Linux Commands & Shell Skills
curl: The Command-Line Web Client That Runs the Web
curl is the pocket HTTP client of every operations toolbox: diagnostic, pipeline-friendly, and honest about what came back. Its flag surface looks enormous and mostly is not in play: about a dozen flags cover day-to-day operational use, and knowing them is the difference between scripted health checks and lucky ones. The rule that saves the most paging is trivial: set --max-time every time, because curl's patience is infinite and yours is not.
Key points
- Look before you download: curl -sSI https://host returns method, headers, and status without a body; add -v when TLS handshakes, proxies, or hosts headers behave strangely.
- Timeout discipline is non-negotiable: --connect-timeout 5 kills dead connections, --max-time 15 kills slow ones; a health check without both can outlast the outage it was supposed to detect.
- Exit codes are the contract in scripts: 7 is connection refused, 28 is timeout, 22 is an HTTP error surfaced by --fail; read the code, not just the output, or your monitoring learns nothing.
- Pair visibility with enforcement: -w '%{http_code} %{time_total}\n' reports what happened, while --fail-with-body surfaces the error body; without one of these, failure looks exactly like success.
- Test what users actually hit: --resolve example.com:443:10.1.2.3 checks a named backend without DNS games, and -H 'Host: vhost.example.com' covers the vhost side of the same request.
- Transfers get deliberate flags: -o names the output, -L follows redirects you have reviewed, --retry 3 --retry-delay 2 softens flaky upstreams, and -F handles multipart uploads wget never cared about.
- Headers and sockets carry the non-browser world: -H 'Authorization: Bearer ...' for APIs and --unix-socket /run/app/app.sock to probe local services that never touch TCP at all.
- Know the two classic traps: proxy environment variables hijacking a request that -v exposes in seconds, and redirects that silently turn a POST into a GET unless you meant it.
Field note
The health check that hung for fifteen minutes was curl without --max-time inside a cron loop, and it outlasted the outage it was supposed to detect. Timeouts now go in before the URL, on principle.
Frequently asked questions
Why did curl exit 0 when the site returned a 500?
curl's success means the transport worked; HTTP-level errors are invisible without --fail (exit 22) or a read of %{http_code} from -w. Monitoring scripts insist on one of the two.
curl or wget for scripts?
curl for APIs, headers, POST bodies, and precise control; wget for mirroring and recursion. For a one-shot GET either works, and a pipeline mixing both is usually a sign nobody decided which one owned the job.
Is skipping TLS verification ever justified?
For one interactive diagnostic against a self-signed lab cert, sometimes; in anything scripted or cron-driven, no. -k disables the only check that stops a man-in-the-middle from owning your transfer.
How do I find out where a slow request actually stalls?
Timing variables: -w 'dns:%{time_namelookup} connect:%{time_connect} tls:%{time_appconnect} ttfb:%{time_starttransfer} total:%{time_total}\n' run a few times separates DNS flakiness from handshake pain from backend stalls.
How Kinetikatech helps with linux commands & shell skills
We've handled this hundreds of times: The commands and scripting habits that decide whether an administrator operates a server or fights it: search, transform, transfer, and supervise text and processes with the tools that live in every base install. With Linux Server Security and Server Management, you get the full loop, we assess, we implement, we watch it around the clock, and we pick up within 30 minutes when it matters.