Linux › Module 6 › Lesson 3
man, --help & Tab Completion
Learn any command faster with man, --help, and tab completion
Opening
You will never memorize every flag
Incident response does not pause so you can scroll social media for "grep examples." Thousands of Linux commands exist, each with a SYNOPSIS, a dozen rarely used switches, and at least one flag that means the opposite of what you guessed from muscle memory on a different tool. Professionals do not memorize the catalog. They look things up in the right place, fast: man for full behavior, --help for a twenty-second flag list, info when GNU hypertext is richer, apropos when they know the job but not the name, and Tab completion so paths and command names stop being typo roulette. This lesson builds that lookup habit on your own VM or WSL — never by pasting a mystery one-liner from a forum into a shell you do not own.
1. man: the manual, by sections
man grep opens the manual page for grep. The pager (often less) takes over your terminal: Space scrolls a page, Enter advances a line, /pattern searches forward inside the page, n jumps to the next match, and q quits back to your prompt. Until you can quit confidently, man feels like a trap. Practice quitting on a harmless page before you need it under pressure.
Section numbers matter more than beginners expect. man 1 passwd documents the passwd command (userland program). man 5 passwd documents the /etc/passwd file format. If man passwd looks "wrong" — describing fields instead of flags — you may have landed in the file-format section. Try man 1 passwd explicitly. Other common sections: 2 (system calls), 3 (library functions), 8 (admin commands). Knowing the section is how you stop arguing with a man page that is answering a different question.
Defenders open man when a flag's exact meaning matters: Does grep -r follow symlinks? Does find -delete actually unlink files, and from which starting path? Read SYNOPSIS and DESCRIPTION before copying a switch from memory. Guessing -f ("force") on the wrong tool is how labs become restore-from-snapshot days. The manual is not bureaucracy — it is the closest thing Linux gives you to a safety data sheet for each binary.
2. --help: the 20-second summary
Most GNU tools accept --help (some use -h; a few accept both). grep --help prints common options immediately — faster than scrolling a long man page when you only forgot whether line numbers are -n or -N. Pipe to a pager if the help is long: grep --help | less, or head the first screen: grep --help | head -n 40. If --help fails or prints almost nothing, man is the next stop — not "run it and see what breaks on production logs."
Treat --help as a checklist, not as a license to invent flags. Confirm the option exists, note whether it takes an argument, and note warnings like "destructive" or "follow symlinks." Then run the command on files you own under $HOME/cyberlium-lab. Lookup muscle is how you stay fast without gambling.
3. info, apropos, and what to do when you forget the name
info is GNU's hypertext manual system (info grep). Some tools are documented more fully there than in man, with menus and cross-links. If info is installed, try it once so you recognize the interface; q still quits in most setups. You do not need info for daily work, but knowing it exists stops you from assuming "no man page" means "no documentation."
apropos password (or man -k password) lists man pages whose short descriptions mention password — useful when you know the job ("rotate a user password," "hash formats") but not the command name. That is how you find tools instead of inventing unsafe aliases or downloading random scripts. Combine with whatis command for a one-line summary when you remember the name but not the purpose.
4. Tab completion: fewer typos, fewer wrong paths
Tab completion is the other half of speed and safety. Type cd /et then Tab to expand toward /etc/. Double Tab lists matches when the prefix is ambiguous. Completing a path under $HOME/cyberlium-lab before you press Enter is a safety feature: you see the real directory name the shell will use. Fewer invented paths means fewer rm accidents and fewer "I thought I was in my home folder" stories.
Completion also helps with command names: type gre then Tab. If the shell offers grep, you are not about to run a mistyped binary. On some systems, programmable completion also fills long options after --. Use it. It is not cheating; it is verifying the filesystem and PATH before you commit.
5. How defenders look up flags under pressure
A practical order on a machine you administer: (1) Tab-complete the command so you are not misspelling it. (2) command --help | less for flags and short reminders. (3) man command for behavior, environment variables, exit codes, and warnings. (4) Only then run the command on files you own — prefer a copy under $HOME/cyberlium-lab, and prefer dry-run or -n if the tool offers one. Never skip to "I saw this on a screenshot" when the screenshot might be find / -delete or an unquoted rm.
Write one line of notes when a flag surprises you. Next incident, that note is faster than re-learning the same trap. Lookup is a skill you practice on calm days so it works on loud days.
6. Wrong vs right: guessing -f because it "usually means force"
Worked failure mode — flags from memory during an incident:
Wrong
You need to search logs fast. You run a command with -r -f copied from a different tool. On this tool, -f meant something else (overwrite, follow, force, or "from file"). You clobber a file or recurse somewhere you did not intend. You never opened man because "there was no time." The restore takes longer than the lookup would have.
Right
Thirty seconds of grep --help or man grep confirms -i -n -E. Tab-complete paths under your home or lab folder. Run the search on a copy in $HOME/cyberlium-lab first if you are unsure. Speed comes from lookup muscle, not from gambling on flags that "usually mean force."
7. Practical: look up a command you already use
On your own VM, WSL, or spare Linux box only — open man and --help. Quit with q. Nothing here installs malware or changes the system. Stay in $HOME/cyberlium-lab if you create any sample files. Do not run destructive find or rm recipes while "practicing lookup."
Command guide
man, --help, info, Tab — lookup drill (your machine)
Your VM / WSL / $HOME only — lookup, do not destroy
Command — copy this
mkdir -p "$HOME/cyberlium-lab/man-help" cd "$HOME/cyberlium-lab/man-help"
Quick flags (pipe if the list is long)
Command — copy this
grep --help | head -n 20
Full manual — Space to scroll, / to search, q to quit
Command — copy this
man grep
man 1 passwd # the command man 5 passwd # the file format
One-line summary when you know the name
Command — copy this
whatis grep 2>/dev/null || true
Optional command
Find a page when you know the topic, not the name
Command — copy this
apropos password | head
or: man -k password
GNU info (q to quit) — optional if installed info grep
Tab completion (type in a real shell, then press Tab)
Optional command
cd /et ls "$HOME/cyberlium-lab/m"
Confirm you can leave the pager (open man, press q)
DO NOT: copy a "force" flag from memory without checking DO NOT: run find with -delete until man find is clear DO NOT: practice lookup by pasting unknown curl|bash scripts
Mission: look it up, then use it
On your own VM/WSL: run grep --help and man grep (quit with q). Find how to print line numbers. Use apropos or man -k once on a word like password. Press Tab to complete a path under /etc or $HOME. Write one sentence: "Under pressure I will check --help/man before guessing a flag because ___."
Stuck? Ask Cyberlium AI Mentor
If man sections or quitting the pager is confusing, ask Cyberlium AI Mentor for a hint — not a dump of every grep flag. Try: "Hint only: how do I search inside a man page and then quit?" Or: "Hint only: man 1 vs man 5 for passwd?" Stay on your own machine; do not ask for exploit recipes.
You can find flags with --help, read behavior in man (including section numbers), discover unknown names with apropos, and type faster with Tab — the same lookup habit defenders use when the clock is running. Next — Bash Scripting Basics — shebang, variables, if, exit codes, and why unquoted $1 is dangerous.
Knowledge Check
APPLY: During an incident you forgot whether grep prints line numbers with -n or -N. Best 20-second move on a log you are allowed to read?
Multiple choice
Knowledge Check
APPLY: man 5 passwd documents something different from man 1 passwd. What is the idea?
Multiple choice
Knowledge Check
APPLY: True or False: Tab completion reduces typos in paths and command names, which lowers the chance of operating on the wrong file.
True or False