Stupid UNIX/Linux Tricks

A log file is filling up my file system!

2011-12-20T06:47:00.003-05:00

Application log files that grow uncontrollably can cause problems, like filling up whatever file system they're located on.

The best way to handle this is to stop the application so you can remove the offending logs, or compress them, then restart the application. But in a production environment you may not be able to stop the application whenever you want.

So, desperate times call for desperate measures. Whack that log file without affecting the application's ability to write to it.


cat /dev/null > /var/app/logfile

...and the app will keep on ticking while you breathe a sigh of relief and set up logrotate!

Copy 'n' Paste: DON'T

2011-10-09T00:11:00.005-04:00

Just happened again today: instead of copying a new config file for some app, you copy 'n' paste from the terminal window on one side of your screen, to your vi or emacs session in another terminal window.

So you end up with something that looks okay, but if there are any long lines in the file, they will be broken up after the paste.

Don't believe me? Copy 'n' paste something like a grub.conf or another file with a long command line from one window to another. That long line will be chopped up by carriage returns. In the case of grub.conf your system will probably not even boot.

Copy:


        kernel /vmlinuz-2.6.32-131.0.15.el6.i686 ro root=/dev/mapper/vg_haydn-lv_root rd_LVM_LV=vg_haydn/lv_root rd_LVM_LV=vg_haydn/lv_swap rd_NO_LUKS rd_NO_MD rd_NO_DM LANG=en_US.UTF-8 SYSFONT=latarcyrheb-sun16 KEYBOARDTYPE=pc KEYTABLE=us crashkernel=auto rhgb quiet

Paste:


        kernel /vmlinuz-2.6.32-131.0.15.el6.i686 ro root=/dev/mapper/vg_hay 
dn-lv_root rd_LVM_LV=vg_haydn/lv_root rd_LVM_LV=vg_haydn/lv_swap rd_NO_LUKS 
rd_NO_MD rd_NO_DM LANG=en_US.UTF-8 SYSFONT=latarcyrheb-sun16 KEYBOARDTYPE=p 
c KEYTABLE=us crashkernel=auto rhgb quiet

How do you find such offending files if you are trying to troubleshoot? Open the file in vi and look for telltale spaces at the beginning or end of lines that should be continuous. When moving your vi cursor up and down through the file, the cursor should JUMP over wrapped lines.

Don't be lazy. Use the right commands to make and edit config files.

Linux boot hanging

2011-07-24T19:09:00.003-04:00

Some versions of linux have a strange issue upon boot, and a simple Google on "boot hanging udev" will show you that there are many possible reasons.

Let me add one more reason to the pile.

On some versions of Red Hat Enterprise Linux 4, if your system is configured to authenticate users to an LDAP directory of some sort, your issue could be that the system is trying to connect to LDAP before seeking its own hardware! By the time of RHEL 4 update 8 this issue was fixed.

The solution is to boot the system off the DVD to linux rescue mode, allow the system to mount the installation on /mnt/sysimage and to edit /mnt/sysimage/etc/nsswitch.conf and remove all references to LDAP in this file.

On the next reboot you should blow right by udev and watch your system start up.

Deleting NULL characters

2010-06-17T19:26:00.004-04:00

If you ever need to process files from a mainframe, it's likely you will come across a file with lots of NULL characters (ASCII 0).

These characters appear in vi or other editors like this:

^@^@^@^@^@^@^@^@^@^@^@

Ugh.

You can use your old friend sed(1) to get rid of them, but you have to match the pattern of the NULL character. And how do you pass that to sed?

sed -e 's/\o00//g' infile > outfile

That pattern says match octal number 00 and replace it with nothing.

TCP keepalive vs $TMOUT

2010-03-26T07:49:00.003-04:00

When a TCP connection times out, it can be annoying at best...and kill applications that depend on the TCP pipe staying up when inactive.

If your shell disconnects after a while, re-log in then enter


$ env | grep TMOUT

If TMOUT is set to non-zero, the session will be disconnected after the number of seconds that TMOUT is set to. If this is an issue, increase TMOUT or set it to zero.

But sometimes you don't have this control over timeouts...idle TCP connections may be configured to drop at the router or firewall level. If you don't have control over those devices, it may be necessary to configure TCP keepalive.

This syntax is for Linux, your OS will be different. Add lines to /etc/sysctl.conf:


net.ipv4.tcp_keepalive_time = 600
net.ipv4.tcp_keepalive_intvl = 60
net.ipv4.tcp_keepalive_probes = 20

then type in


sysctl -p

to get the new values to take effect. The 600 means that keepalive will kick in when the connection has been idle for 10 minutes (600 seconds).

AIX and its "stanza" structure

2009-04-18T14:10:00.003-04:00

Most *nix systems arrange their system data in delimited rows of text files. Pretty simple, eh? Grep for the data you are searching on, then awk out the field you want.


root:x:0:0:root:/root:/bin/bash
bin:x:1:1:bin:/bin:/sbin/nologin
daemon:x:2:2:daemon:/sbin:/sbin/nologin

Not so AIX. This OS favors the "stanza" structure, in which data is presented in this form:


root:
        password = XXXXXXXXXXXXX
        lastupdate = 1239276751
        flags = 
 
joeuser:
        password = XXXXXXXXXXXXX
        lastupdate = 1239044995
        flags =

Ah well, to each their own right? So how do you quickly parse data out of an AIX file? I use this method...probably not the best but it works.


sed -n '/joeuser/,/:/p' /etc/security/passwd

This will return the stanza for joeuser up to and including the next user name below him (:), which you can then grep for whatever field you want.

"I'm root, and you're not!"

2009-03-06T17:18:00.009-05:00

We once came across a very unusual problem: root could log in to this system, get a shell, do anything that root normally does. Non-root users however couldn't log in, those that were logged in could not run any commands including the basics, ls, cd, nothing. Only shell built-ins such as echo worked, and only if you were already logged in.

Our support contact finally told us to look at permissions for the root of the file system:


root@mahler:/# ls -ld /
drwx------ 21 root root 4096 2009-01-22 19:27 /
root@mahler:/#

A big "WTF!" Clearly, someone fat fingered a chmod.

By now you have guessed the solution:


# chmod 755 /

Repetitive tasks 101

2008-12-15T12:29:00.004-05:00

It happens all the time, but recently I was helping with some troubleshooting. The request was for me to issue a telnet command from our UNIX system so that the network people could see the packets and figure out where they were being dropped.

After about the 20th time, I was getting tired of hitting [up-arrow, enter]. So I entered a script at the command line of this system:


# while :
> do
> telnet 192.168.1.50 &
> sleep 10
> pkill telnet
> done

I advised them that the system would repeat the telnet request every ten seconds, kill it, and launch a new one. Repeatedly. For as long as it took.

Then I went and got coffee.

Whew...very strange ARP problem on Solaris 10

2008-10-22T18:54:00.004-04:00

File this one under "Current Events"!

If you are running Solaris 10 update 4 or higher, you may notice Ethernet addresses in Address Resolution Protocol (ARP) cache that do not match the actual address. Here's a good discussion of what's happening.

http://forums.sun.com/thread.jspa?threadID=5327921&start=0

The problem is that dual-homed Windows boxes with Broadcom NICs on the same subnet are hosing the ARP table on your Solaris system. Sun says its drivers are not the problem, and they adhere closely to the RFC 826. Regardless, it is a headache for system administrators.

The correct solution is to patch the Windows boxes. But there may be other workarounds, too. Check the comments section of this post in the weeks ahead.

Kickstarting Linux installs

2008-09-21T22:35:00.004-04:00

If you're not familiar with kickstart, it's a way of passing all or some of the parameters to all those questions they ask you at install, greatly speeding up the install process.

We used to do kickstart installs with floppy drives. Simple enough, you write a ks.cfg file to an ext[2-3] formatted floppy disk, boot off your install CD and enter at the boot: prompt:

boot: linux ks=floppy

Lo and behold, servers started showing up without floppy drives, negating the kickstart advantage.

That is until we finally found out how to use a USB thumb drive to accomplish the same thing. Drop the ks.cfg in the root directory of the thumb drive and enter:

boot: linux ks=hd:sda1:/ks.cfg

That's assuming sda1 is your USB device. It could be something different. For instance if you have two internal (logical) raid devices, the device will probably sdc1, and so forth.

The system is running out of swap space, and I have to add more NOW!

2008-08-29T07:42:00.007-04:00

Here's how to add swap on the fly. Find a disk partition on your system with enough space to hold a swapfile...let's say in this example, 700 Mb. Then cd to that directory.

Let's start with Solaris which is just a couple of commands:

# mkfile 700m ./swapfile
# swap -a ./swapfile
# swap -l

Instant relief! Now let's tackle Linux which is just a little more involved.


# dd if=/dev/zero of=swapfile bs=1024 count=655350
655350+0 records in
655350+0 records out
# mkswap ./swapfile
Setting up swapspace version 1, size = 671072 kB
# swapon ./swapfile
# free

It's important to note that this additional space will not be mounted as swap on the next reboot unless you add the appropriate commands to the system's startup scripts. But these commands WILL get you through a period of heavy virtual memory usage.

I have to grab every file from a web site!

2008-08-19T16:34:00.006-04:00

I hope you're not going to sit there at your browser and click away till you get every file. Find yourself a *nix system with the widely-available wget command installed, change to a directory with a lot of space, and make it easy on yourself!

$ wget --mirror http://www.mysite.com

The --mirror option will follow all links to other files on this site.

You may be in a situation where you need to grab all the numerically-named files in one directory, say from file1.html to file3000.html, even if they are not linked.

$ /bin/bash
$ for i in $(seq 1 3000)
> do
> wget http://www.mysite.com/numberfiles/file$i.html
> done

Simple integer math in modern shells

2008-08-11T10:54:00.005-04:00

If you're accustomed to doing simple math functions in Bourne shell, you probably recall the need for the clumsy expr command, like this:

AVERAGE=`expr $MYCOUNT / 365`

That kind of fractured syntax, with the spaces having to be in the right place, is what makes shell math too complex when compared to higher-level languages like Perl.

But if, like 90% of admins these days, you are using a more advanced shell like Korn or Bash, you can make your math life a lot simpler and more intuitive. Just use the double parentheses operator.

((AVERAGE=$MYCOUNT/365))

No spaces are needed (they're optional) and it's easier to read and analyze, especially when you are doing a large number of calculations inside a script.

I want to setuid root on my shell script.

2008-08-07T19:43:00.012-04:00

No, you don't. Trust me, you really really don't want to do this. It's a security hole a mile wide.

Now having said that, some shells do have options that allow the observance of the setuid bit. Most shells do not have that option.

But if you absolutely must run something setuid root, I would much rather you wrap the commands of your shell in a small C program, using the system() call for instance, compile it, and then setuid on that compiled binary.


#include<stdio.h>

main(int h)
{
        return (system("/run/whatever/here"));
}

Save this file with a .c extension, then compile this with gcc:

gcc myprog.c
mv a.out mynewexe

...then setuid on the compiled executable, mynewexe. If you must. Be careful. By the way, you ever heard of sudo?

I can't create a file and df shows plenty of space!

2008-08-05T13:27:00.013-04:00

This file system has probably run out of inodes. You can check this by:

Linux and AIX: df -i

Sun: df -F ufs -o i

Ten bucks says all your inodes are in a subdirectory named mail. Once you find the offending subdirectory, even this may not work:

rm *

because you may exceed the number of arguments rm can handle. You can put out the fire by whacking the oldest 500:

ls -t | tail -500 | xargs rm

Then use a similar strategy to clean up the rest of the files.

Automate Linux password changes

2008-08-03T21:16:00.009-04:00

We all know, or should know, that "expect", Don Libes' tool to automate interactive programs, is the right tool to automate password changes across disparate platforms.

But did you know that some versions of the Linux passwd(1) command have an option to accept new passwords from stdin? There are cases where this would really come in handy, for instance when creating a bunch of new accounts.


for f in user1 user2 user3 ... usern
do
/usr/sbin/useradd $f
echo "newpassword" | /usr/bin/passwd --stdin $f
done

Check the man page of passwd(1) on your system to ensure the --stdin option is available to you.

What do all those TCP states mean in netstat?

2008-07-31T10:09:00.004-04:00

You see them in UPPER CASE when doing a netstat -a command. The state of your TCP connections is very useful in determining what is going on network-wise on your system.

LISTEN
Means the socket is listening for connections (duh). Look to the left for the port/protocol that's listening.

ESTABLISHED
Indicates an active, communicating session (double duh).

TIME_WAIT
Session is done. You may sometimes see these accumulate but they'll eventually time out.

This is the majority of what you'll see when you do netstat -a. But the next group are very transitory and normally should only last a millisecond or two. If you see these persistently, you can be sure there's some problem with the communications partner, or a firewall, or something else at the logical layer.

CLOSE_WAIT
The connection is closed but waiting for an official close that may or may not come.

SYN_SENT, SYN_RECEIVED
The connection is just starting up with the three-way TCP handshake and you've caught it right in the middle...what are the chances?

FIN_WAIT, CLOSING, LAST_ACK, FIN_WAIT_2
Same thing but the connection is closing. These happen momentarily and something is wrong if you see them consistently.

Network Troubleshooting 101

2008-07-22T10:36:00.010-04:00

When troubleshooting, use IP addresses instead of names. Name resolution should be tackled last.

Start with question one and work your way down the list in order. Answer "no" and you can stop right there because that's your problem.

1. Does your network interface have a link up?

Look for a green LED on the NIC
Linux: ethtool eth0 (you should see link ready)
Solaris: ndd /dev/bge0 link_status (may be different, man ndd)

2. Can the NIC see other systems on the network?

# arp -a

(issue this command repeatedly because arp cache expires and refreshes frequently)

If so, are the IP addresses that appear on the same subnet?

Alternatively, use tcpdump or snoop to examine the traffic on the interface. Make sure you're connected to the right subnet.

3. Can you ping anything else on this subnet?

# ping 10.123.44.2

(or a known active IP address on the subnet)

4. Can you ping the default gateway? Find the default gateway with

netstat -rn

Solaris output looks like this:

Routing Table: IPv4
Destination           Gateway           Flags  Ref     Use     Interface
-------------------- -------------------- ----- ----- ---------- ---------
default              10.123.40.1          UG        1        410

Linux looks like this:

Destination     Gateway         Genmask         Flags   MSS Window  irtt
Iface
0.0.0.0         10.123.14.1     0.0.0.0         UG        0 0          0 eth0

If this line does not appear in your netstat -rn, you have to add a default route (man route) to communicate outside of your subnet.

5. Can you traceroute to your destination system?

# traceroute 10.123.40.85
traceroute to beethoven (10.123.40.85), 30 hops max, 38 byte packets
1  chopin (10.123.14.3)  0.300 ms  0.302 ms  0.228 ms
2  mahler (10.123.248.115)  0.361 ms  0.317 ms  0.239 ms
3  shostakovich (10.123.248.83)  0.360 ms  0.313 ms  0.228 ms
4  beethoven (10.123.40.85)  0.358 ms  0.292 ms  0.239 ms
#

6. Is the destination system listening on the expected port? (see /etc/services for port number)

For instance, is the system accepting mail? (port 25)

# telnet 10.123.40.85 25

If you get a response with an escape character, the port is open.

If you pass all these steps, your issue is probably name resolution. Check /etc/hosts, /etc/nsswitch.conf, /etc/resolv.conf, nslookup, etc. to make sure your names are resolving as they should. Hard-code them in /etc/hosts to fix the issue immediately.

Sun won't tell you, BUT...

2008-07-17T20:58:00.005-04:00

Many people use Veritas Volume Manager to manage storage on big Solaris systems. You can use Veritas to expand the size of Veritas volumes, but you also have to expand the ufs file system that's on top of the device.

You might wonder how Veritas' GUI can expand Solaris ufs file systems, online, without losing data, when Sun support will tell you it's not possible. Well, you just have to know the "undocumented" -M option to mkfs to make it happen.


# /usr/lib/fs/ufs/mkfs -F ufs -M [mountpoint] [vx rdsk device] [volsize from vxprint]

Be careful. If you forget the -M option, you will end up with a brand-new, EMPTY file system.

Watching your output and saving it, too

2008-07-08T11:56:00.002-04:00

Often we want to allow the output of our script or process to scroll by on the screen, and save it at the same time. Output does not have to be either/or when you make use of tee:


$ /usr/local/bin/myscript.sh | tee /tmp/outputfile

...lets you have your cake and eat it, too.

How can I display a file list when the "ls" command is broken?

2008-06-30T14:07:00.008-04:00

If your system is in such a bad shape that you have no ls(1) command or it doesn't work, fear not. You can still crudely display directory contents by using echo which is a shell built-in and not an executable:


$ echo *
bin boot dev etc home initrd lib lost+found mnt opt proc root sbin sys tmp usr var

You can also still use cd to navigate, since that is also a shell built-in. Good luck in recovering your system!

What file was I just editing?

2008-06-14T18:32:00.005-04:00

Yeah, older users get that brain cramp every now and then.


$ ls -lt | head

...shows the most recently changed files in the directory.

Not even sure what subdirectory it was? Man! You are getting senile.


$ find . -mtime -1 -print

Toggle between two directories

2008-06-11T18:52:00.004-04:00

I had forgotten about this one until a couple weeks ago.

Most modern shells offer

cd -

...a command that will take you back to your previous directory. Often times you'll need to toggle, for example, between a data directory and that application's log directory. cd - will take you back and forth between two directories all day.


chopin [/export/home/hwk] $ cd /var/tmp
chopin [/var/tmp] $ cd -
/export/home/hwk
chopin [/export/home/hwk] $ cd -
/var/tmp
chopin [/var/tmp] $ cd -
/export/home/hwk
chopin [/export/home/hwk] $

I need to change a user's UID number

2008-05-26T21:50:00.004-04:00

The first part is straightforward. Let's say joeuser's previous UID is 701, and now you need that UID freed up.


/usr/sbin/usermod -u 12345 joeuser

Now you have to change all joeuser's files to the new UID. Remember that ufs and ext* file systems store all ownerships with the UID, not the userid string.


/usr/bin/find / -user 701 -print | xargs -t chown joeuser

This will find all files with the ownership UID of 701 and reset to joeuser's new UID.

Excluding directories in Solaris tar

2008-05-14T20:54:00.002-04:00

Very fussy syntax here, so be careful.

Create a file like /opt/tar-exclude, containing


./somedir/tempfiles/
./somedir/junk/

cd /somedir
tar cvXf /opt/tar-exclude backup.tar .

Remove all files older than some-number-of-days

2008-05-10T10:42:00.003-04:00

Be careful with this...make sure you don't run it on an operating system directory!

Remove all regular files from /app/logs older than 10 days:


# find /app/logs -type f -mtime +10 -exec rm {} \;

Who's hogging all the space on this file system?

2008-05-02T08:51:00.009-04:00

You get this one all the time!


# cd /home
# du -sk *                         ### disk usage command
132685  kathy
52721   tom
9       dick
96242   steve
7482    rose
567     barney
# cd kathy
# ls -l | sort -rn +4 | head -5    ### lists, sorts, and shows the top five
-rw-r--r--  1 kathy staff    2494013 Apr 25 08:55 errpt.myserver
-rw-------  1 kathy staff    1256156 Apr 25 09:45 fifthl.sna.Z
-rw-r--r--  1 kathy staff     805888 Apr 27 10:08 network.pci.txt
-rw-r--r--  1 kathy staff     566070 Dec 14 2006  myinst.log
-rw-r--r--  1 kathy staff     533504 Apr 27 10:08 adobeinstructions
#

Have your user clean up after him or herself.

I need to find all world-writable files on the system

2008-04-22T20:28:00.001-04:00

This is one you get all the time from auditors...

find / -perm +o=w -print

I know, you don't really need the -print but old habits...

Diagnosing memory issues in Linux

2008-04-07T08:12:00.000-04:00

Ever try to support a high-profile database on Linux? Believe me it's got a lot of challenges. Frequently you will need detailed information on how memory is being used.

Try this tip: send memory information to logger every ten minutes to find patterns in how memory is being used. This gives more detail than sar. Just make sure your /var is not in danger of filling up! Here's the cron entry.


*/10 * * * * cat /proc/meminfo  /usr/bin/logger -p user.info -t "/proc/meminfo: "

sar is your friend!

2008-04-02T11:31:00.000-04:00

The System Activity Reporter (sar) is one of your best tools for performance monitoring, and generally works the same across all versions of *nix. Set up properly, sar collects data continuously from the system and saves it in /var/log/sa or /var/adm/sa.


sar -q     ### run queue size
sar -u     ### processor usage
sar -d     ### disk busy-ness
sar -r     ### virtual memory usage
sar -v     ### report on inode and file tables
sar -A     ### dump everything, long display

Check for options specific to your OS.

Red Hat package commands (rpm)

2008-03-24T17:15:00.000-04:00


rpm -ql httpd             ## Lists all files in installed package
rpm -qi squid             ## On what host was the package built and what's its size?
rpm -qpl somepackage.rpm  ## Lists all files in UNinstalled rpm file
rpm -ivh somepackage.rpm  ## install verbose and with hash marks
rpm -U                    ## upgrade (NOT FOR KERNEL)
rpm -e httpd              ## delete (erase) this package
rpm -F                    ## Freshen package (does not overwrite)
rpm -qa                   ## List all packages.  Grep for desired string
rpm -V                    ## Verify package is installed correctly
rpm -qf /etc/imrc         ## What package does this file come from?
rpm -qa | grep gnome      ## what packages have "gnome" in their name?
rpm -ivh --replacepkgs    ## Force a reinstall of this package

Solaris package commands

2008-03-24T17:07:00.000-04:00

Linux's turn next.

Find out what package contains a command (passwd in this example):


grep passwd /var/sadm/install/contents

Another way:


pkgchk -l -p /usr/bin/admintool

To see all the files in a package:


pkgchk -v SUNWadmap

See what version of a package is installed:


pkginfo -l SUNWvxvm

Oy, I meant to run that command with a & at the end, to get my prompt back

2008-03-22T14:53:00.001-04:00

You can get your shell command line back anytime.


[ctrl]-z              ### Temporarily halts the current job
bg                    ### Throws the job in the background and gives you your prompt

In case you should want to return control back to your running job:

fg

How do I remove a file that begins with a - ?

2008-03-22T14:32:00.000-04:00

The confusion is because rm thinks anything following the - is an option to it. Fortunately the solution is elegant and simple.


/usr/bin/rm ./-filename

I need to search for a string in every file in a directory, recursively

2008-03-22T14:26:00.000-04:00

Piece of cake, but this comes up all the time.


find . -type f -print | xargs grep searchstring

Be careful of Solaris' tar command!

2008-03-22T14:14:00.000-04:00

When creating a tar file in Solaris, NEVER use a leading slash in the target:


tar cvf mytarfile.tar /etc

...because when you untar it on your destination, regardless of the present directory, it will overwrite everything in /etc! What a way to spoil your day. Always, always use relative path targets for Solaris' tar.


cd /etc
tar cvf mytarfile.tar .

Get in the habit of always displaying the tar file's contents first:


tar tvf mytarfile.tar

...and never unpack it if it begins with a slash!

If you have such a tar file, what do you do now?


/usr/bin/cp /usr/sbin/static/tar /tmp
/usr/bin/dd if=file.tar | /usr/bin/chroot /tmp ./tar xf -

...and your output will be safely unpacked in /tmp. Yes, you have to be that anal about it.

Fortunately, this is not a problem with GNU tar in Linux and other OS's; the path is always relative. But you could still muck up things if you are in / when you unpack!

Be careful out there.

Quick action on multiple servers

2008-03-20T09:22:00.000-04:00

I use this one at least five times per day.


$ for f in system1 system2 ... systemn
> do
> ssh -t $f somecommand
> done

It's a great, simple way to perform the same actions on many systems. If you have all your systems listed in a file, it's even simpler:


$ for f in `cat systemlist`
> do
> ssh -t $f somecommand
> done

By the way, the -t option to ssh is appropriate for any command that needs a tty.

Immutable bit - mungeproof files

2008-03-20T08:43:00.001-04:00

When you can't take the chance of a file getting accidentally munged, and if your system supports it, use the immutable bit. Not even root can delete a file with the immutable bit set, unless he clears the bit first (making accidental removal highly unlikely).

Set the immutable bit on a file:


# chattr +i /etc/myfile
# rm -f /etc/myfile
rm: cannot remove `/etc/myfile': Operation not permitted

This form allow you to only append to a file:


# chattr +a /etc/myfile

Snoop and tcpdump

2008-03-20T08:23:00.000-04:00

Snoop and tcpdump are great commands to see if you are getting packets from where you expect. Most of the time to troubleshoot connections you just need this:


snoop -v -d qfe0 -x0 host 192.168.1.87
tcpdump -i en0 host 192.168.1.87

Exclude the host you're connected from:


snoop -x0 -d hme0 not host 192.168.1.20
tcpdump -i eth0 not host 192.168.1.20

View only LDAP connections (for instance):


snoop -x0 port 389
tcpdump port 389

High-performance file system copy

2008-03-19T13:32:00.000-04:00

From one file system to another on a UNIX system, this is the most efficient file system copy utility. Assume your destination disk is mounted on /dest/dir:


$ cd /orig/dir
$ find . -depth -print | cpio -pdm /dest/dir

Sending a mail message at the command line

2008-03-19T13:10:00.000-04:00

If you know your mail host's name, you can test to make sure it's working correctly right from the command line.


$ telnet mailhost 25
helo mylocalhostname
mail from: helmy
rcpt to: recipient@gmail.com
data
Hello World [freeform message body]
.
quit

Telnet script

2008-03-19T13:00:00.001-04:00

I know, you're supposed to use expect to tackle things like this, but for quick and dirty sh, bash, or ksh scripting:


(echo "user"; sleep 3; echo "password"; sleep 3; echo "somecommand"; sleep 3; echo "exit") | telnet host

Three seconds should be enough time to get the prompts back from the remote shell. If you need more time, increase it.

Show non-printable characters in vi

2008-03-19T12:52:00.000-04:00

You just KNOW there's a stray tab or other character in this file, right? So how can you display these characters in vi? Glad you asked.


[ESC] to get into command mode
:set list

Look through the file. Tabs will be ^I, DOS-style end-of-lines will be ^M, etc.

To go back:


[ESC] to get into command mode
:set nolist

Convert a man page to plain text

2008-03-19T12:49:00.001-04:00

You need the contents of that man page for pkill in a plain ASCII text format? No problem.


$ man pkill | col -bf > pkill.txt

Moving stuff between systems - SECURELY

2008-03-19T12:40:00.001-04:00

One of my favorites. Sends a tar stream over a secure shell pipe. Assumes of course that you have ssh configured and installed properly.


$ cd /source/directory
$ tar zcf - . | ssh remotehost "cd /destination/directory; tar zpxvf - "

Will unpack the tar stream in /destination/directory on remotehost.