查看CPU 内存 硬盘 网络 查看进程使用的文件 uptime top ps -aux vmstat iostat iotop nload iptraf nethogs
#安装命令
yum install sysstat #包含 iostat vmstat
yum install iotop
yum install nload
yum install iptraf
yum install nethogs
#使用命令
1：yum install sysstat #包含 iostat vmstat
[root@LAMP log]# iostat -k #以K大小显示。-m 以M大小显示
Linux 2.6.32-642.13.1.el6.x86_64 (LAMP) 02/28/2017 _x86_64_ (1 CPU)
avg-cpu: %user %nice %system %iowait %steal %idle 2.71 0.00 1.44 0.54 0.00 95.30
Device: tps kB_read/s kB_wrtn/s kB_read kB_wrtn scd0 0.00 0.01 0.00 44 0 sda 12.67 235.07 279.01 1043529 1238600
[root@LAMP log]# vmstat
procs -----------memory---------- ---swap-- -----io---- --system-- -----cpu----- r b swpd free buff cache si so bi bo in cs us sy id wa st 1 0 7096 163132 83924 376336 0 2 235 279 98 114 3 1 95 1 0 [root@LAMP log]#
2：yum install iotop
[root@LAMP log]# iotop #实时显示进程硬盘读写
Total DISK READ: 0.00 B/s | Total DISK WRITE: 0.00 B/s
TID PRIO USER DISK READ DISK WRITE SWAPIN IO> COMMAND
1 be/4 root 0.00 B/s 0.00 B/s 0.00 % 0.00 % init
2 be/4 root 0.00 B/s 0.00 B/s 0.00 % 0.00 % [kthreadd]
3 rt/4 root 0.00 B/s 0.00 B/s 0.00 % 0.00 % [migration/0]
4 be/4 root 0.00 B/s 0.00 B/s 0.00 % 0.00 % [ksoftirqd/0]
5 rt/4 root 0.00 B/s 0.00 B/s 0.00 % 0.00 % [stopper/0]
6 rt/4 root 0.00 B/s 0.00 B/s 0.00 % 0.00 % [watchdog/0
3：yum install nload ；yum install iptraf ； yum install nethogs
[root@LAMP ~]# nload 总的网络实时监控
[root@LAMP ~]# iptraf 网络带宽进程的实时监控
[root@LAMP log]# nethogs 网络带宽进程的实时监控
ionice iostat硬盘读写信息 iotop 磁盘进程实时读写
[root@LAMP ~]# vmstat 内存，cpu 信息
ps -aux --sort -pcpu|less 查看CPU按从大到小的排序
ps -aux --sort -rss|less 查看内存按从大到小排序
[root@LAMP ~]# iostat
Linux 2.6.32-642.13.1.el6.x86_64 (LAMP) 02/27/2017 _x86_64_ (1 CPU)
avg-cpu: %user %nice %system %iowait %steal %idle 0.15 0.00 0.42 0.04 0.00 99.39
Device: tps Blk_read/s Blk_wrtn/s Blk_read Blk_wrtn scd0 0.00 0.04 0.00 88 0 sda 1.17 53.35 4.23 127842 10136
[root@LAMP ~]# vmstat
procs -----------memory---------- ---swap-- -----io---- --system-- -----cpu----- r b swpd free buff cache si so bi bo in cs us sy id wa st 0 0 0 707400 22496 40588 0 0 27 2 29 56 0 0 99 0 0
#ton -n 1
Tasks: 72 total, 1 running, 71 sleeping, 0 stopped, 0 zombie Cpu(s): 0.1%us, 0.4%sy, 0.0%ni, 99.4%id, 0.0%wa, 0.0%hi, 0.0%si, 0.0%st Mem: 1004132k total, 296748k used, 707384k free, 22496k buffers Swap: 2097148k total, 0k used, 2097148k free, 40588k cached
PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND 1 root 20 0 19232 1512 1232 S 0.0 0.2 0:01.27 init 2 root 20 0 0 0 0 S 0.0 0.0 0:00.00 kthreadd 3 root RT 0 0 0 0 S 0.0 0.0 0:00.00 migration/0
#top
1:M:内存大小排序
2：P:CPU大小排序
3：u:输入用户可以按用户查看
4:1：查看CPU 核数
5：top -p 进程ID 单独查看一个进程作态
#查看木马程序的绝对路径
[root@LAMP ~]# cat /root/back.sh
#!/bin/bash
sleep 2000
[root@LAMP ~]# sh /root/back.sh &
[2] 4585
[root@LAMP ~]#
ps -aux
lsof -p 进程号
[root@LAMP ~]# lsof -p 4072
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
sh 4072 root cwd DIR 8,2 4096 917505 /root
sh 4072 root rtd DIR 8,2 4096 2 /
sh 4072 root txt REG 8,2 906312 664508 /bin/bash
sh 4072 root mem REG 8,2 99160384 273218 /usr/lib/locale/locale-archive
sh 4072 root mem REG 8,2 1923352 131087 /lib64/libc-2.12.so
sh 4072 root mem REG 8,2 19536 131093 /lib64/libdl-2.12.so
sh 4072 root mem REG 8,2 132408 131129 /lib64/libtinfo.so.5.7
sh 4072 root mem REG 8,2 154664 131076 /lib64/ld-2.12.so
sh 4072 root mem REG 8,2 26060 263587 /usr/lib64/gconv/gconv-modules.cache
sh 4072 root 0u CHR 136,1 0t0 4 /dev/pts/1
sh 4072 root 1u CHR 136,1 0t0 4 /dev/pts/1
sh 4072 root 2u CHR 136,1 0t0 4 /dev/pts/1
sh 4072 root 255r REG 8,2 23 953082 /root/back.sh
[root@LAMP ~]# iotop --help 查看进程硬盘 实时读写速度
Usage: /usr/sbin/iotop [OPTIONS]
DISK READ and DISK WRITE are the block I/O bandwidth used during the sampling period. SWAPIN and IO are the percentages of time the thread spent respectively while swapping in and waiting on I/O more generally. PRIO is the I/O priority at which the thread is running (set using the ionice command).
Controls: left and right arrows to change the sorting column, r to invert the sorting order, o to toggle the --only option, p to toggle the --processes option, a to toggle the --accumulated option, q to quit, any other key to force a refresh.
Options: --version show program's version number and exit -h, --help show this help message and exit -o, --only only show processes or threads actually doing I/O -b, --batch non-interactive mode -n NUM, --iter=NUM number of iterations before ending [infinite] -d SEC, --delay=SEC delay between iterations [1 second] -p PID, --pid=PID processes/threads to monitor [all] -u USER, --user=USER users to monitor [all] -P, --processes only show processes, not all threads -a, --accumulated show accumulated I/O instead of bandwidth -k, --kilobytes use kilobytes instead of a human friendly unit -t, --time add a timestamp on each line (implies --batch) -q, --quiet suppress some lines of header (implies --batch)
