Linux system administrator's guide: the daily jobs, done today

Updated November 2026

A Linux administrator's routine has not changed much in thirty years: look after users, disks, services, logs, scheduled jobs, backups and updates. The tools have. On every major distribution today, systemd starts the services, keeps the logs and runs the timers. This page walks through each job with the commands that work on Debian 13, Ubuntu 24.04 and 26.04 LTS, Fedora, RHEL 9 and 10 (and Alma and Rocky), Arch and openSUSE, as of November 2026.

The classic Linux System Administrator's Guide from the early 2000s is kept by the Linux Documentation Project at tldp.org/LDP/sag. It describes SysV init, LILO and syslog, which most systems no longer use, so read it for background only.

Users, groups and sudo

Each person who logs in should have their own account. Nobody should work as root all day; give admins sudo instead, so every privileged command is logged with the name of the person who ran it.

sudo useradd -m -s /bin/bash -c "Ana Silva" ana   # -m creates /home/ana
sudo passwd ana                                    # set a first password
id ana                                             # show uid, gid and groups

Debian and Ubuntu also ship adduser, a friendlier front end that asks for the password and full name. To give a user admin rights, add them to the admin group. The name differs by family:

Admin group for sudo
DistributionGroupCommand
Debian, Ubuntusudosudo usermod -aG sudo ana
Fedora, RHEL, Alma, Rocky, Arch (once enabled in sudoers)wheelsudo usermod -aG wheel ana

The -a matters: usermod -G without it replaces the user's supplementary groups. Group changes take effect at the next login.

Never edit /etc/sudoers with a plain editor. Put local rules in a file under /etc/sudoers.d/ and check the syntax, because a broken sudoers file can lock every admin out:

sudo visudo -f /etc/sudoers.d/backup-operators
sudo visudo -c        # checks all sudoers files

Other daily user tasks: sudo usermod -L ana locks an account (for someone who has left) without deleting their files; sudo userdel -r ana removes the account and its home directory. If accounts come from a central directory instead of local files, see the LDAP HOWTO and the NIS HOWTO for why NIS should be retired.

Disks and filesystems

Start by looking at what is there. Three commands answer most questions:

lsblk -f          # disks, partitions, filesystem types, UUIDs, mount points
df -h             # how full each mounted filesystem is
findmnt           # what is mounted where, as a tree

Filesystems mounted at boot are listed in /etc/fstab. Always refer to them by UUID= rather than /dev/sdb1, because device names can change between boots. For a data disk that may be missing, add nofail so a dead disk does not stop the boot:

# /etc/fstab
UUID=0a1b2c3d-1111-2222-3333-444455556666  /srv/data  ext4  defaults,nofail  0  2

After editing fstab, test it before you reboot. systemd turns fstab lines into mount units, so tell it to reread the file:

sudo findmnt --verify     # checks fstab syntax and that devices exist
sudo systemctl daemon-reload
sudo mount -a             # mounts everything not yet mounted

A typo in fstab that you only find at the next boot can drop the machine into emergency mode, so this check is worth the ten seconds. For partitioning, swap and encryption, see the partitioning mini-HOWTO; for mirrored disks, the software RAID HOWTO; for a disk that is filling up, the disk usage mini-HOWTO; for file sharing, NFS and Samba.

Services with systemd

A service (a web server, SSH, a database) is a systemd unit. systemctl controls them:

systemctl status ssh                 # Debian/Ubuntu name; sshd on Fedora/RHEL/Arch
sudo systemctl restart ssh           # over SSH: run "sudo sshd -t" first and keep this session open
sudo systemctl enable --now nginx    # start now and at every boot
sudo systemctl disable --now cups    # stop now and do not start at boot
systemctl --failed                   # anything that failed to start
systemctl list-units --type=service --state=running

To change how a packaged service runs, do not edit its file under /usr/lib/systemd/system/; a package update will overwrite it. Use a drop-in instead:

sudo systemctl edit nginx

This opens an editor for /etc/systemd/system/nginx.service.d/override.conf. Add only the lines you want to change, for example a restart policy:

[Service]
Restart=on-failure
RestartSec=5s

systemctl edit reloads the configuration when you save; restart the service to apply it. systemctl cat nginx shows the unit file and every drop-in together, which is the quickest way to see what is really in effect. Boot parameters and boot loaders are covered in the BootPrompt HOWTO and the boot loader page.

Reading logs with journalctl

systemd's journal collects messages from the kernel, from early boot and from every service. Debian stopped installing rsyslog by default in Debian 12, so /var/log/syslog may simply not exist; on any systemd-based distribution the journal is the complete record. Use journalctl:

journalctl -b                    # everything since this boot
journalctl -b -1 -p err          # errors and worse from the previous boot
journalctl -u nginx --since "1 hour ago"
journalctl -u ssh -f             # follow new messages live (Ctrl+C to stop)
journalctl -k                    # kernel messages only, like dmesg
journalctl --list-boots          # which boots the journal remembers

Priorities run from 0 (emerg) to 7 (debug). -p warning shows warnings and everything more serious. Add -x for explanatory text where systemd has it, and -e to jump to the end.

If --list-boots shows only the current boot, logs are kept in memory and lost at reboot. Make them persistent with a drop-in file:

sudo mkdir -p /etc/systemd/journald.conf.d
printf '[Journal]\nStorage=persistent\nSystemMaxUse=1G\n' | sudo tee /etc/systemd/journald.conf.d/local.conf
sudo systemctl restart systemd-journald

By default the journal uses at most 10% of its filesystem, capped at 4 GB. journalctl --disk-usage shows the current size, and sudo journalctl --vacuum-size=500M trims old files at once.

Scheduled jobs: timers and cron

cron still works, but on minimal installs it may not be installed at all (the package is cron on Debian and Ubuntu, cronie on Fedora and RHEL). systemd timers are always there and have two big advantages: the job's output goes to the journal, and a Persistent=true timer catches up on runs missed while the machine was off.

A timer needs two files with the same name. The service says what to run:

# /etc/systemd/system/backup.service
[Unit]
Description=Nightly backup

[Service]
Type=oneshot
ExecStart=/usr/local/sbin/backup.sh

The timer says when:

# /etc/systemd/system/backup.timer
[Unit]
Description=Run the nightly backup

[Timer]
OnCalendar=*-*-* 02:30:00
Persistent=true
RandomizedDelaySec=15min

[Install]
WantedBy=timers.target
systemd-analyze calendar '*-*-* 02:30:00'   # check the expression and the next run
sudo systemctl daemon-reload
sudo systemctl enable --now backup.timer
systemctl list-timers                        # all timers, with next and last run
journalctl -u backup.service                 # output of past runs

Shorthands such as daily (midnight) and weekly (Monday midnight) also work. To run a job by hand for testing, start the service, not the timer: sudo systemctl start backup.service.

Backups

A backup you have never restored is a hope, not a backup. The usual rule is three copies of important data, on two kinds of storage, with one copy off site. Snapshots and RAID are not backups: they do not protect you from a deleted file that was deleted everywhere, or from ransomware that encrypts the live disk.

For a plain copy to another disk, rsync is fine. -a keeps permissions and times, -HAX adds hard links, ACLs and extended attributes, and -n shows what would happen first:

sudo rsync -aHAX --delete -n /srv/data/ /mnt/backup/data/   # dry run
sudo rsync -aHAX --delete    /srv/data/ /mnt/backup/data/

For versioned, encrypted, deduplicated backups, use restic (or BorgBackup). With restic, each run is a snapshot, and unchanged data is stored only once:

sudo restic -r /mnt/backup/restic init                  # once; asks for a password
sudo restic -r /mnt/backup/restic backup /etc /srv/data /home
sudo restic -r /mnt/backup/restic snapshots
sudo restic -r /mnt/backup/restic forget --keep-daily 7 --keep-weekly 5 --keep-monthly 12 --prune
sudo restic -r /mnt/backup/restic restore latest --target /tmp/restore-test

In a script run by a timer, give restic its password with RESTIC_PASSWORD_FILE pointing to a root-only file. Keep a copy of that password somewhere else: without it the backup cannot be read. Test a restore every few months. For files deleted without a backup, see the undeletion mini-HOWTO; for clean shutdown on power loss, the UPS HOWTO.

Updates

Most break-ins use holes that were fixed long ago. Install updates at least weekly, and security updates as soon as you can.

# Debian, Ubuntu
sudo apt update && sudo apt upgrade
# Fedora, RHEL, Alma, Rocky
sudo dnf upgrade
# Arch (read archlinux.org/news first)
sudo pacman -Syu
# openSUSE
sudo zypper patch           # Leap: install all released patches
sudo zypper dup             # Tumbleweed (rolling): dist-upgrade

Automatic updates are sensible for most servers. On Debian and Ubuntu, install unattended-upgrades and turn it on with sudo dpkg-reconfigure unattended-upgrades; its log is in /var/log/unattended-upgrades/. On RHEL 9 and 10 and their clones, install dnf-automatic, set the behaviour in /etc/dnf/automatic.conf, and enable a timer, for example sudo systemctl enable --now dnf-automatic-install.timer (download and install) or dnf-automatic-notifyonly.timer (report only).

A new kernel or C library only takes effect after a reboot, so plan one after those updates. For a fuller hardening checklist, see the Security HOWTO and securing a RHEL server. To build your own kernel (rarely needed), see the Kernel HOWTO.

Mistakes to avoid

Scripting your routine tasks? Start with the Bash introduction. For networking jobs, continue with the network administrator's guide.

Sources