Hacker News Reader

Comment by ktpsns | Hacker News Reader

Interesting that nobody mentioned htop so far (https://en.wikipedia.org/wiki/Htop). It is my favourite command to get a quick glance on the computational facilities of a computer (memory, cores) and what it is doing (load, fancy ps/top). htop is not installed everywhere, but it is easy to make a static build and scp it to the questioned host.

Another very handy command is

  sudo netstat -atpn

which shows you the processes and owners of open TCP/UDP ports. The argument combination is as weird as "ps aux" that I just memorized it by heart.

View on HN

I remember it by imagining netstat wearing pants. There is plain ole netstat and there's netstat wearing pants.

Then there's grep -whor which is also super useful.

What does that do?

Pinches whole-words (by regex usually, e.g. '[A-Z][A-Za-z]*Exception') out of files recursively. Then throw in sort and uniq -c.

example? I tried a few things, clearly since -r it's not a single file grep, but throwing in -h with -r is confusing. I thought I was pretty good at grepping...

-r everyone needs, but usually -R is a better default since it does not ignore symlinks

-h I practically never use since I'm almost always using grep to find what file I need to further investigate and letting the stuff down the | line deal with it

-o makes sense, kinda, I want to do that in the next stage of the pipe, maybe I have used it once? cant remember

but -w... I feel like I'm missing something there.

I think you have dramatically different usage patterns than me. I use -o all the time. I only know -w for a limited time, but it's one of my favorite options since you can filter out a lot of garbage. You could replace it with grep -P '\bpattern\b', I guess.

I think what you are doing here is search, but -o and -w shine at data extraction and data manipulation. Things you would use Excel for, except on multiple GB files.

Very interesting. I'm still floundering for a use case... can you give an outline if it's difficult to make a specific example?

If you are not using search, but are using a recursive (-r) grep, then you are feeding a bunch of data to your pipe but don't care what file it came from. I get that... I mirrored the SEC's ftp back when it was ftp... and it's interesting for correlation and name stuff... but that's not going to work because it's freeform, and it's millions of small files... so you are using (large) files with a known format? Something like spectral datasets where the fields are passed with the data prefixed with it's important tags? Maybe logs?

As I have already said,

    grep -whor '[A-Z][A-Za-z]*Exception' * | sort | uniq -c

for a histogram of exceptions inside logs downloaded from a bunch of nodes.

As for -w, my favourite case is https://unix.stackexchange.com/questions/110645/select-lines...

As for -o,

    grep -o ........-....-....-....-............

It may look like Morse code, but what it does is greps UUIDs out.

Ahhh. TIL!

cool stuff, i was messing around with this. To then take that list of exceptions and find them back the actual files again, tack on at the end: `| grep -Fwf - *`

Thanks! I didn't knew about -o.

My most common grep phrase is grep -iIRn - good for searching in code (when IDE can't find something). You can remove -i if you care about case, but I mostly used it for plsql code, and that's not case-sensitive.

> which shows you the processes and owners of open TCP/UDP ports

naw, that would be `netstat -lntup` (listening, nummeric, tcp, udp, programm)

your mentioned command shows essentially all currently active tcp network streams. https://explainshell.com/explain?cmd=sudo+netstat+-atpn

btw, glances is even more complete than htop

https://github.com/nicolargo/glances

I've been using glances for about a month and am still getting a hang if different UI layouts. It's great for almost any box I'm checking on.

I use both htop and atop, usually htop first as it's more graphical, but atop gives nice IO, wait and NET stats too which is extremely useful.

nmon is also good. Check it out.

atop i sweet for overview, but for IO I reach for iotop

also, dstat

netstat is deprecated and has been for a while, you should be using ss from iproute2. Most of the commands should map directly so it's pretty drop in.

Only on certain Linux systems is it deprecated. On the BSDs netstat is still the preferred tool.

There's are more kinds of UNIX than Linux, and not all of them have deprecated perfectly functional tools.

What is `ss`-equivalent of `netstat -atpn`?

I just use ss -nape most of the time

Uh ok, but ss -atpn isnt very readable on my terminal due to linewrap. Anyone with suggestions ?

    ss -atpn | column -t

Or pipe into `cat`

I like ss if only for the mnemonic "ss 4chan" which sort of but not quite maps to "ss -4tan" ( https://explainshell.com/explain?cmd=ss+-4tan )

Thats glorious, gotta remember that one.

Chan is a japanese name ending for children, various communities have created several Anime mascots over the years. Theyre generally suffixed with that -tan, as a cute misspronounciation of chan.

https://en.m.wikipedia.org/wiki/OS-tan

Btw, 4tan should be that 4chan mascot. Ive seen it previously on sankaku complex, but its been too many years ago. Cant find it right now.

/Edit: i probably should mention that you shouldnt visit sankaku complex at work. Its very... Questionable with nudity

> that 4chan mascot

https://en.wikipedia.org/wiki/Yotsuba%26! (SFW)

This thread has been worth is just to learn about explainshell. I'm so happy that exists.

Prefer netstat -tulpen.

TCP, UDP, listening ports, user, PID and process name, extended detail.

netstat -penult (as in penultimate)

What's the ultimate netstat?

sudo netstat -tuple

:-)

I run netstat -tunapl easy to remember

nobody mentioned htop

htop is my trusted standby. Fell in love with netdata though. https://github.com/firehol/netdata - since we all do our best to stay away from getting shells on the servers, netdata is awesome

If you're ssh-ing random boxes they may not have htop.

...my cracking days are long behind me, I no longer ssh into random boxes :)

netdata is very interesting, thank you for sharing it.

It seems to do something very similar to Cockpit, but netdata has way more stuff out of the box.

To be fair, nobody mentions it until someone mentions it.

Can anybody explain to me why this command can return instantly but "lsof -i" sometimes takes ages to complete?

you need -n, otherwise it's trying to RDNS the IP's. It's a dumb default... chatting on the network without you asking while at the same time censoring the data the kernal was using... similarly "ls" might take forever (which matters if it's a big folder and you are piping it's output or just want |head) because it wants to sort (use -f to fix). The ls is a sensible default, often it's for human consumption, and the sort is way faster than a bunch of DNS lookups that could take an arb long time.

lsof has a good case to join coreutils.

thanks!

A similar issue as with the "-n" flag for netcat exists for "ls": Frequently "ls" is aliased by default in users home directories:

   $ type ls
   ls is aliased to `ls --color=auto'

On slow file systems (for instance, think of shared machines with large directories, NFS and heavy load) this can take ages to give output. Instead, if you just call /bin/ls, this call only calls http://man7.org/linux/man-pages/man3/readdir.3.html and thus gives output promptly.

I've seen \ls used to get the unaliased system version of ls. Likely useful for those commands where you don't want the aliased version and aren't sure if they live in /bin or /usr/bin.

Nice, didn't know about "\ls"! I wonder what's the difference between "\ls" and "command ls". Yes, it's a bit longer to type but the output is the same, I'm asking about what happens behind the scenes.

Reply on news.ycombinator.com