7 Linux useful commands for everyday System Administration

Today I’ll publish my top 7 Linux CLI commands which I use everyday for monitoring Linux server, This Article includes network monitoring, memory monitory and disk monitoring commands.

The following command will show the list of top processes ordered by RAM and CPU use in descendant form (remove the pipeline ( | ) and head if you want to see the full list):

ps -eo pid,ppid,cmd,%mem,%cpu --sort=-%mem | head

Sample Output

[root@server var]# ps -eo pid,ppid,cmd,%mem,%cpu --sort=-%mem | head
 PID  PPID  CMD                        %MEM %CPU
30196 1     /usr/sbin/mysqld            4.5 35.1
25794 18123 /usr/sbin/httpd -DFOREGROUN 1.0 0.9
25315 18123 /usr/sbin/httpd -DFOREGROUN 1.0 1.0
 3501 18123 /usr/sbin/httpd -DFOREGROUN 0.9 1.1
25785 18123 /usr/sbin/httpd -DFOREGROUN 0.9 0.9
25285 18123 /usr/sbin/httpd -DFOREGROUN 0.9 1.0
26903 18123 /usr/sbin/httpd -DFOREGROUN 0.9 1.0
26905 18123 /usr/sbin/httpd -DFOREGROUN 0.9 1.0
 2260 18123 /usr/sbin/httpd -DFOREGROUN 0.9 1.1

Find Largest Directories in Linux

If you want to display the biggest directories in the current working directory, run:

[root@server ~]# du -a | sort -n -r | head -n 5

Sample Output

[root@server var]# du -a | sort -n -r | head -n 5
2376792 .
1998812 ./lib
1894564 ./lib/mysql
1367484 ./lib/mysql/database_md
815108 ./lib/mysql/database_md/md_options.ibd

Find Largest File in a folder

find /home/ -type f -exec du -Sh {} + | sort -rh | head -n 5
OR
find /home/ -type f -printf "%s %p\n" | sort -rn | head -n 5

Sample Output

[root@server var]# find /var -type f -exec du -Sh {} + | sort -rh | head -n 5
797M /var/lib/mysql/database_md/md_options.ibd
233M /var/lib/mysql/database_md/md_postmeta.ibd
125M /var/lib/mysql/database_md/md_posts.ibd
82M /var/lib/mysql/ibdata1
77M /var/lib/rpm/Packages

List Number of open connections per ip

netstat -ntu | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n

Sample Output

[root@server ~]# netstat -ntu | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n
 1 104.28.27.160
 1 108.162.215.245
 1 108.162.216.143
 1 172.68.110.89
 1 172.68.211.5
 1 172.68.253.96
 1 172.68.255.39
 1 172.68.255.9
 1 172.68.65.253
 1 172.68.65.73
 1 172.68.65.91
 1 172.68.94.233
 1 172.68.94.71
 1 172.69.54.58
 1 172.69.62.137
 1 172.69.62.173
 1 172.69.62.185
 1 172.69.62.53
 1 172.69.62.71
 1 173.245.54.32
 1 173.245.54.50
 1 49.207.114.225
 77 178.238.235.165

List processes by disk I/O usage

We need iotop for this purpose.

Install IOTOP

Install iotop on Debian/Ubuntu and Mint linux

To install iotop on Debian/Ubuntu or Mint linux type following command on your terminal:

sudo apt-get install iotop -y

Installing iotop in RHEL, CentOS and Fedora

To install iotop on RHEL, CentOS and Fedora use the following yum command:

yum install iotop

Run this command :

iotop

Sample Output

In IOTop, the processes with most usage are shown to the top of the list.

Total DISK READ :       0.00 B/s | Total DISK WRITE :     134.97 K/s
Actual DISK READ:       0.00 B/s | Actual DISK WRITE:     219.80 K/s
  TID  PRIO  USER     DISK READ  DISK WRITE  SWAPIN     IO>    COMMAND
  344 be/3 root        0.00 B/s    0.00 B/s  0.00 % 32.52 % [jbd2/sda2-8]
30205 be/4 mysql       0.00 B/s    0.00 B/s  0.00 %  2.74 % mysqld
30209 be/4 mysql       0.00 B/s  123.40 K/s  0.00 %  0.05 % mysqld
30215 be/4 mysql       0.00 B/s   11.57 K/s  0.00 %  0.03 % mysqld
30207 be/4 mysql       0.00 B/s    0.00 B/s  0.00 %  0.02 % mysqld
30200 be/4 mysql       0.00 B/s    0.00 B/s  0.00 %  0.01 % mysqld
 5632 be/4 root        0.00 B/s    0.00 B/s  0.00 %  0.00 % sshd: root@pts/0
    1 be/4 root        0.00 B/s    0.00 B/s  0.00 %  0.00 % systemd --switched-root --system --deserialize 21
    2 be/4 root        0.00 B/s    0.00 B/s  0.00 %  0.00 % [kthreadd]
    3 be/4 root        0.00 B/s    0.00 B/s  0.00 %  0.00 % [ksoftirqd/0]
30212 be/4 mysql       0.00 B/s    0.00 B/s  0.00 %  0.00 % mysqld

Find out what program/process is listening on port/ip address

netstat -nap | grep LISTEN

Sample Output

[root@server ~]# netstat -nap | grep LISTEN
tcp 0 0 127.0.0.1:6379 0.0.0.0:* LISTEN 29662/redis-server
tcp 0 0 0.0.0.0:587 0.0.0.0:* LISTEN 898/exim
tcp 0 0 0.0.0.0:110 0.0.0.0:* LISTEN 908/dovecot
tcp 0 0 0.0.0.0:143 0.0.0.0:* LISTEN 908/dovecot
tcp 0 0 178.238.235.165:8080 0.0.0.0:* LISTEN 375/httpd
tcp 0 0 178.238.235.165:80 0.0.0.0:* LISTEN 29481/nginx: master
tcp 0 0 127.0.0.1:8081 0.0.0.0:* LISTEN 375/httpd
tcp 0 0 0.0.0.0:465 0.0.0.0:* LISTEN 898/exim
tcp 0 0 0.0.0.0:8083 0.0.0.0:* LISTEN 2427/nginx: master
tcp 0 0 127.0.0.1:8084 0.0.0.0:* LISTEN 29481/nginx: master
tcp 0 0 178.238.235.165:53 0.0.0.0:* LISTEN 2155/named
tcp 0 0 127.0.0.1:53 0.0.0.0:* LISTEN 2155/named
tcp 0 0 0.0.0.0:21 0.0.0.0:* LISTEN 954/vsftpd
tcp 0 0 0.0.0.0:7576 0.0.0.0:* LISTEN 31291/sshd
tcp 0 0 127.0.0.1:953 0.0.0.0:* LISTEN 2155/named
tcp 0 0 0.0.0.0:25 0.0.0.0:* LISTEN 898/exim
tcp 0 0 178.238.235.165:8443 0.0.0.0:* LISTEN 375/httpd
tcp 0 0 178.238.235.165:443 0.0.0.0:* LISTEN 29481/nginx: master
tcp 0 0 0.0.0.0:2525 0.0.0.0:* LISTEN 898/exim
tcp 0 0 0.0.0.0:993 0.0.0.0:* LISTEN 908/dovecot
tcp 0 0 0.0.0.0:995 0.0.0.0:* LISTEN 908/dovecot
tcp6 0 0 :::3306 :::* LISTEN 30196/mysqld
tcp6 0 0 :::7576 :::* LISTEN 31291/sshd
tcp6 0 0 ::1:953 :::* LISTEN 2155/named

In the above output, if take the first line, it tell us that a process named SSHD with PID 202479 is listening on port 22, tcp protocol, on all available system ip addresses

List processes using swap

for file in /proc/*/status ; do awk '/VmSwap|Name/{printf $2 " " $3}END{ print ""}' $file; done | sort -k 2 -n -r

Sample Output

mysqld 593432 kB
worldserver 528624 kB
mudflow 450760 kB
mongod 448096 kB
mysqld 447140 kB
java 358780 kB
systemd 301720 kB
mysqld 273256 kB
java 252704 kB
node 225476 kB
mysqld 138144 kB
python 129964 kB
mongod 120812 kB
mysqld 116868 kB
mysqld 116644 kB
mysqld 104856 kB
mysqld 104388 kB
mysqld 100088 kB