Hot answers tagged

58

It might suffice to use watch: $ watch tail -n 15 mylogfile.txt


54

On Linux, top actually supports focusing on a single process, although it naturally doesn't have a history graph: top -p PID This is also available on Mac OS X with a different syntax: top -pid PID


50

You should consider using inotifywait, as an example: inotifywait -m /path -e create -e moved_to | while read path action file; do echo "The file '$file' appeared in directory '$path' via '$action'" # do something with the file done In Ubuntu inotifywait is provided by the inotify-tools package. As of version 3.13 (current in ...


45

The lsof command (already mentioned in several answers) will tell you what process has a file open at the time you run it. lsof is available for just about every unix variant. lsof /path/to/file lsof won't tell you about file that were opened two microseconds ago and closed one microsecond ago. If you need to watch a particular file and react when it is ...


37

For Nvidia GPUs there is a tool nvidia-smi that can show memory usage, GPU utilization and temperature of GPU. There also is a list of compute processes and few more options but my graphic card (GeForce 9600 GT) is not fully supported. Sun May 13 20:02:49 2012 +------------------------------------------------------+ | ...


35

Any user, including root, can forward their local email by putting the forwarding address in a file called ~/.forward. You can have multiple addresses there, all on one line and separated by comma. If you want both local delivery and forwarding, put root@localhost as one of the addresses. The system administrator can define email aliases in the file ...


34

From the tail(1) man page: With --follow (-f), tail defaults to following the file descriptor, which means that even if a tail’ed file is renamed, tail will continue to track its end. This default behavior is not desirable when you really want to track the actual name of the file, not the file descrip- tor (e.g., log rotation). ...


32

Try tcpflow: tcpflow -p -c -i eth0 port 80 | grep -oE '(GET|POST|HEAD) .* HTTP/1.[01]|Host: .*' Output is like this: GET /search?q=stack+exchange&btnI=I%27m+Feeling+Lucky HTTP/1.1 Host: www.google.com You can obviously add additional HTTP methods to the grep statement, and use sed to combine the two lines into a full URL.


30

htop is a great replacement to top. It has... Colors! Simple keyboard shortcuts! Scroll the list using the arrow keys! Kill a process without leaving and without taking note of the PID! Mark multiple processes and kill them all! Among all of the features, the manpage says you can press F to follow a process. Really, you should try htop. I never started top ...


26

There are several aspects to this question which have been addressed partially through other tools, but there doesn't appear to be a single tool that provides all the features you're looking for. iotop This tools shows which processes are consuming the most I/O. But it lacks options to show specific file names. $ sudo iotop Total DISK READ: 0.00 B/s ...


25

If the kernel killed a process (because the system ran out of memory), there will be a kernel log message. Check in /var/log/kern.log (on Debian/Ubuntu, other distributions might send kernel logs to a different file, but usually under /var/log under Linux). Note that if the OOM-killer (out-of-memory killer) triggered, it means you don't have enough virtual ...


23

I gave up and coded my own tool. It allows for: -a all files -e existing files -n non-existing files It only outputs the files so you do not need to deal with the output from strace. https://github.com/ole-tange/tangetools/tree/master/tracefile


22

This difference dates back to the original Berkeley Unix, and stems from the fact that the kernel can't actually keep a rolling average; it would need to retain a large number of past readings in order to do so, and especially in the old days there just wasn't memory to spare for it. The algorithm used instead has the advantage that all the kernel needs to ...


21

You may use tcpdump. # tcpdump filter for HTTP GET sudo tcpdump -s 0 -A 'tcp[((tcp[12:1] & 0xf0) >> 2):4] = 0x47455420' # tcpdump filter for HTTP POST sudo tcpdump -s 0 -A 'tcp dst port 80 and (tcp[((tcp[12:1] & 0xf0) >> 2):4] = 0x504f5354)' For a solution using tshark see: ...


21

For Intel GPU's there exists the intel-gpu-tools from http://intellinuxgraphics.org/ project, which brings the command intel_gpu_top (amongst other things). It is similar to top and htop, but specifically for the Intel GPU. render busy: 18%: ███▋ render space: 39/131072 bitstream busy: 0%: ...


18

If you have inotify-tools installed you can use inotifywait to trigger an action if a file or directory is written to: #!/bin/sh dir1=/path/to/A/ while inotifywait -qqre modify "$dir1"; do /run/backup/to/B done Where the -qq switch is completely silent, -r is recursive (if needed) and -e is the event to monitor, in this case modify. From man ...


15

You can use ss from the iproute2 package (which is similar to netstat): ss -l -p -n | grep ",1234," Replace 1234 with the PID of the program.


14

They're kernel threads. [jbd2/%s] are used by JBD2 (the journal manager for ext4) to periodically flush journal commits and other changes to disk. [kdmflush] is used by Device Mapper to process deferred work that it has queued up from other contexts where doing immediately so would be problematic.


14

The manpage reveals the answer. You will need tmux 1.4 (released Dec. 2010) or better. Press Ctrl+B then enter the command: :setw monitor-silence 30 To identify all quiet windows in the session, apply the setting to all windows: :setw -g monitor-silence 30


13

The traditional, portable, commonly-used way is that the parent process watches over its children. The basic primitives are the wait and waitpid system calls. When a child process dies, the parent process receives a SIGCHLD signal, telling it it should call wait to know which child died and its exit status. The parent process can instead choose to ignore ...


13

When you read from /proc, the kernel generates content on the fly. There is no hard drive involved. What you're doing is similar to what any number of monitoring programs do, so I advise you to look at what they're doing. For example, you can see what top does: strace top >/dev/null The trace shows that top opens /proc/uptime, /proc/loadavg, ...


13

Try the watch command, although I suspect just about everyone has written their own version at one time or another. (The cheapie version is while :; do clear; "$@"; sleep 5; done.)


13

You can trace the system calls with strace, but there is indeed an inevitable speed penalty. You need to run strace as root if the command runs with elevated privileges: sudo strace -f -o foo.trace su user -c 'mycommand' Another method that's likely to be faster is to preload a library that wraps around filesystem access functions: ...


13

If you use watch, try the -n option to control the interval between each update. Thus, the following would call tail every 2 seconds $ watch -n 2 tail -n 15 mylogfile.txt while this one polls it every 1 second $ watch -n 1 tail -n 15 mylogfile.txt


13

If you have a separate server to run your check script on, something like this would do a simple Ping test to see if the server is alive: #!/bin/bash SERVERIP=192.168.2.3 NOTIFYEMAIL=test@example.com ping -c 3 $SERVERIP > /dev/null 2>&1 if [ $? -ne 0 ] then # Use your favorite mailer here: mailx -s "Server $SERVERIP is down" -t ...


13

You're looking for tail -f error.log (from man tail): -f, --follow[={name|descriptor}] output appended data as the file grows; -f, --follow, and --fol‐ low=descriptor are equivalent That will let you watch a file and see any changes made to it.


13

Use "less" instead of "tail" for scrollback and search You can use tail -f error.log or, better: tail -F error.log. But if you want to scroll back in the file, that's not very useful. With less +F error.log you get the function of tail -f, but can interrupt the reading of new input with Ctrl+C. Then, you are in the normal less mode, where you can ...


13

I am not aware of a way using iproute2 tools. But as a workaround, you could try this one out. lsof -Pan -p PID -i should give you the information you are looking for. Output lsof -Pan -p 27808 -i COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME httpd 27808 apache 5u IPv6 112811294 0t0 TCP *:80 (LISTEN) httpd 27808 apache ...


13

For checking I/O usage I usually use iotop. It's not installed by default on the distro, but you can easily get it with: sudo apt-get install iotop Then launch it with root priviledges: sudo iotop --only The --only option will show only the processes currently accessing the I/O.


12

From the ps man page: -e Select all processes. Identical to -A. Thus, ps -e will display all of the processes. The common options for "give me everything" are ps -ely or ps aux, the latter is the BSD-style. Often, people then pipe this output to grep to search for a process, as in xenoterracide's answer. In order to avoid also seeing ...



Only top voted, non community-wiki answers of a minimum length are eligible