Hot answers tagged monitoring
24
From the tail(1) man page:
With --follow (-f), tail defaults to following the file descriptor,
which means that even if a tail’ed file is renamed, tail will continue
to track its end. This default behavior is not desirable when you
really want to track the actual name of the file, not the file descrip-
tor (e.g., log rotation). ...
21
The lsof command (already mentioned in several answers) will tell you what process has a file open at the time you run it. lsof is available for just about every unix variant.
lsof /path/to/file
lsof won't tell you about file that were opened two microseconds ago and closed one microsecond ago. If you need to watch a particular file and react when it is ...
14
You should consider using inotifywait, as an example:
inotifywait -m /path 2>&- | awk '$2 == "CREATE" { print $3; fflush() }' |
while read file; do
echo "$file"
# do something with the file
done
In Ubuntu inotifywait is provided by the inotify-tools package.
13
Any user, including root, can forward their local email by putting the forwarding address in a file called ~/.forward. You can have multiple addresses there, all on one line and separated by comma. If you want both local delivery and forwarding, put root@localhost as one of the addresses.
The system administrator can define email aliases in the file ...
11
This difference dates back to the original Berkeley Unix, and stems from the fact that the kernel can't actually keep a rolling average; it would need to retain a large number of past readings in order to do so, and especially in the old days there just wasn't memory to spare for it. The algorithm used instead has the advantage that all the kernel needs to ...
11
If the kernel killed a process (because the system ran out of memory), there will be a kernel log message. Check in /var/log/kern.log (on Debian/Ubuntu, other distributions might send kernel logs to a different file, but usually under /var/log under Linux).
Note that if the OOM-killer (out-of-memory killer) triggered, it means you don't have enough virtual ...
11
If you have inotify-tools installed you can use inotifywait to trigger an action if a file or directory is written to:
#!/bin/sh
dir1=/path/to/A/
while inotifywait -qqre modify "$dir1"; do
/run/backup/to/B
done
Where the -qq switch is completely silent, -r is recursive (if needed) and -e is the event to monitor, in this case modify. From man ...
11
Making /dev/null a named pipe is probably the easiest way. Be warned that some programs (sshd, for example) will act abnormally or fail to execute when they find out that it isn't a special file (or they may read from /dev/null, expecting it to return EOF).
# Remove special file, create FIFO and read from it
rm /dev/null && mkfifo -m622 /dev/null ...
10
check iftop and nload
iftop does for network usage what top(1) does for CPU usage. It listens to network traffic on a named interface and displays a table of current bandwidth usage by pairs of hosts. Handy for answering the question "why is our ADSL link so slow?".
nload is a console application which monitors network traffic and bandwidth usage ...
9
Snort
From their about page:
Originally released in 1998 by Sourcefire founder and CTO Martin Roesch, Snort is a free, open source network intrusion detection and prevention system capable of performing real-time traffic analysis and packet logging on IP networks. Initially called a “lightweight” intrusion detection technology, Snort has evolved into a ...
9
I use conky to display date, battery, cpu, ram and swap information. You can find my conky file here or take a look at a thread about conky configs in the arch-linux forum. There you find many different configs and screenshots of conky in use.
9
Use tcpdump.
tcpdump -w httpdebug.pcap -i eth0 port 80 will sniff all packets heading to or from port 80 on the eth0 interface and output them to httpdebug.pcap, which you can then read at your leisure, either with tcpdump again (with multiple -x options, refer to the tcpdump manpage ) in console if you're feeling masochistic, or with wireshark.
I really ...
9
Try watch. From the manpage:
Name
watch - execute a program periodically, showing output fullscreen
Synopsis
watch [-dhvt] [-n <seconds>] [--differences[=cumulative]] [--help] [--interval=<seconds>] [--no-title] [--version] <command>
Description
watch runs command repeatedly, displaying its output (the first ...
8
They're kernel threads.
[jbd2/%s] are used by JBD2 (the journal manager for ext4) to periodically flush journal commits and other changes to disk.
[kdmflush] is used by Device Mapper to process deferred work that it has queued up from other contexts where doing immediately so would be problematic.
8
Try tcpflow:
tcpflow -p -c -i eth0 port 80 | grep -oE '(GET|POST|HEAD) .* HTTP/1.[01]|Host: .*'
Output is like this:
GET /search?q=stack+exchange&btnI=I%27m+Feeling+Lucky HTTP/1.1
Host: www.google.com
You can obviously add additional HTTP methods to the grep statement, and use sed to combine the two lines into a full URL.
8
The traditional, portable, commonly-used way is that the parent process watches over its children.
The basic primitives are the wait and waitpid system calls. When a child process dies, the parent process receives a SIGCHLD signal, telling it it should call wait to know which child died and its exit status. The parent process can instead choose to ignore ...
8
When you read from /proc, the kernel generates content on the fly. There is no hard drive involved.
What you're doing is similar to what any number of monitoring programs do, so I advise you to look at what they're doing. For example, you can see what top does:
strace top >/dev/null
The trace shows that top opens /proc/uptime, /proc/loadavg, ...
7
Are you connected directly to the machine or are you logged in remotely via ssh or the like? If the latter, make sure that the perceived lag isn't caused by the network...
If connected directly, besides looking at IO and system load, you might have a look at memory usage. If a system starts swapping heavily, the perceived responsiveness dramatically ...
7
I don't believe there is a way to determine which program created a file once it exists. You can watch for the file to be recreated, though, using inotify. inotifywait is a command-line interface for the inotify subsystem; you can tell it to look for create events in your home directory:
$ (sleep 5; touch ~/making-a-test-file) &
[1] 22526
$ inotifywait ...
7
You can watch everything that happens on a filesystem by accessing it over LoggedFS. This is a stacked filesystem that logs every access in a directory tree.
loggedfs -l /var/tmp/$USER-home-fs.log ~
Logging your whole home directory might slow your system down though. You'll at least want to write a configuration file with stringent filters.
If you have ...
7
I realize this is going to sound both simplistic and absurd, but if you have
control over the apps in question (maybe in a test environment) you could
mount ONLY that directory on a partition of its own, then iostat, etc. would
tell you only about it, and nothing else on that spot.
If there are physical drives involved you could fake it up with a loopback
...
7
Using iotop.
Iotop is a Python program with a top like UI used to show of behalf of which process is the I/O going on. It requires Python ≥ 2.5 (or Python ≥ 2.4 with the ctypes module) and a Linux kernel ≥ 2.6.20 with the TASK_DELAY_ACCT CONFIG_TASKSTATS, TASK_IO_ACCOUNTING and CONFIG_VM_EVENT_COUNTERS options on.
7
I don't think so. It just means that the CPU is overheating. And your building of a huge program probably is the cause (I'm assuming that after the build finishes things get back to normal, and if you repeat the build the message appears again).
You might want to check your system cooling (eg. fans, dust), as the message suggests.
6
You probably want inoticoming, which is a user space command that uses the inotify framework. You can use it to watch a directory and execute the script of your choice, which can then do anything you want.
I've used this extensively for monitoring directories for file activity and it works well.
6
From the ps man page:
-e Select all processes. Identical to -A.
Thus, ps -e will display all of the processes. The common options for "give me everything" are ps -ely or ps aux, the latter is the BSD-style. Often, people then pipe this output to grep to search for a process, as in xenoterracide's answer. In order to avoid also seeing ...
6
You can try with a simple infinite loop:
while true; do
python myapp.py
done
Edit: the above is just a simple generic example. Most probably modifications are needed to take into account exit errors etc. For example:
until `python myapp.py; echo $?`; do
echo "exit ok, restarting"
done
6
Your editor has its own buffer for the file. When you modify the text in the editor, nothing is written to the file itself.
When you save your changes, chances are that the editor simply deletes the old file and create a new one. tail -f will still be connected to the deleted file, so it won't show anything new.
6
This looks like a directory from one of the free desktop standards. Any application compliant with it could be creating it.
Those "standard" directories can be specified in $HOME/.config/user-dirs.dirs. You can change the name there not to start with a capital letter and to be hidden somewhere, but getting totally rid of will be difficult.
There is one ...
6
This directory might be created by any application that follows the Freedesktop userdirs standard. That potentially includes all Gnome or KDE applications.
If you want to know which application creates the file, you can use the LoggedFS filesystem or the Linux audit subsystem. See Is it possible to find out what program or script created a given file? for ...
6
I'm going to have to be cheap and copy my answer from this question.
ntop is probably the best solution for doing this. It is designed to run long term and capture exactly what youre looking for.
It can show you which clients are receiving/sending the most traffic, where theyre recieving/sending to, what protocols and ports are being used etc.
It then uses ...
Only top voted, non community-wiki answers of a minimum length are eligible
