Random Tech Ramblings

Posts

journalctl Notes

- September 03, 2020

Show logs since a specific time journalctl --since yesterday journalctl --since "1 hour ago" journalctl --since "2020-09-03 12:34" Show logs for a specific systemd unit journalctl -u haproxy.service Show logs for several units together journalctl -u varnish.service -u hitch.service --since today Show logs by executable journalctl /usr/bin/bash Display kernel messages journalctl -k Output journal entires as JSON journalctl -b -u nobody -o json or formatted JSON journalctl -b -u nobody -o json-pretty Supported output formats: cat : Only the message field export : Binary format for backup or transfer json : One-line per entry standard JSON json-pretty : Human readable JSON json-sse : Server-sent event compatible JSON short : Default syslog style output short-iso : Default with ISO 8601 timestamps ( YYYY-MM-DDTHH:mm:SS+TZ ) short-monotonic : Default with monotonic timestamps since boot ( [ 1.817288] ) short-precise : Default with microsecond precision timestamps (

awk One-Liners

- September 03, 2020

(This is a work in progress) Get the average of a column ls -l | grep -v total | awk -F' ' '{sum += $5 } END { print "AVG=", sum/NR }' Print a file with line numbers awk '{ print FNR "\t" $0 }' file Print number of lines in a file (analogous to wc -l ) awk 'END { print NR }'

Find the process listening on a port

- August 04, 2020

Using netstat PORT=80; sudo netstat -ltnp | grep ":${PORT}" Using lsof PORT=80; sudo lsof -i :${PORT}

Show connections per destination for a specific port

- August 04, 2020

PORT=5432; netstat -an |grep ":${PORT} " | \ awk '{count[$5]++} END {for (host in count) print host, count[host]}' To view the same over time: PORT=5432; watch "netstat -an |grep \":${PORT} \" | \ awk '{count[\$5]++} END {for (host in count) print host, count[host]}'"

Find deleted files that have open file handles

- May 30, 2020

If you have unexplained disk usage that isn't reflected in du output, you most likely have a process holding onto a filehandle for a file that has since been deleted. You can use lsof to find the process/file by running: lsof -nP | grep '(deleted)'

Clearing IPTables rules

- April 23, 2020

Occasionally I find it necessary to quickly clear out all the IPTables rules without accidentally losing access to the machine. I've found the below commands to be the quickest way to accomplish that goal (substitute ip6tables if you live in an IPv6 world) iptables -P INPUT ACCEPT iptables -P FORWARD ACCEPT iptables -P OUTPUT ACCEPT iptables -t nat -F iptables -t mangle -F iptables -F iptables -X You can confirm afterward by running iptables -nvL , which should produce output similar to: Chain INPUT (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination Chain FORWARD (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination

Search This Blog