Linux One Liners

ssh tee

Pipe the output of a command ran over ssh to the local terminal

# echo '********';whoami;hostname;ssh root@host2 -c 3des "echo '********' && hostname && whoami | tee /tmp/hostname.txt";echo '********'
********
host1
root
********
host2
root
********

Or a shorter version:

# ssh root@host2 -c 3des "hostname | tee /tmp/hostname.txt"
host2

Pretty Print memory use by processes (with PID)

resize; echo -ne '\n';echo "===========================================";ps -eo user,pid,%cpu,%mem,rsz,args|sort -rnk4|awk 'BEGIN {printf "%s\t\t%s\t\t%s\t%s\t%s\t%s\n","USER","PID","%CPU","%MEM","RSZ","COMMAND"}{printf "%s\t\t\%s\t\t%g'%'\t%g'%'\t%d MB\t%-10s\n",$1,$2,$3,$4,$5/1024,$6}'|head -n30;echo "===========================================";echo -e "\n===========================================";vmstat -s -S M|head -n10;echo "==========================================="

Sample output:
free mem Linux One Liners

Top ten processes by CPU

resize;clear;echo '--';echo '[code]';echo;date;echo "Top 10 Processes by CPU %";echo ""; ps -eo user,%cpu,%mem,rsz,args,pid,lstart|sort -rnk2|awk 'BEGIN {printf "%12s\t%s\t%s\t%s\t%s\n","USER","%CPU","%MEM","RSZ","COMMAND","PID","Started"}{printf "%12s\t%g'%'\t%g'%'\t%d MB\t%s\n",$1,$2,$3,$4/1024,$5}'|head -n10;echo; echo "== Last 90 mins ==";echo;sar|head -n3;sar -u|tail -n10;echo;sar -q|head -n3;sar -q|tail -n10;echo;echo "== Current 5 Second Intervals ==";echo;sar -u 5 12;echo;sar -q 5 12;echo '[/code]'

Low memory

resize;clear;echo;date;echo; vmstat -a -S m|tail -n1|awk 'BEGIN {FS=" "}{printf "nAvailtActivetTotaltPercent Availn%sMBt%sMBt%sMBt%snn",$4+$5,$6,$4+$5+$6,($4+$5)/($4+$5+$6)*100}';echo;echo "Top 10 Processes by MEMĀ %";echo;ps -eo user,%cpu,%mem,rsz,args|sort -rnk4|awk 'BEGIN {printf "%8st%6st%6st%8st%sn","USER","%CPU","%MEM","RSZ","COMMAND"}{printf "%8st%6st%6st%8s MBt%-12sn",$1,$2,$3,$4/1024,$5}'|head -n10; echo ""; echo "== Last 90 Minutes ==";echo; sar -r|head -n3; sar -r|tail -n10;echo; sar -B|head -n3; sar -B|tail -n10;echo

Drop Memory Caches

echo 1 > /proc/sys/vm/drop_caches

Disk Space stuff

FS='./';resize;clear;date;df -h $FS; echo "Largest Directories:"; du -hcx --max-depth=2 $FS 2>/dev/null | grep [0-9]G | head -15 | sort -rk 1;echo "Largest Files:"; nice -n 19 find $FS -mount -type f -ls 2>/dev/null| sort -rnk7| head -n20 |awk '{printf "%8d MBt%sn",($7/1024)/1024,$NF}'

Netstat and Networking Fun

General netstat

netstat -anpt | egrep '^Proto|ESTAB'
netstat -anpt | sort -k3 -rn | head

General netstat command to show all ports

netstat -antp

Show local listening TCP/UDP ports, and the process they belong to

netstat -tulpn

Ton of network statistic info

netstat -sw

Get MAC Addresses from dmesg

dmesg | egrep -i "^eth.*b(([a-f0-9]{2}:){5}[a-f0-9]{2}|[0-9a-f]{12})b" | sed -r 's/([a-f0-9]{2})([a-f0-9]{2})([a-f0-9]{2})([a-f0-9]{2})([a-f0-9]{2})([a-f0-9]{2})/1:2:3:4:5:6/i'"

Alternative (Only shows in the form of eth2: 00:1B:21:9C:2C:15):

dmesg | sed -nr "s/^(eth[0-9]{1,2}).*b(([a-f0-9]{2}:){5}[a-f0-9]{2}|[0-9a-f]{12})b/1: 2/ip" | sed -r 's/([a-f0-9]{2})([a-f0-9]{2})([a-f0-9]{2})([a-f0-9]{2})([a-f0-9]{2})([a-f0-9]{2})/1:2:3:4:5:6/i'

Automatically Update MAC addresses in ifcfg scripts

Using dmseg

for ETH in `ifconfig -a | grep '^e' | awk '{print $1}'`; do MAC=`dmesg | sed -nr "s/^$ETH.*b(([a-f0-9]{2}:){5}[a-f0-9]{2}|[0-9a-f]{12})b/1/ip" | sed -r 's/([a-f0-9]{2})([a-f0-9]{2})([a-f0-9]{2})([a-f0-9]{2})([a-f0-9]{2})([a-f0-9]{2})/1:2:3:4:5:6/i' | tr [:lower:] [:upper:]`; sed -i "s/^HWADDR.*/HWADDR=$MAC/g" /etc/sysconfig/network-scripts/ifcfg-$ETH; done;

Using lshw, ethtool and proc

for ETH in `ifconfig -a | grep '^e' | awk '{print $1}'`; do VENDOR=`lshw -class network | grep $ETH -B 3 | sed -n 's/.*vendor: (.*).*/1/p'`; if [ "$VENDOR" == "Intel Corporation" ]; then BOND=`ip addr | sed -n "s/[0-9]*: $ETH:.*(bond[0-9:]*).*/1/p"`; if [ $BOND ]; then MAC=`cat /proc/net/bonding/$BOND | grep Slave Interface: $ETH -A 3 | sed -n 's/Permanent HW addr: (.*)/1/p' | tr [:lower:] [:upper:]`; else MAC=`ethtool -e $ETH length 320 | grep '0x0000' | awk '{print $2":"$3":"$4":"$5":"$6":"$7}' | tr [:lower:] [:upper:]`; fi; elif [ "$VENDOR" == "Broadcom Corporation" ]; then MAC=`ethtool -e $ETH length 320 | grep '0x0130' | awk '{print $8":"$9":"$10":"$11":"$12":"$13}' | tr [:lower:] [:upper:]`; else echo "$ETH: UNKNOWN VENDOR"; exit 1; fi; sed -i "s/^HWADDR.*/HWADDR=$MAC/g" /etc/sysconfig/network-scripts/ifcfg-$ETH; done;

Compare MAC Addresses between actual and ifcfg scripts

Using dmesg

for ETH in `ifconfig -a | grep '^e' | awk '{print $1}'`; do MACDMESG=`dmesg | sed -nr "s/^$ETH.*b(([a-f0-9]{2}:){5}[a-f0-9]{2}|[0-9a-f]{12})b/1/ip" | sed -r 's/([a-f0-9]{2})([a-f0-9]{2})([a-f0-9]{2})([a-f0-9]{2})([a-f0-9]{2})([a-f0-9]{2})/1:2:3:4:5:6/i' | tr [:lower:] [:upper:]`; MACIFCFG=`sed -nr "s/^HWADDR=(.*)$/1/p" /etc/sysconfig/network-scripts/ifcfg-$ETH | tr [:lower:] [:upper:]`; if [ "$MACIFCFG" == "$MACDMESG" ]; then echo $ETH: MATCH; else echo -e "$ETH: NO MATCHntifcfg: $MACIFCFGntdmesg: $MACDMESG"; fi; done;

Using lshw, ethtool and proc

for ETH in `ifconfig -a | grep '^e' | awk '{print $1}'`; do VENDOR=`lshw -class network | grep $ETH -B 3 | sed -n 's/.*vendor: (.*).*/1/p'`; MACIFCFG=`sed -nr "s/^HWADDR=(.*)$/1/p" /etc/sysconfig/network-scripts/ifcfg-$ETH | tr [:lower:] [:upper:]`; if [ "$VENDOR" == "Intel Corporation" ]; then KEY='0x0000'; BOND=`ip addr | sed -n "s/[0-9]*: $ETH:.*(bond[0-9:]*).*/1/p"`; if [ $BOND ]; then REALMAC=`cat /proc/net/bonding/$BOND | grep Slave Interface: $ETH -A 3 | sed -n 's/Permanent HW addr: (.*)/1/p' | tr [:lower:] [:upper:]`; else REALMAC=`ethtool -e $ETH length 320 | grep $KEY | awk '{print $2":"$3":"$4":"$5":"$6":"$7}' | tr [:lower:] [:upper:]`; fi; elif [ "$VENDOR" == "Broadcom Corporation" ]; then KEY='0x0130'; REALMAC=`ethtool -e $ETH length 320 | grep $KEY | awk '{print $8":"$9":"$10":"$11":"$12":"$13}' | tr [:lower:] [:upper:]`; else echo "$ETH: UNKNOWN VENDOR"; exit 1; fi; if [ "$MACIFCFG" == "$REALMAC" ]; then echo $ETH: MATCH; else echo -e "$ETH: NO MATCHntConfigured: $MACIFCFGntCorrect: $REALMAC"; fi; done;

TCP dump examples

tcpdump -i eth0 -nn host XXX.XXX.XXX.XXX and port 111 -c 1000 tcpdump -C 10 -W 50 -nn -U -i eth0 -w /home/tcpdump/tcpdump.pcap -Z &

Fail over and test Network interfaces

ifenslave -c bond0 eth1 && ping -c5 `route -n | awk '/^0.0.0.0/{print $2}'`; ifenslave -c bond0 eth0 && ping -c5 `route -n | awk '/^0.0.0.0/{print $2}'`; tail -25 /var/log/messages | grep bonding && cat /proc/net/bonding/bond*

HTTP tricks

To test if webserver is up and serving content

echo -e "GET / HTTP/1.1nn" | nc -v -w 5 www.google.com 80 | head -9

See total memory of apache

ps aux | awk '/[h]ttpd/{total+=$6}END{print "Total Apache Memory: "total/1024"MB"}'

See total memory of nginx

ps aux | awk '/[n]ginx/{total+=$6}END{print "Total Nginx Memory: "total/1024"MB"}'

See memory of each http process

ps waux |egrep 'sbin/httpd$' |awk '{sum+=$6} END {print "Avg RSS per Apache process: " sum/1024/NR "MB"}'

watch incoming connections to web and out from web to app

netstat -pnta | grepĀ :81 | grep SERVER_IP | grep -v TIME | wc -l

open web connections

netstat -plnant | grep ":80" | grep -i established

List and Count HTTP Connections


Show Apache Processes and cpu/mem status

echo "Apache Processes: " `ps xuaw |egrep -i '[0-9] /usr/sbin/httpd ' -c` && iostat 2 2 | grep -i ^avg-cpu -A 1|tail -n 2 && free -m