Commands to Monitor Servers (CENTOS AND REDHAT) <\/p>\n
These commands are mainly for rpm based linux servers like CentOS etc.. <\/p>\n
May be some commands works in ubuntu servers etc…<\/p>\n
Command to find out total established connections, closing connection, TIME_WAIT and much more.<\/p>\n
netstat -nat | awk ‘{print $6}’ | sort | uniq -c | sort -n<\/p>\n
Sample Output:<\/p>\n
1 established
\n1 Foreign
\n5 LISTEN
\n16 TIME_WAIT
\n19 ESTABLISHED<\/p>\n
ig out more information about a specific ip address<\/p>\n
netstat -nat |grep {IP-address} | awk ‘{print $6}’ | sort | uniq -c | sort -n<\/p>\n
2 LISTEN
\n4 FIN_WAIT1
\n4 ESTABLISHED
\n7 TIME_WAIT<\/p>\n
To print list of all unique IP address connected to server, enter:<\/p>\n
netstat -nat | awk ‘{ print $5}’ | cut -d: -f1 | sed -e ‘\/^$\/d’ | uniq<\/p>\n
To print total of all unique IP address, enter:<\/p>\n
netstat -nat | awk ‘{ print $5}’ | cut -d: -f1 | sed -e ‘\/^$\/d’ | uniq | wc -l<\/p>\n
If you think your Linux box is under attack, print out a list of open connections on your box and sorts them by according to IP address, enter:<\/p>\n netstat -atun | awk ‘{print $5}’ | cut -d: -f1 | sed -e ‘\/^$\/d’ |sort | uniq -c | sort -n<\/p>\n ommand to list the connections to port 80:<\/p>\n netstat -alntp | grep :80<\/p>\n To check the number of connections to port 80:<\/p>\n netstat -alntp | grep :80 | wc -l<\/p>\n Command To Find Out Top 10 CPU Consuming Process<\/p>\n ps -auxf | sort -nr -k 3 | head -10<\/p>\n Command To Find Out The Top 10 Memory Consuming Process<\/p>\n ps -auxf | sort -nr -k 4 | head -10<\/p>\n An useful command to list connections to a particular port with its proccess id.<\/p>\n For eg: Port 8080<\/p>\n lsof -w -n -i tcp:8080<\/p>\n Linux Screen Command<\/p>\n Steps<\/p>\n – Create a screen using the command<\/p>\n screen -S geopc<\/p>\n – Close the shell without logout<\/p>\n – Open a new shell and type<\/p>\n screen -ls<\/p>\n Sample Output:<\/p>\n There are screens on: – You can login to that screen using the command screen -r ‘screen name’<\/p>\n screen -r 5002.geopc<\/p>\n To attach a scree that is already attached with the following command:<\/p>\n screen -x -R<\/p>\n","protected":false},"excerpt":{"rendered":" Commands to Monitor Servers (CENTOS AND REDHAT) <\/p>\n These commands are mainly for rpm based linux servers like CentOS etc.. <\/p>\n May be some commands works in ubuntu servers etc…<\/p>\n Command to find out total established connections, closing connection, TIME_WAIT and much more.<\/p>\n netstat -nat | awk ‘{print $6}’ | sort | uniq -c […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[17],"tags":[],"_links":{"self":[{"href":"https:\/\/mohan.sg\/index.php?rest_route=\/wp\/v2\/posts\/286"}],"collection":[{"href":"https:\/\/mohan.sg\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/mohan.sg\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/mohan.sg\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/mohan.sg\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=286"}],"version-history":[{"count":3,"href":"https:\/\/mohan.sg\/index.php?rest_route=\/wp\/v2\/posts\/286\/revisions"}],"predecessor-version":[{"id":288,"href":"https:\/\/mohan.sg\/index.php?rest_route=\/wp\/v2\/posts\/286\/revisions\/288"}],"wp:attachment":[{"href":"https:\/\/mohan.sg\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=286"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/mohan.sg\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=286"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/mohan.sg\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=286"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\nIf Box is Under DoS Attack or Not<\/strong><\/p>\n
\n16921.joemon (Dead ???)
\n3981.name (Attached)
\n5002.geopc (Attached)
\nRemove dead screens with ‘screen -wipe’.
\n3 Sockets in \/tmp\/screens\/S-root.<\/p>\n