Tag Info

Hot answers tagged

29

From the tail(1) man page: With --follow (-f), tail defaults to following the file descriptor, which means that even if a tail’ed file is renamed, tail will continue to track its end. This default behavior is not desirable when you really want to track the actual name of the file, not the file descrip- tor (e.g., log rotation). ...


24

The lsof command (already mentioned in several answers) will tell you what process has a file open at the time you run it. lsof is available for just about every unix variant. lsof /path/to/file lsof won't tell you about file that were opened two microseconds ago and closed one microsecond ago. If you need to watch a particular file and react when it is ...


18

Any user, including root, can forward their local email by putting the forwarding address in a file called ~/.forward. You can have multiple addresses there, all on one line and separated by comma. If you want both local delivery and forwarding, put root@localhost as one of the addresses. The system administrator can define email aliases in the file ...


17

If the kernel killed a process (because the system ran out of memory), there will be a kernel log message. Check in /var/log/kern.log (on Debian/Ubuntu, other distributions might send kernel logs to a different file, but usually under /var/log under Linux). Note that if the OOM-killer (out-of-memory killer) triggered, it means you don't have enough virtual ...


17

You should consider using inotifywait, as an example: inotifywait -m /path -e create -e move_to | while read path action file; do echo "The file '$file' appeared in directory '$path' via '$action'" # do something with the file done In Ubuntu inotifywait is provided by the inotify-tools package. As of version 3.13 (current in Ubuntu ...


14

Try tcpflow: tcpflow -p -c -i eth0 port 80 | grep -oE '(GET|POST|HEAD) .* HTTP/1.[01]|Host: .*' Output is like this: GET /search?q=stack+exchange&btnI=I%27m+Feeling+Lucky HTTP/1.1 Host: www.google.com You can obviously add additional HTTP methods to the grep statement, and use sed to combine the two lines into a full URL.


13

This difference dates back to the original Berkeley Unix, and stems from the fact that the kernel can't actually keep a rolling average; it would need to retain a large number of past readings in order to do so, and especially in the old days there just wasn't memory to spare for it. The algorithm used instead has the advantage that all the kernel needs to ...


13

If you have inotify-tools installed you can use inotifywait to trigger an action if a file or directory is written to: #!/bin/sh dir1=/path/to/A/ while inotifywait -qqre modify "$dir1"; do /run/backup/to/B done Where the -qq switch is completely silent, -r is recursive (if needed) and -e is the event to monitor, in this case modify. From man ...


11

Making /dev/null a named pipe is probably the easiest way. Be warned that some programs (sshd, for example) will act abnormally or fail to execute when they find out that it isn't a special file (or they may read from /dev/null, expecting it to return EOF). # Remove special file, create FIFO and read from it rm /dev/null && mkfifo -m622 /dev/null ...


10

Try watch. From the manpage: Name watch - execute a program periodically, showing output fullscreen Synopsis watch [-dhvt] [-n <seconds>] [--differences[=cumulative]] [--help] [--interval=<seconds>] [--no-title] [--version] <command> Description watch runs command repeatedly, displaying its output (the first ...


10

check iftop and nload iftop does for network usage what top(1) does for CPU usage. It listens to network traffic on a named interface and displays a table of current bandwidth usage by pairs of hosts. Handy for answering the question "why is our ADSL link so slow?". nload is a console application which monitors network traffic and bandwidth usage ...


9

They're kernel threads. [jbd2/%s] are used by JBD2 (the journal manager for ext4) to periodically flush journal commits and other changes to disk. [kdmflush] is used by Device Mapper to process deferred work that it has queued up from other contexts where doing immediately so would be problematic.


9

I use conky to display date, battery, cpu, ram and swap information. You can find my conky file here or take a look at a thread about conky configs in the arch-linux forum. There you find many different configs and screenshots of conky in use.


9

Snort From their about page: Originally released in 1998 by Sourcefire founder and CTO Martin Roesch, Snort is a free, open source network intrusion detection and prevention system capable of performing real-time traffic analysis and packet logging on IP networks. Initially called a “lightweight” intrusion detection technology, Snort has evolved into a ...


9

htop is a great replacement to top. It has... Colors! Simple keyboard shortcuts! Scroll the list using the arrow keys! Kill a process without leaving and without taking note of the PID! Mark multiple processes and kill them all! Among all of the features, the manpage says you can press F to follow a process. Really, you should try htop. I never started top ...


9

You can watch everything that happens on a filesystem by accessing it over LoggedFS. This is a stacked filesystem that logs every access in a directory tree. loggedfs -l /var/tmp/$USER-home-fs.log ~ Logging your whole home directory might slow your system down though. You'll at least want to write a configuration file with stringent filters. If you have ...


9

Use tcpdump. tcpdump -w httpdebug.pcap -i eth0 port 80 will sniff all packets heading to or from port 80 on the eth0 interface and output them to httpdebug.pcap, which you can then read at your leisure, either with tcpdump again (with multiple -x options, refer to the tcpdump manpage ) in console if you're feeling masochistic, or with wireshark. I really ...


9

I realize this is going to sound both simplistic and absurd, but if you have control over the apps in question (maybe in a test environment) you could mount ONLY that directory on a partition of its own, then iostat, etc. would tell you only about it, and nothing else on that spot. If there are physical drives involved you could fake it up with a loopback ...


9

For Intel GPU's there exists the intel-gpu-tools from http://intellinuxgraphics.org/ project, which brings the command intel_gpu_top (amongst other things). It is similar to top and htop, but specifically for the Intel GPU. render busy: 18%: ███▋ render space: 39/131072 bitstream busy: 0%: ...


9

For Nvidia GPUs there is a tool nvidia-smi that can show memory usage, GPU utilization and temperature of GPU. There also is a list of compute processes and few more options but my graphic card (GeForce 9600 GT) is not fully supported. Sun May 13 20:02:49 2012 +------------------------------------------------------+ | ...


9

There are several aspects to this question which have been addressed partially through other tools, but there doesn't appear to be a single tool that provides all the features you're looking for. iotop This tools shows which processes are consuming the most I/O. But it lacks options to show specific file names. $ sudo iotop Total DISK READ: 0.00 B/s ...


8

I don't believe there is a way to determine which program created a file once it exists. You can watch for the file to be recreated, though, using inotify. inotifywait is a command-line interface for the inotify subsystem; you can tell it to look for create events in your home directory: $ (sleep 5; touch ~/making-a-test-file) & [1] 22526 $ inotifywait ...


8

The traditional, portable, commonly-used way is that the parent process watches over its children. The basic primitives are the wait and waitpid system calls. When a child process dies, the parent process receives a SIGCHLD signal, telling it it should call wait to know which child died and its exit status. The parent process can instead choose to ignore ...


8

When you read from /proc, the kernel generates content on the fly. There is no hard drive involved. What you're doing is similar to what any number of monitoring programs do, so I advise you to look at what they're doing. For example, you can see what top does: strace top >/dev/null The trace shows that top opens /proc/uptime, /proc/loadavg, ...


8

If you have a separate server to run your check script on, something like this would do a simple Ping test to see if the server is alive: #!/bin/bash SERVERIP=192.168.2.3 NOTIFYEMAIL=test@example.com ping -c 3 $SERVERIP > /dev/null 2>&1 if [ $? -ne 0 ] then # Use your favorite mailer here: mailx -s "Server $SERVERIP is down" -t ...


8

There are several tools that can do this. Bmon One that should be in most repositories for various distros is bmon.      It can be run in a condensed view too.             If you're looking for something else I'd suggest taking a look at this Linuxaria article titled: Monitor ...


7

From the ps man page: -e Select all processes. Identical to -A. Thus, ps -e will display all of the processes. The common options for "give me everything" are ps -ely or ps aux, the latter is the BSD-style. Often, people then pipe this output to grep to search for a process, as in xenoterracide's answer. In order to avoid also seeing ...


7

Are you connected directly to the machine or are you logged in remotely via ssh or the like? If the latter, make sure that the perceived lag isn't caused by the network... If connected directly, besides looking at IO and system load, you might have a look at memory usage. If a system starts swapping heavily, the perceived responsiveness dramatically ...


7

The console standby for this is top, but there are alternatives like my favorite htop that give you a little more display flexibility and allow you a few more operations on the processes. A less interactive view that is better for use in scripts would be the ps program and all it's relatives. Edit: Based on your clarified question, you might note that ...


7

Using iotop. Iotop is a Python program with a top like UI used to show of behalf of which process is the I/O going on. It requires Python ≥ 2.5 (or Python ≥ 2.4 with the ctypes module) and a Linux kernel ≥ 2.6.20 with the TASK_DELAY_ACCT CONFIG_TASKSTATS, TASK_IO_ACCOUNTING and CONFIG_VM_EVENT_COUNTERS options on.



Only top voted, non community-wiki answers of a minimum length are eligible