Commands


1. Process#

一句话:先找是谁在跑、占了什么资源、监听了什么端口。

Need Command
CPU top processes ps aux --sort=-%cpu | head
Memory top processes ps aux --sort=-%mem | head
Process tree pstree -ap
Process command ps -fp <pid>
Process files lsof -p <pid>
Process cwd readlink -f /proc/<pid>/cwd
Process env tr '\0' '\n' < /proc/<pid>/environ
Threads ps -T -p <pid>
Kill gracefully kill -TERM <pid>
Kill forcefully kill -KILL <pid>

2. Memory#

一句话:先判断是真内存压力,还是 page cache 看起来占用高。

Need Command
Memory summary free -h
Memory trend vmstat 1
Top memory processes ps aux --sort=-%mem | head -20
OOM logs dmesg -T | grep -i -E 'oom|killed process'
Swap usage swapon --show
Per process memory pmap -x <pid> | tail -1
cgroup memory cat /sys/fs/cgroup/memory.current
slab summary slabtop

3. Disk#

一句话:磁盘问题分三类查:空间、inode、IO。

Need Command
Filesystem usage df -h
Inode usage df -ih
Directory size du -h --max-depth=1 <path> | sort -h
Large files find <path> -type f -size +1G -ls
Deleted open files lsof +L1
Block devices lsblk -f
Mounts findmnt
Disk IO iostat -xz 1
Per process IO iotop -oPa

4. Network#

一句话:先确认监听,再确认连接,再确认 DNS / route / firewall。

Need Command
Listening TCP ports ss -lntp
Listening UDP ports ss -lnup
Active connections ss -antp
Process by port lsof -i :<port>
DNS lookup dig <domain>
DNS with public resolver dig @8.8.8.8 <domain>
HTTP check curl -v http://<host>:<port>/
TLS check openssl s_client -connect <host>:443 -servername <domain>
Route ip route
Address ip addr
Capture packets tcpdump -i <iface> host <ip> and port <port>

5. Logs#

一句话:systemd 服务先看 journal,传统应用再看 /var/log

Need Command
Service logs journalctl -u <service> -n 200
Follow service logs journalctl -u <service> -f
Boot logs journalctl -b
Error logs journalctl -p err -n 100
Kernel logs dmesg -T
Follow file tail -f <file>
Search gzip logs zgrep '<pattern>' <file>.gz

6. System#

一句话:系统状态先看启动时间、负载、内核、资源限制。

Need Command
Uptime / load uptime
Kernel uname -a
OS release cat /etc/os-release
CPU info lscpu
Current time date
Time sync status timedatectl
Limits ulimit -a
Open files limit cat /proc/<pid>/limits
Timers systemctl list-timers
Failed units systemctl --failed

7. Kill Process#

一句话:先确认目标进程,再优先优雅退出,最后才强制 kill。

Need Command
Find process by name pgrep -af <name>
Show process detail ps -fp <pid>
Show process tree pstree -aps <pid>
Graceful stop by PID kill -TERM <pid>
Force kill by PID kill -KILL <pid>
Reload config if supported kill -HUP <pid>
Kill by exact process name pkill -x <name>
Graceful kill by pattern pkill -TERM -f '<pattern>'
Force kill by pattern pkill -KILL -f '<pattern>'
Kill all processes of user pkill -TERM -u <user>
Check if process still exists pgrep -af <name>
Kill systemd service systemctl stop <service>

Recommended flow:

# 1. Find the exact process.
pgrep -af <name>

# 2. Inspect the process before killing it.
ps -fp <pid>
pstree -aps <pid>

# 3. Prefer graceful stop.
kill -TERM <pid>

# 4. Verify.
pgrep -af <name>

# 5. Use force kill only when graceful stop fails.
kill -KILL <pid>

Examples:

# Example 1: kill one process by keyword safely.
pgrep -af victorialogs
ps -fp 12345
kill -TERM 12345
pgrep -af victorialogs
# Example 2: process ignores TERM, then force kill.
kill -TERM 12345
sleep 5
ps -p 12345
kill -KILL 12345
# Example 3: find who owns a port, then stop it.
sudo lsof -i :8427
ps -fp <pid>
kill -TERM <pid>
# Example 4: systemd-managed service should be stopped by systemctl.
systemctl status vmauth
systemctl stop vmauth
systemctl status vmauth
# Example 5: use pkill only after previewing the exact matches.
pgrep -af 'python.*worker'
pkill -TERM -f 'python.*worker'
pgrep -af 'python.*worker'
# Example 6: kill by exact process name.
# This matches process name exactly, such as "nginx", not the full command line.
pgrep -x nginx
pkill -TERM -x nginx
pgrep -x nginx

Notes:

kill:
    sends signal to PID

pkill:
    finds process by name/pattern and sends signal

-TERM:
    asks process to exit cleanly

-KILL:
    kernel kills process immediately
    process cannot clean up files, sockets, locks, or buffers

-f:
    matches full command line
    powerful but risky; inspect with pgrep -af first

systemd service:
    use systemctl stop <service> instead of killing MainPID directly
    otherwise systemd may restart it