categories:
who -b
system boot Jan 8 08:47
who -r
run-level 5 Jan 8 08:47
last reboot
reboot system boot 5.0.0-37-generic Wed Jan 8 08:47 still running
reboot system boot 5.0.0-37-generic Tue Jan 7 08:51 - 20:01 (11:09)
reboot system boot 5.0.0-37-generic Mon Jan 6 08:43 - 23:09 (14:25)
reboot system boot 5.0.0-37-generic Sun Jan 5 09:21 - 22:31 (13:10)
reboot system boot 5.0.0-37-generic Sat Jan 4 11:42 - 22:00 (10:18)
reboot system boot 5.0.0-37-generic Fri Jan 3 08:53 - 22:03 (13:10)
wtmp begins Wed Jan 1 18:41:57 2020
#如果只需要查看最后一次Linux系统启动的时间
last reboot | head -1
reboot system boot 5.0.0-37-generic Wed Jan 8 08:47 still running
#/proc/uptime
date -d "`cut -f1 -d. /proc/uptime` seconds ago"
Wed Jan 8 08:47:07 CST 2020
netstat -lnatup | grep :22
tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN 1264/sshd
tcp 0 0 192.168.8.135:22 192.168.8.101:56244 ESTABLISHED 14493/sshd: anyux [
tcp6 0 0 :::22 :::* LISTEN 1264/sshd
ss -lnatup | grep :22
tcp LISTEN 0 128 0.0.0.0:22 0.0.0.0:* users:(("sshd",pid=1264,fd=3))
tcp ESTAB 0 0 192.168.8.135:22 192.168.8.101:56244 users:(("sshd",pid=14495,fd=3),("sshd",pid=14493,fd=3))
tcp LISTEN 0 128 [::]:22 [::]:* users:(("sshd",pid=1264,fd=4))
#搜索被某一进程打开的相关文件
lsof -p `ps -ef | grep ssh | head -1 | awk '{print $2}'` | head -5
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
sshd 1264 root cwd DIR 8,21 4096 2 /
sshd 1264 root rtd DIR 8,21 4096 2 /
sshd 1264 root txt REG 8,21 786856 3803186 /usr/sbin/sshd
sshd 1264 root mem REG 8,21 47568 2889896 /lib/x86_64-linux-gnu/libnss_files-2.27.so
#查看被打开某一文件的相关进程信息
root@anyux:~# lsof /proc/ | head -5
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
systemd 1 root 11r REG 0,4 0 15476 /proc/1/mountinfo
systemd 1 root 13r REG 0,4 0 4026532071 /proc/swaps
systemd-j 315 root 10r REG 0,4 0 14917 /proc/sys/kernel/hostname
systemd-r 814 systemd-resolve 7r REG 0,4 0 14917 /proc/sys/kernel/hostname
#查看网络连接
root@anyux:~# lsof -i:22
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
sshd 1264 root 3u IPv4 35389 0t0 TCP *:ssh (LISTEN)
sshd 1264 root 4u IPv6 35391 0t0 TCP *:ssh (LISTEN)
sshd 14493 root 3u IPv4 179110 0t0 TCP anyux:ssh->shz:56244 (ESTABLISHED)
sshd 14495 anyux 3u IPv4 179110 0t0 TCP anyux:ssh->shz:56244 (ESTABLISHED)
#查看活动的连接:
lsof -i @192.168.8.101
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
sshd 14493 root 3u IPv4 179110 0t0 TCP anyux:ssh->shz:56244 (ESTABLISHED)
sshd 14495 anyux 3u IPv4 179110 0t0 TCP anyux:ssh->shz:56244 (ESTABLISHED)
#查看某个用户的打开的文件
lsof -u root | head -5
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
systemd 1 root cwd DIR 8,21 4096 2 /
systemd 1 root rtd DIR 8,21 4096 2 /
systemd 1 root txt REG 8,21 1595792 2891189 /lib/systemd/systemd
systemd 1 root mem REG 8,21 1700792 2889869 /lib/x86_64-linux-gnu/libm-2.27.so
#查看非某个用户的打开的文件
lsof -u ^root | head -5
#查看当前登录用户信息
who /var/log/wtmp | head -5
anyux pts/0 2020-01-01 18:41 (192.168.8.101)
anyux pts/0 2020-01-01 23:27 (192.168.8.101)
root :0 2020-01-03 08:55 (:0)
root :0 2020-01-04 11:42 (:0)
anyux pts/1 2020-01-04 21:01 (192.168.8.101)
#查看用户登录历史
last anyux | head -5
anyux pts/0 192.168.8.101 Thu Jan 9 09:10 gone - no logout
anyux pts/4 192.168.8.101 Wed Jan 8 20:36 - 22:15 (01:38)
anyux pts/0 192.168.8.101 Wed Jan 8 20:17 - 20:36 (00:19)
anyux pts/0 192.168.8.101 Wed Jan 8 14:16 - 16:54 (02:38)
anyux pts/0 192.168.8.101 Mon Jan 6 18:06 - down (05:02)
#查看所有用户最近一次登录历史
#命令将读取/var/log/lastlog文件;用户排列顺序按照/etc/passwd中的顺序
lastlog | head -5
Username Port From Latest
root **Never logged in**
daemon **Never logged in**
bin **Never logged in**
sys **Never logged in**
#查看用户anyux的登陆历史
lastlog -u anyux | head -5
Username Port From Latest
anyux pts/0 192.168.8.101 四 1月 9 09:10:27 +0800 2020
#查看最近1天之内的登陆历史
lastlog -t 1
Username Port From Latest
anyux pts/0 192.168.8.101 四 1月 9 09:10:27 +0800 2020
#根据/var/log/wtmp文件中的登陆和退出时间报告用户连接的时间(小时),默认输出报告总时间
#-p:显示每个用户的连接时间
#-d:显示每天的连接时间
#-y:显示年份,和-d配合使用
ac -p
root 76.27
anyux 17.82
total 94.09
ac -d
Jan 1 total 4.99
Jan 2 total 2.68
Jan 3 total 13.14
Jan 4 total 10.56
Jan 5 total 13.17
Jan 6 total 19.46
Jan 7 total 11.16
Jan 8 total 18.10
Today total 0.84
ac -y
total 94.09
查看%wa,IO等待所占用的CPU时间的百分比,高过30%时IO压力高
top
top - 09:34:40 up 47 min, 2 users, load average: 0.00, 0.07, 0.20
Tasks: 276 total, 1 running, 227 sleeping, 0 stopped, 1 zombie
%Cpu(s): 0.2 us, 0.2 sy, 0.4 ni, 99.1 id, 0.0 wa, 0.0 hi, 0.0 si, 0.0 st
如果 %util 接近 100%,说明产生的I/O请求太多,I/O系统已经满负荷,该磁盘可能存在瓶颈。
idle小于70% IO压力就较大了,一般读取速度有较多的wait.
iostat -x 1 1 | grep sd* -A1 |grep -v "loop*"| column -t
avg-cpu: %user %nice %system %iowait %steal %idle
6.08 1.75 1.67 0.10 0.00 90.40
--
Device r/s w/s rkB/s wkB/s rrqm/s wrqm/s %rrqm %wrqm r_await w_await aqu-sz rareq-sz wareq-sz svctm %util
--
sda 1.29 0.01 55.79 0.04 0.05 0.00 3.52 37.50 4.06 11.95 0.00 43.31 6.00 1.04 0.13
sdb 20.01 5.56 424.68 257.25 0.35 6.30 1.72 53.12 1.04 1.00 0.00 21.22 46.24 0.43 1.10
time dd if=/dev/zero bs=1M count=2048 of=direct_2G
iostat -d 2 3 | grep sd*
Device tps kB_read/s kB_wrtn/s kB_read kB_wrtn
sda 1.00 38.37 1.07 186305 5204
sdb 18.06 288.89 188.41 1402544 914708
Device tps kB_read/s kB_wrtn/s kB_read kB_wrtn
sda 0.00 0.00 0.00 0 0
sdb 0.00 0.00 0.00 0 0
Device tps kB_read/s kB_wrtn/s kB_read kB_wrtn
sda 0.00 0.00 0.00 0 0
sdb 12.00 0.00 76.00 0 152
ps -aux | sort -k4nr | head -n 1
root 3963 2.3 3.7 1161884 299812 tty2 SLl+ 08:48 1:41 /opt/google/chrome/chrome --no-sandbox
ps -aux | sort -k2nr | head -1
root 6953 0.0 0.0 14588 788 pts/0 S+ 10:02 0:00 head -1
time touch {1..10000}
dmidecode
cat /etc/os-release
#内核
uname -a
401 未授权:登录失败
403 ?禁止:禁止执行访问?
404 找不到?
500 服务器的内部错误?
502 网关出错?
邮件服务器通过侦听TCP端口110提供POP3服务
egrep -v "#|^$" httpd.conf
#!/bin/bash
tname="admin"
tpasswd="123"
name=''
passwd=''
function login(){
echo "请输入用户名:"
read name
echo "请输入密码:"
read passwd
}
function check(){
if [ ${tname} == ${name} -a ${tpasswd} == ${passwd} ]; then
echo "登录成功"
exit 0
fi
main
}
function main(){
login
check
}
main
awk '{h[$1]++}END{for(i in h) print i,h[i]}' /var/log/nginx/access.log |sort -nrk2 |head | column -t
C ->A ->B
对A的操作
#开启访问
echo 1 > /proc/sys/net/ipv4/ip_forward
#配置
iptables -t nat -A PREROUTING -p tcp -m tcp --dport 80 -j DNAT --to-destination 192.168.50.4:8080
iptables -t nat -A POSTROUTING -d 192.168.50.4/32 -p tcp -m tcp --sport 8080 -j SNAT --to-source 192.168.50.3
iptables -t filter -A INPUT -p tcp -m state --state NEW -m tcp --dport 80 -j ACCEPT
#保存
service iptables save
#重启
service iptables restart
设计到的工具:jstack、jmap、jstat(这三个是jre自带的)wireshark(抓包)等
操作:检查数据库问题,网络问题,服务器状态
服务器状态问题:jvm内存(jmpa-heap查看)服务器内存
io:磁盘读写
cpu:tomcat进程,jstack导出线程文件,jstat 查看GC情况,查看xms,xmx设置
端口:whireshark抓包,查看连接状态
linux下whireshark换成tcpdump抓包,下载,再使用whireshark分析
原文:https://www.cnblogs.com/anyux/p/12201672.html