paulgorman.org

Linux Commands

A little of this is Debian specific, but most of it works on any Linux or unix-like system.

Also, here are some top tips from commandlinefu.com.

The Debian Reference is useful.

Automation

• at
• crontab
• watch

Filesystems, disks, block devices

• file
• findmnt
• lsblk

Help

• man
• whatis

IO & Disk Usage

• du
• iotop

Misc

• chroot
• fc-list
• import
• ldd
• logger
• look
• notify-send
• rlwrap
• sudo su
• xfontsel
• xlsfonts

Network

• ethtool
• iftop
• ip
• iptables
• iptraf
• lsof -i
• netcat (nc)
• nethogs
• nload
• nmap
• ping
• sar

Package Management

• apt-cache search
• apt-cache show
• apt-file search
• dpkg -l
• dpkg -L
• dpkg -S

Processes

• kill
• lsof
• nice
• pidof
• pstree
• sar
• strace
• time
• timeout
• top
• ulimit

Shell & Files

• awk
• cd -
• diff
• file
• find
• grep
• history
• less +F
• md5sum
• nl
• rsync
• sed
• ssh
• stat
• tac
• tar
• vimdiff
• xargs
• zcat, zgrep, zless

Sound

• avconv (ffmpeg)
• pacmd

System & Kernel

• lsmod
• lspci
• lsusb
• modprobe
• service
• uptime

Time

• ntpq
• ntpdate

Xorg

• xrandr
• xrdb

apt-cache search finds packages

Search for packages related to foo with apt-cache search foo. It accepts regular expressions. --full outputs more info for each package. --names-only searches only the package names (like apt-cache pkgnames |grep human, but also outputs the short package descriptions).

apt-cache show foo shows info for package foo

apt-file search foo finds files in packages

at runs a command at scheduled time

$ at 20:04
warning: commands will be executed using /bin/sh
at> export DISPLAY=:0
at> zenity --warning --title="Alarm" --text="Tea time!"
at> ^D
job 1 at Mon Oct 20 20:04:00 2013
$
$ at -f myjob.sh 18:30 tuesday
warning: commands will be executed using /bin/sh
job 9 at Tue Oct 22 18:30:00 2013

The -f flag executes commands in a file.

atq shows pending jobs. atrm jobnumber deletes a job.

avconv converts media files

convert .flac files in current directory to .mp3:

for a in *.flac; do   < /dev/null avconv -i "$a" -qscale:a 0 "${a[@]/%flac/mp3}"; done

(avconv is Debian's ffmpeg.)

awk processes text records

See my awk notes.

$ echo "one two three" | awk '{print $2}'
two

$ awk -F':' '{print $1,$6}' < /etc/passwd | column -t
root         /root
daemon       /usr/sbin
bin          /bin
sys          /dev
sync         /bin
games        /usr/games
man          /var/cache/man
lp           /var/spool/lpd

$ awk '$6 ~/[0-9]$/' /etc/fstab | awk '$6 >1' | column -t
/dev/mapper/vg0-Boot  /boot    ext4  defaults  0  2
/dev/mapper/vg0-Home  /home    ext4  defaults  0  2
/dev/mapper/vg0-Var   /var     ext4  defaults  0  2
/dev/sdb1             /backup  ext4  defaults  0  2

cd - to previous directory

cd - changes to previous working directory, so you can switch back and forth between two directories.

chroot ~/jail /bin/foo confines foo to use path as its root directory

crontab schedules jobs

Edit your crontab with crontab -e. List your current crontab with crontab -l. The crontab fields are:

*     *     *   *    *        command to be executed
-     -     -   -    -
|     |     |   |    |
|     |     |   |    +----- day of week (0 - 6) (Sunday=0)
|     |     |   +------- month (1 - 12)
|     |     +--------- day of        month (1 - 31)
|     +----------- hour (0 - 23)
+------------- min (0 - 59)

Crontab entry examples:

15 * * * * echo “Run at 15 min past every hour”
22 8 * * * echo “This command is run daily at 8:22 am”
22 20 * * * echo “This command is run daily at 8:22 pm”
* 4 * * Sun echo “Runs at 4 am every Sunday”
42 3 1 * * echo “Runs 3:42 am every 1st of the month”
01 * 19 07 * echo “This command is run hourly on the 19th of July”

diff compares files

diff --side-by-side file1.txt file2.txt

colordiff is a colorizing wrapper for diff, but it's not installed by default.

See also vimdiff.

dpkg -l lists installed packages

dpkg -l | grep foo see if package foo is installed.

dpkg -L lists files installed by package

dpkg -L foo lists all the files installed by package foo.

dpkg -S names package that installed file

dpkg -S /foo/bar names the package that supplied the file.

du for disk usage

Just as df -h shows what percentage of each volume is in use, du -hs filename shows the size of a directory (or file). The -s flag is summary; dropping it shows the size of each subdirectory. du -ah shows the size of each file in in a directory:

$ du -ah Books/ | sort -nr | head -n 5
1008K   Books/Technical/onlisp.pdf
976K    Books/Technical/Eloquent JavaScript/img
908K    Books/Technical/Regular_Expression_Pocket_Reference_Second_Edition.pdf
868K    Books/DnD/Adventures/the_pod_caverns_of_the_sinister_shroom.pdf
848K    Books/Technical Papers/diveintopython-html-5.4.zip
$
$ sudo du -d 1 -h /var |sort -h
4.0K	/var/local
4.0K	/var/opt
4.0K	/var/tmp
8.0K	/var/mail
16K	/var/gopher
3.4M	/var/www
6.3M	/var/spool
13M	/var/backups
75M	/var/log
279M	/var/lib
2.7G	/var/cache
3.1G	/var
$ 

ethtool described network interface

sudo ethtool eth0 shows a lot of info about the interface, including its link mode and the advertised link modes of its partners, and whether it detects link. It can also force various settings, like sudo ethtool -s eth0 autoneg off duplex full to force full duplex mode.

fc-list list fonts recognized by fontconfig

file shows file type

file classifies the types of files supplied as arguments. file -s /dev/sdb1 reads a special block or character file, which can indicate whether data or a filesystem exists on it.

23:15 bava ~ $ sudo file -s /dev/sdb1
/dev/sdb1: Linux rev 1.0 ext4 filesystem data, UUID=93a51594-79c4-4ef9-8fc7-c5d8aa3953a4 (needs journal recovery) (extents) (large files) (huge files)
23:18 bava ~ $ file emacstest.txt
emacstest.txt: ASCII text
23:18 bava ~ $ file june
june: symbolic link to `/home/paulgorman/Documents/2014/june/'
23:19 bava ~ $ file marks
marks: directory

find (and note 'xargs')

paulgorman@falstaff:~$ find -iname pingwan*
./bin/pingwan.pl
./repo/pingwan
./repo/pingwan/.hg/store/data/pingwan.pl.i
./repo/pingwan/pingwan.pl
paulgorman@falstaff:~$
paulgorman@falstaff:~$ find -iname pingwan.pl -exec ls -lh {} \;
-rw-r--r-- 1 paulgorman paulgorman 9.1K May 10 09:19 ./bin/pingwan.pl
-rw-r--r-- 1 paulgorman paulgorman 7.1K Jan 19  2010 ./repo/pingwan/pingwan.pl
paulgorman@falstaff:~$ 
paulgorman@falstaff:~$ find -iname pingwan.pl | xargs grep Bloomfield
./bin/pingwan.pl:#       name    =>  'Bloomfield Villas Clubhouse',
./bin/pingwan.pl:        name    =>  'Bloomfield Villas Lsg',
./bin/pingwan.pl:        name    =>  'Glens of Bloomfield',
./repo/pingwan/pingwan.pl:#		name	=>	'Bloomfield Villas Clubhouse',
./repo/pingwan/pingwan.pl:		name	=>	'Bloomfield Villas Lsg',
./repo/pingwan/pingwan.pl:		name	=>	'Glens of Bloomfield',
paulgorman@falstaff:~$ 

Or find files modified within the last hour:

find ~ -type f -mtime 0

find has lots of options. Some useful ones include -not -maxdepth N -name -iname -type [fd...] -perm NNN -regex pattern.

find . recursively lists all the files under the current directory.

findmnt shows a tree of mounted filesystems

$ findmnt
TARGET                       SOURCE                               FSTYPE      OPTIONS
/                            /dev/mapper/LVM_Volume_Group_01-Root ext4        rw,relatime,errors=remount-ro,data=orde
├─/sys                       sysfs                                sysfs       rw,nosuid,nodev,noexec,relatime
│ └─/sys/fs/fuse/connections fusectl                              fusectl     rw,relatime
├─/proc                      proc                                 proc        rw,nosuid,nodev,noexec,relatime
│ └─/proc/sys/fs/binfmt_misc binfmt_misc                          binfmt_misc rw,nosuid,nodev,noexec,relatime
├─/dev                       udev                                 devtmpfs    rw,relatime,size=10240k,nr_inodes=39911
│ └─/dev/pts                 devpts                               devpts      rw,nosuid,noexec,relatime,gid=5,mode=62
├─/run                       tmpfs                                tmpfs       rw,nosuid,noexec,relatime,size=3194316k
│ ├─/run/lock                tmpfs                                tmpfs       rw,nosuid,nodev,noexec,relatime,size=51
│ └─/run/shm                 tmpfs                                tmpfs       rw,nosuid,nodev,noexec,relatime,size=63
├─/boot                      /dev/mapper/LVM_Volume_Group_01-Boot ext4        rw,relatime,stripe=4,data=ordered
├─/home                      /dev/mapper/LVM_Volume_Group_01-Home ext4        rw,relatime,data=ordered
├─/var                       /dev/mapper/LVM_Volume_Group_01-Var  ext4        rw,relatime,data=ordered
│ └─/var/lib/nfs/rpc_pipefs  rpc_pipefs                           rpc_pipefs  rw,relatime
└─/backup                    /dev/sdb1                            ext4        rw,relatime,data=ordered

grep

To grep which files in the current directory contain foo: grep -lr foo ..

history shows shell command history

One of my favorite shell aliases:

alias h='history 60 | sort -k2 | uniq -f2 | sort -bn'

import makes screenshots

Use the Imagemagick utility import to capture screenshots:

import bat.png
import -frame foo.png
import -window root bar.png

iftop monitors network activity

iftop is top for network activity. If you want to turn off DNS lookups run it with the -n flag or just hit "n" while it's running to toggle lookups. The "p" key toggle display of ports.

import takes a screenshot

import -window root ~/foo.png does screen capture. It's part of ImageMagick.

iotop monitors disk usage

iotop is top for disc reads and writes. The flags -ao are useful. -a shows accumulated I/O instead of bandwidth. -o shows only processes or threads actively doing I/O.

ip do network stuff

ip addr show ip link show ip --stats link ip addr add 192.168.1.100/24 dev eth0 ip link set eth0 up ip route show ip route add default via 192.168.1.1 ip route show cache ip route flush cache ip neighbor show

Note that ip route show won't necessarily show all routes; see ip-rule(8). ip route show table all will show all the routes.

ip replaces ifconfig, route, iptunnel, and arp.

iptables filter packets (firewall)

Kernel packet filter. Rules are organized into chains, where a packet is matched against each rule in the chain. Chains are grouped into tables; by default the tables are filter (the default table), nat, mangle, raw, and security. The man page is good.

$ sudo iptables --list --verbose
$ sudo iptables --table nat --numeric --list

Use ip6tables for IPv6.

iptraf monitors network traffic

iptraf monitors (and can capture) network traffic (connections, ports, type, etc.). It's sort of like netstat, but ongoing rather than a single run (and more colorful).

kill sends signals to processes

The -l flag lists the signals. kill -TERM pid is the default signal if none is specified. The -KILL, -INT, -HUP, -STOP, and -CONT signals are often used.

Before sending SIGKILL (9), try sending SIGTERM (15) to give the process a chance to clean up after itself.

killall foo signals processes by name rather than pid.

ldd /bin/foo lists shared libraries used by /bin/foo

$ ldd /bin/bash
    linux-vdso.so.1 (0x00007fff555fe000)
    libncurses.so.5 => /lib/x86_64-linux-gnu/libncurses.so.5 (0x00007f53c4285000)
    libtinfo.so.5 => /lib/x86_64-linux-gnu/libtinfo.so.5 (0x00007f53c405b000)
    libdl.so.2 => /lib/x86_64-linux-gnu/libdl.so.2 (0x00007f53c3e56000)
    libc.so.6 => /lib/x86_64-linux-gnu/libc.so.6 (0x00007f53c3aae000)
    /lib64/ld-linux-x86-64.so.2 (0x00007f53c44cc000)

less +F is a better tail

less +F filename.log shows continuing updates of the end of a file, like tail -f filename.log but better. If you interrupt less (to search or whatever) you can resume following with SHIFT-F.

lsblk shows block devices

$ lsblk
NAME                                MAJ:MIN RM   SIZE RO TYPE MOUNTPOINT
sda                                   8:0    0   2.7T  0 disk 
├─sda1                                8:1    0     2M  0 part 
└─sda2                                8:2    0     2T  0 part 
  ├─LVM_Volume_Group_01-Root (dm-0) 254:0    0 558.5G  0 lvm  /
  ├─LVM_Volume_Group_01-Boot (dm-1) 254:1    0   284M  0 lvm  /boot
  ├─LVM_Volume_Group_01-Home (dm-2) 254:2    0 745.1G  0 lvm  /home
  ├─LVM_Volume_Group_01-Var (dm-3)  254:3    0 745.1G  0 lvm  /var
  └─LVM_Volume_Group_01-Swap (dm-4) 254:4    0    60M  0 lvm  [SWAP]
sdb                                   8:16   0 931.5G  0 disk 
└─sdb1                                8:17   0 931.5G  0 part /backup
sr0                                  11:0    1  1024M  0 rom  

logger logs messages to syslog

$ logger "This is a test of the logger command."
$ logger -p local7.info "Logger can Facility to mark the message source and a Level to mark the message severity."

See logger(1) and syslog(3).

look looks up entries in a dictionary (or other file)

$ look pseudo
pseudo
pseudonym
pseudonym's
pseudonyms
$ look pseudo websters1913-29765-8.txt 
pseudo-martyr, pseudo-philosopher. Also used adjectively.
pseudobacteria. Sternberg.
pseudodipte.] (Arch.)
pseudodox which judgeth evil good, and darkness light." T. Adams.
pseudopipte.] (Arch.)
pseudopipte.] (Arch.)
pseudovarium.
pseudonavicula stage.
pseudopodia, by means of which they move about and take their food.
pseudoneuropterous insects of the genus Termes. These insects are

lsof finds processes using a file or port, vise versa

lsof tells which process has a file open (including sockets, directories, device files, etc.). It has many other options, like finding which files a process has open.

paulgorman@falstaff:~$ lsof -c gvim
COMMAND   PID       USER   FD   TYPE             DEVICE SIZE/OFF       NODE NAME
gvim    29723 paulgorman  cwd    DIR              254,0    12288   15106050 /home/paulgorman
gvim    29723 paulgorman  rtd    DIR              254,0     4096          2 /
gvim    29723 paulgorman  txt    REG              254,0  2277440   15327526 /usr/bin/vim.gnome
...
paulgorman@falstaff:~$ lsof /home/paulgorman
COMMAND     PID       USER   FD   TYPE DEVICE SIZE/OFF     NODE NAME
wmiirc      740 paulgorman  cwd    DIR  254,0    12288 15106050 /home/paulgorman
wmiirc      776 paulgorman  cwd    DIR  254,0    12288 15106050 /home/paulgorman
x-termina   777 paulgorman  cwd    DIR  254,0    12288 15106050 /home/paulgorman
bash        778 paulgorman  cwd    DIR  254,0    12288 15106050 /home/paulgorman
...
paulgorman@falstaff:~$ lsof -i
COMMAND    PID       USER   FD   TYPE   DEVICE SIZE/OFF NODE NAME
chrome   23339 paulgorman   73u  IPv4 54618659      0t0  TCP falstaff.local:37098->10.100.225.77:https (ESTABLISHED)
rdesktop 28066 paulgorman    4u  IPv4 54470880      0t0  TCP falstaff.local:41502->db.example.com:3389 (ESTABLISHED)
perl     29498 paulgorman    3u  IPv4 54620210      0t0  UDP falstaff.local:47310->ht-terminal-2.example.com:echo

lsof -i shows what processes have ports open.

md5sum calculates a file's checksum

Calculate the checksum for a file:

paulgorman@falstaff:~$ md5sum buddys_menu.pdf 
9f6de035f72c16711e786e8f955135d9  buddys_menu.pdf
paulgorman@falstaff:~$ 

Note that md5sum -c sums.txt compares files to checksums listed in the text file like:

99c3a849f6e9a0d143f057433c7f4d84  debian-6.10-desktop-amd64.iso
b950a4d7cf3151e5f213843e2ad77fe3  debian-6.10-desktop-i386.iso
a3494ff33a3e5db83669df5268850a01  debian-6.10-desktop-powerpc.iso
2f44a48a9f5b4f1dff36b63fc2115f40  debian-6.10-server-amd64.iso
cd6c09ff8f9c72a19d0c3dced4b31b3a  debian-6.10-server-i386.iso

lsmod lists loaded kernel modules.

lspci shows connected PCI devices.

The -v or -vv flags show more detail.

lsusb shows connected USB devices.

The -v or -vv flags show more detail.

man manual pages

$ man -S1 -k cpu
lscpu (1)            - display information on CPU architecture
taskset (1)          - retrieve or set a process's CPU affinity

-S specifies the section (1 is "executable programs or shell commands"). -k searches short descriptions for keywords; like apropos. Remember man man.

modprobe manipulates kernel modules.

The default behavior is to insert the module named in the argument into the running kernel, along with its dependencies if any (e.g. — modprobe mymod). Prefer modprobe over insmod and rmmod. The -l flags lists all available modules. The -r flag removes a module from the kernel.

netcat

Like cat, but works on the network. It does a bunch of diffrent stuff.

Test network connectivity between box A (10.0.0.100) and B.
On A (acting as the server): nc -l -p 4444
On B (acting as the client): nc 10.0.0.100 4444
We can then type messages back and forth.

A quick port scan of the first thousand ports:
nc -zvn 10.0.0.14 1-1000 2>&1 |grep succeeded, then grab the banner of an open port:
netcat -v 10.0.0.14 21

Ad hoc file tranfer. On the receiving box:
nc -l 9988 < foo.txt, and on the sending box:
nc --n 10.0.0.14 9988 > foo.txt

dd over the network. On the source box:
dd if=/dev/sda | nc -l 9988, and on the destination box:
nc -n 10.0.0.14 9988 | dd of=/dev/sda

nethogs

nethogs monitors network usage by process.

nice sets a process's CPU usage

Set process priority (CPU) for a given process with:

nice -n 18 myprocess

Both positive and negative numbers can be used. Higher numbers are a lower priority. 19 has the least priority. You can also readjust the priority of an already running process using renice.

nl numbers the lines in a file

nload visualizes network load

nload is pretty useful for monitoring real-time traffic in and out of an interface.

nmap scans networks

nmap -sn 10.0.0.0/24 to discover IP's in use on the /24 (255.255.255.0) subnet. (In earlier versions, -sn was -sP.)

notify-send message to desktop

notify-send "My message" appears as a desktop notification, if libnotify-bin and a notification daemon like dunst are installed.

ntpdate

ntpdate -d 10.0.0.1 queries/tests a network time server. The -d flag is debugging mode, and will not alter the time on the local machine; ntpdate can also be used to set the local time.

ntpq

ntpq -p prints the status of time servers:

$ ntpq -p
     remote           refid      st t when poll reach   delay   offset  jitter
==============================================================================
*clock1.albyny.i .CDMA.           1 u  366 1024  377   37.155    0.533   1.720
 15.126.193.186  192.5.41.40      2 u   9d 1024    0   29.098    0.950   0.000
+sisdb01.muskego 173.255.240.184  3 u  886 1024  377   20.897   -1.808   1.592
 barricade.rack9 209.51.161.238   2 u  32d 1024    0   17.961   -0.608   0.000
 10.0.0.1        198.7.57.182     4 u  894 1024  377    0.354  114.271   4.180

pacmd reconfigures PulseAudio

Linux sound is kind of a mess, because there are various sound layers and alternatives. Assuming you're using PulseAudio, pacmd list-sinks displays the sound output devices ("sinks") that Pulse knows about; the current/default device is starred. pacmd set-default-sink N changes the current/default output/sink (where N is the number of the device shown by pacmd list-sinks). pacmd list-sources displays the input devices; pacmd set-default-source N changes the current/default input/source device.

Test sound output: cat /dev/urandom | pacat

A quick and dirty test mic test: arecord -f cd -c1 | aplay.

pidof gives ID of named process

Returns the process ID of any processes matching a supplied name.

paulgorman@bava:~$ pidof xterm
16841 16789 16737
paulgorman@bava:~$ pidof xterm | xargs kill

ping can show a summary while running

CTRL | (pipe) forces ping to print the summary statistics without stopping the flow of packets.

pstree prints a process tree

pv views pipes

Insert pv in any pipeline to view its progress:

paulgorman@bava:~$ dd if=/dev/lvgroup/terminal | gzip -c | pv -c > /dev/null
6.47GB 0:16:36 [98.9kB/s] [    <=>                ] 

rlwrap adds realine support

rlwrap give readline support to things that don't have it, like rlwrap sbcl.

rsync syncs files

Local to remote (flags archive, don't overwrite newer files, compress, use human-readable numbers):

rsync -e ssh -auzh SOURCE user@host:DESTINATION

Remote to local:

rsync -e ssh -auvzh user@host:SOURCE DESTINATION

A trailing slash on the path means to copy the contents of the directory. No trailing slash means to copy the directory itself.

The --delete option tells rsync to delete files from the receiving side that don't exist on the sending side.

rsync -e ssh -auvzh --delete ./foo/ user@host:foo/

The --dry-run option shows what it would do with those arguments, without actually making changes.

sed edits streams

See my sed notes.

$ echo "All the king's horses and all the king's men..." | sed 's/king/dog/g'
All the dog's horses and all the dog's men..

Change multiple files:

$ cat a.conf
All the dogs went home.
$
$ cat b.conf 
I fed the dogs lunch.
I fed the dogs dinner.
$
$ for i in ./*; do
> sed -i 's/dog/cat/g' $i
> done
$
$ cat a.conf 
All the cats went home.
$
$ cat b.conf 
I fed the cats lunch.
I fed the cats dinner.

service controls init scripts

$ sudo service apache2 reload
[ ok ] Reloading web server: apache2.

Using service is preferred over calling init scripts directly (e.g. — sudo /etc/init.d/apache2 reload), because calling the init script directly doesn't guarantee the service will start with the expected environment (i.e. — the environment it had at boot time).

sar

sar is one of the tools from the sysstat package.

paulgorman@falstaff:~$ sar 1 3
Linux 2.6.32-5-amd64 (falstaff) 	09/29/2011 	_x86_64_	(8 CPU)

09:50:24 AM     CPU     %user     %nice   %system   %iowait    %steal     %idle
09:50:25 AM     all      1.66      0.13      0.89      0.00      0.00     97.32
09:50:26 AM     all      1.37      0.12      0.87      0.00      0.00     97.63
09:50:27 AM     all      1.77      0.00      0.83      0.00      0.00     97.40
Average:        all      1.60      0.08      0.86      0.00      0.00     97.45
paulgorman@falstaff:~$ 
paulgorman@falstaff:~$ sar -n DEV 1 1
Linux 2.6.32-5-amd64 (falstaff) 	09/29/2011 	_x86_64_	(8 CPU)

10:16:43 AM     IFACE   rxpck/s   txpck/s    rxkB/s    txkB/s   rxcmp/s   txcmp/s  rxmcst/s
10:16:44 AM        lo      0.00      0.00      0.00      0.00      0.00      0.00      0.00
10:16:44 AM      eth0      1.00      3.00      0.07      0.19      0.00      0.00      0.00
10:16:44 AM      pan0      0.00      0.00      0.00      0.00      0.00      0.00      0.00
10:16:44 AM  vboxnet0      0.00      0.00      0.00      0.00      0.00      0.00      0.00

Average:        IFACE   rxpck/s   txpck/s    rxkB/s    txkB/s   rxcmp/s   txcmp/s  rxmcst/s
Average:           lo      0.00      0.00      0.00      0.00      0.00      0.00      0.00
Average:         eth0      1.00      3.00      0.07      0.19      0.00      0.00      0.00
Average:         pan0      0.00      0.00      0.00      0.00      0.00      0.00      0.00
Average:     vboxnet0      0.00      0.00      0.00      0.00      0.00      0.00      0.00
paulgorman@falstaff:~$ 

Other tools from sysstat:

• sar collects and displays ALL system activities statistics.
• sadc stands for “system activity data collector”. This is the sar backend tool that does the data collection.
• sa1 stores system activities in binary data file. sa1 depends on sadc for this purpose. sa1 runs from cron.
• sa2 creates daily summary of the collected statistics. sa2 runs from cron.
• sadf can generate sar report in CSV, XML, and various other formats. Use this to integrate sar data with other tools.
• iostat generates CPU, I/O statistics
• mpstat displays CPU statistics.
• pidstat reports statistics based on the process id (PID)
• nfsiostat displays NFS I/O statistics.
• cifsiostat generates CIFS statistics.

service controls and reports on init scripts.

paulgorman@falstaff:~$ sudo service ssh status
[sudo] password for paulgorman: 
sshd is running.
paulgorman@falstaff:~$ 
paulgorman@falstaff:~$ sudo service --status-all
 [ + ]  acpid
 [ ? ]  alsa-utils
 [ - ]  anacron
 [ + ]  apache2
 [ + ]  atd
 [ + ]  avahi-daemon
 [ ? ]  binfmt-support
 [ + ]  bluetooth
 [ - ]  bootlogd
...
paulgorman@falstaff:~$ 
paulgorman@falstaff:~$ sudo service cups restart
Restarting Common Unix Printing System: cupsd. 

ssh -X hostname with X11 redirection

To work around having to run an X client as root on the remote box:

~ $ sudo su -
X11 connection rejected because of wrong authentication.
ROOT! ~ # xauth merge ~paulgorman/.Xauthority

stat for detailed file info

stat filename shows all kinds of stuff about the file, including its permissions in octal format, the number of links to it, and its last modification time.

strace tracks process system calls

If a command reliably produces an error, strace -f -o /tmp/trace.txt mycommand may give a clue if you look for the error string in its output.

sudo su don't

It's generally better to use sudo -s; it preserves more of your regular user environment, and provides better accountability. sudo -i is similar, but runs the login shell specified in the user's passwd entry; it may be useful if you need to sudo into a particular user's login environment. Both are superior to sudo su in most cases.

21:17 bava ~ $ sudo -s
Temperature: 70.9 F (21.6 C)
Relative Humidity: 58%
Wind: from the NE (040 degrees) at 5 MPH (4 KT)
Sky conditions: clear
ROOT! bava ~ # pwd
/home/paulgorman
ROOT! bava ~ # whoami
root
ROOT! bava ~ # ls ~
august     Dropbox              june          output.xkb    tmp
bin        foo.png              bar.pdf       Pictures      Videos
Books      emacstest.txt        marks         Public        websters1913-29765-8.txt
Desktop    emacstest.txt~       mbox          repo          xboxdrv
Documents  gPodder              Music         server-0.xkb  zine_cover_art_WORKING
Downloads  july                 Notes         Templates
ROOT! bava ~ # exit
exit
21:28 bava ~ $ sudo -i
ROOT! bava ~ # pwd
/root
ROOT! bava ~ # whoami
root
ROOT! bava ~ # ls ~
backup.log  bin  crontab.txt
ROOT! bava ~ # exit
logout
21:29 bava ~ $

tar archives files

Create archive with compression:

tar -cvzf newarchive.tgz myfile

If you're archive directory foo, but don't want to include subdirectory bar:

tar -cvzf newarchive.tgz foo --exclude foo/bar

Add foo to existing archive bar.tar:

tar -rvf bar.tar foo

Unpack an archive (extract, verbose, gzip, file):

tar -xvzf myarchive.tgz

List the contents of existing archive (without unpacking):

tar -tzf myarchive.tgz

tac like cat, but last line first

tac /var/log/apache2/error.log | less

time process execution duration

Show how long a process ran:

paulgorman@falstaff:~/2011$ time ping 10.0.36.1
PING 10.0.36.1 (10.0.36.1) 56(84) bytes of data.
64 bytes from 10.0.36.1: icmp_req=1 ttl=254 time=19.5 ms
64 bytes from 10.0.36.1: icmp_req=2 ttl=254 time=41.6 ms
64 bytes from 10.0.36.1: icmp_req=63 ttl=254 time=18.0 ms
64 bytes from 10.0.36.1: icmp_req=64 ttl=254 time=33.9 ms
^C
--- 10.0.36.1 ping statistics ---
64 packets transmitted, 64 received, 0% packet loss, time 63035ms
rtt min/avg/max/mdev = 17.904/26.518/55.178/9.103 ms

real	1m3.119s
user	0m0.004s
sys	0m0.008s
paulgorman@falstaff:~/2011$

timeout kills command after duration

timeout 2s weather dtw

top monitors the system

• h for help
• Z picks colors
• x highlights the sort column
• Left and right carrots change the sort column
• R reversed to sort order
• V turns on tree mode to show process parents and children, which is interesting if not always useful
• i toggles idle tasks
• If you hit W immediately before quiting with q, top will save your current settings as its defaults.

If I just wanted to watch java processes:

top -p `pidof java | sed 's/\s/,/g'`

htop is worth a look.

ulimit limits a process's memory

Limit the resources (in this example, memory and virtual memory in kb) used by a process (sets limits on that particular shell):

ulimit -m 512000 -v 512000

Show the limits for the current shell:

ulimit -a

uptime summarizes system health

paulgorman@bava:~$ uptime
 22:22:42 up 4 days,  2:27,  1 user,  load average: 0.05, 0.16, 0.25

Note the load average number too. This is how many process had to wait to run during the last one, five, and fifteen minutes.

watch something repetatively

The watch command executes another command at a specified interval (defaulting to every two seconds).

watch -cdn1 free
watch -cd 'ls -l | grep log'

(-c interprets ANSI color codes, -d highlights changes, and -nN sets the interval.)

whatis the function of a program?

I use whereis all the time, but forget about whatis.

paulgorman@falstaff:~$ whatis sed
sed (1)              - stream editor for filtering and transforming text
paulgorman@falstaff:~$ 

vimdiff is diff in vim

The utility of diff with the power of vim.

• do Get changes from other window into the current window.
• dp Put the changes from current window into the other window.
• ]c Jump to the next change.
• [c Jump to the previous change.
• Ctrl-W Ctrl-W Switch to the other split window.

xargs combines commands

xfontsel GUI for selecting an X font

xlsfonts lists X fonts

xrandr --output DVI-0 --brightness 0.5 reduces brightness

xrandr can also do stuff like rotate the screen.

xrdb ~/.Xdefaults reloads X settings

zcat, zgrep, zless work on compressed files

Creating a swapfile

$ sudo -s
# fallocate -l 8G /swapfile
# chmod 600 /swapfile
# mkswap /swapfile
# swapon /swapfile

Add to /etc/fstab:

/swapfile none swap defaults 0 0

free -m should show your swap.

Tips from commandlinefu.com

command !$

Substitute last argument from last command

sudo !!

Re-run last command through sudo

python -m SimpleHTTPServer

Server current directory at http://localhost:8000/

:w !sudo tee %

In vim, save if you forgot to start editing with elevated privileges

^foo^bar

Re-run last command, but replace foo with bar

mtr example.com

mtr is like ping with traceroute

[SPACE] command

Commands prepended with a space are not saved in your command history

mount | column -t

Display mount in nice columns. Note: findmnt is nice, if available.

echo "ls -l" | at midnight

Schedule a one-off command

sudo netstat -tlnp

List listening ports, with controlling process ID

mount -t tmpfs tmpfs /mnt -o size=1024m

Make a RAM disk

man ascii

Show ASCII character table

(cd /tmp && ls)

Jump to directory, run command, and return to current directory

net rpc shutdown -I ipAddressOfWindowsPC -U username%password

Shut down a windows box. 'net rpc' to see other commands.

python -m smtpd -n -c DebuggingServer localhost:1025

Start simple email server that shows messages on STDOUT

rm !(*.foo|*.bar|*.baz)

Delete all files that don't match the pattern. The extglob option must be enabled (shopt -s extglob) for negative wildcards to work when pattern matching. And you don't want any spaces between the pipes. It would be a fine idea to test the above with ls !(*.foo|*.bar|*.baz)

man hier

Describes the filesystem hierarchy

mount /path/to/file.iso /mnt/cdrom -oloop

Mount an ISO image

watch -n 1 mysqladmin --user= --password= processlist

Monitor queries being run by MySQL

rename 's/-/_/' ./*

Rename files in current directory according to pattern

chmod --reference file1 file2

Makes file2 permissions the same as file1

tar -tf | xargs rm -r

Remove files also found in archive

© Paul Gorman