How do I find the source of a command line operation?

Suppose I’m able to type abc in the command line and it will run (so the shell doesn't say "abc: command not found").

How can I find out what abc is or does? Is it a script? Program? Alias?

You can use the type command, ex. type abc. For example, in a bash shell:

$ type while cd ls gcc apt
while is a shell keyword
cd is a shell builtin
ls is aliased to `ls --color=auto'
gcc is /usr/bin/gcc
apt is hashed (/usr/bin/apt)

The plain type command only shows the first result. If there are multiple versions of abc in different locations on your PATH, or abc is provided as both a shell keyword and an external executable, or to see both the aliased and unaliased versions of a command, you can use type -a to list all of them ex.:

$ type -a time
time is a shell keyword
time is /usr/bin/time

$ type -a ls
ls is aliased to `ls --color=auto'
ls is /bin/ls

$ type -a datamash
datamash is /usr/local/bin/datamash
datamash is /usr/bin/datamash

In bash, type itself is a shell builtin. Other shells such as zsh and ksh and dash (which provides /bin/sh in Ubuntu) provide similar functionality (although dash doesn't currently provide type -a). In tcsh, the nearest equivalent is the builtin which command - not to be confused with the external which command - see Why not use “which”? What to use then?

For commands that are identified as external programs (i.e. have a path, like /usr/bin/gcc) you can use the file command to find out what sort of program:

$ file /bin/ls /usr/bin/gcc /usr/sbin/adduser
/bin/ls:           ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, BuildID[sha1]=2f15ad836be3339dec0e2e6a3c637e08e48aacbd, for GNU/Linux 3.2.0, stripped
/usr/bin/gcc:      symbolic link to gcc-9
/usr/sbin/adduser: Perl script text executable

For already installed commands use steeldriver's answer.

For not installed commands read below.

There is special package named command-not-found. Its purpose is

Suggest installation of packages in interactive bash sessions

Once installed this package will do its job and suggest you installation of deb-package with known executable name.

If you know executable name and/or part of its filepath, then you can find its package using one of two options:

• local apt-file by

  sudo apt-get install apt-file
  sudo apt-file update
  apt-file search bin/htop
  

  to get something like

  htop: /usr/bin/htop
  

• online using package contents search on https://packages.ubuntu.com - see results at this link.

There are a couple of other possibilities:

which abc

will return the location of the program abc in your system.

For example,

which cat
/bin/cat

If your program abc came with some documentation, it is possible to find more about it by running

man abc

This would show you the manual page if any for this program. You can learn much more about its usage, command line options and parameters. You might even find examples of how to use abc or a web page where the maintainers keep the program going.

An alternative to man or manual pages is a utility called info. Some program maintainers wish to give you the same or similar content to a man page using info instead.

info abc

for example will show you what help may be offered.

Since you mentioned aliases, you may show the aliases and their definitions with the alias command

alias

Here's the sample output on my Ubuntu 20.04 machine

alias alert='notify-send --urgency=low -i "$([ $? = 0 ] && echoterminal || echo error)" "$(history|tail -n1|sed -e '\''s/^\s*[0-9]\+\s*//;s/[;&|]\s*alert$//'\'')"'
alias egrep='egrep --color=auto'
alias fgrep='fgrep --color=auto'
alias grep='grep --color=auto'
alias l='ls -CF'
alias la='ls -A'
alias ll='ls -alF'
alias ls='ls --color=auto'

I'm assuming we're talking about bash shells (or maybe zsh if it's similar enough) here...

Commands like which and whereis, which other answers have mentioned, look for matching files in the directories listed in the PATH environment variable. So you could also just check for a command called abc in those directories manually. The whereis command does a bit more, checking places listed in other environment variables, looking for files matching the name given with some standard extensions, etc... Also, if abc is found in multiple locations, which only shows the one that would be run whereas whereis shows them all.

The shell might also map abc to a shell alias or a shell function. Aliases can be listed with the alias built-in command and they are pretty straight forward.

Shell function names can be listed with typeset -F, so you can search the output from that command to look for abc. If you want to set what code is associated with a given shell function you can use the type abc.

Suppose I’m able to type abc in the command line and it does anything but return

abc: command not found

How can I find out what abc is or does? Is it a script? Program? Alias?

None of the above. If it wasn't found, then it isn't anything. You could create or install (or add to the search path) a script or a program or an alias named abc, then it will be a script or a program or an alias. But at the moment, it is nothing.