News for hackers. Stuff that matters.
Re:I usually run 'w' first when troubleshooting unknown mach... by ktpsns on Tuesday March 27, 2018 @04:51AM (#16686532)
Interesting that nobody mentioned htop so far (https://en.wikipedia.org/wiki/Htop). It is my favourite command to get a quick glance on the computational facilities of a computer (memory, cores) and what it is doing (load, fancy ps/top). htop is not installed everywhere, but it is easy to make a static build and scp it to the questioned host.

Another very handy command is

  sudo netstat -atpn
which shows you the processes and owners of open TCP/UDP ports. The argument combination is as weird as "ps aux" that I just memorized it by heart.
Re:I usually run 'w' first when troubleshooting unknown mach... by jaipilot747 on Tuesday March 27, 2018 @05:44AM (#16686760)
I remember it by imagining netstat wearing pants. There is plain ole netstat and there's netstat wearing pants.
Re:I usually run 'w' first when troubleshooting unknown mach... by thriftwy on Tuesday March 27, 2018 @05:57AM (#16686827)
Then there's grep -whor which is also super useful.
Re:I usually run 'w' first when troubleshooting unknown mach... by ajuc on Tuesday March 27, 2018 @09:45AM (#16688256)
Thanks! I didn't knew about -o.

My most common grep phrase is grep -iIRn - good for searching in code (when IDE can't find something). You can remove -i if you care about case, but I mostly used it for plsql code, and that's not case-sensitive.

Re:I usually run 'w' first when troubleshooting unknown mach... by blowski on Tuesday March 27, 2018 @06:02AM (#16686844)
What does that do?
Re:I usually run 'w' first when troubleshooting unknown mach... by thriftwy on Tuesday March 27, 2018 @06:20AM (#16686921)
Pinches whole-words (by regex usually, e.g. '[A-Z][A-Za-z]*Exception') out of files recursively. Then throw in sort and uniq -c.
Re:I usually run 'w' first when troubleshooting unknown mach... by jakeogh on Tuesday March 27, 2018 @07:30AM (#16687275)
example? I tried a few things, clearly since -r it's not a single file grep, but throwing in -h with -r is confusing. I thought I was pretty good at grepping...

-r everyone needs, but usually -R is a better default since it does not ignore symlinks

-h I practically never use since I'm almost always using grep to find what file I need to further investigate and letting the stuff down the | line deal with it

-o makes sense, kinda, I want to do that in the next stage of the pipe, maybe I have used it once? cant remember

but -w... I feel like I'm missing something there.

Re:I usually run 'w' first when troubleshooting unknown mach... by thriftwy on Tuesday March 27, 2018 @07:45AM (#16687378)
I think you have dramatically different usage patterns than me. I use -o all the time. I only know -w for a limited time, but it's one of my favorite options since you can filter out a lot of garbage. You could replace it with grep -P '\bpattern\b', I guess.

I think what you are doing here is search, but -o and -w shine at data extraction and data manipulation. Things you would use Excel for, except on multiple GB files.

Re:I usually run 'w' first when troubleshooting unknown mach... by jakeogh on Tuesday March 27, 2018 @07:52AM (#16687414)
Very interesting. I'm still floundering for a use case... can you give an outline if it's difficult to make a specific example?

If you are not using search, but are using a recursive (-r) grep, then you are feeding a bunch of data to your pipe but don't care what file it came from. I get that... I mirrored the SEC's ftp back when it was ftp... and it's interesting for correlation and name stuff... but that's not going to work because it's freeform, and it's millions of small files... so you are using (large) files with a known format? Something like spectral datasets where the fields are passed with the data prefixed with it's important tags? Maybe logs?

Re:I usually run 'w' first when troubleshooting unknown mach... by thriftwy on Tuesday March 27, 2018 @08:01AM (#16687452)
As I have already said,

    grep -whor '[A-Z][A-Za-z]*Exception' * | sort | uniq -c
for a histogram of exceptions inside logs downloaded from a bunch of nodes.

As for -w, my favourite case is https://unix.stackexchange.com/questions/110645/select-lines...

As for -o,

    grep -o ........-....-....-....-............
It may look like Morse code, but what it does is greps UUIDs out.
Re:I usually run 'w' first when troubleshooting unknown mach... by jakeogh on Tuesday March 27, 2018 @08:09AM (#16687495)
Ahhh. TIL!
Re:I usually run 'w' first when troubleshooting unknown mach... by djKianoosh on Tuesday March 27, 2018 @04:20PM (#16692368)
cool stuff, i was messing around with this. To then take that list of exceptions and find them back the actual files again, tack on at the end: `| grep -Fwf - *`
Re:I usually run 'w' first when troubleshooting unknown mach... by y4mi on Tuesday March 27, 2018 @07:30AM (#16687276)
> which shows you the processes and owners of open TCP/UDP ports

naw, that would be `netstat -lntup` (listening, nummeric, tcp, udp, programm)

your mentioned command shows essentially all currently active tcp network streams. https://explainshell.com/explain?cmd=sudo+netstat+-atpn

btw, glances is even more complete than htop

https://github.com/nicolargo/glances

Re:I usually run 'w' first when troubleshooting unknown mach... by SpeciesInvader on Tuesday March 27, 2018 @08:44AM (#16687708)
I've been using glances for about a month and am still getting a hang if different UI layouts. It's great for almost any box I'm checking on.
Re:I usually run 'w' first when troubleshooting unknown mach... by BuildTheRobots on Tuesday March 27, 2018 @04:53AM (#16686540)
I use both htop and atop, usually htop first as it's more graphical, but atop gives nice IO, wait and NET stats too which is extremely useful.
Re:I usually run 'w' first when troubleshooting unknown mach... by jakeogh on Tuesday March 27, 2018 @07:45AM (#16687376)
atop i sweet for overview, but for IO I reach for iotop
Re:I usually run 'w' first when troubleshooting unknown mach... by v_lisivka on Tuesday March 27, 2018 @07:34AM (#16687295)
nmon is also good. Check it out.
Re:I usually run 'w' first when troubleshooting unknown mach... by mdekkers on Tuesday March 27, 2018 @01:44PM (#16690955)
also, dstat
Re:I usually run 'w' first when troubleshooting unknown mach... by poooogles on Tuesday March 27, 2018 @05:04AM (#16686588)
netstat is deprecated and has been for a while, you should be using ss from iproute2. Most of the commands should map directly so it's pretty drop in.
Re:I usually run 'w' first when troubleshooting unknown mach... by kchoudhu on Tuesday March 27, 2018 @09:08AM (#16687901)
There's are more kinds of UNIX than Linux, and not all of them have deprecated perfectly functional tools.
Re:I usually run 'w' first when troubleshooting unknown mach... by mmillin on Tuesday March 27, 2018 @07:29AM (#16687268)
Only on certain Linux systems is it deprecated. On the BSDs netstat is still the preferred tool.
Re:I usually run 'w' first when troubleshooting unknown mach... by bloopernova on Tuesday March 27, 2018 @12:29PM (#16690112)
I like ss if only for the mnemonic "ss 4chan" which sort of but not quite maps to "ss -4tan" ( https://explainshell.com/explain?cmd=ss+-4tan )
Re:I usually run 'w' first when troubleshooting unknown mach... by y4mi on Tuesday March 27, 2018 @12:54PM (#16690406)
Thats glorious, gotta remember that one.

Chan is a japanese name ending for children, various communities have created several Anime mascots over the years. Theyre generally suffixed with that -tan, as a cute misspronounciation of chan.

https://en.m.wikipedia.org/wiki/OS-tan

Btw, 4tan should be that 4chan mascot. Ive seen it previously on sankaku complex, but its been too many years ago. Cant find it right now.

/Edit: i probably should mention that you shouldnt visit sankaku complex at work. Its very... Questionable with nudity

Re:I usually run 'w' first when troubleshooting unknown mach... by mappu on Tuesday March 27, 2018 @03:26PM (#16691918)
Re:I usually run 'w' first when troubleshooting unknown mach... by telchar on Tuesday March 27, 2018 @02:09PM (#16691187)
This thread has been worth is just to learn about explainshell. I'm so happy that exists.
Re:I usually run 'w' first when troubleshooting unknown mach... by dod9er on Tuesday March 27, 2018 @10:04AM (#16688446)
Uh ok, but ss -atpn isnt very readable on my terminal due to linewrap. Anyone with suggestions ?
Re:I usually run 'w' first when troubleshooting unknown mach... by defen on Tuesday March 27, 2018 @12:13PM (#16689908)

    ss -atpn | column -t
Or pipe into `cat`
Re:I usually run 'w' first when troubleshooting unknown mach... by sridca on Tuesday March 27, 2018 @09:43AM (#16688237)
What is `ss`-equivalent of `netstat -atpn`?
Re:I usually run 'w' first when troubleshooting unknown mach... by liveoneggs on Tuesday March 27, 2018 @11:03AM (#16689127)
I just use ss -nape most of the time
Re:I usually run 'w' first when troubleshooting unknown mach... by philamonster on Tuesday March 27, 2018 @10:35AM (#16688782)
Prefer netstat -tulpen.

TCP, UDP, listening ports, user, PID and process name, extended detail.

Re:I usually run 'w' first when troubleshooting unknown mach... by gowld on Tuesday March 27, 2018 @10:39AM (#16688833)
netstat -penult (as in penultimate)

What's the ultimate netstat?

Re:I usually run 'w' first when troubleshooting unknown mach... by gjvc on Wednesday March 28, 2018 @12:19AM (#16695253)
sudo netstat -tuple

:-)

Re:I usually run 'w' first when troubleshooting unknown mach... by sateesh on Tuesday March 27, 2018 @10:56AM (#16689028)
I run netstat -tunapl easy to remember
Re:I usually run 'w' first when troubleshooting unknown mach... by mdekkers on Tuesday March 27, 2018 @01:43PM (#16690949)
nobody mentioned htop

htop is my trusted standby. Fell in love with netdata though. https://github.com/firehol/netdata - since we all do our best to stay away from getting shells on the servers, netdata is awesome

Re:I usually run 'w' first when troubleshooting unknown mach... by bloopernova on Wednesday March 28, 2018 @09:45AM (#16697554)
netdata is very interesting, thank you for sharing it.

It seems to do something very similar to Cockpit, but netdata has way more stuff out of the box.

Re:I usually run 'w' first when troubleshooting unknown mach... by discreditable on Tuesday March 27, 2018 @02:08PM (#16691170)
If you're ssh-ing random boxes they may not have htop.
Re:I usually run 'w' first when troubleshooting unknown mach... by mdekkers on Tuesday March 27, 2018 @04:29PM (#16692444)
...my cracking days are long behind me, I no longer ssh into random boxes :)
Re:I usually run 'w' first when troubleshooting unknown mach... by rhizome on Tuesday March 27, 2018 @02:55PM (#16691651)
To be fair, nobody mentions it until someone mentions it.
Re:I usually run 'w' first when troubleshooting unknown mach... by comboy on Tuesday March 27, 2018 @06:08AM (#16686872)
Can anybody explain to me why this command can return instantly but "lsof -i" sometimes takes ages to complete?
Re:I usually run 'w' first when troubleshooting unknown mach... by jakeogh on Tuesday March 27, 2018 @06:12AM (#16686896)
you need -n, otherwise it's trying to RDNS the IP's. It's a dumb default... chatting on the network without you asking while at the same time censoring the data the kernal was using... similarly "ls" might take forever (which matters if it's a big folder and you are piping it's output or just want |head) because it wants to sort (use -f to fix). The ls is a sensible default, often it's for human consumption, and the sort is way faster than a bunch of DNS lookups that could take an arb long time.

lsof has a good case to join coreutils.

Re:I usually run 'w' first when troubleshooting unknown mach... by ktpsns on Tuesday March 27, 2018 @09:21AM (#16688010)
A similar issue as with the "-n" flag for netcat exists for "ls": Frequently "ls" is aliased by default in users home directories:

   $ type ls
   ls is aliased to `ls --color=auto'
On slow file systems (for instance, think of shared machines with large directories, NFS and heavy load) this can take ages to give output. Instead, if you just call /bin/ls, this call only calls http://man7.org/linux/man-pages/man3/readdir.3.html and thus gives output promptly.
Re:I usually run 'w' first when troubleshooting unknown mach... by kbenson on Tuesday March 27, 2018 @10:35AM (#16688786)
I've seen \ls used to get the unaliased system version of ls. Likely useful for those commands where you don't want the aliased version and aren't sure if they live in /bin or /usr/bin.
Re:I usually run 'w' first when troubleshooting unknown mach... by ssebastianj on Tuesday March 27, 2018 @04:10PM (#16692278)
Nice, didn't know about "\ls"! I wonder what's the difference between "\ls" and "command ls". Yes, it's a bit longer to type but the output is the same, I'm asking about what happens behind the scenes.
Re:I usually run 'w' first when troubleshooting unknown mach... by comboy on Tuesday March 27, 2018 @06:58AM (#16687094)
thanks!