CentOS8 CheatSheet fuer System Administratoren

1 System

1.1 Hardware

• Show hardware details

lshw

• show bios hardware details

dmidecode

1.2 Disk/Filesystem

• Show block uage of mounted disks

df -hP

• Show inode uage of mounted disks

df -hiP

• show how blockdevices are configured in system

lsblk

• get 10 biggest files in current dir

du -sm * .[^\.]* | sort -n | tail

• use ncdu to find large files

dnf -y install epel-release
dnf config-manager --enable epel
dnf -y install ncdu
ncdu -x /  #replace / with needed mountpoint

1.3 Memory

• Show memory statistics

free -th

• Top provides memory information as well

top

1.4 CPU

• show system load (1m, 5m, 15m)

w

• detailed realtime statictics of procs, memory, swap, io, system, cpu

vmstat 1

1.5 Processes

• show processes with tree

ps -f fax

• detailed process information

ps  -faxo ruser,ppid,pid,rss,vsz,pcpu,tty,args

1.6 Debugging Tools

• dstat performance monitoring

dnf -y install pcp-system-tools
dstat -af
dstat -cdngy
dstat -f -M time,cpu,net,disk,sys,swap,page,load,proc,topcpu --output $(date '+%Y.%m.%d-%H.%M')-dstat.csv
dstat -cdngymsp --lock --tcp --output $(date '+%Y.%m.%d-%H.%M')-dstat.csv

2 Services

• list all services

systemctl list-units --type service

• List failed services on boot

systemctl --failed

• show all running services

systemctl --all --state=running

• show detailed service status

systemctl status <svc-name>

• most common service handling

 systemctl [start|stop|restart|status|enable|disable|mask] <svc-name>

• check if service is enabled to autostart after reboot

systemctl is-enabled <svc-name>

3 Events

3.1 Show last boots

journalctl --list-boots
last reboot

3.2 Journal

• Show log since last boot

journalctl -b

• Kernel messages (like dmesg)

journalctl -k

• Show latest log and wait for changes

journalctl -f

• Reverse output (newest first)

journalctl -r

• Show only errors and worse

journalctl -b -p err

• Filter on time (example)

journalctl --since=2014-06-00 --until="2014-06-07 12:00:00"

• Since yesterday

journalctl --since=yesterday

• Show only log of SERVICE

journalctl -u SERVICE

• Match executable, e.g. dhclient

journalctl /usr/sbin/dhclient

• Match device node, e.g. /dev/sda

journalctl /dev/sda

3.3 Log Files

• tail all currently open text files

lsof -F | sed '/^n\//!d;s/^n//;s/ .*//' | sort -u | xargs file | grep ' text$' | cut -d: -f1 | xargs tail -fn0

• tail all files under /var/log

tail -f -n0 /var/log/* /var/log/*/*

4 Debugging

4.1 strace examples (process tracing)

strace -ff -e trace=write -e write=1,2 -p SOME_PID
strace -e open ls
strace -e trace=open,read ls /home
strace -o output.txt ls 
strace -f -p 1725 -o firefox_trace.txt # f: follow process
strace -t -e open ls /home #timestamp
strace -c ls /home # statistics
strace -f -t -e trace=file systemctl restart SuSEfirewall2 2>&1 | grep open | cut -d'"' -f2

4.2 SOS Report (Log Bundle)

This collects a log bundle which can be used for later debugging and analyzing.
Start this BEFORE you try to repair or change something, as well do not forget to snapshot/backup System/Application before debugging.

dnf -y install sos
sosreport
cp -av /var/tmp/sosreport* /root/

5 This and That

5.1 CentOS 8 Core to Stream migration

CentOS8 will be discontinued by the Red Hat team. All the effort will go into CentOS Stream operating System which is a rolling release of CentOS.
This is not a replacement for CentOS Core!!! Even if Red Hat will rename CentOS Stream to CentOS later on.
You can directly migrate a CentOS8 into a CentOS8 Stream in place:

dnf install centos-release-stream
dnf distro-sync
cat /etc/centos-release
reboot