1、iostat/iotop 磁盘使用
[root@server01~]#iostat##静态显示 Linux3.10.0-514.el7.x86_64(server01)2017年07月11日_x86_64_(1cpu) avg-cpu:%user%nice%system%iowait%steal%idle 0.320.004.050.290.0095.34 Device:tpskB_read/skB_wrtn/skB_readkB_wrtn sda1.6253.203.8923465217158 sdb0.030.210.009200 scd00.000.010.00440 [root@server01~]#iotop##动态显示 TotalDISKREAD:0.00B/s|TotalDISKWRITE:0.00B/s ActualDISKREAD:0.00B/s|ActualDISKWRITE:0.00B/s TIDPRIoUSERDISKREADDISKWRITESWAPINIO>COMMAND 1be/4root0.00B/s0.00B/s0.00%0.00%systemd-~rialize21 2be/4root0.00B/s0.00B/s0.00%0.00%[kthreadd] 3be/4root0.00B/s0.00B/s0.00%0.00%[ksoftirqd/0] ......
2、free 内存使用
[root@server01~]#free totalusedfreesharedbuff/cacheavailable Mem:10083921139486147566868279688719948 Swap:209714802097148 [root@server01~]#free-m##兆 totalusedfreesharedbuff/cacheavailable Mem:9841116006273703 Swap:204702047 [root@server01~]#free-g totalusedfreesharedbuff/cacheavailable Mem:000000 Swap:101 [root@server01~]#free-h##智能显示 totalusedfreesharedbuff/cacheavailable Mem:984M111M600M6.7M273M703M Swap:2.0G0B2.0G
buffer：cpu传给内存（buffer），再写入磁盘。
cache：从磁盘读进内存（cache），再提交cpu。
total=used+free+buff/cache；
available包含free和buff/cache剩余部分。
3、ps 系统进程
[root@server01~]#psaux USERPID%cpu%MEMVSZRSSTTYSTATSTARTTIMECOMMAND root10.00.61280926708?Ss7月100:01/usr/lib/syste root20.00.000?S7月100:00[kthreadd] root30.00.000?S7月100:00[ksoftirqd/0] ...... [root@server01~]#ps-elf FSUIDPIDPPIDCPRINIADDRSZWCHANSTIMETTYTIMECMD 4Sroot100800-32023ep_pol7月10?00:00:01/usr/lib/systemd/systemd--switched-root--system--deserialize21 1Sroot200800-0kthrea7月10?00:00:00[kthreadd] 1Sroot320800-0smpboo7月10?00:00:00[ksoftirqd/0] ......
“ps aux”和“ps -elf”的作用是一致的，使用哪个取决于用户使用习惯。
�STAT部分详解：
D 不能中断的进程 < 高优先级进程
R run状态的进程 N 低优先级进程
S sleep状态的进程 L 内存中被锁了内存分页
T 暂停的进程 s 主进程
Z 僵尸进程 l 多线程进程
+ 前台进程
4、netstat 网络状态
[root@server01~]#netstat ActiveInternetconnections(w/oservers) ProtoRecv-QSend-QLocalAddressForeignAddressState tcp064server01:sshgateway:51102ESTABLISHED udp00server01:53475marla.ludost.net:ntpESTABLISHED udp00server01:4487661-216-153-107.HINE:ntpESTABLISHED udp00server01:40498ntp1.ams1.nl.leasew:ntpESTABLISHED udp00server01:49814ntp4.itcompliance.d:ntpESTABLISHED ActiveUNIXdomainsockets(w/oservers) ProtoRefCntFlagsTypeStateI-NodePath unix2[]DGRAM7564/run/systemd/notify ...... [root@server01~]#netstat-lnp##能显示端口和连接状态 ActiveInternetconnections(onlyservers) ProtoRecv-QSend-QLocalAddressForeignAddressStatePID/Programname tcp000.0.0.0:220.0.0.0:*LISTEN1293/sshd tcp00127.0.0.1:250.0.0.0:*LISTEN1793/master tcp600:::22:::*LISTEN1293/sshd tcp600::1:25:::*LISTEN1793/master udp00127.0.0.1:3230.0.0.0:*492/chronyd udp600::1:323:::*492/chronyd raw600:::58:::*7510/NetworkManager ActiveUNIXdomainsockets(onlyservers) ...... [root@server01~]#netstat-an ActiveInternetconnections(serversandestablished) ProtoRecv-QSend-QLocalAddressForeignAddressState tcp000.0.0.0:220.0.0.0:*LISTEN tcp00127.0.0.1:250.0.0.0:*LISTEN tcp064192.168.137.100:22192.168.137.1:51102ESTABLISHED tcp600:::22:::*LISTEN tcp600::1:25:::*LISTEN udp00192.168.137.100:5347579.98.105.18:123ESTABLISHED udp00127.0.0.1:3230.0.0.0:* udp00192.168.137.100:5838161.216.153.107:123ESTABLISHED ...... [root@server01~]#netstat-lntp##只显示TCP ActiveInternetconnections(onlyservers) ProtoRecv-QSend-QLocalAddressForeignAddressStatePID/Programname tcp000.0.0.0:220.0.0.0:*LISTEN1293/sshd tcp00127.0.0.1:250.0.0.0:*LISTEN1793/master tcp600:::22:::*LISTEN1293/sshd tcp600::1:25:::*LISTEN1793/master [root@server01~]#netstat-lnup##只显示UDP ActiveInternetconnections(onlyservers) ProtoRecv-QSend-QLocalAddressForeignAddressStatePID/Programname udp00127.0.0.1:3230.0.0.0:*492/chronyd udp600::1:323:::*492/chronyd [root@server01~]#netstat-an|awk'/^tcp/{++sta[$NF]}END{for(keyinsta)printkey,"\t",sta[key]}'##统计连接数 LISTEN4 ESTABLISHED1 [root@server01~]#ss-an ...... u_strESTAB00*13719*13718 u_strESTAB00*17908*17907 u_strESTAB00*14545*14546 u_strESTAB00*13612*13720 udpUNCONN00:::58:::* udpESTAB00192.168.137.100:56524163.172.177.158:123 udpESTAB00192.168.137.100:4272379.98.105.18:123 udpUNCONN00127.0.0.1:323*:* udpESTAB00192.168.137.100:5838161.216.153.107:123 ......
5、tcpdump 抓包
[root@server01~]#tcpdump-nn-iens33##指定抓包网卡 ...... 00:43:14.089076IP192.168.137.100.22>192.168.137.1.51102:Flags[P.],seq1265808:1266096,ack18561,win260,length288 00:43:14.089308IP192.168.137.1.51102>192.168.137.100.22:Flags[.],ack1266096,win251,length0 00:43:14.089335IP192.168.137.100.22>192.168.137.1.51102:Flags[P.],seq1266096:1266272,length176 ^C 8213packetscaptured 8215packetsreceivedbyfilter 0packetsdroppedbykernel
其他用法：
tcpdump-nnport80##指定抓包端口 tcpdump-nnnotport25andhost192.168.137.1##“and”匹配多个过滤条件 tcpdump-nn-c100-w1.cap##100个包写入文件 tcpdump-r/tmp/1.cap##读取抓包文件
�除了tcpdump外，wireshark也可以用于抓包：
[root@server01~]#tshark-n-ta-Rhttp.request-Tfields-e"frame.time"-e"ip.src"-e"http.host"-e"http.request.mothod"-e"http.request.uri" ##显示访问http请求的域名以及uri
参数解读：
-e<field> Addafieldtothelistoffieldstodisplayif-Tfieldsisselected.Thisoptioncanbeusedmultipletimesonthecommandline.Atleastonefieldmustbeprovidedifthe-Tfieldsoptionisselected.Columnnamesmaybeusedprefixedwith"col." Example:-eframe.number-eip.addr-eudp-ecol.info Givingaprotocolratherthanasinglefieldwillprintmultipleitemsofdataabouttheprotocolasasinglefield.Fieldsareseparatedbytabcharactersbydefault.-Econtrolstheformatoftheprintedfields. -R<Readfilter> Causethespecifiedfilter(whichusestheSyntaxofread/displayfilters,ratherthanthatofcapturefilters)tobeappliedduringthefirstpassofanalysis.Packetsnotmatchingthefilterarenotconsideredforfuturepasses.Onlymakessensewithmultiplepasses,see-2.Forregularfilteringonsingle-passdissectsee-Yinstead. Notethatforward-lookingfieldssuchas'responseinframe#'cannotbeusedwiththisfilter,sincetheywillnothavebeencalculatewhenthisfilterisapplied.
其他用法：
①抓取MysqL的查询： tshark-n-ieth1-R'MysqL.query'-Tfields-e"ip.src"-e"MysqL.query" tshark-ieth1port3307-dtcp.port==3307,MysqL-z"proto,colinfo,MysqL.query,MysqL.query" ②抓取指定类型的MySQL查询： tshark-n-ieth1-R'MysqLmatches"SELECT|INSERT|DELETE|UPDATE"'-Tfields-e"ip.src"-e"MysqL.query" ③统计http的状态： tshark-n-q-zhttp,stat,-zhttp,tree ④增加时间标签： tshark-tad tshark-ta原文链接：https://www.f2er.com/centos/376826.html
