Sysadmin

Sysadmin: users, logins, services, disk hogs, kernel messages.

File aliases/admin.sh. Disable: export ALIASX_DISABLE="admin"

Users and logins

Name	Runs	What it does
`logins`	`last -n 20`	last 20 logins
`reboots`	`last reboot \| head`	reboot history
`userinfo USER`		id, groups, shell, home and last login example $ userinfo deploy uid=1001(deploy) gid=1001(deploy) groups=1001(deploy),27(sudo),998(docker) home=/home/deploy shell=/bin/bash deploy pts/0 10.0.0.5 Thu Oct 1 09:12 still logged in
`failedlogins`		recent failed SSH logins example $ failedlogins Oct 02 03:14:07 web1 sshd[9120]: Failed password for root from 203.0.113.9 port 51022 ssh2 Oct 02 03:14:11 web1 sshd[9120]: Failed password for root from 203.0.113.9 port 51022 ssh2
`humans`		real user accounts (uid 1000+) example $ humans ali deploy	Linux

Services (systemd)

Name	Runs	What it does
`enabled`	`systemctl list-unit-files --state=enabled`	services that start at boot	needs systemctl
`svc NAME`		status and last 20 log lines of a service example $ svc nginx ● nginx.service - A high performance web server Active: active (running) since Thu 2026-10-01 08:00:12 UTC; 1 day ago Main PID: 812 (nginx)	needs systemctl
`svcr NAME`		restart a service after y/N example $ svcr nginx Restart nginx? [y/N] y	needs systemctl
`svcstop NAME`		stop a service after y/N example $ svcstop nginx Stop nginx? [y/N] n Cancelled.	needs systemctl

Disk

Name	Runs	What it does
`deleted`	`lsof +L1`	deleted files still holding disk space
`bigfiles [DIR] [SIZE]`		files bigger than SIZE (default . 100M) example $ bigfiles /var 500M 2.1G /var/lib/docker/overlay2/3f1c.../layer.tar 812M /var/log/journal/system@0001.journal

Kernel

Name	Runs	What it does
`kmsg`	`asroot dmesg -T \| tail -40`	last kernel messages	Linux
`oom`	`journalctl -k \| grep -i "out of memory"`	out-of-memory kills	Linux
`timesync`	`timedatectl`	clock and NTP status	Linux