Linux 下常用命令与技巧汇总 #

date -d "$(awk -F. '{print $1}' /proc/uptime) second ago" +"%Y-%m-%d %H:%M:%S"
2018-01-17 22:27:55

who -b
         system boot  2018-01-17 22:27

uptime -s
2019-09-04 00:40:58

ps -e -o pid,lstart,etime,args

date -s "dd/mm/yyyy hh:mm:ss"

timedatectl set-time "2012-10-30 18:17:16"

hwclock –-systohc

hwclock --hctosys

lscpu               #查看CPU信息
lspci               #查看PCI信息
lsusb               #查看外设USB
lsscsi              #查看SCSI设备
lsblk               #查看块设备
dmidecode -t memory #查内存槽位信息. 不跟 -t , 查全量processor, Memory, BIOS

chattr +i /etc/resolv.conf

$ stat messages
  File: ‘messages’
  Size: 0         	Blocks: 0          IO Block: 4096   regular empty file
Device: fd01h/64769d	Inode: 528438      Links: 1
Access: (0600/-rw-------)  Uid: (    0/    root)   Gid: (    0/    root)
Context: system_u:object_r:var_log_t:s0
Access: 2018-01-14 21:32:01.977218590 +0800
Modify: 2018-01-14 21:32:01.977218590 +0800
Change: 2018-01-14 21:32:01.977218590 +0800
 Birth: -

xxd  -s 1 -l 5 /etc/hosts

$ xxd a.js
0000000: 7661 7220 6120 3d20 310a                 var a = 1.
$ xxd -i a.js
unsigned char a_js[] = {
  0x76, 0x61, 0x72, 0x20, 0x61, 0x20, 0x3d, 0x20, 0x31, 0x0a
};
unsigned int a_js_len = 10;

rename .yumtx .txt yum*

$ df -hT
Filesystem                   Type      Size  Used Avail Use% Mounted on
/dev/mapper/VolGroup-lv_root ext4       50G  8.0G   39G  18% /
devtmpfs                     devtmpfs  484M     0  484M   0% /dev
tmpfs                        tmpfs     495M     0  495M   0% /dev/shm
tmpfs                        tmpfs     495M  460K  494M   1% /run
tmpfs                        tmpfs     495M     0  495M   0% /sys/fs/cgroup
/dev/sda1                    ext4      477M  234M  215M  53% /boot
/dev/mapper/VolGroup-lv_home ext4       12G   41M   11G   1% /home
tmpfs                        tmpfs      99M     0   99M   0% /run/user/0

$ df -hi
Filesystem                   Inodes IUsed IFree IUse% Mounted on
/dev/mapper/VolGroup-lv_root   3.2M  170K  3.0M    6% /
devtmpfs                       121K   389  121K    1% /dev
tmpfs                          124K     1  124K    1% /dev/shm
tmpfs                          124K   498  124K    1% /run
tmpfs                          124K    16  124K    1% /sys/fs/cgroup
/dev/sda1                      126K   358  125K    1% /boot
/dev/mapper/VolGroup-lv_home   740K    31  740K    1% /home
tmpfs                          124K     1  124K    1% /run/user/0

du -xs /tmp/* | sort -rn -k1
8	systemd-private-415928f8a9ee431abb4fdb7f6265aa87-chronyd.service-uw9sq7
4	test
4	empty
4	a.tar.gz

find <PATH> -type f -exec rm {} \;    # 删除查找到的文件, 将 path 改为实际要查找的目录

find [PATH] [option] [action]  

-mtime n : n为数字，意思为在n天之前的“一天内”被更改过的文件；  
-mtime +n : 列出在n天之前（不含n天本身）被更改过的文件名；  
-mtime -n : 列出在n天之内（含n天本身）被更改过的文件名；  
-newer file : 列出比file还要新的文件名  
例如：  
find /root -mtime 0 # 在当前目录下查找今天之内有改动的文件  
  
与文件权限及名称有关的参数：  
-name filename ：找出文件名为filename的文件  
-size [+-]SIZE ：找出比SIZE还要大（+）或小（-）的文件  
-tpye TYPE ：查找文件的类型为TYPE的文件，TYPE的值主要有：一般文件（f)、设备文件（b、c）、  
             目录（d）、连接文件（l）、socket（s）、FIFO管道文件（p）；  
-perm mode ：查找文件权限刚好等于mode的文件，mode用数字表示，如0755；  
-perm -mode ：查找文件权限必须要全部包括mode权限的文件，mode用数字表示  
-perm +mode ：查找文件权限包含任一mode的权限的文件，mode用数字表示  
例如：  
find / -name passwd # 查找文件名为passwd的文件  
find . -perm 0755 # 查找当前目录中文件权限的0755的文件  
find . -size +12k # 查找当前目录中大于12KB的文件，注意c表示byte  

find /tmp -name *.png -type f | xargs tar -cvzf images.tar.gz

ls /etc/*.conf | xargs -i cp {} /home/likegeeks/Desktop/out

grep -i "the" /etc/hosts

grep -A 3 "localhost" /etc/hosts

grep -r "abc" /etc

grep -v "127" /etc/hosts

grep -r "abc" -I /etc

$ tail -3 /var/log/yum.log-20180101
Dec 10 00:35:55 Installed: libvirt-debuginfo-3.2.0-14.el7_4.3.x86_64
Dec 10 18:52:40 Installed: cloud-init-0.7.9-9.el7.centos.2.x86_64
Dec 10 19:50:30 Erased: cloud-init-0.7.9-9.el7.centos.2.x86_64

$ tail -n +770 /var/log/yum.log-20180101
Dec 10 18:52:40 Installed: cloud-init-0.7.9-9.el7.centos.2.x86_64
Dec 10 19:50:30 Erased: cloud-init-0.7.9-9.el7.centos.2.x86_64

mkdir -p new_folder/{folder_1,folder_2,folder_3,folder_4,folder_5}

$ echo $0
-bash

$ echo $?
0

nohup COMMAND  >output.log 2>&1 &

lsmod                               #显示当前装入的内核模块
modinfo module_name                 #显示模块信息
modprobe -c                         #显示模块的配置信息       
modprobe --show-depends module_name #显示模块的依赖信息
modprobe module_name                #手动加载模块
rmmod module_name                   #卸载模块

$ /etc/modprobe.d/bonding.conf
options bonding mode=1

$ cat /etc/modprobe.d/myalias.conf
# Lets you use 'mymod' in MODULES, instead of 'really_long_module_name'
alias mymod really_long_module_name

$ cat /lib/modules/$(uname -r)/modules.builtin
kernel/lib/zlib_deflate/zlib_deflate.ko
kernel/lib/zlib_inflate/zlib_inflate.ko
kernel/lib/crc16.ko
kernel/lib/crc32.ko

$ blkid
/dev/sda1: UUID="04f8e14d-906d-475a-bacc-7d4be966f670" TYPE="ext4"
/dev/sda2: UUID="8pXbJg-c7bG-CzS4-Xs9Y-SdBD-TYOJ-0r9hgF" TYPE="LVM2_member"
/dev/mapper/VolGroup-lv_swap: UUID="c058935d-34e0-403c-82f6-435b1c8194ce" TYPE="swap"
/dev/mapper/VolGroup-lv_root: UUID="e9fe20ee-5d6f-4610-98ca-7cbed5d012ad" TYPE="ext4"
/dev/mapper/VolGroup-lv_home: UUID="43578ba0-a809-4274-931d-b92f881196ad" TYPE="ext4"
$ blkid | column -t
/dev/sda1:                     UUID="04f8e14d-906d-475a-bacc-7d4be966f670"    TYPE="ext4"
/dev/sda2:                     UUID="8pXbJg-c7bG-CzS4-Xs9Y-SdBD-TYOJ-0r9hgF"  TYPE="LVM2_member"
/dev/mapper/VolGroup-lv_swap:  UUID="c058935d-34e0-403c-82f6-435b1c8194ce"    TYPE="swap"
/dev/mapper/VolGroup-lv_root:  UUID="e9fe20ee-5d6f-4610-98ca-7cbed5d012ad"    TYPE="ext4"
/dev/mapper/VolGroup-lv_home:  UUID="43578ba0-a809-4274-931d-b92f881196ad"    TYPE="ext4"

$ grep -E "sshd|qemu" /etc/passwd | column -t -s:
sshd  x  74   74   Privilege-separated SSH  /var/empty/sshd  /sbin/nologin
qemu  x  107  107  qemu user                /                /sbin/nologin

$ strings /proc/1158/environ
LANG=en_US.UTF-8
PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin
NOTIFY_SOCKET=/run/systemd/notify
SSH_USE_STRONG_RNG=0

readlink /proc/[pid]/exe

pwdx [pid]

$ lsof /var/log/audit/audit.log
COMMAND PID USER   FD   TYPE DEVICE SIZE/OFF   NODE NAME
auditd  669 root    5w   REG  253,1  2027785 524474 /var/log/audit/audit.log

$ lsof /

$ lsof +D /var/spool/
COMMAND  PID    USER   FD   TYPE DEVICE SIZE/OFF   NODE NAME
master  1297    root  cwd    DIR  253,1     4096 524402 /var/spool/postfix
master  1297    root   10uW  REG  253,1       33 524591 /var/spool/postfix/pid/master.pid
qmgr    1301 postfix  cwd    DIR  253,1     4096 524402 /var/spool/postfix
pickup  4178 postfix  cwd    DIR  253,1     4096 524402 /var/spool/postfix

$ lsof -u tcpdump
COMMAND   PID    USER   FD   TYPE DEVICE SIZE/OFF    NODE NAME
tcpdump 17905 tcpdump  cwd    DIR  253,1     4096 2752513 /root
tcpdump 17905 tcpdump  rtd    DIR  253,1     4096       2 /
tcpdump 17905 tcpdump  txt    REG  253,1   929928 1323976 /usr/sbin/tcpdump
tcpdump 17905 tcpdump  mem    REG  253,1    62184 1328951 /usr/lib64/libnss_files-2.17.so
tcpdump 17905 tcpdump  mem    REG    0,7           231120 socket:[231120] (stat: No such file or directory)
tcpdump 17905 tcpdump  mem    REG  253,1    90664 1311459 /usr/lib64/libz.so.1.2.7
tcpdump 17905 tcpdump  mem    REG  253,1    19776 1328757 /usr/lib64/libdl-2.17.so
tcpdump 17905 tcpdump  mem    REG  253,1  2127336 1314561 /usr/lib64/libc-2.17.so
tcpdump 17905 tcpdump  mem    REG  253,1   266496 1312167 /usr/lib64/libpcap.so.1.5.3
tcpdump 17905 tcpdump  mem    REG  253,1  2512448 1312014 /usr/lib64/libcrypto.so.1.0.2k
tcpdump 17905 tcpdump  mem    REG  253,1    23968 1311919 /usr/lib64/libcap-ng.so.0.0.0
tcpdump 17905 tcpdump  mem    REG  253,1   164264 1311451 /usr/lib64/ld-2.17.so
tcpdump 17905 tcpdump    0u   CHR  136,1      0t0       4 /dev/pts/1
tcpdump 17905 tcpdump    1u   CHR  136,1      0t0       4 /dev/pts/1
tcpdump 17905 tcpdump    2u   CHR  136,1      0t0       4 /dev/pts/1
tcpdump 17905 tcpdump    3u  pack 231120      0t0     ALL type=SOCK_RAW
tcpdump 17905 tcpdump    4w   REG  253,1   864256 2756467 /root/abc2

$ fuser -v /
                     USER        PID ACCESS COMMAND
/:                   root     kernel mount /
                     root          1 .rc.. systemd
                     root          2 .rc.. kthreadd
                     root          3 .rc.. ksoftirqd/0
                     root          5 .rc.. kworker/0:0H

fuser -k /

dd if=/dev/zero of=/tmp/abc.txt bs=1M count=10

rpm -qa

rpm -qf /etc/ssh/sshd_config

rpm -qf `which strace`

rpm -ql strace

rpm -qc openssh-server

rpm -qd openssh-server

$ rpm -q --scripts openssh-server
preinstall scriptlet (using /bin/sh):
getent group sshd >/dev/null || groupadd -g 74 -r sshd || :
getent passwd sshd >/dev/null || \
  useradd -c "Privilege-separated SSH" -u 74 -g sshd \
  -s /sbin/nologin -r -d /var/empty/sshd sshd 2> /dev/null || :
postinstall scriptlet (using /bin/sh):

if [ $1 -eq 1 ] ; then
        # Initial installation
        systemctl preset sshd.service sshd.socket >/dev/null 2>&1 || :
fi
preuninstall scriptlet (using /bin/sh):

if [ $1 -eq 0 ] ; then
        # Package removal, not upgrade
        systemctl --no-reload disable sshd.service sshd.socket > /dev/null 2>&1 || :
        systemctl stop sshd.service sshd.socket > /dev/null 2>&1 || :
fi
postuninstall scriptlet (using /bin/sh):

systemctl daemon-reload >/dev/null 2>&1 || :
if [ $1 -ge 1 ] ; then
        # Package upgrade, not uninstall
        systemctl try-restart sshd.service >/dev/null 2>&1 || :
fi

rpm -qa --queryformat "%-35{NAME} %{VERSION} %{RELEASE} %{INSTALLTIME:date}\n"
jzlib                               1.1.1 6.el7 Thu 27 Jun 2019 11:30:01 AM HKT
nss                                 3.36.0 7.1.el7_6 Tue 11 Jun 2019 11:13:42 PM HKT
hamcrest                            1.3 6.el7 Thu 27 Jun 2019 11:30:01 AM HKT
dhcp-libs                           4.2.5 68.el7.centos.1 Tue 11 Jun 2019 11:13:43 PM HKT

rpm -q --changelog openssh-server

rpm -q --provides glibc

rpm -q --whatrequires [CAPABILITY]

rpm -q -R glibc

rpm -q --whatprovides [CAPABILITY]

$ rpm  -V openssh-server
S.5....T.  c /etc/ssh/sshd_config

rpm -ivh abc.rpm

rpm -e abc.rpm

rpm -Uvh abc.rpm

rpm -ql -p abc.rpm

yum install a            #安装软件包a   (加上-y选项，可以在安装软件包时，不弹出是否继续的提示)
yum install xxx --downloadonly --downloaddir=/xxx  #只下载,不安装.
yum reinstall xxx        #重装
yum remove a             #卸载软件包a
yum groups list          #查看已安装的软件组和可用的软件组
yum groups  install "Basic Web Server"    #安装软件组
yum groups remove "Basic Web Server"      #卸载软件组
yum info a               #查看软件包a的相关信息，如大小，版本等...
yum update a             #更新软件包a
yum update               #整体更新所有可更新的软件包
yum provides 文件或目录    #查看文件由哪个rpm包提供的
yum search tree          #从仓库中搜索关键词为tree的包
yum history              #查看yum运行历史记录

$ yum list --showduplicates systemd
Installed Packages
systemd.x86_64                  219-42.el7_4.1                  @updates
Available Packages
systemd.x86_64                  219-42.el7                      base
systemd.x86_64                  219-42.el7_4.1                  updates
systemd.x86_64                  219-42.el7_4.4                  updates

yum install systemd-219-42.el7_4.4

$ yum history info 307
Loaded plugins: auto-update-debuginfo, fastestmirror
Transaction ID : 307
Begin time     : Sat Dec  9 20:24:11 2017
Begin rpmdb    : 700:b36eb7acc22b3ab4b107097d0b740dc6bfd84a58
End time       :            20:24:12 2017 (1 seconds)
End rpmdb      : 701:df2089f95d28d6f1f19561b39352bf3dd7a98c75
User           : root <root>
Return-Code    : Success
Command Line   : install qemu-kvm
Transaction performed with:
    Installed     rpm-4.11.3-25.el7.x86_64                      @base
    Installed     yum-3.4.3-154.el7.centos.noarch               @base
    Installed     yum-plugin-fastestmirror-1.1.31-42.el7.noarch @base
Packages Altered:
    Updated qemu-img-10:1.5.3-141.el7_4.2.x86_64        @updates
    Update           10:1.5.3-141.el7_4.4.x86_64        @updates
    Install qemu-kvm-10:1.5.3-141.el7_4.4.x86_64        @updates
    Updated qemu-kvm-common-10:1.5.3-141.el7_4.2.x86_64 @updates
    Update                  10:1.5.3-141.el7_4.4.x86_64 @updates
history info

$ yum history list  cloud-init
Loaded plugins: auto-update-debuginfo, fastestmirror
ID     | Command line             | Date and time    | Action(s)      | Altered
-------------------------------------------------------------------------------
   312 | erase cloud-init         | 2018-01-11 00:07 | Erase          |    1
   311 | install cloud-init       | 2018-01-11 00:01 | Install        |    1
   310 | erase cloud-init         | 2017-12-10 19:50 | Erase          |    1
   309 | install cloud-init       | 2017-12-10 18:52 | Install        |    1
   306 | erase cloud-init         | 2017-12-09 13:09 | Erase          |    1
   301 | install cloud-init       | 2017-10-14 11:49 | Install        |    5
history list

$ yum deplist strace
package: strace.x86_64 4.12-4.el7
  dependency: /bin/sh
   provider: bash.x86_64 4.2.46-29.el7_4
  dependency: libc.so.6(GLIBC_2.15)(64bit)
   provider: glibc.x86_64 2.17-196.el7_4.2
  dependency: libgcc_s.so.1()(64bit)
   provider: libgcc.x86_64 4.8.5-16.el7_4.1
  dependency: libgcc_s.so.1(GCC_3.0)(64bit)
   provider: libgcc.x86_64 4.8.5-16.el7_4.1
  dependency: libgcc_s.so.1(GCC_3.3.1)(64bit)
   provider: libgcc.x86_64 4.8.5-16.el7_4.1
  dependency: rtld(GNU_HASH)
   provider: glibc.x86_64 2.17-196.el7_4.2
   provider: glibc.i686 2.17-196.el7_4.2

tar -xzvf abc.tar.gz               #解压缩
tar -xzvf abc.tar.gz -C /path      #解压缩到制动的path目录下
tar -tzvf abc.tar.gz               #不解压,只查看文件列表
tar -czvf abc.tar.gz a.txt b.txt   #将 a.txt 和 b.txt 压缩为 abc.tar.gz

gzip -d FileName.gz      #解压
gzip FileName            #压缩

bzip2 -d FileName.bz2    #解压

tar jxvf FileName.tar.bz2 #解压

uncompress FileName.Z    #解压
compress FileName        #压缩

unzip FileName.zip       #解压
zip FileName.zip DirName #压缩

rar x FileName.rar                #解压
rar a FileName.rar DirName        #压缩

rpm2cpio FileName.rpm | cpio -div   #解包

ar p FileName.deb data.tar.gz | tar -xzvf  #解包

systemctl    -t help            #列出所有的单元类型
systemctl --type "unit"         #查看指定单元类型的状况, 替换 unit 为 "mount", "service", "socket"等
systemctl --failed              #查看所有加载失败的单元信息
systemctl status sshd           #查看sshd服务单元状况
systemctl start sshd            #启动sshd服务单元
systemctl stop sshd             #停止sshd服务单元
systemctl restart sshd          #重启sshd服务单元
systemctl enable sshd           #配置sshd服务单元开机自动启动
systemctl disable sshd          #配置sshd服务单元开机不启动
systemctl reload sshd           #重新加载sshd服务单元的配置文件
systemctl mask sshd             #彻底屏蔽sshd服务单元
systemctl unmask sshd           #取消屏蔽sshd服务单元
systemctl list-units            #列出当前所有的单元, 这是 systemctl 的默认命令
systemctl get-default           #查看系统默认启动的Target
systemctl set-default multi-user.target  # 设置系统默认的target为 多用户模式
systemctl list-dependencies multi-user.target  #查看该target下所有的unit
systemctl list-dependencies sshd   # 查看一个service所依赖的所有unit
systemctl list-dependencies --reverse sshd   # 查看哪个unit依赖该服务
systemctl list-dependencies --before sshd   # 查看所有unit after sshd, 也就是 sshd 配置里的before=
systemctl list-dependencies --after sshd   # 查看所有unit before sshd
systemctl cat sshd              #查看service的配置文件
systemctl show sshd             #查看service的配置参数, 不带 service则显示默认的配置. 可用来查询nofile, noproc等限制资源参数
systemctl list-jobs             #查看有哪些job仍在运行或者等待运行

$ systemctl | grep LSB
  network.service       loaded active running   LSB: Bring up/down networking
  prl-x11.service       loaded active exited    LSB: Autostart script for Parallels service
  prltoolsd.service     loaded active running   LSB: Autostart script for guest tools service.

$ systemctl --version
systemd 219
+PAM +AUDIT +SELINUX +IMA -APPARMOR +SMACK +SYSVINIT +UTMP +LIBCRYPTSETUP +GCRYPT +GNUTLS +ACL +XZ -LZ4 -SECCOMP +BLKID +ELFUTILS +KMOD +IDN

$ systemd-analyze
Startup finished in 579ms (kernel) + 2.964s (initrd) + 8.899s (userspace) = 12.442s

$ systemd-analyze blame | head -5
          4.949s NetworkManager-wait-online.service
          3.379s network.service
           987ms postfix.service
           656ms dev-mapper-VolGroup\x2dlv_root.device
           591ms lvm2-monitor.service

$ systemd-analyze critical-chain
The time after the unit is active or started is printed after the "@" character.
The time the unit takes to start is printed after the "+" character.

multi-user.target @8.863s
└─postfix.service @7.864s +987ms
  └─network.target @7.856s
    └─NetworkManager.service @2.459s +64ms
      └─network-pre.target @2.458s
        └─firewalld.service @1.934s +523ms
          └─polkit.service @1.724s +203ms
            └─basic.target @1.721s
              └─sockets.target @1.721s
                └─iscsiuio.socket @1.721s
                  └─sysinit.target @1.709s
                    └─systemd-update-utmp.service @1.700s +8ms
                      └─auditd.service @1.426s +272ms
                        └─systemd-tmpfiles-setup.service @1.358s +58ms
                          └─rhel-import-state.service @1.303s +52ms
                            └─local-fs.target @1.299s
                              └─home.mount @1.283s +15ms
                                └─systemd-fsck@dev-mapper-VolGroup\x2dlv_home.service @1.266s +14ms
                                  └─dev-mapper-VolGroup\x2dlv_home.device @1.265s

systemd-analyze plot >a.svg

journalctl                       # 查看所有日志（默认情况下 ，显示所有可以查看的日志）
journalctl -k                    # 查看内核日志（不显示应用日志）
journalctl -b                    # 查看系统本次启动的日志                 
journalctl -b -1                 # 查看上一次启动的日志（需更改设置）
journalctl -f               # 实时滚动显示最新日志
journalctl /usr/lib/systemd/systemd # 查看指定可执行文件的日志, 必须指定绝对路径
journalctl _PID=1                # 查看指定进程的日志
journalctl -u sshd               # 查看某个 Unit 的日志
journalctl --disk-usage          # 显示日志占据的硬盘空间
journalctl --list-boots          # 显示每次启动的id和时间

journalctl --since "2012-10-30 18:17:16"
journalctl --since "2020-10-01"
journalctl --since "20 min ago"
journalctl --since "-5m"
journalctl --since "-5d"
journalctl --since yesterday
journalctl --since "2015-01-10" --until "2015-01-11 03:00"
journalctl --since 09:00 --until "1 hour ago"

zless /usr/share/doc/<package -name>/changelog.Debian.gz
zless /usr/share/doc/<package -name>/changelog.gz

$ man -k logrotate
dh_installlogrotate (1) - install logrotate config files
logrotate (8) - rotates, compresses, and mails system logs
logrotate.conf (5) - rotates, compresses, and mails system logs

mkdir empty_dir
rsync -a --delete empty_dir/    yourdirectory/

find /tmp -type f -exec rm {} \;      #删除/tmp目录下所有文件

sysctl -a                                       #打印当前参数
sysctl -w net.ipv4.tcp_fin_timeout=30           #实时更新一个系统参数, 高危. 要验证好
sysctl -p                                       #读取/etc/sysctl.conf和 /etc/sysctl.d/下配置文件信息,使其生效  

> abc.txt
cp /dev/null abc.txt

strace -ftT -o a.txt ls -rlt

strace -c ls

strace -p [pid]

strace -e trace=open ls
strace -e trace=open,write ls

$ lsblk -f
NAME   FSTYPE LABEL UUID                                 MOUNTPOINT
vda
└─vda1 ext3         32236b41-fcde-460e-8c34-ba50515b33f2 /
$ blkid
/dev/vda1: UUID="32236b41-fcde-460e-8c34-ba50515b33f2" TYPE="ext3"

ln -s regular_file softlink          创建软连接

HISTTIMEFORMAT="%d/%m/%y %T"
history

$ pstree -p
systemd(1)─┬─agetty(1176)
           ├─auditd(669)───{auditd}(670)
           ├─avahi-daemon(701)───avahi-daemon(720)
           ├─chronyd(721)
           ├─crond(1169)
           ├─dbus-daemon(702)───{dbus-daemon}(730)
           ├─dhclient(4673)
           ├─dnsmasq(1344)───dnsmasq(1345)
           ├─firewalld(776)───{firewalld}(952)
           ├─gssproxy(714)─┬─{gssproxy}(724)
           │               ├─{gssproxy}(725)
           │               ├─{gssproxy}(726)
           │               ├─{gssproxy}(727)
           │               └─{gssproxy}(728)

rsync -azv /var/opt/installation/inventory/ /root/temp/

rsync -avz /root/temp/ thegeekstuff@192.168.200.10:/home/thegeekstuff/temp/

$ ldd `which python`
	linux-vdso.so.1 =>  (0x00007fffb1fb4000)
	libpython2.7.so.1.0 => /lib64/libpython2.7.so.1.0 (0x00007f5dee201000)
	libpthread.so.0 => /lib64/libpthread.so.0 (0x00007f5dedfe5000)
	libdl.so.2 => /lib64/libdl.so.2 (0x00007f5dedde0000)
	libutil.so.1 => /lib64/libutil.so.1 (0x00007f5dedbdd000)
	libm.so.6 => /lib64/libm.so.6 (0x00007f5ded8db000)
	libc.so.6 => /lib64/libc.so.6 (0x00007f5ded517000)
	/lib64/ld-linux-x86-64.so.2 (0x0000561b940b0000)
[root@linux /tmp/new_folder]#

man ascii

iptables -nvL

iptables -A  INPUT -p TCP --dport 22 -j REJECT --reject-with ICMP echo-reply

iptables -t nat -A PREROUTING -p tcp --dport 80 -j REDIRECT--to-ports 8081

iptables -t nat -A POSTROUTING -p TCP -j MASQUERADE --to-ports 21000-31000

iptables -A INPUT -p tcp -j LOG --log-prefix "input packet"

iptables -t nat -A POSTROUTING -p tcp -o eth0 -j SNAT --to-source 192.168.10.15-192.168.10.160:2100-3200

iptables -t nat -A PREROUTING -p tcp -d 15.45.23.67 --dport 80 -j DNAT --to-destination 192.168.10.1-192.168.10.10:80-100

iptables -t mangle -A PREROUTING -p tcp --dport 22 -j MARK --set-mark 22

# set ACCEPT for default action
iptables -P INPUT ACCEPT
iptables -P FORWARD ACCEPT
iptables -P OUTPUT ACCEPT
# flush all chains
iptables -F
# delete all  user-defined chains
iptables -X

iptables -A INPUT -p tcp --dport 21 -j DROP

iptables -nvL --line-numbers

iptables -D INPUT 3

tcpdump -i eth0 -nnv

tcpdump -i eth1 host 192.168.1.1 and port 25

tcpdump -i eth0 -c 1000

tcpdump -i eth0 -C 1 -w abc
$ ls -rlt abc*
-rw-r--r--. 1 tcpdump tcpdump 1001078 Jan 14 23:33 abc
-rw-r--r--. 1 tcpdump tcpdump  647168 Jan 14 23:33 abc1

tcpdump -n -i eth0 'not net 10.0.0.0/8 and not net 192.168.0.0/16 and not net 172.16.0.0/12'

$ dig www.baidu.com @8.8.8.8

; <<>> DiG 9.9.4-RedHat-9.9.4-51.el7 <<>> www.baidu.com @8.8.8.8
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 4712
;; flags: qr rd ra; QUERY: 1, ANSWER: 3, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 512
;; QUESTION SECTION:
;www.baidu.com.			IN	A

;; ANSWER SECTION:
www.baidu.com.		1043	IN	CNAME	www.a.shifen.com.
www.a.shifen.com.	218	IN	A	220.181.112.244
www.a.shifen.com.	218	IN	A	220.181.111.188

;; Query time: 78 msec
;; SERVER: 8.8.8.8#53(8.8.8.8)
;; WHEN: Mon Jan 15 00:03:09 HKT 2018
;; MSG SIZE  rcvd: 101

$ dig -x 74.125.135.105
;; QUESTION SECTION:
;105.135.125.74.in-addr.arpa.   IN      PTR

;; ANSWER SECTION:
105.135.125.74.in-addr.arpa. 83205 IN   PTR     ni-in-f105.1e100.net.

dig +trace www.baidu.com

$ ntpdate ntp1.aliyun.com
15 Jan 23:18:51 ntpdate[18981]: adjust time server 182.92.12.11 offset 0.000643 sec

$ chronyc sources -v
210 Number of sources = 2

  .-- Source mode  '^' = server, '=' = peer, '#' = local clock.
 / .- Source state '*' = current synced, '+' = combined , '-' = not combined,
| /   '?' = unreachable, 'x' = time may be in error, '~' = time too variable.
||                                                 .- xxxx [ yyyy ] +/- zzzz
||      Reachability register (octal) -.           |  xxxx = adjusted offset,
||      Log2(Polling interval) --.      |          |  yyyy = measured offset,
||                                \     |          |  zzzz = estimated error.
||                                 |    |           \
MS Name/IP address         Stratum Poll Reach LastRx Last sample
===============================================================================
^* time5.aliyun.com              2   6    37    41  +2394ns[+1057us] +/-   15ms
^- 120.25.115.19                 2   6    37    40  -2559us[-2559us] +/-   67ms

netstat -lntp

netstat -antp

netstat -rn

netstat -s

$ ethtool -i  eth0
driver: virtio_net
version: 1.0.0
firmware-version:
expansion-rom-version:
bus-info: 0000:00:05.0
supports-statistics: no
supports-test: no
supports-eeprom-access: no
supports-register-dump: no
supports-priv-flags: no

$ ethtool eth0
Settings for eth0:
	Link detected: yes

ip --details link
ip link  show type bridge  #显示所有的桥接设备

!/bin/bash

# Arguments: $1: Interface ('grep'-regexp).

# Static list of types (from `ip link help`):
TYPES=(bond bond_slave bridge dummy gre gretap ifb ip6gre ip6gretap ip6tnl ipip ipoib ipvlan macvlan macvtap nlmon sit vcan veth vlan vti vxlan tun tap)

iface="$1"

for type in "${TYPES[@]}"; do
  ip link show type "${type}" | grep -E '^[0-9]+:' | cut -d ':' -f 2 | sed 's|^[[:space:]]*||' | while read _if; do
    echo "${_if}:${type}"
  done | grep "^${iface}"
done

ip addr

ip addr add 10.211.55.10/24 dev eth0

ip addr del 10.211.55.10/24 dev eth0

$ ip route
default via 10.211.55.1 dev eth0
10.211.55.0/24 dev eth0 proto kernel scope link src 10.211.55.9
192.168.122.0/24 dev virbr0 proto kernel scope link src 192.168.122.1

$ ip route get 192.168.1.1
192.168.1.1 via 10.211.55.1 dev eth0 src 10.211.55.9
    cache

ip route add default via 20.0.0.1

$ ip rule list
0:	from all lookup local
32766:	from all lookup main
32767:	from all lookup default

$ echo "250 test" >> /etc/iproute2/rt_tables
$ ip rule add from 192.168.2.0/24 table test

$ ip route list table main

$ ip rule add from 0/0 table 1 pref 32800

ip rule add from 192.168.3.112/32 [tos 0x10] table ２ pref 1500

ip route add default via 182.169.1.1 table test

$ who
root     pts/0        2018-01-17 22:28 (10.211.55.2)

HISTTIMEFORMAT="%d/%m/%y %T "

PS1="[\e[1;31m\u@\h \e[0;34m${PWD}\e[0m]\\$ "

$ dmidecode -s system-manufacturer
OpenStack Foundation

$ systemd-detect-virt
kvm

$ virt-what
kvm

$ lscpu
Architecture:          x86_64              // 架构 
CPU op-mode(s):        32-bit, 64-bit      // 位数
Byte Order:            Little Endian       // 小端
CPU(s):                2                   // 逻辑cpu数
On-line CPU(s) list:   0,1
Thread(s) per core:    1                   // 一个核有一个线程. 
Core(s) per socket:    2                   // 一个插槽有两个核
Socket(s):             1                   // 总共一个插槽
NUMA node(s):          1
Vendor ID:             GenuineIntel
CPU family:            6
Model:                 69
Model name:            Intel(R) Core(TM) i5-4260U CPU @ 1.40GHz
Stepping:              1
CPU MHz:               2000.000
BogoMIPS:              4000.00
Hypervisor vendor:     KVM                 // 虚拟化类型
Virtualization type:   full                // 全虚拟化
L1d cache:             32K
L1i cache:             32K
L2 cache:              256K
L3 cache:              3072K
NUMA node0 CPU(s):     0,1
............

$ taskset -p 691
pid 691's current affinity mask: 3

# ulimit -n 1048577
-bash: ulimit: op]en files: cannot modify limit: Operation not permitted
# ulimit -n unlimited
-bash: ulimit: open files: cannot modify limit: Operation not permitted
# cat /proc/sys/fs/nr_open
1048576

# sysctl -w fs.nr_open=2147483585
sysctl: setting key "fs.nr_open": Invalid argument
fs.nr_open = 2147483585
# sysctl -w fs.nr_open=2147483584
fs.nr_open = 2147483584

$ cat /proc/sys/fs/file-max
97703

$ cat /proc/sys/fs/file-nr
1344	0	97703

ss -s                #显示各socket的统计信息
ss -ntlp             #-n 不解析, -t 显示tcp连接  -l 显示监听socket, -p 显示使用的进程名
ss -t -a             #查看所有tcp连接, 不带-a则指显示 Established 连接
ss -to               #查看tcp的keepalive信息
ss -ti               #查看tcp的内部信息,比如拥塞算法,rto,rtt,cwnd,ssthresh等
ss -tm               #查看tcp的内存使用信息, 比如收发缓冲区的大小

ss  -A raw,packet_raw  -a -p                             #查看raw socket的信息
ss -tn  state listening                                  #显示处于listening状态的连接
ss -tn  state established                                #显示处于established状态的连接
ss -tn  state listening  '( sport == 22 )'               #显示处于listening状态且源端口为22的连接
ss -tn '( sport == 22 )'                                 #显示源端口为22的连接
ss -tn '( sport != 22 )'                                 #显示源端口不为22的连接
ss -tn '( sport == 22 || dport == 22 )'                  #显示源端口为22或者目标端口为22的连接
ss -tn '( dst 10.211.55.2 && dport == 58181 )'           #显示目标ip为10.211.55.2且目标端口为58181的连接
ss -tn '( src 127.0.0.1 )'                               #显示源ip为 127.0.0.1的连接
ss -tn '( ! dst 10.211.55.2 && dport != 58181 )'         #显示目标ip不是10.211.55.2且目标端口不是58181的连接

faillock --reset
pam_tally2 -r -u [username]

ps aux | awk '{sum+=$6} END {print sum / 1024}'

$ cat rss.sh
#/bin/bash
for PROC in `ls  /proc/|grep "^[0-9]"`
do
  if [ -f /proc/$PROC/statm ]; then
      TEP=`cat /proc/$PROC/statm | awk '{print ($2)}'`
      RSS=`expr $RSS + $TEP`
  fi
done
RSS=`expr $RSS \* 4`
echo $RSS"KB"

xfs_repair -n -v /dev/mapper/vg-home

xfs_repair -v /dev/mapper/vg-home

echo "Linux@123" |passwd --stdin root

udevadm info /dev/sda1
P: /devices/pci0000:00/0000:00:1f.2/ata1/host0/target0:0:0/0:0:0:0/block/sda/sda1
N: sda1
S: disk/by-id/ata-CentOS_Linux-0_SSD_FFACPKN8NC9MK3EX3N4R-part1
S: disk/by-uuid/5de1c8df-9b03-4830-9b56-b96a2290b78f
E: DEVLINKS=/dev/disk/by-id/ata-CentOS_Linux-0_SSD_FFACPKN8NC9MK3EX3N4R-part1 /dev/disk/by-uuid/5de1c8df-9b03-4830-9b56-b96a2290b78f
E: DEVNAME=/dev/sda1
E: DEVPATH=/devices/pci0000:00/0000:00:1f.2/ata1/host0/target0:0:0/0:0:0:0/block/sda/sda1
E: DEVTYPE=partition
E: ID_ATA=1
E: ID_ATA_ROTATION_RATE_RPM=0
E: ID_ATA_SATA=1
E: ID_ATA_SATA_SIGNAL_RATE_GEN1=1

udevadm info -a /dev/sda1
P: /devices/pci0000:00/0000:00:1f.2/ata1/host0/target0:0:0/0:0:0:0/block/sda/sda1
N: sda1
S: disk/by-id/ata-CentOS_Linux-0_SSD_FFACPKN8NC9MK3EX3N4R-part1
S: disk/by-uuid/5de1c8df-9b03-4830-9b56-b96a2290b78f
E: DEVLINKS=/dev/disk/by-id/ata-CentOS_Linux-0_SSD_FFACPKN8NC9MK3EX3N4R-part1 /dev/disk/by-uuid/5de1c8df-9b03-4830-9b56-b96a2290b78f
E: DEVNAME=/dev/sda1
E: DEVPATH=/devices/pci0000:00/0000:00:1f.2/ata1/host0/target0:0:0/0:0:0:0/block/sda/sda1
E: DEVTYPE=partition
E: ID_ATA=1
E: ID_ATA_ROTATION_RATE_RPM=0
E: ID_ATA_SATA=1
E: ID_ATA_SATA_SIGNAL_RATE_GEN1=1

python -m SimpleHTTPServer 8000

dpkg -l

$ dpkg -S /usr/bin/growpart
cloud-guest-utils: /usr/bin/growpart

$ cat /var/log/apt/history.log

top -d 0.1

$ top -Hp 4592
Threads:  11 total,   0 running,  11 sleeping,   0 stopped,   0 zombie
%Cpu(s):  0.0 us,  0.0 sy,  0.0 ni, 98.4 id,  0.0 wa,  1.6 hi,  0.0 si,  0.0 st
MiB Mem :   7809.8 total,   5711.5 free,    910.8 used,   1187.6 buff/cache
MiB Swap:      0.0 total,      0.0 free,      0.0 used.   6748.4 avail Mem

    PID USER      PR  NI    VIRT    RES    SHR S  %CPU  %MEM     TIME+ COMMAND
   4592 root      20   0 1810424 372332  14820 S   0.0   4.7   0:06.87 gopls
   4593 root      20   0 1810424 372332  14820 S   0.0   4.7   0:06.01 gopls
   4594 root      20   0 1810424 372332  14820 S   0.0   4.7   0:00.68 gopls
   4595 root      20   0 1810424 372332  14820 S   0.0   4.7   0:07.53 gopls
   4596 root      20   0 1810424 372332  14820 S   0.0   4.7   0:00.58 gopls
   4597 root      20   0 1810424 372332  14820 S   0.0   4.7   0:00.00 gopls
   4598 root      20   0 1810424 372332  14820 S   0.0   4.7   0:06.96 gopls
   4605 root      20   0 1810424 372332  14820 S   0.0   4.7   0:06.64 gopls
   4644 root      20   0 1810424 372332  14820 S   0.0   4.7   0:06.70 gopls
   4647 root      20   0 1810424 372332  14820 S   0.0   4.7   0:00.01 gopls
   4818 root      20   0 1810424 372332  14820 S   0.0   4.7   0:00.27 gopls

ping -i 0.1 www.163.com

$ ping -s 1024 www.163.com
PING z163ipv6.v.bsgslb.cn (117.23.1.15) 1024(1052) bytes of data.
1032 bytes from 117.23.1.15: icmp_seq=1 ttl=128 time=7.03 ms
1032 bytes from 117.23.1.15: icmp_seq=2 ttl=128 time=7.77 ms

# 使用 grep 查找 Pss 指标后，再用 awk 计算累加值
$ grep Pss /proc/[1-9]*/smaps | awk '{total+=$2}; END {printf "%d kB\n", total }'
391266 kB

7fae7db9f000-7fae7dc8f000 r-xp 00000000 08:05 536861                     /usr/lib/x86_64-linux-gnu/libstdc++.so.6.0.20
7fae7dc8f000-7fae7de8f000 ---p 000f0000 08:05 536861                     /usr/lib/x86_64-linux-gnu/libstdc++.so.6.0.20
7fae7de8f000-7fae7de97000 r--p 000f0000 08:05 536861                     /usr/lib/x86_64-linux-gnu/libstdc++.so.6.0.20
7fae7de97000-7fae7de99000 rw-p 000f8000 08:05 536861                     /usr/lib/x86_64-linux-gnu/libstdc++.so.6.0.20

$ file -i old.txt
old.txt: text/plain; charset=us-ascii

iconv -f iso8859-1 -t utf-8 abc.txt > abc.txt.utf8

convmv -f GBk -t UTF-8 --notest -r *，这

while true; do cat /proc/stat  | grep "cpu " ; sleep 30; done
for n in {1..1000}; do touch a$n; rm -rf a$n; done
for file in $(ls -1 /proc/[1-9]*/status); do grep Name $file; done

no dhcpoffers received
no working leases in persistent database - sleeping

#read -p "PID=" pid
pid=$1
cat /proc/$pid/status|egrep '(Sig|Shd)(Pnd|Blk|Ign|Cgt)'|while read name mask;do
    bin=$(echo "ibase=16; obase=2; ${mask^^*}"|bc)
    echo -n "$name $mask $bin "
    i=1
    while [[ $bin -ne 0 ]];do
        if [[ ${bin:(-1)} -eq 1 ]];then
            kill -l $i | tr '\n' ' '
        fi
        bin=${bin::-1}
        set $((i++))
    done
    echo
done
# vim:et:sw=4:ts=4:sts=4:

auditctl -a always,exit -F arch=b64 -F a1=15 -S kill -k log_kill
auditctl -a always,exit -F arch=b64 -F a1=9 -S kill -k log_kill

localectl set-locale LANG=en_US.UTF-8
localectl set-locale LANG=zh_CN.UTF-8
localectl list-locales

$ abc
-bash: abc: command not found
$ echo $?
127
$ sleep 1000
^C
$ echo $?
130

vi abc.txt
:%!xxd
修改完后,运行下面的命令. 注意左边改动会生效,右边的文本改动不生效
:%!xxd -r

$ ifstat
#kernel
Interface        RX Pkts/Rate    TX Pkts/Rate    RX Data/Rate    TX Data/Rate
                 RX Errs/Drop    TX Errs/Drop    RX Over/Rate    TX Coll/Rate
lo                    14 0            14 0           819 0           819 0
                       0 0             0 0             0 0             0 0
eth0                  25 0            18 0          2058 0          2784 0
                       0 0             0 0             0 0             0 0
virbr0                 0 0             0 0             0 0             0 0
                       0 0             0 0             0 0             0 0
docker0                0 0             0 0             0 0             0 0
                       0 0             0 0             0 0             0 0

$ nstat
#kernel
IpInReceives                    8297               0.0
IpInDelivers                    8297               0.0
IpOutRequests                   7789               0.0
IcmpInMsgs                      6                  0.0
IcmpInErrors                    3                  0.0
IcmpInDestUnreachs              6                  0.0
IcmpOutMsgs                     6                  0.0
IcmpOutDestUnreachs             6                  0.0

$ lnstat -d
/proc/net/stat/nf_conntrack:
	 1: entries
	 2: searched
	 3: found
	 4: new
	 5: invalid
	 6: ignore
	 7: delete
	 8: delete_list
	 9: insert
	10: insert_failed
	11: drop
	12: early_drop
	13: icmp_error
	14: expect_new
	15: expect_create
	16: expect_delete
	17: search_restart
/proc/net/stat/ndisc_cache:
	 1: entries
	 2: allocs
	 3: destroys
	 4: hash_grows
	 5: lookups
	 6: hits
	 7: res_failed
	 8: rcv_probes_mcast
	 9: rcv_probes_ucast
	10: periodic_gc_runs
	11: forced_gc_runs
	12: unresolved_discards

$ lnstat -k "entries,insert_failed"
nf_connt|nf_connt|
 entries|insert_f|
        |   ailed|
       7|       0|
       7|       0|
       7|       0|

$ tc -s qdisc
$ tc -s qdisc ls dev eth0

$ conntrack -L
tcp      6 430950 ESTABLISHED src=10.211.55.22 dst=10.211.55.2 sport=22 dport=51568 src=10.211.55.2 dst=10.211.55.22 sport=51568 dport=22 [ASSURED] mark=0 use=1
tcp      6 5 TIME_WAIT src=10.211.55.22 dst=113.142.161.250 sport=48530 dport=80 src=113.142.161.250 dst=10.211.55.22

$ cat /proc/sys/net/netfilter/nf_conntrack_count
4

$ cat /proc/sys/net/netfilter/nf_conntrack_max
65536

sysctl -w net.nf_conntrack_max=xxxxx

    0     0 ACCEPT     all  --  *      virbr0  0.0.0.0/0            192.168.122.0/24     ctstate RELATED,ESTABLISHED

ClientAliveInterval 60 
ClientAliveCountMax 3 

$ systemctl restart auditd
Failed to restart auditd.service: Operation refused, unit auditd.service may be requested by dependency only (it is configured to refuse manual start/stop).
See system logs and 'systemctl status auditd.service' for details.

$ aureport --start 01/10/2020 07:00:00 --end 01/10/2020 19:00:00

Summary Report
======================
Range of time in logs: 04/27/2019 20:30:36.683 - 01/01/1970 08:00:00.000
Selected time for report: 01/10/2020 07:00:00 - 01/10/2020 19:00:00
Number of changes in configuration: 0
Number of changes to accounts, groups, or roles: 0
Number of logins: 0
Number of failed logins: 0
Number of authentications: 0
Number of failed authentications: 0
Number of users: 0
Number of terminals: 0
Number of host names: 0
Number of executables: 0
Number of commands: 0
Number of files: 0

$ aureport --start yesterday --end today

Summary Report
======================
Range of time in logs: 04/27/2019 20:30:36.683 - 10/01/2020 13:10:43.415
Selected time for report: 09/30/2020 00:00:00 - 10/01/2020 13:12:35
Number of changes in configuration: 46
Number of changes to accounts, groups, or roles: 0
Number of logins: 25
Number of failed logins: 2
Number of authentications: 80
Number of failed authentications: 1
Number of users: 2
Number of terminals: 16
Number of host names: 3
Number of executables: 14
Number of commands: 11
Number of files: 2

$ aureport --start yesterday -e -i --summary

Event Summary Report
======================
total  type
======================
14485  CRYPTO_KEY_USER
8076  USER_START
7639  USER_END
6762  CRED_ACQ
6761  USER_ACCT
6753  LOGIN
6704  CRED_REFR
6527  CRED_DISP
4966  NETFILTER_CFG

$ aureport -x -i --summary

Executable Summary Report
=================================
total  file
=================================
33791  /usr/sbin/sshd
31880  /usr/sbin/crond
7432  /usr/lib/systemd/systemd
4370  /usr/sbin/xtables-multi
651  ?
627  /usr/bin/python2.7
608  /usr/bin/login
309  /usr/bin/kmod
232  /usr/lib/systemd/systemd-update-utmp
204  /
102  /usr/sbin/libvirtd
94  /usr/sbin/tcpdump
60  /usr/bin/su
50  /usr/bin/dockerd-current
42  /usr/sbin/groupadd

$ aureport -t

Log Time Range Report
=====================
/var/log/audit/audit.log.2: 04/27/2019 20:30:36.683 - 12/01/2019 10:40:01.857
/var/log/audit/audit.log.1: 12/01/2019 10:40:01.858 - 06/08/2020 12:20:01.343
/var/log/audit/audit.log: 06/08/2020 12:20:01.358 - 10/01/2020 13:42:52.455

$ ausearch --start today -i

ausearch --start today -i  -m syscall

ausearch --start today -i  -k xxxx

ausearch --start today -i  -f /etc/passwd

awk '{printf "  %6i MB %s \n",$6*$15/256,$1}' /proc/slabinfo | sort -nrk1 | head -10

11: Resource temporarily unavailable
12: Cannot allocate memory