Top Command in Detail

top is a system administration tool which allows the root user to view processes running on the system and other vital system information.

Enter top -S to display resource use information using "cumulative" mode (the -S flag will report CPU time used by processes and their children since top -S was started).

top - 03:31:05 up 7:40, 1 user, load average: 0.00, 0.00, 0.00
Tasks: 15 total, 1 running, 14 sleeping, 0 stopped, 0 zombie
Cpu(s): 0.1% us, 0.0% sy, 0.0% ni, 99.9% id, 0.0% wa, 0.0% hi, 0.0% si
Mem: 512000k total, 115552k used, 396448k free, 0k buffers
Swap: 0k total, 0k used, 0k free, 0k cached

PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND
1 root 15 0 1516 520 452 S 0.0 0.1 0:05.28 init
1559 root 15 0 1564 536 440 S 0.0 0.1 0:00.03 syslogd
1579 root 18 0 2512 1228 1016 S 0.0 0.2 0:00.01 mysqld_safe
1598 root 18 0 2512 560 344 S 0.0 0.1 0:00.00 mysqld_safe
1599 mysql 18 0 97960 16m 3100 S 0.0 3.2 0:02.06 mysqld
1600 root 21 0 1496 504 440 S 0.0 0.1 0:00.00 logger
1673 daemon 18 0 1696 368 280 S 0.0 0.1 0:00.00 atd
1676 root 15 0 1776 748 604 S 0.0 0.1 0:02.16 cron
1683 root 18 0 10516 4216 3184 S 0.0 0.8 0:00.21 apache
1696 www-data 15 0 10520 1988 896 S 0.0 0.4 0:00.00 apache
1697 www-data 15 0 10520 1960 868 S 0.0 0.4 0:00.00 apache
11830 root 18 0 3472 896 660 S 0.0 0.2 0:03.91 sshd
28133 root 15 0 14456 1980 1456 S 0.0 0.4 0:00.19 sshd
28166 root 15 0 2568 1408 1128 S 0.0 0.3 0:00.68 bash
21716 root 15 0 2072 1028 836 R 0.0 0.2 0:00.04 top


Column Names

Commonly-used columns:

1. PID - Process ID - The unique ID of the process (commonly used with the kill command)
2. USER - Username which the process is running under
3. PR - Priority for the process (ranges from -20 for very important processes to 19 for unimportant processes)
4. NI - Nice value modifies the priority of the process (a negative value will increase the priority of the process and a positive value will decrease the priority of the process)
5. VIRT - Total amount of virtual memory used by the process
6. RES - Resident size (kb) - Non-swapped physical memory which the process has used
7. SHR - Shared memory size (kb) - Amount of shared memory which the process has used (shared memory is memory which could be allocated to other processes)
8. S - Process status - Possible values:
* R - Running
* D - Sleeping (may not be interrupted)
* S - Sleeping (may be interrupted)
* T - Traced or stopped
* Z - Zombie or "hung" process
9. %CPU - Percentage of CPU time the process was using at the time top last updated
10. %MEM - Percentage of memory (RAM) the process was using at the time top last updated
11. TIME+ - Cumulative CPU time which the process and children of the process have used
12. COMMAND - Name of the process or the path to the command used to start the process (press c to toggle between the name of the process and the path to the command used to start the process)

Wonderful Find Command

"find" is a versatile tool which can be used to locate files and directories satisfying different user criteria. But the sheer number of options for this command line tool makes it at the same time both powerful and encumbering for the user.

Here are a few combinations which one can use to get useful results using find command.

* Find all HTML files starting with letter 'a' in your current directory (Case sensitive):

Code: find . -name a\*.html

* Find files which are larger than 5 MB in size:

Code: find . -size 5000k -type f

Here the ' ' in ' 5000k' indicates greater than and k is kilobytes. And the dot '.' indicates the current directory. The -type option can take any of the following values:
f - file
d - directory
l - symbolic link
c - character
p - named pipe (FIFO)
s - socket
b - block device

* Find all empty files in your directory:

Code: find . -size 0c -type f

* Find is very powerful in that you can combine it with other commands. For example, to find all empty files in the current directory and delete them, do the following:

Code: find . -empty -maxdepth 1 -exec rm {} \;

* To search for a html file having the text 'Web sites' in it, you can combine find with grep as follows:

Code: find . -type f -iname \*.html -exec grep -s "Web sites" {} \;

* Compress log files on an individual basis:

Code: find /var -iname \*.log -exec bzip {} \;

* Find all files which belong to user lal and change its ownership to ravi:

Code: find / -user lal -exec chown ravi {} \;

* xargs command can also be used instead of the -exec option as follows:

Code: find /var -iname \*.log | xargs bzip –

* Find all files which do not belong to any user:

Code: find . –nouser

* find files of size between 700k and 1000k:

Code: find . \( -size 700k -and -size -1000k \)


* How about getting a formatted output of the above command with the size of each file listed ?:

Code: find . \( -size 700k -and -size -1000k \) -exec du -Hs {} \; 2>/dev/null


* You can also limit your search by file system type. For example, to restrict search to files residing only in the NTFS and VFAT filesystem, do the following:

Code: find / -maxdepth 2 \( -fstype vfat -or -fstype ntfs \) 2> /dev/null

Regards
Nobs

How to Reset a Linux Box root password.

If the linux box protected with root password only.

Do a hard reboot on the machine and click on ‘e’ button to edit the boot like when you get the grub menu. Scrol down to the line which starts with kernel and hit ‘e’ again to edit and add ‘single’ (with out quotes) at the end and hit Enter. Now use ‘b’ to boot then you will get single user mode from where you can change the server root password.

If the linux box is protected with a password for single user mode.

Few system require root password to boot into ‘single mode’ in that case try to edit the gurb boot line and add ‘init=/bin/bash’ at the end of kernel line. You will be redirected to a bash shell instead of init.

Now you may want to mount the root paritition with read/write permission.

mount –no remount,rw /

Then reset the password.

If the Grub is protected with a root password, then try booting from a LiveCD and open a root shell. Execute fdisk –l to show the available disk partition. Mount the root paritition to /mnt

mount -o,rw /dev/hda1 /mnt

Make sure that you mount a root partition. Next change this partition as your root directory using following command

chroot /mnt

Now try to change the root password using passwd command.

Regards
Nobs

Increasing Mysql Packet Size

A communication packet is a single SQL statement sent to the MySQL server, a single row that is sent to the client, or a binary log event sent from a master replication server to a slave.

The largest possible packet that can be transmitted to or from a MySQL 5.1 server or client is 1GB.

When a MySQL client or the mysqld server receives a packet bigger than max_allowed_packet bytes, it issues a Packet too large error and closes the connection. With some clients, you may also get a Lost connection to MySQL server during query error if the communication packet is too large.

So if you want to handle big packets, you must increase this variable both in the client and in the server.

The server's default max_allowed_packet value is 1MB. You can increase this if the server needs to handle big queries. For example, to set the variable to 16MB, start the server like this:

# mysqld --max_allowed_packet=16M

You can also use my.cnf to set max_allowed_packet. For example, to set the size for the server to 16MB, add the following lines in my.cnf file:

[mysqld]
max_allowed_packet=16M

You can also get strange problems with large packets if you are using large BLOB values but have not given mysqld access to enough memory to handle the query. If you suspect this is the case, try adding ulimit -d 256000 to the beginning of the mysqld_safe script and restarting mysqld.

Wonderful lsof Command

lsof is a tool for locating open files. What makes this especially useful is that in Linux, everything is treated as a file: pipes, directories, devices, inodes, sockets and so on.

lsof (no options) will list all files opened by any processes currently running. To restrict this to processes owned by username, use lsof -u username. Here's some sample output:

COMMAND PID USER FD TYPE DEVICE SIZE NODE NAME
sshd 2354 nobs mem REG 254,0 14880 105723 /lib/libcap.so.1.10
sshd 2354 nobs DEL REG 0,8 127123574 /dev/zero
bash 2363 nobs cwd DIR 254,4 20480 7274497 /home/nobs
bash 2363 nobs txt REG 254,0 769368 4126 /bin/bash
bash 2363 nobs mem REG 254,0 97928 105698 /lib/ld-2.3.6.so

The FD column shows file descriptor information, or identifies other types of file. Here, cwd indicates the current working directory, and txt indicates program text. The TYPE column has filetype info (REG indicates a regular file). The NODE column may be useful if you're trying to recover a deleted file. See the man page for a full explanation of the output.

lsof filename shows which processes have files of this name open. lsof +D /directory will show processes which have files in this directory open. You can use this if you're trying to unmount a filesystem but getting an 'in use' error, to find the processes using files on that File System, and kill them as required.

lsof -c processname will show all processes beginning with processname that have files open; lsof +p PID does the same thing for a process ID. Using lsof -i will get you information about IP sockets. Check out the man page for more detail and for the many other available options. lsof is really a cool one to play around.

Cheers
Nobs

Recovering Deleted Files With lsof

One of the more neat things you can do with the versatile utility lsof is use it to recover a file you've just accidentally deleted.

A file in Linux is a pointer to an inode, which contains the file data (permissions, owner and where its actual content lives on the disk). Deleting the file removes the link, but not the inode itself – if another process has it open, the inode isn't released for writing until that process is done with it.

To try this out, create a test text file, save it and then type less test.txt. Open another terminal window, and type rm testing.txt. If you try ls testing.txt you'll get an error message. But! less still has a reference to the file. So:

# lsof | grep testing.txt
less 4607 juliet 4r REG 254,4 21
8880214 /home/juliet/testing.txt (deleted)

The important columns are the second one, which gives you the PID of the process that has the file open (4607), and the fourth one, which gives you the file descriptor (4). Now, we go look in /proc, where there will still be a reference to the inode, from which you can copy the file back out:

# ls -l /proc/4607/fd/4
lr-x------ 1 juliet juliet 64 Apr 7 03:19
/proc/4607/fd/4 -> /home/juliet/testing.txt (deleted)
# cp /proc/4607/fd/4 testing.txt.bk

Note: don't use the -a flag with cp, as this will copy the (broken) symbolic link, rather than the actual file contents.

Now check the file to make sure you've got what you think you have, and you're done!

Cheers
Nobs

Difference Between Soft Link and Hard Link

Hard Links :

1. All Links have same inode number.

2.ls -l command shows all the links with the link column(Second) shows No. of links.

3. Links have actual file contents

4.Removing any link ,just reduces the link count , but doesn’t affect other links.

Soft Links(Symbolic Links) :

1.Links have different inode numbers.

2. ls -l command shows all links with second column value 1 and the link points to original file.

3. Link has the path for original file and not the contents.

4.Removing soft link doesn’t affect anything but removing original file ,the link becomes “dangling” link which points to nonexistant file.

Regards
Nobs