Learn › RHCSA (EX200) › Exam Orientation + Essential Tools
man - a hands-on Linux lab on a real virtual machine.
Offline documentation is the only help on the RHCSA exam. Confirm a page with whatis, open the right section with man and man 5, search by keyword with man -k and apropos, locate a page with man -w, navigate with /word and q, and read package docs under /usr/share/doc. RHEL 10 fact: info is not installed by default, so man and /usr/share/doc are the workhorses.
Picture exam day. You are in front of a real RHEL machine, a task on the screen: set the right options in a config file. You know the file. You just cannot remember the exact field order, and there is no Google. No notes. No phone. The tab that would have saved you at your desk is gone.
This is the moment that separates the people who pass from the people who freeze. Because the answer is not gone. It is sitting on the machine in front of you, in a system called the manual pages. Learn to reach it fast and the closed-book exam stops being scary. This lesson is that single survival skill: when you forget, the machine remembers.
The black boxes below are a practice terminal, a safe sandbox that checks only the one command each step teaches. You cannot break anything. Some outputs here (the keyword search list, the doc folder listing) are longer and change as packages come and go, so we show one real capture and note where yours will differ. On the live RHEL 10 machine at the end of the module, you run these against the real system.
man is short for manual. It opens the manual page for a command, a config file, or a system feature: a structured reference that ships with the software itself. Nearly everything on the system has one. When you type man ls, you are reading the same reference the people who wrote ls shipped alongside it.
This is the RHCSA objective 'locate, read, and use system documentation.' The exam explicitly allows man, info, and /usr/share/doc, and nothing else. There is a wrinkle worth knowing now: on RHEL 10, info is not even installed by default. So the real workhorses, the two you will actually lean on, are man and the package docs under /usr/share/doc. That is where this lesson spends its time.
Before you open a full page, there is a one-line lookup that confirms a page exists and tells you in a sentence what it covers. It is called whatis. Hand it a command name and it prints the page's section number and its one-line description, nothing more.
Ask it about ls. Before you run it, decide what you expect: a single short line naming ls and saying what it does.
prompt: student@servera:~$ answer: whatis ls output: ls (1) - list directory contents hint: The command is the word whatis, then a space, then the name you want to look up: whatis ls
One line, and two facts in it. The (1) is the section number: section 1 is user commands, the everyday programs you run. The text after the dash is the one-line summary. That (1) matters more than it looks, because the same name can live in more than one section. whatis is your fastest way to confirm a page exists before you commit to reading it.
Manual pages are filed into numbered sections. Three of them carry almost every RHCSA lookup:
Here is the trap that catches people. passwd exists in TWO sections. man passwd gives you section 1, the command that changes a password. man 5 passwd gives you section 5, the format of the /etc/passwd file, its colon-separated fields. Different pages, different answers. To open a specific section, you put its number between man and the name. Open the file-format page for passwd now:
prompt: student@servera:~$ answer: man 5 passwd output: hint: Put the section number between the word man and the name: man, then 5, then passwd.
That command opens a full page in a scrolling viewer, so nothing prints as a neat block here. What matters is the SHAPE of the command: man <section> <name>. When a task asks about a config FILE, reach for section 5. When it asks about a COMMAND, plain man name gives you section 1.
The lookups so far assume you know the name. Often on the exam you do not. You know the topic, 'something to do with passwords,' but not which command. man -k searches every page's one-line description for a keyword and lists every match. The -k stands for keyword. Its twin, apropos, does exactly the same thing, same output, same database.
Search the whole manual for anything mentioning passwd. Expect a list, one match per line, each with a name, a section number, and a summary.
prompt: student@servera:~$ answer: man -k passwd output: chgpasswd (8) - update group passwords in batch mode chpasswd (8) - update passwords in batch mode fgetpwent_r (3) - get passwd file entry reentrantly getpwent_r (3) - get passwd file entry reentrantly hint: Add the -k keyword flag: man, then -k, then the word to search for: man -k passwd
This is only the first four lines of a much longer list, and yours will differ: the exact matches depend on which packages are installed, so you may see more entries, or them in a different order. What does not change is the MOVE. When you cannot recall a command's name, man -k keyword (or apropos keyword) turns the whole manual into a search box. If it prints nothing appropriate, the search index is stale; sudo mandb rebuilds it.
One more lookup earns its place. man -w does not open a page; it prints the PATH to the file on disk. The -w stands for where. This is how you prove a page exists, see which section won when a name lives in several, or hand the path to another tool.
Ask where the ls page lives. Expect a single file path, ending in the section number and .gz because the pages are stored compressed.
prompt: student@servera:~$ answer: man -w ls output: /usr/share/man/man1/ls.1.gz hint: Add the -w where flag: man, then -w, then the name: man -w ls
Read the path and it tells its own story. It sits under /usr/share/man, in the man1 folder (section 1), and the filename is ls.1.gz: the name, the section, and .gz for compressed. So ls really is a section 1 page, confirmed from disk. Your exact path prefix can differ slightly across machines, but the shape, .../man<section>/<name>.<section>.gz, is universal.
A man page opens in a pager called less, a full-screen scroller. Pages can be thousands of lines, and scrolling to find one flag wastes the time you do not have on the exam. So you search INSIDE the page. Press /, type a word, press Enter, and it jumps to the first match. Press n for the next match, q to quit and return to the shell.
The single highest-value search: type /EXAMPLES inside almost any page and you land on ready-to-copy sample commands. These keys are worth burning into muscle memory:
On the exam, do not read a page top to bottom. Open it, press /EXAMPLES or /OPTIONS, read the two lines you need, press q, and get back to the task. A man lookup should cost you under a minute.
Some things do not live in a man page: a service's README, a sample config you can copy, a changelog. Those ship under /usr/share/doc. Every installed package may drop a folder there named after itself, holding the extra docs the maintainers included. When a task asks you to configure a service you have never touched, this folder often hides a working example config to copy instead of guess.
List what has docs installed. Expect a column of package-name folders.
prompt: student@servera:~$ answer: ls /usr/share/doc output: NetworkManager alsa-lib appstream apr apr-util at attr audit hint: The command is ls, then a space, then the path: ls /usr/share/doc
This is the top of a long, alphabetical list, and yours will differ: the folders that appear depend entirely on which packages are installed on your machine. The lesson is the LOCATION, not this exact list. When you need a package's README or a sample config, look in /usr/share/doc/<packagename>/, then ls and cat your way through it.
Scaffolding off. No command shown. You have every piece you need.
You are mid-task and blanking. You need something that deals with passwords, but you cannot dredge up the command's name, so opening a page directly is out. You want to turn the whole manual into a search box and list everything whose description mentions passwd, so you can spot the right command in the results.
prompt: student@servera:~$ answer: man -k passwd ||| apropos passwd output: chgpasswd (8) - update group passwords in batch mode chpasswd (8) - update passwords in batch mode fgetpwent_r (3) - get passwd file entry reentrantly getpwent_r (3) - get passwd file entry reentrantly hint: You forgot the name, so you need a keyword search across the whole manual. Think of the -k flag on man, or its twin command apropos.
Either man -k passwd or apropos passwd works; they are the same search over the same database. You got a list of every page whose description mentions passwd, and from the section numbers you can pick the right one: (8) for admin batch tools, (3) for library functions. This is the exam move that matters most, because on a closed-book exam the thing you forget most is a command's exact name, and keyword search is how you get it back.
You earned this cheat sheet. Every row is a lookup you just ran:
And the moves inside a page: /word searches, n jumps to the next hit, q quits. When you forget a flag, man has it. When you forget a config file's fields, man 5 has it. When you forget the command's name entirely, man -k finds it. When even that comes up short, /usr/share/doc has the README.
The third RHCSA-allowed tool, info, is not installed by default on RHEL 10, so do not build a habit around it. Treat man and /usr/share/doc as the two you rely on, and you will match what the exam machine actually gives you.
The practice terminal has shown you the shape of offline help: whatis to confirm a page, man and man 5 to open the right section, man -k and apropos to search by keyword, man -w to find a page on disk, /word to search inside a page, and /usr/share/doc for package docs. Every one of those you typed yourself.
The essential-tools module ends on one real RHEL 10 machine, the essential-tools capstone mission, and that is where you use these for real. A full AlmaLinux 10 system boots for you, with its own live manual and its own /usr/share/doc. It hands you objectives that lean on exactly what you practiced across this module, and this lesson is the one that rescues you when you forget a flag mid-task. One difference from here: the mission shows no commands. You read the objective, you recall the lookup, you type it. That recall is the exam skill.
Finish the other essential-tools lessons, then go read a real machine's manual for yourself.
Practice man, info, and /usr/share/doc in a real Linux terminal at The Linux Camp. Progress is verified automatically as you type commands on the machine.