd günlüklerini 200 MB'a indirir
sudo apt clean                        # indirilmiş paket önbelleğini siler
docker system df                      # Docker kullanıyorsanız imaj/volume boyutları

(Shrink systemd logs to 200 MB, clear the downloaded package cache, and show image/volume sizes if you use Docker.)

Sometimes df says the disk is full but du can't find that many files. This is usually caused by a file that has been deleted but is still held open by a process. You can see these files with sudo lsof +L1 and recover the space by restarting the relevant service. If you can't create files even though the disk doesn't look full, check inode usage with df -i.

journalctl: Why did the service crash?

On Ubuntu, most services write their logs to systemd's journal. journalctl reads these records:

journalctl -u nginx                 # yalnızca nginx servisinin kayıtları
journalctl -u nginx -n 100 --no-pager   # son 100 satır
journalctl -u myapp -f              # canlı izleme (tail -f gibi)
journalctl --since "1 hour ago"     # son bir saatteki tüm kayıtlar
journalctl -p err -b                # bu açılıştan beri yalnızca hatalar
journalctl -b -1                    # bir önceki açılışın kayıtları

(Logs for the nginx service only, the last 100 lines, live following like tail -f, everything from the last hour, only errors since this boot, and the logs of the previous boot.)

If a service isn't running, do the following in order: check its state with systemctl status servis-adi, then read the latest error messages with journalctl -u servis-adi -n 50. The first line of the error message often tells you the problem directly: a missing file, a port already in use, a faulty configuration line and so on.

Nginx and some databases also write to their own files; these live in folders like /var/log/nginx/ and are followed with tail -f.

If you want to permanently limit how much space the logs take, add the line SystemMaxUse=500M to /etc/systemd/journald.conf and run sudo systemctl restart systemd-journald.

ufw: Which ports are open?

UFW (Uncomplicated Firewall) lets you manage Ubuntu's firewall with simple commands.

Important: Always allow SSH before enabling UFW. Otherwise your connection will drop and you'll only be able to reach the server through the panel's console.

sudo ufw allow OpenSSH          # SSH (22) portuna izin
sudo ufw allow 80,443/tcp       # web trafiği
sudo ufw enable
sudo ufw status numbered        # kuralları numaralı listeler

(Allow SSH on port 22, allow web traffic, enable the firewall, and list the rules with numbers.)

Other commonly used rules:

sudo ufw allow from 203.0.113.10 to any port 5432   # PostgreSQL'e yalnızca bir IP erişsin
sudo ufw deny 3306/tcp                               # MySQL portunu dışarıya kapat
sudo ufw delete 3                                    # 3 numaralı kuralı sil
sudo ufw limit OpenSSH                               # çok sık bağlantı denemelerini sınırla

(Let only one IP reach PostgreSQL, close the MySQL port to the outside, delete rule number 3, and rate-limit overly frequent SSH connection attempts.)

If you've changed the SSH port, write the new port number instead of OpenSSH (sudo ufw allow 2222/tcp). For more thorough hardening steps, see our Linux server security guide.

rsync: Copying and backing up files safely

rsync copies files locally or over SSH to another machine. Its biggest advantage is that it transfers only the parts that have changed; the second copy finishes very quickly.

rsync -avh /var/www/ /yedek/www/                        # yerel kopya
rsync -avh /var/www/ [email protected]:/yedek/www/ # başka sunucuya
rsync -avh --delete /var/www/ /yedek/www/              # kaynakta silineni hedefte de sil
rsync -avh --dry-run --delete /var/www/ /yedek/www/    # önce ne yapacağını göster

(A local copy, a copy to another server, deleting on the destination what was deleted at the source, and a dry run showing what would happen first.)

Parameters: -a preserves permissions, ownership and timestamps; -v shows details; -h prints sizes in a readable form. With --exclude you can leave out folders you don't want:

rsync -avh --exclude 'node_modules' --exclude '.cache' /srv/proje/ /yedek/proje/

Watch the trailing slash: /var/www/ copies the folder's contents, while /var/www copies the folder itself. This difference matters when using --delete; if you're not sure, try it first with --dry-run.

Copying database files directly while the service is running can produce an inconsistent backup. Take a dump with mysqldump or pg_dump first, then transfer that file with rsync.

cron: Scheduling tasks

cron runs commands automatically at set intervals. To edit your own user's task list:

crontab -e

Each line consists of five time fields and a command: minute, hour, day of month, month, day of week.

# Her gece 03:00'te web dosyalarını yedekle
0 3 * * * rsync -a --delete /var/www/ /yedek/www/ >> /var/log/yedek.log 2>&1

# Her 15 dakikada bir betik çalıştır
*/15 * * * * /usr/local/bin/kontrol.sh

# Her pazartesi 09:30'da
30 9 * * 1 /usr/local/bin/haftalik-rapor.sh

(Back up the web files every night at 03:00, run a script every 15 minutes, and run a weekly report every Monday at 09:30.)

Good habits:

• Use full paths in commands; cron's PATH variable is shorter than the one in your session.
• Redirect output to a file (>> dosya.log 2>&1), otherwise errors disappear silently.
• Check your schedule with a tool like crontab.guru before writing it.
• List existing tasks with crontab -l. You can see whether cron is running jobs with journalctl -u cron.

As a modern alternative, systemd timers can also be used; their logs show up in journalctl and they can catch up on missed runs. Still, for simple jobs cron remains the most practical option.

A quick checklist

When something goes wrong on the server, following this order is usually enough:

1. htop and free -h: CPU and RAM status
2. df -h: disk usage
3. systemctl status servis and journalctl -u servis: service status and error message
4. sudo ufw status: firewall rules, if there's an access problem

In the TürkiyeVPS customer panel you can also track your VPS server's resource usage and monthly traffic; used together with these command-line tools, it becomes easier to find the source of problems.

Frequently Asked Questions

What's the difference between htop and top?

Both show running processes and resource usage. htop is colorful and interactive: it offers mouse selection, easy sorting, filtering and a tree view. top, on the other hand, comes installed on every system.

Why do df and du give different results?

df measures the overall usage of the file system, while du measures the total size of the files in folders. Files that have been deleted but are still held open keep taking up space in df but don't appear in du. Restarting the relevant service recovers the space.

What's the difference between rsync and scp?

scp copies files from scratch every time. rsync transfers only the parts that have changed, can resume an interrupted transfer and offers synchronization options such as deletion and exclusion. rsync is better suited for regular backups.

My cron job isn't running. How do I check?

First make sure the job is registered with crontab -l. Then check whether cron started the job with journalctl -u cron. Most problems come from not using full paths in the command or the script not having execute permission.