Common Linux website fault analysis commands

Transferred from: Success! TXT: accept-Nat | awk '{print $6}' | sort | uniq-c | sort-Rn netstat-N | awk '/^ TCP/{++ s [$ NF] }; end {for (a in S) print a, s [a]} 'or netstat-N | awk'/^ TCP/{++ State [$ NF]}; end {for (key in State) print key, "\ t ", state [Key]} 'netstat-N | awk'/^ TCP/{++ arr [$ NF]}; end {for (K in ARR) print K, "\ t", arr [k]} 'netstat-N | awk'/^ TCP/{print $ NF} '| sort | Uniq-c | sort-Rn netstat-ant | awk '{print $ NF}' | grep-V '[A-Z]' | sort | uniq-C2. query request count 20 IP addresses (usually used to find attack sources): netstat-anlp | grep 80 | grep TCP | awk '{print $5}' | awk-F: '{print $1}' | sort | uniq-c | sort-Nr | head-n20netstat-ant | awk '/: 80/{split ($5, IP ,": "); ++ A [IP [1]} end {for (I in a) print a [I], i} '| sort-Rn | head-n203. use tcpdump to sniff access to port 80 to see who has the highest tcpdump-I eth0-tnn DST port 80-C 1000 | awk-F ". "'{print $1". "$2 ". "$3 ". "$4} '| sort | uniq-c | sort-Nr | head-204. find more time_wait connections. netstat-N | grep time_wait | awk '{print $5}' | sort | uniq-c | sort-Rn | head-n205. find more SYN connections. connect netstat-an | grep SYN | awk '{print $5}' | awk-F: '{print $1}' | sort | uniq-c | sort-Nr | more6. process netstat-ntlp | grep 80 | awk '{print $7}' | cut -D/-F1 website log analysis article 1 (APACHE): 1. obtain the first 10 IP addresses of cat access. log | awk '{print $1}' | sort | uniq-c | so RT-Nr | head-10cat access. log | awk '{counts [$ (11)] + = 1}; end {for (URL in counts) print counts [url], URL}' 2. the most frequently accessed file or page, with the first 20 cat access. log | awk '{print $11}' | sort | uniq-c | sort-Nr | head-203. list the largest number of EXE files transmitted (commonly used when analyzing download sites) Cat access. log | awk '($7 ~ /\. EXE/) {print $10 "" $1 "" $4 "" $7} '| sort-Nr | head-204. lists the EXE files with an output greater than 200000 bytes (about KB) and the number of occurrences of the corresponding files cat access. log | awk '($10> 200000 & $7 ~ /\. * EXE/) {print $7} '| sort-N | uniq-c | sort-Nr | head-1005. if the last column of the log records the page file transfer time, the most time-consuming page cat access is listed on the client. log | awk '($7 ~ /\. PHP/) {print $ NF "" $1 "" $4 "" $7} '| sort-Nr | head-1006. list the most time-consuming pages (more than 60 seconds) and the corresponding page occurrence times cat access. log | awk '($ NF> 60 & $7 ~ /\. PHP/) {print $7} '| sort-N | uniq-c | sort-Nr | head-1007. lists the cat access files that have been transferred for more than 30 seconds. log | awk '($ NF> 30) {print $7}' | sort-N | uniq-c | sort-Nr | head-208. count website traffic (g) Cat access. log | awk '{sum + = $10} end {print sum/1024/1024/1024}' 9. count 404 of connected awk' ($9 ~ /404/) 'access. log | awk '{print $9, $7}' | sort10. HTTP status statistics. cat access. log | awk '{counts [$ (9)] + = 1}; end {for (code in counts) Print Code, counts [Code]} 'cat access. log | awk '{print $9}' | sort | uniq-c | sort-rn10. spider analysis shows which spider is capturing the content. /Usr/sbin/tcpdump-I eth0-l-S 0-w-DST port 80 | strings | grep-I User-Agent | grep-I-e 'bot | crawler | slurp | Spider's website daily Analysis 2 (SQUID) 2. traffic Statistics by domain zcat squid_access.log.tar.gz | awk '{print $10, $7} '| awk' begin {FS = "[/]"} {trfc [$4] + = $1} end {for (domain in trfc) {printf "% s \ t % d \ n", domain, trfc [domain]} 'the more efficient Perl version can be downloaded here: plugin-I eth0-S 0-L-w-DST port 3306 | strings | egrep-I 'select | update | Delete | insert | set | commit | rollback | create | drop | alter | call 'System debug Analysis 1. debug the strace-P pid2. trace the pidgdb-p pid of the specified process.