Tag Info

Hot answers tagged

32

On Linux, top actually supports focusing on a single process, although it naturally doesn't have a history graph: top -p PID This is also available on Mac OS X with a different syntax: top -pid PID


32

The lsof command (already mentioned in several answers) will tell you what process has a file open at the time you run it. lsof is available for just about every unix variant. lsof /path/to/file lsof won't tell you about file that were opened two microseconds ago and closed one microsecond ago. If you need to watch a particular file and react when it is ...


31

It might suffice to use watch: $ watch tail -n 15 mylogfile.txt


29

From the tail(1) man page: With --follow (-f), tail defaults to following the file descriptor, which means that even if a tail’ed file is renamed, tail will continue to track its end. This default behavior is not desirable when you really want to track the actual name of the file, not the file descrip- tor (e.g., log rotation). ...


22

You should consider using inotifywait, as an example: inotifywait -m /path -e create -e moved_to | while read path action file; do echo "The file '$file' appeared in directory '$path' via '$action'" # do something with the file done In Ubuntu inotifywait is provided by the inotify-tools package. As of version 3.13 (current in ...


21

Any user, including root, can forward their local email by putting the forwarding address in a file called ~/.forward. You can have multiple addresses there, all on one line and separated by comma. If you want both local delivery and forwarding, put root@localhost as one of the addresses. The system administrator can define email aliases in the file ...


20

If the kernel killed a process (because the system ran out of memory), there will be a kernel log message. Check in /var/log/kern.log (on Debian/Ubuntu, other distributions might send kernel logs to a different file, but usually under /var/log under Linux). Note that if the OOM-killer (out-of-memory killer) triggered, it means you don't have enough virtual ...


16

htop is a great replacement to top. It has... Colors! Simple keyboard shortcuts! Scroll the list using the arrow keys! Kill a process without leaving and without taking note of the PID! Mark multiple processes and kill them all! Among all of the features, the manpage says you can press F to follow a process. Really, you should try htop. I never started top ...


16

Try tcpflow: tcpflow -p -c -i eth0 port 80 | grep -oE '(GET|POST|HEAD) .* HTTP/1.[01]|Host: .*' Output is like this: GET /search?q=stack+exchange&btnI=I%27m+Feeling+Lucky HTTP/1.1 Host: www.google.com You can obviously add additional HTTP methods to the grep statement, and use sed to combine the two lines into a full URL.


16

This difference dates back to the original Berkeley Unix, and stems from the fact that the kernel can't actually keep a rolling average; it would need to retain a large number of past readings in order to do so, and especially in the old days there just wasn't memory to spare for it. The algorithm used instead has the advantage that all the kernel needs to ...


15

If you have inotify-tools installed you can use inotifywait to trigger an action if a file or directory is written to: #!/bin/sh dir1=/path/to/A/ while inotifywait -qqre modify "$dir1"; do /run/backup/to/B done Where the -qq switch is completely silent, -r is recursive (if needed) and -e is the event to monitor, in this case modify. From man ...


13

You're looking for tail -f error.log (from man tail): -f, --follow[={name|descriptor}] output appended data as the file grows; -f, --follow, and --fol‐ low=descriptor are equivalent That will let you watch a file and see any changes made to it.


13

Use "less" instead of "tail" for scrollback and search You can use tail -f error.log or, better: tail -F error.log. But if you want to scroll back in the file, that's not very useful. With less +F error.log you get the function of tail -f, but can interrupt the reading of new input with Ctrl+C. Then, you are in the normal less mode, where you can ...


12

Try the watch command, although I suspect just about everyone has written their own version at one time or another. (The cheapie version is while :; do clear; "$@"; sleep 5; done.)


12

I gave up and coded my own tool. It allows for: -a all files -e existing files -n non-existing files It only outputs the files so you do not need to deal with the output from strace. https://github.com/ole-tange/tangetools/tree/master/tracefile


12

For Intel GPU's there exists the intel-gpu-tools from http://intellinuxgraphics.org/ project, which brings the command intel_gpu_top (amongst other things). It is similar to top and htop, but specifically for the Intel GPU. render busy: 18%: ███▋ render space: 39/131072 bitstream busy: 0%: ...


12

For Nvidia GPUs there is a tool nvidia-smi that can show memory usage, GPU utilization and temperature of GPU. There also is a list of compute processes and few more options but my graphic card (GeForce 9600 GT) is not fully supported. Sun May 13 20:02:49 2012 +------------------------------------------------------+ | ...


12

There are several aspects to this question which have been addressed partially through other tools, but there doesn't appear to be a single tool that provides all the features you're looking for. iotop This tools shows which processes are consuming the most I/O. But it lacks options to show specific file names. $ sudo iotop Total DISK READ: 0.00 B/s ...


11

You can watch everything that happens on a filesystem by accessing it over LoggedFS. This is a stacked filesystem that logs every access in a directory tree. loggedfs -l /var/tmp/$USER-home-fs.log ~ Logging your whole home directory might slow your system down though. You'll at least want to write a configuration file with stringent filters. If you have ...


11

Making /dev/null a named pipe is probably the easiest way. Be warned that some programs (sshd, for example) will act abnormally or fail to execute when they find out that it isn't a special file (or they may read from /dev/null, expecting it to return EOF). # Remove special file, create FIFO and read from it rm /dev/null && mkfifo -m622 /dev/null ...


11

Try watch. From the manpage: Name watch - execute a program periodically, showing output fullscreen Synopsis watch [-dhvt] [-n <seconds>] [--differences[=cumulative]] [--help] [--interval=<seconds>] [--no-title] [--version] <command> Description watch runs command repeatedly, displaying its output (the first ...


10

They're kernel threads. [jbd2/%s] are used by JBD2 (the journal manager for ext4) to periodically flush journal commits and other changes to disk. [kdmflush] is used by Device Mapper to process deferred work that it has queued up from other contexts where doing immediately so would be problematic.


10

The traditional, portable, commonly-used way is that the parent process watches over its children. The basic primitives are the wait and waitpid system calls. When a child process dies, the parent process receives a SIGCHLD signal, telling it it should call wait to know which child died and its exit status. The parent process can instead choose to ignore ...


10

You can trace the system calls with strace, but there is indeed an inevitable speed penalty. You need to run strace as root if the command runs with elevated privileges: sudo strace -f -o foo.trace su user -c 'mycommand' Another method that's likely to be faster is to preload a library that wraps around filesystem access functions: ...


10

check iftop and nload iftop does for network usage what top(1) does for CPU usage. It listens to network traffic on a named interface and displays a table of current bandwidth usage by pairs of hosts. Handy for answering the question "why is our ADSL link so slow?". nload is a console application which monitors network traffic and bandwidth usage ...


9

Snort From their about page: Originally released in 1998 by Sourcefire founder and CTO Martin Roesch, Snort is a free, open source network intrusion detection and prevention system capable of performing real-time traffic analysis and packet logging on IP networks. Initially called a “lightweight” intrusion detection technology, Snort has evolved into a ...


9

I use conky to display date, battery, cpu, ram and swap information. You can find my conky file here or take a look at a thread about conky configs in the arch-linux forum. There you find many different configs and screenshots of conky in use.


9

Use tcpdump. tcpdump -w httpdebug.pcap -i eth0 port 80 will sniff all packets heading to or from port 80 on the eth0 interface and output them to httpdebug.pcap, which you can then read at your leisure, either with tcpdump again (with multiple -x options, refer to the tcpdump manpage ) in console if you're feeling masochistic, or with wireshark. I really ...


9

I realize this is going to sound both simplistic and absurd, but if you have control over the apps in question (maybe in a test environment) you could mount ONLY that directory on a partition of its own, then iostat, etc. would tell you only about it, and nothing else on that spot. If there are physical drives involved you could fake it up with a loopback ...


9

If you have a separate server to run your check script on, something like this would do a simple Ping test to see if the server is alive: #!/bin/bash SERVERIP=192.168.2.3 NOTIFYEMAIL=test@example.com ping -c 3 $SERVERIP > /dev/null 2>&1 if [ $? -ne 0 ] then # Use your favorite mailer here: mailx -s "Server $SERVERIP is down" -t ...



Only top voted, non community-wiki answers of a minimum length are eligible