Based on the Linux Master 1 exam syllabusReport an error
alias applies only to the first word of a command. For permanent effect use ~/.bashrc; for a temporary bypass use \command.!! (previous) · !100 (by number) · !$ (last argument of the previous command). Behavior is tuned with HISTSIZE and HISTCONTROL.Ctrl-Z suspends (SIGSTOP), Ctrl-C terminates (SIGINT). Revive a stopped job with bg/fg.nohup ... & (at start) or disown (midway).$( ) is command substitution (output becomes the value), $(( )) is arithmetic expansion (the calculation result). One pair of parentheses makes a completely different meaning.For an administrator who types the same commands dozens of times a day, the shell has to be more than a mere input box. The first tool for that is the alias.
alias gives a nickname to a command or a group of commands, so you don't have to memorize frequently used option combinations.alias # show all registered aliases
alias ll='ls -alF' # typing ll runs ls -alF
alias rm='rm -i' # always run rm in confirmation mode (safety net)
alias ..='cd ..' # typing .. moves to the parent directory
alias grep='grep --color=auto' # color grep results
unalias ll # remove the ll alias
unalias -a # remove all aliases~/.bashrc (because .bashrc is read every time a shell starts).# Add it to ~/.bashrc for permanent effect
echo "alias ll='ls -alF'" >> ~/.bashrc
source ~/.bashrc # apply immediatelyAn alias applies only to the first word (the command name) of a command. Even if you register alias ll='ls -l', it is not expanded in xll or echo ll. The shell substitutes only when the first word of the command line is in the alias list.
⚠️ Trap: To run the original command when an alias is masking it, put a backslash (
\) in front of the command. For example, withalias rm='rm -i'in effect, typing\rm fileruns the originalrmwithout confirmation.command rm fileor the absolute path/bin/rm filehas the same effect. This is the standard way to bypass an alias temporarily.
The alias feature first appeared in the C shell created by Bill Joy in 1978. The earlier Bourne shell had no aliases. This convenience was so popular that successor shells such as ksh and bash all adopted it. So the answer to "Which shell first introduced alias?" is csh.
history shows the commands you entered earlier, with numbers.~/.bash_history file at logout.history # full command history
history 10 # the latest 10
history -c # clear the history in memory
!! # re-run the immediately preceding command
!100 # re-run command number 100
!ls # re-run the most recent command starting with ls
!$ # the last argument of the preceding command
sudo !! # re-run the preceding command with sudo added!$ (the last argument of the preceding command) is used especially often.
mkdir /opt/myapp/config
cd !$ # same as cd /opt/myapp/configHistory behavior is controlled by environment variables.
| Variable | Meaning |
|---|---|
HISTSIZE | Number of commands to keep in the current session's memory |
HISTFILE | Path of the file to save history to (usually ~/.bash_history) |
HISTFILESIZE | Maximum number of lines to store in the history file |
HISTCONTROL | Controls saving of duplicate and space-prefixed commands (ignoredups, ignorespace) |
export HISTSIZE=5000
export HISTCONTROL=ignoredups # save consecutive duplicate commands only onceIf you set HISTCONTROL=ignorespace, commands that begin with a space are not kept in the history. When typing a command that contains a password, putting a single space at the very start of the line keeps it out of the history file, which is good for security. ignoreboth applies ignoredups and ignorespace at the same time.
⚠️ Trap:
history -cclears only the history in memory. The~/.bash_historyfile remains and is loaded again at the next login. To empty the file too, runhistory -c && history -w(clear memory, then overwrite the file) or empty the file directly with> ~/.bash_history. Also, if you use several terminals at once, the history of the last shell to exit can overwrite the file.
If you append & to the end of a command, it runs in the background and the shell returns the prompt immediately.
sleep 100 & # run in the background
# [1] 12345 → [job number] PID is printed
tar czf backup.tar.gz /data & # compress in the background[1] is the job number and 12345 is the process ID (PID).These are the commands for stopping a running foreground job and sending it to the background, or managing background jobs.
| Action | Behavior |
|---|---|
Ctrl-Z | Suspends (stopped) the foreground job |
jobs | Show the current shell's job list (-l includes PIDs) |
bg %1 | Resume (running) job 1 in the background |
fg %1 | Bring job 1 to the foreground |
kill %1 | Terminate job 1 |
# Try it yourself: stop it, then run it in the background
sleep 300 # run in the foreground (the shell is tied up)
# Press Ctrl-Z → [1]+ Stopped sleep 300
jobs # [1]+ Stopped sleep 300
bg %1 # [1]+ sleep 300 & (resumed in the background)
jobs # [1]+ Running sleep 300 &
fg %1 # bring it back to the foregroundCtrl-Z suspends (SIGSTOP) the job rather than terminating it. A stopped job can be run again in the background with bg or returned to the foreground with fg. Ctrl-C, on the other hand, sends SIGINT to the job and terminates it. Do not mix them up — Z is suspend, C is terminate.
% is the symbol that refers to a job number. fg %1 means job 1, and fg %% or fg means the most recent job.The + and - signs after the job number also have meaning. + is the current job — the job targeted when you use fg or bg without arguments — and - is the previous job. They are displayed as [1]+ and [2]- in the jobs output.
nohup ./long_job.sh &
# nohup: ignoring input and appending output to 'nohup.out'
nohup ./backup.sh > backup.log 2>&1 & # output to a file of your choicenohup (no hangup) runs a command immune to SIGHUP.nohup.out file.To detach a job already started with & from the shell after the fact, use disown.
./long_job.sh &
disown %1 # remove job 1 from the jobs list, immune to SIGHUP
disown -h %1 # keep the job but just ignore SIGHUP| Method | When | Features |
|---|---|---|
nohup cmd & | At start of execution | Records output in nohup.out, ignores SIGHUP |
disown %n | Midway through execution | Detaches an already running job from the shell |
screen / tmux | Per session | Detaches and reattaches the terminal session itself (powerful) |
The 'HUP' in SIGHUP comes from hang up (as in hanging up a phone). In the early days of Unix, terminals were connected through actual telephone modems, and when you hung up the phone, a signal was sent to all the connected processes to clean up — that is the origin of SIGHUP. Today the same signal is delivered when an SSH session drops, which is why jobs you were running die.
If you forget the & in nohup cmd &, the command runs in the foreground and the shell stays tied up. nohup only means "ignore SIGHUP", not "send it to the background". Background execution is strictly the job of &, so you need to use both together to get the "keep running in the background even if the terminal closes" behavior.
Command substitution is the feature that uses the output of a command as an argument to another command or as a variable value.
# Two notations: $(...) or `...`
TODAY=$(date +%Y%m%d)
echo "Backup file: backup_$TODAY.tar.gz"
# Backup file: backup_20260605.tar.gz
# Use a command result directly as another command's argument
echo "Kernel version: $(uname -r)"
kill $(pgrep -f myapp) # terminate all myapp processes at once
files=$(ls *.log) # put the list of log files in a variable
cd $(dirname /opt/app/conf/x.ini) # move to /opt/app/confCommand substitution takes only the output as the value. It is the text printed to stdout that gets substituted, not the command's exit status (success/failure). The trailing newline is removed automatically. That is why you can get a count as a clean number with count=$(ls | wc -l).
For arithmetic, use the similar-looking $(( ... )). You need to distinguish it from command substitution $( ).
echo $((3 + 4)) # 7 (arithmetic expansion)
echo $(expr 3 + 4) # 7 (substituting the external expr command — the old way)
n=5; echo $((n * 2)) # 10$( ) (command substitution) and $(( )) (arithmetic expansion) differ only in the number of parentheses but have completely different meanings. The single one means "run the command and substitute its output"; the double one means "calculate the arithmetic expression and substitute the result". In the old days arithmetic was also done by substituting the expr command ($(expr ...)), but it launches an external process and is therefore slow. The shell built-in $(( )) is faster and standard.
Tomorrow we move on to shell scripting basics, which automate all of this.
\command : Notation that ignores the alias and runs the original command. command cmd and the absolute path have the same effect.~/.bash_history : The file where command history is saved at logout.!! / !n / !$ : History expansions that recall the previous command / command number n / the last argument of the previous command.ignoredups (exclude duplicates), ignorespace (exclude commands starting with a space).&).[1] that is meaningful only within the current shell. Different from the system-wide PID.Ctrl-Z vs Ctrl-C : Suspend (SIGSTOP) and terminate (SIGINT). Z is stop, C is end.jobs / fg / bg : Show the job list, pull a job to the foreground, and resume it in the background.& together.$( ) vs arithmetic expansion $(( )) : Using a command's output as a value versus calculating an arithmetic expression and using the result.Click a choice to reveal the answer and explanation.
Question 1
Which key combination suspends a job running in the foreground?
Question 2
Which command runs a job ignoring SIGHUP so that the background job does not end even if the terminal is closed?
Question 3
With alias rm='rm -i' set, which of the following is NOT a way to run the original rm without confirmation?
Question 4
Which history notation reuses the last argument of the command just executed?
Question 5
Which of the following is command substitution?
Question 6
In the output of the jobs command, what does the + sign after the job number mean?
Question 7
What should you do to keep using an alias registered on the command line even after logout?