1. Process#
一句话:先找是谁在跑、占了什么资源、监听了什么端口。
| Need | Command |
|---|---|
| CPU top processes | ps aux --sort=-%cpu | head |
| Memory top processes | ps aux --sort=-%mem | head |
| Process tree | pstree -ap |
| Process command | ps -fp <pid> |
| Process files | lsof -p <pid> |
| Process cwd | readlink -f /proc/<pid>/cwd |
| Process env | tr '\0' '\n' < /proc/<pid>/environ |
| Threads | ps -T -p <pid> |
| Kill gracefully | kill -TERM <pid> |
| Kill forcefully | kill -KILL <pid> |
2. Memory#
一句话:先判断是真内存压力,还是 page cache 看起来占用高。
| Need | Command |
|---|---|
| Memory summary | free -h |
| Memory trend | vmstat 1 |
| Top memory processes | ps aux --sort=-%mem | head -20 |
| OOM logs | dmesg -T | grep -i -E 'oom|killed process' |
| Swap usage | swapon --show |
| Per process memory | pmap -x <pid> | tail -1 |
| cgroup memory | cat /sys/fs/cgroup/memory.current |
| slab summary | slabtop |
3. Disk#
一句话:磁盘问题分三类查:空间、inode、IO。
| Need | Command |
|---|---|
| Filesystem usage | df -h |
| Inode usage | df -ih |
| Directory size | du -h --max-depth=1 <path> | sort -h |
| Large files | find <path> -type f -size +1G -ls |
| Deleted open files | lsof +L1 |
| Block devices | lsblk -f |
| Mounts | findmnt |
| Disk IO | iostat -xz 1 |
| Per process IO | iotop -oPa |
4. Network#
一句话:先确认监听,再确认连接,再确认 DNS / route / firewall。
| Need | Command |
|---|---|
| Listening TCP ports | ss -lntp |
| Listening UDP ports | ss -lnup |
| Active connections | ss -antp |
| Process by port | lsof -i :<port> |
| DNS lookup | dig <domain> |
| DNS with public resolver | dig @8.8.8.8 <domain> |
| HTTP check | curl -v http://<host>:<port>/ |
| TLS check | openssl s_client -connect <host>:443 -servername <domain> |
| Route | ip route |
| Address | ip addr |
| Capture packets | tcpdump -i <iface> host <ip> and port <port> |
5. Logs#
一句话:systemd 服务先看 journal,传统应用再看 /var/log。
| Need | Command |
|---|---|
| Service logs | journalctl -u <service> -n 200 |
| Follow service logs | journalctl -u <service> -f |
| Boot logs | journalctl -b |
| Error logs | journalctl -p err -n 100 |
| Kernel logs | dmesg -T |
| Follow file | tail -f <file> |
| Search gzip logs | zgrep '<pattern>' <file>.gz |
6. System#
一句话:系统状态先看启动时间、负载、内核、资源限制。
| Need | Command |
|---|---|
| Uptime / load | uptime |
| Kernel | uname -a |
| OS release | cat /etc/os-release |
| CPU info | lscpu |
| Current time | date |
| Time sync status | timedatectl |
| Limits | ulimit -a |
| Open files limit | cat /proc/<pid>/limits |
| Timers | systemctl list-timers |
| Failed units | systemctl --failed |
7. Kill Process#
一句话:先确认目标进程,再优先优雅退出,最后才强制 kill。
| Need | Command |
|---|---|
| Find process by name | pgrep -af <name> |
| Show process detail | ps -fp <pid> |
| Show process tree | pstree -aps <pid> |
| Graceful stop by PID | kill -TERM <pid> |
| Force kill by PID | kill -KILL <pid> |
| Reload config if supported | kill -HUP <pid> |
| Kill by exact process name | pkill -x <name> |
| Graceful kill by pattern | pkill -TERM -f '<pattern>' |
| Force kill by pattern | pkill -KILL -f '<pattern>' |
| Kill all processes of user | pkill -TERM -u <user> |
| Check if process still exists | pgrep -af <name> |
| Kill systemd service | systemctl stop <service> |
Recommended flow:
# 1. Find the exact process.
pgrep -af <name>
# 2. Inspect the process before killing it.
ps -fp <pid>
pstree -aps <pid>
# 3. Prefer graceful stop.
kill -TERM <pid>
# 4. Verify.
pgrep -af <name>
# 5. Use force kill only when graceful stop fails.
kill -KILL <pid>Examples:
# Example 1: kill one process by keyword safely.
pgrep -af victorialogs
ps -fp 12345
kill -TERM 12345
pgrep -af victorialogs# Example 2: process ignores TERM, then force kill.
kill -TERM 12345
sleep 5
ps -p 12345
kill -KILL 12345# Example 3: find who owns a port, then stop it.
sudo lsof -i :8427
ps -fp <pid>
kill -TERM <pid># Example 4: systemd-managed service should be stopped by systemctl.
systemctl status vmauth
systemctl stop vmauth
systemctl status vmauth# Example 5: use pkill only after previewing the exact matches.
pgrep -af 'python.*worker'
pkill -TERM -f 'python.*worker'
pgrep -af 'python.*worker'# Example 6: kill by exact process name.
# This matches process name exactly, such as "nginx", not the full command line.
pgrep -x nginx
pkill -TERM -x nginx
pgrep -x nginxNotes:
kill:
sends signal to PID
pkill:
finds process by name/pattern and sends signal
-TERM:
asks process to exit cleanly
-KILL:
kernel kills process immediately
process cannot clean up files, sockets, locks, or buffers
-f:
matches full command line
powerful but risky; inspect with pgrep -af first
systemd service:
use systemctl stop <service> instead of killing MainPID directly
otherwise systemd may restart it