[CentOS 7系列]监控系统状态下

1、iostat/iotop 磁盘使用

[root@server01~]#iostat##静态显示
Linux3.10.0-514.el7.x86_64(server01)2017年07月11日_x86_64_(1CPU)

avg-cpu:%user%nice%system%iowait%steal%idle
0.320.004.050.290.0095.34

Device:tpskB_read/skB_wrtn/skB_readkB_wrtn
sda1.6253.203.8923465217158
sdb0.030.210.009200
scd00.000.010.00440

[root@server01~]#iotop##动态显示
TotalDISKREAD:0.00B/s|TotalDISKWRITE:0.00B/s
ActualDISKREAD:0.00B/s|ActualDISKWRITE:0.00B/s
TIDPRIOUSERDISKREADDISKWRITESWAPINIO>COMMAND
1be/4root0.00B/s0.00B/s0.00%0.00%systemd-~rialize21
2be/4root0.00B/s0.00B/s0.00%0.00%[kthreadd]
3be/4root0.00B/s0.00B/s0.00%0.00%[ksoftirqd/0]
......

2、free 内存使用

[root@server01~]#free
totalusedfreesharedbuff/cacheavailable
Mem:10083921139486147566868279688719948
Swap:209714802097148
[root@server01~]#free-m##兆
totalusedfreesharedbuff/cacheavailable
Mem:9841116006273703
Swap:204702047
[root@server01~]#free-g
totalusedfreesharedbuff/cacheavailable
Mem:000000
Swap:101
[root@server01~]#free-h##智能显示
totalusedfreesharedbuff/cacheavailable
Mem:984M111M600M6.7M273M703M
Swap:2.0G0B2.0G

buffer：cpu传给内存（buffer），再写入磁盘。

cache：从磁盘读进内存（cache），再提交cpu。

total=used+free+buff/cache；

available包含free和buff/cache剩余部分。

3、ps 系统进程

[root@server01~]#psaux
USERPID%CPU%MEMVSZRSSTTYSTATSTARTTIMECOMMAND
root10.00.61280926708?Ss7月100:01/usr/lib/syste
root20.00.000?S7月100:00[kthreadd]
root30.00.000?S7月100:00[ksoftirqd/0]
......
[root@server01~]#ps-elf
FSUIDPIDPPIDCPRINIADDRSZWCHANSTIMETTYTIMECMD
4Sroot100800-32023ep_pol7月10?00:00:01/usr/lib/systemd/systemd--switched-root--system--deserialize21
1Sroot200800-0kthrea7月10?00:00:00[kthreadd]
1Sroot320800-0smpboo7月10?00:00:00[ksoftirqd/0]
......

“ps aux”和“ps -elf”的作用是一致的，使用哪个取决于用户使用习惯。

�STAT部分详解：

D 不能中断的进程 < 高优先级进程

R run状态的进程 N 低优先级进程

S sleep状态的进程 L 内存中被锁了内存分页

T 暂停的进程 s 主进程

Z 僵尸进程 l 多线程进程

+ 前台进程

4、netstat 网络状态

[root@server01~]#netstat
ActiveInternetconnections(w/oservers)
ProtoRecv-QSend-QLocalAddressForeignAddressState
tcp064server01:sshgateway:51102ESTABLISHED
udp00server01:53475marla.ludost.net:ntpESTABLISHED
udp00server01:4487661-216-153-107.HINE:ntpESTABLISHED
udp00server01:40498ntp1.ams1.nl.leasew:ntpESTABLISHED
udp00server01:49814ntp4.itcompliance.d:ntpESTABLISHED
ActiveUNIXdomainsockets(w/oservers)
ProtoRefCntFlagsTypeStateI-NodePath
unix2[]DGRAM7564/run/systemd/notify
......
[root@server01~]#netstat-lnp##能显示端口和连接状态
ActiveInternetconnections(onlyservers)
ProtoRecv-QSend-QLocalAddressForeignAddressStatePID/Programname
tcp000.0.0.0:220.0.0.0:*LISTEN1293/sshd
tcp00127.0.0.1:250.0.0.0:*LISTEN1793/master
tcp600:::22:::*LISTEN1293/sshd
tcp600::1:25:::*LISTEN1793/master
udp00127.0.0.1:3230.0.0.0:*492/chronyd
udp600::1:323:::*492/chronyd
raw600:::58:::*7510/NetworkManager
ActiveUNIXdomainsockets(onlyservers)
......
[root@server01~]#netstat-an
ActiveInternetconnections(serversandestablished)
ProtoRecv-QSend-QLocalAddressForeignAddressState
tcp000.0.0.0:220.0.0.0:*LISTEN
tcp00127.0.0.1:250.0.0.0:*LISTEN
tcp064192.168.137.100:22192.168.137.1:51102ESTABLISHED
tcp600:::22:::*LISTEN
tcp600::1:25:::*LISTEN
udp00192.168.137.100:5347579.98.105.18:123ESTABLISHED
udp00127.0.0.1:3230.0.0.0:*
udp00192.168.137.100:5838161.216.153.107:123ESTABLISHED
......
[root@server01~]#netstat-lntp##只显示TCP
ActiveInternetconnections(onlyservers)
ProtoRecv-QSend-QLocalAddressForeignAddressStatePID/Programname
tcp000.0.0.0:220.0.0.0:*LISTEN1293/sshd
tcp00127.0.0.1:250.0.0.0:*LISTEN1793/master
tcp600:::22:::*LISTEN1293/sshd
tcp600::1:25:::*LISTEN1793/master
[root@server01~]#netstat-lnup##只显示UDP
ActiveInternetconnections(onlyservers)
ProtoRecv-QSend-QLocalAddressForeignAddressStatePID/Programname
udp00127.0.0.1:3230.0.0.0:*492/chronyd
udp600::1:323:::*492/chronyd
[root@server01~]#netstat-an|awk'/^tcp/{++sta[$NF]}END{for(keyinsta)printkey,"\t",sta[key]}'##统计连接数
LISTEN4
ESTABLISHED1
[root@server01~]#ss-an
......

u_strESTAB00*13719*13718
u_strESTAB00*17908*17907
u_strESTAB00*14545*14546
u_strESTAB00*13612*13720
udpUNCONN00:::58:::*
udpESTAB00192.168.137.100:56524163.172.177.158:123
udpESTAB00192.168.137.100:4272379.98.105.18:123
udpUNCONN00127.0.0.1:323*:*
udpESTAB00192.168.137.100:5838161.216.153.107:123
......

5、tcpdump 抓包

[root@server01~]#tcpdump-nn-iens33##指定抓包网卡
......
00:43:14.089076IP192.168.137.100.22>192.168.137.1.51102:Flags[P.],seq1265808:1266096,ack18561,win260,length288
00:43:14.089308IP192.168.137.1.51102>192.168.137.100.22:Flags[.],ack1266096,win251,length0
00:43:14.089335IP192.168.137.100.22>192.168.137.1.51102:Flags[P.],seq1266096:1266272,length176
^C
8213packetscaptured
8215packetsreceivedbyfilter
0packetsdroppedbykernel

其他用法：

tcpdump-nnport80##指定抓包端口
tcpdump-nnnotport25andhost192.168.137.1##“and”匹配多个过滤条件
tcpdump-nn-c100-w1.cap##100个包写入文件
tcpdump-r/tmp/1.cap##读取抓包文件

�除了tcpdump外，wireshark也可以用于抓包：

[root@server01~]#tshark-n-ta-Rhttp.request-Tfields-e"frame.time"-e"ip.src"-e"http.host"-e"http.request.mothod"-e"http.request.uri"
##显示访问http请求的域名以及uri

参数解读：

-e<field>
Addafieldtothelistoffieldstodisplayif-Tfieldsisselected.Thisoptioncanbeusedmultipletimesonthecommandline.Atleastonefieldmustbeprovidedifthe-Tfieldsoptionisselected.Columnnamesmaybeusedprefixedwith"col."
Example:-eframe.number-eip.addr-eudp-ecol.info
Givingaprotocolratherthanasinglefieldwillprintmultipleitemsofdataabouttheprotocolasasinglefield.Fieldsareseparatedbytabcharactersbydefault.-Econtrolstheformatoftheprintedfields.

-R<Readfilter>
Causethespecifiedfilter(whichusesthesyntaxofread/displayfilters,ratherthanthatofcapturefilters)tobeappliedduringthefirstpassofanalysis.Packetsnotmatchingthefilterarenotconsideredforfuturepasses.Onlymakessensewithmultiplepasses,see-2.Forregularfilteringonsingle-passdissectsee-Yinstead.
Notethatforward-lookingfieldssuchas'responseinframe#'cannotbeusedwiththisfilter,sincetheywillnothavebeencalculatewhenthisfilterisapplied.

其他用法：

①抓取mysql的查询：
tshark-n-ieth1-R'mysql.query'-Tfields-e"ip.src"-e"mysql.query"
tshark-ieth1port3307-dtcp.port==3307,mysql-z"proto,colinfo,mysql.query,mysql.query"
②抓取指定类型的MySQL查询：
tshark-n-ieth1-R'mysqlmatches"SELECT|INSERT|DELETE|UPDATE"'-Tfields-e"ip.src"-e"mysql.query"
③统计http的状态：
tshark-n-q-zhttp,stat,-zhttp,tree
④增加时间标签：
tshark-tad
tshark-ta