Biggest 10 Files
\ndu -sh * | sort -n | tail
\ndu -x -a . | sort -n -r | head -n 10<\/p>\n
List All the Process By memory usage
\nps -e -orss=,args= | sort -b -k1,1n | pr -TW$COLUMNS
\nps -eo pcpu,pid,user,args | sort -k 1 -r | head -10
\nps -eo pcpu,pid,user,args | sort -r -k1 | less<\/p>\n
find how many files an application is using
\nlsof +c 0 | cut -d’ ‘ -f1 | sort | uniq \u2013c<\/p>\n
Highest CPU Usage
\nps -eo pcpu,pid,user,args | sort -k 1 -r | head -10 | awk “{ print $2 }”<\/p>\n
Total Memory Usage
\nsar -q 1 | tail -1 | awk ‘{ print “” $3}’ | sed ‘s\/%\/\/g’<\/p>\n
CPU Threshold
\ntop -b -n 1 | awk -F'[:,]’ ‘\/^Cpu\/{sub(“\\\\..*”,””,$2); print $2}’<\/p>\n
Current User With Session Count
\nwho | awk ‘{ User [$1]++; } END { for (i in User) printf “%-9s %s\\n”, i, User [i] }’<\/p>\n
Memory Details
\nfree -t -m | grep “Total” | awk ‘{ print “Total Memory space : “$2 ” MB”;
\nprint “Used Memory Space : “$3″ MB”;
\nprint “Free Memory : “$4″ MB”;
\n}’<\/p>\n
Swap memory Details
\nfree -t -m | grep “Swap” | awk ‘{ print “Total Swap space : “$2 ” MB”;
\nprint “Used Swap Space : “$3″ MB”;
\nprint “Free Swap : “$4″ MB”;
\n}’<\/p>\n
Process Using memory
\nps aux | awk ‘{if ($5 != 0 ) print $2,$5,$6,$11}’ | sort -k2n<\/p>\n
Largest File Or Directory
\ndu -sk \/var\/log\/* | sort -r -n | head -10<\/p>\n
Processes Count Used By Users
\nps hax -o user | sort | uniq -c<\/p>\n
Who Started this Process
\nps -o comm= -p $(ps -o ppid= -p PID)<\/p>\n
How Much Ram Is Being Used
\nps -o rss -C java | tail -n +2 | (sed ‘s\/^\/x+=\/’; echo x) | bc<\/p>\n
When Was the Process Started
\nps -o lstart PID<\/p>\n
Environment Variables belong to a Process
\nps ewwo command PID | tr ‘ ‘ ‘\\n’ | grep \\=<\/p>\n
List Threads by Pid along with Thread Start Time
\nps -o pid,lwp,lstart –pid PID -L<\/p>\n
CPU usage for EACH cores
\nps ax -L -o pid,tid,psr,pcpu,args | sort -nr -k4| head -15 | cut -c 1-90<\/p>\n
Memory Percentage Usage of a Process
\nps -o comm,%mem,args PID<\/p>\n
Total CPU Usage Percentage
\nps aux | awk {‘sum+=$3;print sum’} | tail -n 1<\/p>\n
Find Class Files inSide the Jar Location
\nfind . -iname ‘*.jar’ -printf “unzip -c %p | grep -q ‘sample Text’ && echo %p\\n” | sh<\/p>\n
Find the Class File in jars
\nfind . -name “*.jar” | while read line; do unzip -l $line; done | grep<\/p>\n
Search The File From Multiple Jar Files
\nfind . -name “*.jar” | xargs -tn1 jar tvf | grep –color “log4j.xml”<\/p>\n
List of Files That Are Open For Writing to Disk
\nlsof | grep -e “[[:digit:]]\\+w”<\/p>\n
See which Process is Holding the File
\nlsof -r1 \/common\/jboss.log<\/p>\n
List the files accessed by a program
\nstrace -f -o foo.trace su user -c ‘mycommand’?<\/p>\n
get size of data that haven’t been written to disk yet
\nThe term for that is “dirty” data (data that has been changed, but not yet flushed to permanent storage).
\ncat \/proc\/meminfo | grep Dirty
\nDirty : 188 kB<\/p>\n
Owner of the File
\n\/sbin\/fuser admin.lok
\nadmin.lok: 5912
\nPmap Output In Kilo Bytes
\npmap -x PID | awk ‘\/\\[ anon \\]\/ {total += $3} END {print total}’<\/p>\n
determine which application is utilizing a certain port?
\nlsof -w -n -i tcp:80 ( or any Othe Port)
\nStart Number of active, and recently torn down TCP sessions
\nnetstat -ant | egrep -i ‘(ESTABLISHED|WAIT|CLOSING)’ | wc -l<\/p>\n
Number of sessions waiting for ACK (SYN Flood)
\nnetstat -ant | egrep -i ‘(SYN)’ | wc -l
\nFind Network Connections
\nOut Going Going Connections
\nlocalhost:root002-~ $ lsof | grep omdx1971
\njava 1142 dwls977 924u IPv6 141719124 0t0 TCP localMachine :27710->eth0.remoteMachine.nova.com:54426 (ESTABLISHED)<\/p>\n
java 1142 dwls977 925u IPv6 141713891 0t0 TCP localMachine :27710->eth0.remoteMachine.nova.com:54141 (ESTABLISHED)<\/p>\n
Incoming Connections
\nOnce you got the Out Going Connections , we can get the Port and try it on the local machine to find the connection information<\/p>\n
remoteMachine:root002-~ $ netstat | grep 54426
\ntcp 0 0 localMachine :54426 eth0.remoteMachine.nova.co:27710 ESTABLISHED
\nAll Outgoing Connections
\nnetstat -an | grep -i tcp | grep ESTABLISHED | less
\ntalk to Other over the Network
\nDev:vx1379:djbs002-~ $ lsof -p 29118 -a -i ( Process Talk)
\nshow the number of connections active to a port and also the number of connections from that ip in order
\nnetstat -ntu | awk ‘{print $5}’ | cut -d: -f1 | sort | uniq -c | sort -n
\nList listening TCP sockets
\nnetstat -ant | egrep -i ‘(LISTEN)’
\nList Per User Process
\nps -e -o uid,vsz | awk ‘{ usage[$1] += $2 } END { for (uid in usage) { print uid, “:”, usage[uid] } }’
\nWorking Directory of a Running process
\nlsof -bw -d cwd -a -c java
\nExtract files from war\/Ear
\njar xf abc.war log4j-test.xml WEB-INF\/
\nAll Connections from a Specific process
\nlsof -p PID -a -i
\nScan a port On a Remote Machine
\nnc -v -w 1 -z
\nShow The Java Process
\ntop -b -n 1|grep java|wc -l
\nSmallest To biggest
\nls -s | sort -nr | more
\nFind Files That Exceed a Specified Size Limit
\nfind . -size +400 -print
\nGrep All Files Of A Certain File Type For A Specific Pattern
\nfind . -type f -name ‘*.cs’ -print0 | xargs -0 grep –color=always -n PATTERN<\/p>\n
Zero Length File Sizes
\nfind . -type f -size 0k -exec rm {} \\; | awk ‘{ print $8 }’
\nFind and Kill a Process
\nps ux | grep | grep \u2013v grep | awk \u2018{print $2}\u2019 | xargs \u2013r kill -9
\nFiles Opened By a Process
\nlsof +f | grep PID
\nFind The Command Line Of the Process Using Specific Port
\ncat \/proc\/$(lsof -ti:)\/cmdline
\nAll Open Tomcat Threads
\nps -ALcf | grep org.apache.catalina.startup.Bootstrap | wc -l<\/p>\n
Find The MAC Address
\n[root@vx111a test]# cat \/sys\/class\/net\/eth0\/address<\/p>\n
List all the Installed Perl packages
\nperl -MFile::Find=find -MFile::Spec::Functions -Tlwe ‘find { wanted => sub { print canonpath $_ if \/\\.pm\\z\/ }, no_chdir => 1 }, @INC’
\nFind Whether a Port is Open On a Remote Machine
\nnmap -p
\nStatus Of the HTTP
\ncurl -o \/dev\/null –silent –head –write-out ‘%{http_code}\\n’
\n200
\n-o \/dev\/null throws away the usual output
\n-silent throws away the progress meter
\n-head makes a HEAD HTTP request, instead of GET
\n-write-out ‘%{http_code}\\n’ prints the required status code
\nFind Whether The Process is 32Bit or 64Bit
\nfile -L \/proc\/PID\/exe<\/p>\n
The Output would be some thing like this
\n\/proc\/6462\/exe: ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), for GNU\/Linux 2.2.5, dynamically linked (uses shared libs), not stripped
\nConvert Of Bytes to Mbs
\nunits –terse “3415014314 bytes” “MB”<\/p>\n
SSh and Execute a Command
\nssh root@ -q ‘echo $MYDIR\u2019
\nFind out what is listening on a series of ports
\n\/sbin\/fuser -n tcp {7000..8000}
\nView details of network activity between
\nlsof -i :7000-8000
\nList all files opened by a particular command
\nlsof -c java
\nList Threads By PID along with Thread Start Time
\nps -o lwp,lstart –pid PID<\/p>\n
Count Threads OF a Process
\nps uH -p PID | wc \u2013l<\/p>\n
Print a stack trace of a running process
\nPstack PID
\nReturn Number of kernel Threads Owned by a process
\nps -o thcount \u2013p PID
\nShow Ports that belong to this PID
\nnetstat –all –program | grep PID<\/p>\n
Drop all the Connections available now for a Port
\niptables -I INPUT -p tcp -dport 80 -j DROP<\/p>\n
Find and Grep a File
\nfind $PWD -type f -exec egrep PAVAN {} \\;<\/p>\n
Find the Time took Process To Complete
\n\/usr\/bin\/time -v<\/p>\n
Memory Information ( Much Better than Free Command)
\nvmstat -s -S M
\nList all the Jars loaded by a Process
\nlsof -p PID | grep jar<\/p>\n
All process Running as a Specific User
\npgrep -l -f -x -u root
\nFind and Remove Files Matching a pattern
\nfind $PWD -type f -name “*Jul-*.ESS-A1.log” -exec rm -f {} \\;<\/p>\n
Find and Zip files matching a Pattern
\nfind $PWD \u2013type f \u2013name \u201cess_admin.controllermessages.log.\u201d | xargs tar zcvf one.tar<\/p>\n
How to list all unique ip address currently connected to a specific port
\nss -o state established ‘( dport = :10012 )’|awk -F”[\\t :]+” ‘NR!=1{ ip[$5]+=1 } END{ for (i in ip){n++};print n }’<\/p>\n
Find and Gzip
\nfind $PWD \u2013type f \u2013name \u201c*.log\u201d | xargs tar zcvf one.tar<\/p>\n
Find and Remove
\nfind \u2013type f \u2013name \u201c*.log\u201d | xargs rm
\nfind \u2013type f \u2013name \u201c*.log\u201d -exec rm -f {} \\;<\/p>\n
Find Files That are Updated in The Last 60 Minutes
\nfind $PWD -mmin -60<\/p>\n
Find all files Older than 2 days and gzip them
\nfind $PWD -type f -mtime +2 | xargs gzip<\/p>\n
How many Open Tomcat Threads
\nps -ALcf | grep org.apache.catalina.startup.Bootstrap | wc -l<\/p>\n
Differences between 2 files in remote hosts
\ndiff <(ssh alice cat \/etc\/apt\/sources.list) <(ssh bob cat \/etc\/apt\/sources.list)\n\nMonitor the active thread count of a process (jvm) on linux\nps uH -p 10343 | wc -l\n\nHow do I find out which service is listening on a specific port?\nlsof -Pnl +M -i4 ( IP 4 )\nlsof -Pnl +M -i6 ( IP 6 )\nnetstat -npl\n\nDisplay CPU,Memory Usages of the Users\nps axo user,pcpu,pmem,rss --no-heading | awk '{pCPU[$1]+=$2; pMEM[$1]+=$3; sRSS[$1]+=$4} END {for (user in pCPU) if (pCPU[user]>0 || sRSS[user]>10240) printf “%s:@%.1f%% of total CPU,@%.1f%% of total MEM@(%.2f GiB used)\\n”, user, pCPU[user], pMEM[user], sRSS[user]\/1024\/1024}’ | column -ts@ | sort -rnk2
\nKill a Process on the Port
\nkill -9 `lsof -t -i :port_number`
\nHow Many Established Connection
\nlsof | grep -c “(ESTABLISHED)”
\nHow to enlarge existing file to specific size
\ndd if=\/dev\/zero bs=1 seek=new_filesize count=0 of=your_file
\nFor example this:
\ndd if=\/dev\/zero bs=1G seek=1000 count=0 of=test
\nwill enlarge file test to 1000G
\nTail the Last Bytes of Files
\ntail -c 400 jboss.log > jboss.log11
\nDeleted Files along with File Descriptor(FD)
\nlsof | awk ‘(\/deleted\/) {print “FD :-“,$4,”| File Name:-“,$9}’
\nCheck the Files For Changes From the last 1 Hour
\nawk -vDate=`date -d’now-1 hours’ +[%d\/%b\/%Y:%H:%M:%S` ‘ { if ($4 > Date) print Date FS $4}’
\nThreads in a Process
\nps -eLo pid,ppid,tid,pcpu,comm | grep PID
\nGrep Multiple Words
\ngrep -w ‘warning\\|error\\|critical’ \/var\/log\/messages
\nFind Out What Partition a File Belongs To
\nWe can use the df command to find out what partition a file belongs,<\/p>\n
[root@vx111a perl]# df -T file1
\nFilesystem Type 1K-blocks Used Available Use% Mounted on
\n\/dev\/sda7 ext3 49594196 5499736 41534504 12% \/soa
\nFind Out Port
\n\/sbin\/fuser 10011\/tcp
\n10011\/tcp: 32506<\/p>\n
lsof -i tcp:10012
\nCOMMAND PID USER FD TYPE DEVICE SIZE\/OFF NODE NAME
\njava 32506 jbs002 67u IPv6 20552857 0t0 TCP *:10012 (LISTEN)
\nThread Ids of a process in Linux using Proc
\ncat \/proc\/PID\/task<\/p>\n
How To Find The Number Of Open Files for a Process Name and process pid sorted by number of open files.?
\nlsof | perl -lane ‘$x{“$F[0]:$F[1]”}++;END { print “$x{$_}\\t$_” for sort {$x{$a}<=>$x{$b}} keys %x}’
\nTo show connections to a specific host
\nlsof -i@192.168.1.5<\/p>\n
Show connections based on the host and the port using @host:port
\nlsof -i@192.168.1.5:22
\nlsof -i@eth0.omhq111a.nova.com<\/p>\n
Grep All Files Of A Certain File Type For A Specific Pattern
\nfind . -type f -name ‘*.*’ -print0 | xargs -0 grep –color=always -n GCMonitor<\/p>\n
Top 20 Process With High File Descriptors
\nfor x in `ps -eF| awk ‘{ print $2 }’`;do echo `ls \/proc\/$x\/fd 2> \/dev\/null | wc -l` $x `cat \/proc\/$x\/cmdline 2> \/dev\/null`;done | sort -n -r | head -n 20<\/p>\n
Ping a URL to Find the HTTP Status
\nDev:Hunter@root-~ $ printf “GET \/ HTTP\/1.0\\r\\nvx111a: www\\r\\n\\r\\n” | nc vx111a 10011 | head
\nHTTP\/1.1 200 OK
\nServer: Apache-Coyote\/1.1
\nSet-Cookie: JSESSIONID=291DBACCB3596F4FBC38ABFBDE99AA7C.jasB2; Path=\/
\nETag: W\/”7857-1235874240000″
\nLast-Modified: Sun, 01 Mar 2009 02:24:00 GMT
\nContent-Type: text\/html
\nContent-Length: 7857
\nDate: Thu, 10 Oct 2013 02:33:39 GMT
\nConnection: close<\/p>\n
Dev:Hunter@root-~ $ nc -zw2 vx111a 10011 || echo http service is down
\nConnection to vx111a 10011 port [tcp\/*] succeeded!<\/p>\n
Dev:Hunter@root-~ $ curl -sL -w “%{http_code}\\\\n” “http:\/\/vx111a:10011\/wls_monitor\/” -o \/dev\/null
\n200<\/p>\n
Redirect and Print
\nDev:vx111a:jbs002-~ $ jmap -heap 922 2>\/dev\/null | grep MaxPermSize | awk ‘{print $3}’
\n268435456<\/p>\n
The 2>\/dev\/null at the end of the find command tells your shell to redirect the error messages (FD #2) to \/dev\/null, so you don’t have to see them on screen. Use \/dev\/null to to send any unwanted output from program\/command. All data written on a \/dev\/null special file is discarded by the system. To redirect standard error to \/dev\/null and store file list to output.txt, type:<\/p>\n
Find Who is Using Port
\nDev:vx111a:djbs002-~ $ \/sbin\/fuser 10011\/tcp
\n10011\/tcp: 32506<\/p>\n
Dev:vx111a:djbs002-~ $ lsof -i tcp:10012
\nCOMMAND PID USER FD TYPE DEVICE SIZE\/OFF NODE NAME
\njava 32506 djbs002 67u IPv6 20552857 0t0 TCP *:10012 (LISTEN)<\/p>\n
Search For Out Of memory
\nfind . -type f -exec grep -l java.lang.OutOfMemoryError {} \\;
\n.\/MANDY-B1_gc.log
\n.\/heap.log
\n.\/MANDY -B1.log.yyyyMMdd_HHmmss<\/p>\n
Conenct to the Linux Machine From windows Machine to Download Files
\npscp -i C:\\Ateam_uberkey.ppk jbs002@vx111a:\/tmp\/top.log C:\\Users\\Jag\\Desktop\\temp\\top.log<\/p>\n
Note : pscp is available with putty Software which is free to download<\/p>\n
Obtain the Number of Thread States in a Thread Dump
\ndev:vx1abc:he002:nc-Dumps $ awk ‘\/State: \/ { print }’ < td.log.073716.013908855 | sort | uniq -c\n 10 java.lang.Thread.State: RUNNABLE\n 8 java.lang.Thread.State: TIMED_WAITING (on object monitor)\n 2 java.lang.Thread.State: TIMED_WAITING (sleeping)\n 2 java.lang.Thread.State: WAITING (on object monitor)\n 24 java.lang.Thread.State: WAITING (parking)\n\nObtain the Count of Threads based on Thread State\ndev:vx1cea:djhe002:nc-stackDetils $ awk '\/State: TIMED_WAITING\/ { getline; print }' < td.2013-10-17-03.log | sort | uniq -c\n 50 at java.lang.Object.wait(Native Method)\n 15 at java.lang.Thread.sleep(Native Method)\n 5 at sun.misc.Unsafe.park(Native Method)\n\nGrep Multiple Strings \ngrep 'RUNNABLE\\|ListenPort\\|port\\|clusters\\|broadcastchannel\\|multicastaddress\\|multicastport\\|server_cluster' td.log.073652.957462762\n\nNumber of Connection Hits in between\nDev:vx1322:jbs002-JAS-A2 $ egrep \"2013-08-09 16:47:12|2013-08-09 16:50:00\" jboss.log | wc -l\n3\n\nHow many Requests Happened Per Minutes\negrep \"17\/Aug\/2013:01|17\/Aug\/2013:02\" PHYRES-H1_access.log | cut -d[ -f2 | cut -d] -f1 | awk -F: '{print $2\":\"$3}' | sort -nk1 -nk2 | uniq -c | sed 's\/[ ]*\/\/'\n\nQuery packages\ndev:vx1abc:he002:nc-~ $ rpm -q --queryformat '\\n%{NAME} %{VERSION} %{RELEASE} %{ARCH}\\n' glibc\nglibc 2.12 1.80.el6_3.6 x86_64\nglibc 2.12 1.80.el6_3.6 i686\n\nProcessor and Memory Usage Per User\nps axo user,pcpu,pmem,rss --no-heading | awk '{pCPU[$1]+=$2; pMEM[$1]+=$3; sRSS[$1]+=$4} END {for (user in pCPU) if (pCPU[user]>0 || sRSS[user]>10240) printf “%s:@%.1f%% of total CPU,@%.1f%% of total MEM@(%.2f GiB used)\\n”, user, pCPU[user], pMEM[user], sRSS[user]\/1024\/1024}’ | column -ts@ | sort -rnk2<\/p>\n","protected":false},"excerpt":{"rendered":"
Biggest 10 Files du -sh * | sort -n | tail du -x -a . | sort -n -r | head -n 10<\/p>\n
List All the Process By memory usage ps -e -orss=,args= | sort -b -k1,1n | pr -TW$COLUMNS ps -eo pcpu,pid,user,args | sort -k 1 -r | head -10 ps -eo pcpu,pid,user,args | […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4,17],"tags":[],"_links":{"self":[{"href":"https:\/\/mohan.sg\/index.php?rest_route=\/wp\/v2\/posts\/3451"}],"collection":[{"href":"https:\/\/mohan.sg\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/mohan.sg\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/mohan.sg\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/mohan.sg\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=3451"}],"version-history":[{"count":1,"href":"https:\/\/mohan.sg\/index.php?rest_route=\/wp\/v2\/posts\/3451\/revisions"}],"predecessor-version":[{"id":3452,"href":"https:\/\/mohan.sg\/index.php?rest_route=\/wp\/v2\/posts\/3451\/revisions\/3452"}],"wp:attachment":[{"href":"https:\/\/mohan.sg\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=3451"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/mohan.sg\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=3451"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/mohan.sg\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=3451"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}