2018-03-20 Linux Learning

10.6 Monitoring IO Performance

iostat -x   磁盘使用iotop  磁盘使用free   查看内存使用情况free -m / -g / -hbuffer/cache公式：total=used+free+buff/cacheavaliable 包含free和buffer/cacheiostat -x    [[email protected] ~]# iostat -x    Linux 3.10.0-693.17.1.el7.x86_64 (aming-01)     2018年03月05日     _x86_64_    (1 CPU)    avg-cpu:  %user   %nice %system %iowait  %steal   %idle               0.06    0.00    0.13    0.00    0.00   99.80    Device:         rrqm/s   wrqm/s     r/s     w/s    rkB/s    wkB/s avgrq-sz avgqu-sz   await r_await w_await  svctm  %util%util  io等待处理数据百分比，数字大，说明磁盘忙iotop    主要看IO选项

10.7 Free

    [[email protected] ~]# free -h                  total        used        free      shared  buff/cache   available    Mem:           1.8G        142M        1.3G        8.6M        372M        1.5G    Swap:          4.0G          0B        4.0G

Pre-allocating a certain capacity to Buff/cache
Disk--Memory Cache---CPU
CPU-to-memory buffer-to-disk

10.8 PS

ps   查看系统进程    用法： ps aux、ps -elfstat 部分说明    D   不能中断的进程    R   run状态的进程    S   sleep状态进程    T   暂停的进程    Z   僵尸进程    <   高优先级进程    N   低优先级进程    L   内存中被锁了内存分页    s   主进程    l   多线程进程    +   前台进程    [[email protected] ~]# ps aux |grep apache    root       2391  0.0  0.0 112676   980 pts/0    R+   06:42   0:00 grep --color=auto apache杀掉某个进程，先找到这个进程的PID，及进程目录    [[email protected] ~]# ls -l /proc/566    总用量 0    ............................    lrwxrwxrwx. 1 root root 0 3月   5 06:47 exe -> /usr/bin/vmtoolsd

10.9 Viewing network status

Netstat view the network status NETSTAT-LNP view the listening port Netstat-an view the network connection status of the system NETSTAT-LNTP only see TCP, not including Socketss-an and Netstat share a small skill Qiao Netstat-an | awk '/^tcp/{++sta[$NF]} END {for (key in STA) print key, "\ T", Sta[key]} '-A: Lists all the connections, listening, and Socket data on the current system-T: Lists the number of TCP network packets According to-u: Lists the UDP network packet data-N: Not in the program's service name, the port number to display;-L: Lists the services currently in network listening (listen);-P: Lists the program PID for the Network service [[email&nbsp           ;p rotected] ~]# netstat-nltup Active Internet connections (only servers) Proto recv-q send-q Local Address               Foreign Address State Pid/program name TCP 0 0 0.0.0.0:22 0.0.0.0:*      LISTEN 898/sshd TCP 0 0 127.0.0.1:25 0.0.0.0:* LISTEN                1135/master TCP6 0 0::: $:::* LISTEN 898/sshd TCP6 0 0:: 1:25:::* LISTEN 1135/master [[Email protec Ted] ~]#Netstat-an |    awk '/^tcp/{++sta[$NF]} END {for (key in STA) print key, "\ T", Sta[key]} ' LISTEN 4 established 1 established Number of concurrent connections, how many are connected to the server, 1000 servers are generally acceptable

10.10 Linux Catch package

Monitoring System Status Grab Kit tcpdump yum install-y tcpdump usage: tcpdump-nn tcpdump-nn-i ens33 tcpdump-nn Port Tcpdum P-nn not port and host 192.168.0.100 tcpdump-nn-c 100-w 1.cap tshark-n-t a-r http.request-t Fields-e "fr  Ame.time "-E" ip.src "-E" http.host "-E" Http.request.method "-E" Http.request.uri "Yum install-y wireshark tcpdump Looking at the flow of data to a UDP packet is more likely to be an attack [[email protected] ~]# tcpdump-nn-i ens33 port [[email protected] ~]# Tcpdump-nn not port Tcpdump:bluetooth Link-layer type filtering not implemented [[Email protec Ted] ~]# Tcpdump-nn not port $ and host 192.168.104.1 Tcpdump:bluetooth Link-layer type filtering not Implemente d [[email protected] ~]# tcpdump-nn-i ens33-c 1 tcpdump:verbose output suppressed, use-v or-vv fo R Full protocol decode listening on ENS33, Link-type EN10MB (Ethernet), capture size 262144 bytes 06:34:33.9 80191 IP 192.168.104.160. > 192.168.104.1.49499:flags [P.], seq 2353381568:2353381756, Ack 1768454766, win 313, options [Nop,nop,ts Val 1335 0665 ECR 888596759], length 188 1 packet captured 2 packets received by filter 0 packets dropped by K Ernel [[email protected] ~]# tcpdump-nn-i ens33-c 10-w/tmp/33.cap tcpdump:listening on Ens33, Lin        K-type EN10MB (Ethernet), capture size 262144 bytes Ten packets captured packets received by filter  0 packets dropped by kernel [[email protected] ~]# file/tmp/33.cap/tmp/33.cap:tcpdump capture file          (Little-endian)-version 2.4 (Ethernet, capture length 262144) [[email protected] ~]# tcpdump-r/tmp/33.cap Reading from File/tmp/33.cap, Link-type en10mb (Ethernet) 06:41:05.765404 IP aming-01.ssh > 192.168.10 4.1.49499:flags [P.], seq 2353411216:2353411340, Ack 1768460730, win 313, options [Nop,nop,ts Val 13742450 ECR 888989950] , length 124

2018-03-20 Linux Learning