... in conjunction with '-i' filter for protocol in state -U ......... show unix domain sockets ('@' indicates abstract sock name, see unix(7)) file flags: R/W/RW ..... read/write/read-write CR ......... create AP ......... append TR ......... truncate -s protocols TCP, UDP -s states (TCP) CLOSED, IDLE, BOUND, LISTEN, ESTABLISHED, SYN_SENT, SYN_RCDV, ESTABLISHED, CLOSE_WAIT, FIN_WAIT1, CLOSING, LAST_ACK, FIN_WAIT_2, TIME_WAIT -s states (UDP) Unbound, Idle","breadcrumbs":"Resource analysis & monitor » lsof » lsof(8)","id":"216","title":"lsof(8)"},"217":{"body":"","breadcrumbs":"Resource analysis & monitor » lsof » Examples","id":"217","title":"Examples"},"218":{"body":"Show open files with file flags for process: lsof +fg -p ","breadcrumbs":"Resource analysis & monitor » lsof » File flags","id":"218","title":"File flags"},"219":{"body":"Show open tcp connections for $USER: lsof -a -u $USER -i TCP Note : -a ands the results. If -a is not given all open files matching $USER and all tcp connections are listed ( ored ).","breadcrumbs":"Resource analysis & monitor » lsof » Open TCP connections","id":"219","title":"Open TCP connections"},"22":{"body":"* match any string\n? match any single char\n\\\\ match backslash\n[abc] match any char of 'a' 'b' 'c'\n[a-z] match any char between 'a' - 'z'\n[^ab] negate, match all not 'a' 'b'\n[:class:] match any char in class, available: alnum,alpha,ascii,blank,cntrl,digit,graph,lower, print,punct,space,upper,word,xdigit With extglob shell option enabled it is possible to have more powerful patterns. In the following pattern-list is one ore more patterns separated by | char. ?(pattern-list) matches zero or one occurrence of the given patterns\n*(pattern-list) matches zero or more occurrences of the given patterns\n+(pattern-list) matches one or more occurrences of the given patterns\n@(pattern-list) matches one of the given patterns\n!(pattern-list) matches anything except one of the given patterns Note: shopt -s extglob/shopt -u extglob to enable/disable extglob option.","breadcrumbs":"Tools » bash » Pathname","id":"22","title":"Pathname"},"220":{"body":"Show open connections to localhost for $USER: lsof -a -u $USER -i @localhost","breadcrumbs":"Resource analysis & monitor » lsof » Open connection to specific host","id":"220","title":"Open connection to specific host"},"221":{"body":"Show open connections to port :1234 for $USER: lsof -a -u $USER -i :1234","breadcrumbs":"Resource analysis & monitor » lsof » Open connection to specific port","id":"221","title":"Open connection to specific port"},"222":{"body":"lsof -i 4TCP -s TCP:ESTABLISHED","breadcrumbs":"Resource analysis & monitor » lsof » IPv4 TCP connections in ESTABLISHED state","id":"222","title":"IPv4 TCP connections in ESTABLISHED state"},"223":{"body":"This may help to find which processes keep devices busy when trying to unmount and the device is currently busy. # Assuming /proc is a mount point.\nlsof /proc","breadcrumbs":"Resource analysis & monitor » lsof » List open files in a mounted directory.","id":"223","title":"List open files in a mounted directory."},"224":{"body":"ss [option] [filter] [option] -p ..... Show process using socket -l ..... Show sockets in listening state -4/-6 .. Show IPv4/6 sockets -x ..... Show unix sockets -n ..... Show numeric ports (no resolve) -O ..... Oneline output per socket [filter] dport/sport PORT .... Filter for destination/source port dst/src ADDR ........ Filter for destination/source address and/or .............. Logic operator ==/!= ............... Comparison operator (EXPR) .............. Group exprs","breadcrumbs":"Resource analysis & monitor » ss » ss(8)","id":"224","title":"ss(8)"},"225":{"body":"Show all tcp IPv4 sockets connecting to port 443: ss -4 'dport 443' Show all tcp IPv4 sockets that don't connect to port 443 or connect to address 1.2.3.4. ss -4 'dport != 443 or dst 1.2.3.4'","breadcrumbs":"Resource analysis & monitor » ss » Examples","id":"225","title":"Examples"},"226":{"body":"pidstat [opt] [interval] [cont] -U [user] show username instead UID, optionally only show for user -r memory statistics -d I/O statistics -h single line per process and no lines with average","breadcrumbs":"Resource analysis & monitor » pidstat » pidstat(1)","id":"226","title":"pidstat(1)"},"227":{"body":"pidstat -r -p [interval] [count] minor_pagefault: Happens when the page needed is already in memory but not allocated to the faulting process, in that case the kernel only has to create a new page-table entry pointing to the shared physical page (not required to load a memory page from disk). major_pagefault: Happens when the page needed is NOT in memory, the kernel has to create a new page-table entry and populate the physical page (required to load a memory page from disk).","breadcrumbs":"Resource analysis & monitor » pidstat » Page fault and memory utilization","id":"227","title":"Page fault and memory utilization"},"228":{"body":"pidstat -d -p [interval] [count]","breadcrumbs":"Resource analysis & monitor » pidstat » I/O statistics","id":"228","title":"I/O statistics"},"229":{"body":"pgrep [opts] -n only list newest matching process -u only show matching for user -l additionally list command -a additionally list command + arguments -x match exactly","breadcrumbs":"Resource analysis & monitor » pgrep » pgrep(1)","id":"229","title":"pgrep(1)"},"23":{"body":"Note: The trick with bash I/O redirection is to interpret from left-to-right. # stdout & stderr to file\ncommand >file 2>&1\n# equivalent\ncommand &>file # stderr to stdout & stdout to file\ncommand 2>&1 >file The article Bash One-Liners Explained, Part III: All about redirections contains some nice visualization to explain bash redirections.","breadcrumbs":"Tools » bash » I/O redirection","id":"23","title":"I/O redirection"},"230":{"body":"For example attach gdb to newest zsh process from $USER. gdb -p $(pgrep -n -u $USER zsh)","breadcrumbs":"Resource analysis & monitor » pgrep » Debug newest process","id":"230","title":"Debug newest process"},"231":{"body":"ps [opt] opt: --no-header .... do not print column header -o ....... comma separated list of output columns -p ....... only show pid -C ...... only show processes matching name -T ............. list threads --signames ..... use short signames instead bitmasks Set PS_FORMAT env variable to setup default output columns. Frequently used output columns pid process id\nppid parent process id\npgid process group id\ntid thread id comm name of process\ncmd name of process + args (full) etime elapsed time (since process started)\nuser user owning process\nthcount thread count of process\nnice nice value (-20 highest priority to 19 lowest) pcpu cpu utilization (percent)\npmem physical resident set (rss) (percent)\nrss physical memory (in kb)\nvsz virtual memory (in kb) sig mask of pending signals\nsigcatch mask of caught signals\nsigignore mask of ignored signals\nsigmask mask of blocked signals","breadcrumbs":"Resource analysis & monitor » ps » ps(1)","id":"231","title":"ps(1)"},"232":{"body":"for tid in $(ps -o tid --no-header -T -p 31084); do taskset -c -p $tid;\ndone","breadcrumbs":"Resource analysis & monitor » ps » Example: Use output for scripting","id":"232","title":"Example: Use output for scripting"},"233":{"body":"watch -n1 ps -o pid,pcpu,pmem,rss,vsz,state,user,comm -C fish","breadcrumbs":"Resource analysis & monitor » ps » Example: Watch processes by name","id":"233","title":"Example: Watch processes by name"},"234":{"body":"# With signal masks.\nps -o pid,user,sig,sigcatch,sigignore,sigmask,comm -p 66570 # With signal names.\nps --signames -o pid,user,sig,sigcatch,sigignore,sigmask,comm -p 66570","breadcrumbs":"Resource analysis & monitor » ps » Example: Show signal information","id":"234","title":"Example: Show signal information"},"235":{"body":"pmap [opts] Dump virtual memory map of process. Compared to /proc//maps it shows the size of the mappings.\nopts: -p show full path in the mapping -x show details (eg RSS usage of each segment)","breadcrumbs":"Resource analysis & monitor » pmap » pmap(1)","id":"235","title":"pmap(1)"},"236":{"body":"pstack Dump stack for all threads of process.","breadcrumbs":"Resource analysis & monitor » pstack » pstack(1)","id":"236","title":"pstack(1)"},"237":{"body":"time strace ltrace perf OProfile callgrind","breadcrumbs":"Trace and Profile » Trace and Profile","id":"237","title":"Trace and Profile"},"238":{"body":"# statistics of process run\n/usr/bin/time -v ","breadcrumbs":"Trace and Profile » time » /usr/bin/time(1)","id":"238","title":"/usr/bin/time(1)"},"239":{"body":"strace [opts] [prg] -f .......... follow child processes on fork(2) -ff ......... follow fork and separate output file per child -p .... attach to running process -s ... max string size, truncate of longer (default: 32) -e ... expression for trace filtering -o ... log output into -c .......... dump syscall statitics at the end -C .......... like -c but dump regular ouput as well -k .......... dump stack trace for each syscall -P ... only trace syscall accesing path -y .......... print paths for FDs -tt ......... print absolute timestamp (with us precision) -r .......... print relative timestamp -z .......... log only successful syscalls -Z .......... log only failed syscalls -n .......... print syscall numbers -y .......... translate fds (eg file path, socket) -yy ......... translate fds with all information (eg IP) -x .......... print non-ASCII chars as hex string : trace=syscall[,syscall] .... trace only syscall listed trace=file ................. trace all syscall that take a filename as arg trace=process .............. trace process management related syscalls trace=signal ............... trace signal related syscalls signal ..................... trace signals delivered to the process","breadcrumbs":"Trace and Profile » strace » strace(1)","id":"239","title":"strace(1)"},"24":{"body":"j>&i Duplicate fd i to fd j, making j a copy of i. See dup2(2) . Example: command 2>&1 >file duplicate fd 1 to fd 2, effectively redirecting stderr to stdout redirect stdout to file","breadcrumbs":"Tools » bash » Explanation","id":"24","title":"Explanation"},"240":{"body":"Trace open(2) & socket(2) syscalls for a running process + child processes: strace -f -e trace=open,socket -p Trace signals delivered to a running process: strace -e signal -e 'trace=!all' -p ","breadcrumbs":"Trace and Profile » strace » Examples","id":"240","title":"Examples"},"241":{"body":"ltrace [opts] [prg] -f .......... follow child processes on fork(2) -p .... attach to running process -o ... log output into