Linux Flashcards
What does uptime tell you? Where does it get its info from?
Uptime, logged in user count, load average for past 1, 5, 15 minutes
Reads from binary file /var/run/utmp
Name 3 ways to see when the system was last booted.
who -b
uptime
last reboot | head -1
Where can you see steal time? What does it affect? What is too much? What can be done?
Steal time can be seen in iostat.
It only applies to virtualization, basically it means a process had to wait for the cpu to complete some other task in a different virtualization instance.
More than 10% for 20+ minutes is no good.
Maybe the host isn’t fast enough to handle everything or maybe it’s just too crowded (in that case move to a less crowded VM).
https://scoutapm.com/blog/understanding-cpu-steal-time-when-should-you-be-worried
What is nice time? Where can you see it? What does it mean?
Can bee seen with iostat or top. It’s the amount of time processes with positive priorities are running. If things get busy, some processes will throttle back. Note, negative priority processes do not show up under nice time.
With nice/setpriority, explain which direction from zero is more favorable to the system and which is more favorable to the process. What is the max value both ways?
Positive is more favorable to the system, negative is more favorable to the process. 20/-20 are the max/min
How do you run a process with altered priority? Why would you want to do this
nice
If its non critical you can set a positive priority to allow it to throttle back if system gets busy. You can set a negative value if it’s critical and have privileges but you may want to consider a better design that doesn’t rely on this as system can become unstable if it takes over.
How do you alter the priority of an already running process?
renice
What does iostat show you?
Averages for time spent in cpu states since boot (or while running at predefined intervals) as well as block device statistics like read per second, total, etc
What is system time % (as opposed to user time %)? Where do you see it?
CPU time spent executing system code (aka kernel instructions), non userspace. Iostat or top or similiar. Should be as low as possible, but can spike high for input/output to console or else-wise.
What can sar do?
Basically logs iostat over time but extra ability is it can break down cpu stats by processor with -P ALL so you can see if a single core is going wonky.
How to diagnose hardware interrupts?
mpstat -P ALL, look where there are lots of interrupts on each processor. cat /proc/interrupts, see if any devices are generating a large number of interrupts, Can use dmesg to look for messages related to the devices with high count.
How to get memory info? And more detailed?
Free. vmstat
How do you see your routing table?
netstat -r
What does netstat -s do? Name some useful things it shows you.
Summary of network activity by protocol (since last boot).
How many outing packets were dropped
How many incoming packets had bad addresses
TCP retransmit count
Failed connection attempt count.
How do you display network connections that are currently listening? Which type of connections will this show? How do you see which programs/pids are using them? How to show only connected?
netstat -l
shoes system I-nodes (sockets) and network.
- t only tcp
- u only udp
- p is to show pids
- a to only show connected
What does w do?
Shows who is logged on and what they’re doing, cpu time for processes and current process. Can give a username to only see their info. Also shows you the 1,5,15 load averages for the system.
What do you use iotop for? How?
iotop requires root access, it gives you the the thread ids and for each shows you the priority, the disk read/write throughput, the percentage of time it is spending swapping in, and the percentage of time the process is blocking on io, and the command.
So if you had a lot of iowat time from top, iotop allows you to see exactly what is contributing to that.
Whats the different between netstat and ss?
ss queries the kernel socket directly, while netstat uses /proc/net/tcp.
netstat is deprecated.
What is iptraf?
Like wireshark, very complicated.
Tell me about collectd
Plugins to monitor system, like sar but way more.
Gathers constantly, writes at 10 min intervals (can be configured)
Only collects, doesn’t display
config, plugin loading and conf
/etc/collectd/collctd.conf
plain text file with fields and how they are derived or grabbed
/usr/share/collectd/types.db
uses rrd to collect stuff, files stored in, binary format, need rrd tool to read
/var/lib/collectd/rrr/hostname/blah
rrd - round robin database tool
stores time-series data in a circular buffer
Other viewers for collectd data
Nagios
Cacti
MRTG
Ichinga forked from Nagios
Explain what a LKM is? Where are they stored? What is their extension?
Loadable Kernel Module
Not taking up memory and loaded automatically, you manage. Like nvidia driver on linux. Loaded when needed, unloaded when not.
/lib/modules/$(uname -r)/kernel
broken out by type, multiple levels
.ko files (kernel object)
These are just storage, not indicating run or config
Name two ways to get hostname
hostname
uname -n
