iakovlev.org

File and Archiving Commands

Archiving

tar

The standard UNIX archiving utility. Originally a Tape ARchiving program, it has developed into a general purpose package that can handle all manner of archiving with all types of destination devices, ranging from tape drives to regular files to even stdout (see Example 3-4). GNU tar has been patched to accept various compression filters, such as tar czvf archive_name.tar.gz *, which recursively archives and gzips all files in a directory tree except dotfiles in the current working directory ($PWD). [1]

Some useful tar options:

-c create (a new archive)
-x extract (files from existing archive)
--delete delete (files from existing archive)
This option will not work on magnetic tape devices.
-r append (files to existing archive)
-A append (tar files to existing archive)
-t list (contents of existing archive)
-u update archive
-d compare archive with specified filesystem
-z gzip the archive
(compress or uncompress, depending on whether combined with the -c or -x) option
-j bzip2 the archive

It may be difficult to recover data from a corrupted gzipped tar archive. When archiving important files, make multiple backups.

shar

Shell archiving utility. The files in a shell archive are concatenated without compression, and the resultant archive is essentially a shell script, complete with #!/bin/sh header, and containing all the necessary unarchiving commands. Shar archives still show up in Internet newsgroups, but otherwise shar has been pretty well replaced by tar/gzip. The unshar command unpacks shar archives.

ar

Creation and manipulation utility for archives, mainly used for binary object file libraries.

rpm

The Red Hat Package Manager, or rpm utility provides a wrapper for source or binary archives. It includes commands for installing and checking the integrity of packages, among other things.

A simple rpm -i package_name.rpm usually suffices to install a package, though there are many more options available.

rpm -qf identifies which package a file originates from.

bash$ rpm -qf /bin/ls coreutils-5.2.1-31

rpm -qa gives a complete list of all installed rpm packages on a given system. An rpm -qa package_name lists only the package(s) corresponding to package_name.

bash$ rpm -qa redhat-logos-1.1.3-1 glibc-2.2.4-13 cracklib-2.7-12 dosfstools-2.7-1 gdbm-1.8.0-10 ksymoops-2.4.1-1 mktemp-1.5-11 perl-5.6.0-17 reiserfs-utils-3.x.0j-2 ... bash$ rpm -qa docbook-utils docbook-utils-0.6.9-2 bash$ rpm -qa docbook | grep docbook docbook-dtd31-sgml-1.0-10 docbook-style-dsssl-1.64-3 docbook-dtd30-sgml-1.0-10 docbook-dtd40-sgml-1.0-11 docbook-utils-pdf-0.6.9-2 docbook-dtd41-sgml-1.0-10 docbook-utils-0.6.9-2

cpio

This specialized archiving copy command (copy input and output) is rarely seen any more, having been supplanted by tar/gzip. It still has its uses, such as moving a directory tree.

Example 12-27. Using cpio to move a directory tree

#!/bin/bash
 
 # Copying a directory tree using 'cpio.'
 
 # Advantages of using 'cpio':
 #   Speed of copying. It's faster than 'tar' with pipes.
 #   Well suited for copying special files (named pipes, etc.)
 #+  that 'cp' may choke on.
 
 ARGS=2
 E_BADARGS=65
 
 if [ $# -ne "$ARGS" ]
 then
   echo "Usage: `basename $0` source destination"
   exit $E_BADARGS
 fi  
 
 source=$1
 destination=$2
 
 find "$source" -depth | cpio -admvp "$destination"
 #               ^^^^^         ^^^^^
 # Read the 'find' and 'cpio' man page to decipher these options.
 
 
 # Exercise:
 # --------
 
 #  Add code to check the exit status ($?) of the 'find | cpio' pipe
 #+ and output appropriate error messages if anything went wrong.
 
 exit 0

rpm2cpio

This command extracts a cpio archive from an rpm one.

Example 12-28. Unpacking an rpm archive

#!/bin/bash
 # de-rpm.sh: Unpack an 'rpm' archive
 
 : ${1?"Usage: `basename $0` target-file"}
 # Must specify 'rpm' archive name as an argument.
 
 
 TEMPFILE=$$.cpio                         # Tempfile with "unique" name.
                                          # $$ is process ID of script.
 
 rpm2cpio < $1 > $TEMPFILE                # Converts rpm archive into cpio archive.
 cpio --make-directories -F $TEMPFILE -i  # Unpacks cpio archive.
 rm -f $TEMPFILE                          # Deletes cpio archive.
 
 exit 0
 
 #  Exercise:
 #  Add check for whether 1) "target-file" exists and
 #+                       2) it is really an rpm archive.
 #  Hint:                    parse output of 'file' command.

Compression

gzip

The standard GNU/UNIX compression utility, replacing the inferior and proprietary compress. The corresponding decompression command is gunzip, which is the equivalent of gzip -d.

The zcat filter decompresses a gzipped file to stdout, as possible input to a pipe or redirection. This is, in effect, a cat command that works on compressed files (including files processed with the older compress utility). The zcat command is equivalent to gzip -dc.

On some commercial UNIX systems, zcat is a synonym for uncompress -c, and will not work on gzipped files.

Notes

[1]	A tar czvf archive_name.tar.gz * will include dotfiles in directories below the current working directory. This is an undocumented GNU tar "feature".
[2]	This is a symmetric block cipher, used to encrypt files on a single system or local network, as opposed to the "public key" cipher class, of which pgp is a well-known example.
[3]	Creates a temporary directory when invoked with the `-d` option.

Miscellaneous Commands

Command that fit in no special category

jot, seq

These utilities emit a sequence of integers, with a user-selected increment.

The normal separator character between each integer is a newline, but this can be changed with the -s option.

bash$ seq 5 1 2 3 4 5 bash$ seq -s : 5 1:2:3:4:5

Both jot and seq come in handy in a for loop.

Example 12-48. Using seq to generate loop arguments

#!/bin/bash
 # Using "seq"
 
 echo
 
 for a in `seq 80`  # or   for a in $( seq 80 )
 # Same as   for a in 1 2 3 4 5 ... 80   (saves much typing!).
 # May also use 'jot' (if present on system).
 do
   echo -n "$a "
 done      # 1 2 3 4 5 ... 80
 # Example of using the output of a command to generate 
 # the [list] in a "for" loop.
 
 echo; echo
 
 
 COUNT=80  # Yes, 'seq' may also take a replaceable parameter.
 
 for a in `seq $COUNT`  # or   for a in $( seq $COUNT )
 do
   echo -n "$a "
 done      # 1 2 3 4 5 ... 80
 
 echo; echo
 
 BEGIN=75
 END=80
 
 for a in `seq $BEGIN $END`
 #  Giving "seq" two arguments starts the count at the first one,
 #+ and continues until it reaches the second.
 do
   echo -n "$a "
 done      # 75 76 77 78 79 80
 
 echo; echo
 
 BEGIN=45
 INTERVAL=5
 END=80
 
 for a in `seq $BEGIN $INTERVAL $END`
 #  Giving "seq" three arguments starts the count at the first one,
 #+ uses the second for a step interval,
 #+ and continues until it reaches the third.
 do
   echo -n "$a "
 done      # 45 50 55 60 65 70 75 80
 
 echo; echo
 
 exit 0

Example 12-49. Letter Count"

#!/bin/bash
 # letter-count.sh: Counting letter occurrences in a text file.
 # Written by Stefano Palmeri.
 # Used in ABS Guide with permission.
 # Slightly modified by document author.
 
 MINARGS=2          # Script requires at least two arguments.
 E_BADARGS=65
 FILE=$1
 
 let LETTERS=$#-1   # How many letters specified (as command-line args).
                    # (Subtract 1 from number of command line args.)
 
 
 show_help(){
 	   echo
            echo Usage: `basename $0` file letters  
            echo Note: `basename $0` arguments are case sensitive.
            echo Example: `basename $0` foobar.txt G n U L i N U x.
 	   echo
 }
 
 # Checks number of arguments.
 if [ $# -lt $MINARGS ]; then
    echo
    echo "Not enough arguments."
    echo
    show_help
    exit $E_BADARGS
 fi  
 
 
 # Checks if file exists.
 if [ ! -f $FILE ]; then
     echo "File \"$FILE\" does not exist."
     exit $E_BADARGS
 fi
 
 
 
 # Counts letter occurrences .
 for n in `seq $LETTERS`; do
       shift
       if [[ `echo -n "$1" | wc -c` -eq 1 ]]; then             #  Checks arg.
              echo "$1" -\> `cat $FILE | tr -cd  "$1" | wc -c` #  Counting.
       else
              echo "$1 is not a  single char."
       fi  
 done
 
 exit $?
 
 #  This script has exactly the same functionality as letter-count2.sh,
 #+ but executes faster.
 #  Why?

getopt

The getopt command parses command-line options preceded by a dash. This external command corresponds to the getopts Bash builtin. Using getopt permits handling long options by means of the -l flag, and this also allows parameter reshuffling.

Example 12-50. Using getopt to parse command-line options

#!/bin/bash
 # Using getopt.
 
 # Try the following when invoking this script:
 #   sh ex33a.sh -a
 #   sh ex33a.sh -abc
 #   sh ex33a.sh -a -b -c
 #   sh ex33a.sh -d
 #   sh ex33a.sh -dXYZ
 #   sh ex33a.sh -d XYZ
 #   sh ex33a.sh -abcd
 #   sh ex33a.sh -abcdZ
 #   sh ex33a.sh -z
 #   sh ex33a.sh a
 # Explain the results of each of the above.
 
 E_OPTERR=65
 
 if [ "$#" -eq 0 ]
 then   # Script needs at least one command-line argument.
   echo "Usage $0 -[options a,b,c]"
   exit $E_OPTERR
 fi  
 
 set -- `getopt "abcd:" "$@"`
 # Sets positional parameters to command-line arguments.
 # What happens if you use "$*" instead of "$@"?
 
 while [ ! -z "$1" ]
 do
   case "$1" in
     -a) echo "Option \"a\"";;
     -b) echo "Option \"b\"";;
     -c) echo "Option \"c\"";;
     -d) echo "Option \"d\" $2";;
      *) break;;
   esac
 
   shift
 done
 
 #  It is usually better to use the 'getopts' builtin in a script,
 #+ rather than 'getopt'.
 #  See "ex33.sh".
 
 exit 0

See Example 9-12 for a simplified emulation of getopt.

run-parts

The run-parts command [1] executes all the scripts in a target directory, sequentially in ASCII-sorted filename order. Of course, the scripts need to have execute permission.

The cron daemon invokes run-parts to run the scripts in the /etc/cron.* directories.

yes

In its default behavior the yes command feeds a continuous string of the character y followed by a line feed to stdout. A control-c terminates the run. A different output string may be specified, as in yes different string, which would continually output different string to stdout. One might well ask the purpose of this. From the command line or in a script, the output of yes can be redirected or piped into a program expecting user input. In effect, this becomes a sort of poor man's version of expect.

yes | fsck /dev/hda1 runs fsck non-interactively (careful!).

yes | rm -r dirname has same effect as rm -rf dirname (careful!).

Caution advised when piping yes to a potentially dangerous system command, such as fsck or fdisk. It may have unintended side-effects.

banner

Prints arguments as a large vertical banner to stdout, using an ASCII character (default '#'). This may be redirected to a printer for hardcopy.

printenv

Show all the environmental variables set for a particular user.

bash$ printenv | grep HOME HOME=/home/bozo

lp

The lp and lpr commands send file(s) to the print queue, to be printed as hard copy. [2] These commands trace the origin of their names to the line printers of another era.

bash$ lp file1.txt or bash lp <file1.txt

It is often useful to pipe the formatted output from pr to lp.

bash$ pr -options file1.txt | lp

Formatting packages, such as groff and Ghostscript may send their output directly to lp.

bash$ groff -Tascii file.tr | lp

bash$ gs -options | lp file.ps

Related commands are lpq, for viewing the print queue, and lprm, for removing jobs from the print queue.

tee

[UNIX borrows an idea here from the plumbing trade.]

This is a redirection operator, but with a difference. Like the plumber's "tee," it permits "siponing off" to a file the output of a command or commands within a pipe, but without affecting the result. This is useful for printing an ongoing process to a file or paper, perhaps to keep track of it for debugging purposes.

                   tee
                  |------> to file
                  |
   ===============|===============
   command--->----|-operator-->---> result of command(s)
   ===============================

cat listfile* | sort | tee check.file | uniq > result.file
(The file check.file contains the concatenated sorted "listfiles", before the duplicate lines are removed by uniq.)

mkfifo

This obscure command creates a named pipe, a temporary first-in-first-out buffer for transferring data between processes. [3] Typically, one process writes to the FIFO, and the other reads from it. See Example A-15.

pathchk

This command checks the validity of a filename. If the filename exceeds the maximum allowable length (255 characters) or one or more of the directories in its path is not searchable, then an error message results.

Unfortunately, pathchk does not return a recognizable error code, and it is therefore pretty much useless in a script. Consider instead the file test operators.

dd

This is the somewhat obscure and much feared "data duplicator" command. Originally a utility for exchanging data on magnetic tapes between UNIX minicomputers and IBM mainframes, this command still has its uses. The dd command simply copies a file (or stdin/stdout), but with conversions. Possible conversions are ASCII/EBCDIC, [4] upper/lower case, swapping of byte pairs between input and output, and skipping and/or truncating the head or tail of the input file. A dd --help lists the conversion and other options that this powerful utility takes.

# Converting a file to all uppercase: dd if=$filename conv=ucase > $filename.uppercase # lcase # For lower case conversion

Example 12-51. A script that copies itself

#!/bin/bash
 # self-copy.sh
 
 # This script copies itself.
 
 file_subscript=copy
 
 dd if=$0 of=$0.$file_subscript 2>/dev/null
 # Suppress messages from dd:   ^^^^^^^^^^^
 
 exit $?

Example 12-52. Exercising dd

#!/bin/bash
 # exercising-dd.sh
 
 # Script by Stephane Chazelas.
 # Somewhat modified by document author.
 
 input_file=$0   # This script.
 output_file=log.txt
 n=3
 p=5
 
 dd if=$input_file of=$output_file bs=1 skip=$((n-1)) count=$((p-n+1)) 2> /dev/null
 # Extracts characters n to p from this script.
 
 # -------------------------------------------------------
 
 echo -n "hello world" | dd cbs=1 conv=unblock 2> /dev/null
 # Echoes "hello world" vertically.
 
 exit 0

To demonstrate just how versatile dd is, let's use it to capture keystrokes.

Example 12-53. Capturing Keystrokes

#!/bin/bash
 # dd-keypress.sh: Capture keystrokes without needing to press ENTER.
 
 
 keypresses=4                      # Number of keypresses to capture.
 
 
 old_tty_setting=$(stty -g)        # Save old terminal settings.
 
 echo "Press $keypresses keys."
 stty -icanon -echo                # Disable canonical mode.
                                   # Disable local echo.
 keys=$(dd bs=1 count=$keypresses 2> /dev/null)
 # 'dd' uses stdin, if "if" (input file) not specified.
 
 stty "$old_tty_setting"           # Restore old terminal settings.
 
 echo "You pressed the \"$keys\" keys."
 
 # Thanks, Stephane Chazelas, for showing the way.
 exit 0

The dd command can do random access on a data stream.
echo -n . | dd bs=1 seek=4 of=file conv=notrunc # The "conv=notrunc" option means that the output file will not be truncated. # Thanks, S.C.

The dd command can copy raw data and disk images to and from devices, such as floppies and tape drives (Example A-5). A common use is creating boot floppies.

dd if=kernel-image of=/dev/fd0H1440

Similarly, dd can copy the entire contents of a floppy, even one formatted with a "foreign" OS, to the hard drive as an image file.

dd if=/dev/fd0 of=/home/bozo/projects/floppy.img

Other applications of dd include initializing temporary swap files (Example 28-2) and ramdisks (Example 28-3). It can even do a low-level copy of an entire hard drive partition, although this is not necessarily recommended.

People (with presumably nothing better to do with their time) are constantly thinking of interesting applications of dd.

Example 12-54. Securely deleting a file

#!/bin/bash
 # blot-out.sh: Erase "all" traces of a file.
 
 #  This script overwrites a target file alternately
 #+ with random bytes, then zeros before finally deleting it.
 #  After that, even examining the raw disk sectors by conventional methods
 #+ will not reveal the original file data.
 
 PASSES=7         #  Number of file-shredding passes.
                  #  Increasing this slows script execution,
                  #+ especially on large target files.
 BLOCKSIZE=1      #  I/O with /dev/urandom requires unit block size,
                  #+ otherwise you get weird results.
 E_BADARGS=70     #  Various error exit codes.
 E_NOT_FOUND=71
 E_CHANGED_MIND=72
 
 if [ -z "$1" ]   # No filename specified.
 then
   echo "Usage: `basename $0` filename"
   exit $E_BADARGS
 fi
 
 file=$1
 
 if [ ! -e "$file" ]
 then
   echo "File \"$file\" not found."
   exit $E_NOT_FOUND
 fi  
 
 echo; echo -n "Are you absolutely sure you want to blot out \"$file\" (y/n)? "
 read answer
 case "$answer" in
 [nN]) echo "Changed your mind, huh?"
       exit $E_CHANGED_MIND
       ;;
 *)    echo "Blotting out file \"$file\".";;
 esac
 
 
 flength=$(ls -l "$file" | awk '{print $5}')  # Field 5 is file length.
 pass_count=1
 
 chmod u+w "$file"   # Allow overwriting/deleting the file.
 
 echo
 
 while [ "$pass_count" -le "$PASSES" ]
 do
   echo "Pass #$pass_count"
   sync         # Flush buffers.
   dd if=/dev/urandom of=$file bs=$BLOCKSIZE count=$flength
                # Fill with random bytes.
   sync         # Flush buffers again.
   dd if=/dev/zero of=$file bs=$BLOCKSIZE count=$flength
                # Fill with zeros.
   sync         # Flush buffers yet again.
   let "pass_count += 1"
   echo
 done  
 
 
 rm -f $file    # Finally, delete scrambled and shredded file.
 sync           # Flush buffers a final time.
 
 echo "File \"$file\" blotted out and deleted."; echo
 
 
 exit 0
 
 #  This is a fairly secure, if inefficient and slow method
 #+ of thoroughly "shredding" a file.
 #  The "shred" command, part of the GNU "fileutils" package,
 #+ does the same thing, although more efficiently.
 
 #  The file cannot not be "undeleted" or retrieved by normal methods.
 #  However . . .
 #+ this simple method would *not* likely withstand
 #+ sophisticated forensic analysis.
 
 #  This script may not play well with a journaled file system.
 #  Exercise (difficult): Fix it so it does.
 
 
 
 #  Tom Vier's "wipe" file-deletion package does a much more thorough job
 #+ of file shredding than this simple script.
 #     http://www.ibiblio.org/pub/Linux/utils/file/wipe-2.0.0.tar.bz2
 
 #  For an in-depth analysis on the topic of file deletion and security,
 #+ see Peter Gutmann's paper,
 #+     "Secure Deletion of Data From Magnetic and Solid-State Memory".
 #       http://www.cs.auckland.ac.nz/~pgut001/pubs/secure_del.html

od

The od, or octal dump filter converts input (or files) to octal (base-8) or other bases. This is useful for viewing or processing binary data files or otherwise unreadable system device files, such as /dev/urandom, and as a filter for binary data. See Example 9-28 and Example 12-13.

hexdump

Performs a hexadecimal, octal, decimal, or ASCII dump of a binary file. This command is the rough equivalent of od, above, but not nearly as useful.

objdump

Displays information about an object file or binary executable in either hexadecimal form or as a disassembled listing (with the -d option).

bash$ objdump -d /bin/ls /bin/ls: file format elf32-i386 Disassembly of section .init: 080490bc <.init>: 80490bc: 55 push %ebp 80490bd: 89 e5 mov %esp,%ebp . . .

mcookie

This command generates a "magic cookie", a 128-bit (32-character) pseudorandom hexadecimal number, normally used as an authorization "signature" by the X server. This also available for use in a script as a "quick 'n dirty" random number.
random000=$(mcookie)

Of course, a script could use md5 for the same purpose.
# Generate md5 checksum on the script itself. random001=`md5sum $0 | awk '{print $1}'` # Uses 'awk' to strip off the filename.

The mcookie command gives yet another way to generate a "unique" filename.

Example 12-55. Filename generator

#!/bin/bash
 # tempfile-name.sh:  temp filename generator
 
 BASE_STR=`mcookie`   # 32-character magic cookie.
 POS=11               # Arbitrary position in magic cookie string.
 LEN=5                # Get $LEN consecutive characters.
 
 prefix=temp          #  This is, after all, a "temp" file.
                      #  For more "uniqueness," generate the filename prefix
                      #+ using the same method as the suffix, below.
 
 suffix=${BASE_STR:POS:LEN}
                      # Extract a 5-character string, starting at position 11.
 
 temp_filename=$prefix.$suffix
                      # Construct the filename.
 
 echo "Temp filename = "$temp_filename""
 
 # sh tempfile-name.sh
 # Temp filename = temp.e19ea
 
 #  Compare this method of generating "unique" filenames
 #+ with the 'date' method in ex51.sh.
 
 exit 0

units

This utility converts between different units of measure. While normally invoked in interactive mode, units may find use in a script.

Example 12-56. Converting meters to miles

#!/bin/bash
 # unit-conversion.sh
 
 
 convert_units ()  # Takes as arguments the units to convert.
 {
   cf=$(units "$1" "$2" | sed --silent -e '1p' | awk '{print $2}')
   # Strip off everything except the actual conversion factor.
   echo "$cf"
 }  
 
 Unit1=miles
 Unit2=meters
 cfactor=`convert_units $Unit1 $Unit2`
 quantity=3.73
 
 result=$(echo $quantity*$cfactor | bc)
 
 echo "There are $result $Unit2 in $quantity $Unit1."
 
 #  What happens if you pass incompatible units,
 #+ such as "acres" and "miles" to the function?
 
 exit 0

m4

A hidden treasure, m4 is a powerful macro processing filter, [5] virtually a complete language. Although originally written as a pre-processor for RatFor, m4 turned out to be useful as a stand-alone utility. In fact, m4 combines some of the functionality of eval, tr, and awk, in addition to its extensive macro expansion facilities.

The April, 2002 issue of Linux Journal has a very nice article on m4 and its uses.

Example 12-57. Using m4

#!/bin/bash
 # m4.sh: Using the m4 macro processor
 
 # Strings
 string=abcdA01
 echo "len($string)" | m4                           # 7
 echo "substr($string,4)" | m4                      # A01
 echo "regexp($string,[0-1][0-1],\&Z)" | m4         # 01Z
 
 # Arithmetic
 echo "incr(22)" | m4                               # 23
 echo "eval(99 / 3)" | m4                           # 33
 
 exit 0

doexec

The doexec command enables passing an arbitrary list of arguments to a binary executable. In particular, passing argv[0] (which corresponds to $0 in a script) lets the executable be invoked by various names, and it can then carry out different sets of actions, according to the name by which it was called. What this amounts to is roundabout way of passing options to an executable.

For example, the /usr/local/bin directory might contain a binary called "aaa". Invoking doexec /usr/local/bin/aaa list would list all those files in the current working directory beginning with an "a", while invoking (the same executable with) doexec /usr/local/bin/aaa delete would delete those files.

The various behaviors of the executable must be defined within the code of the executable itself, analogous to something like the following in a shell script:
case `basename $0` in "name1" ) do_something;; "name2" ) do_something_else;; "name3" ) do_yet_another_thing;; * ) bail_out;; esac

dialog

The dialog family of tools provide a method of calling interactive "dialog" boxes from a script. The more elaborate variations of dialog -- gdialog, Xdialog, and kdialog -- actually invoke X-Windows widgets. See Example 33-19.

sox

The sox, or "sound exchange" command plays and performs transformations on sound files. In fact, the /usr/bin/play executable (now deprecated) is nothing but a shell wrapper for sox.

For example, sox soundfile.wav soundfile.au changes a WAV sound file into a (Sun audio format) AU sound file.

Shell scripts are ideally suited for batch processing sox operations on sound files. For examples, see the Linux Radio Timeshift HOWTO and the MP3do Project.

Notes

[1]

This is actually a script adapted from the Debian Linux distribution.

[2]

The print queue is the group of jobs "waiting in line" to be printed.

[3]

For an excellent overview of this topic, see Andy Vaught's article, Introduction to Named Pipes, in the September, 1997 issue of Linux Journal.

[4]

EBCDIC (pronounced "ebb-sid-ick") is an acronym for Extended Binary Coded Decimal Interchange Code. This is an IBM data format no longer in much use. A bizarre application of the conv=ebcdic option of dd is as a quick 'n easy, but not very secure text file encoder.
cat $file | dd conv=swab,ebcdic > $file_encrypted # Encode (looks like gibberish). # Might as well switch bytes (swab), too, for a little extra obscurity. cat $file_encrypted | dd conv=swab,ascii > $file_plaintext # Decode.

[5]

A macro is a symbolic constant that expands into a command string or a set of operations on parameters.

System and Administrative Commands

The startup and shutdown scripts in /etc/rc.d illustrate the uses (and usefulness) of many of these comands. These are usually invoked by root and used for system maintenance or emergency filesystem repairs. Use with caution, as some of these commands may damage your system if misused.

Users and Groups

users

Show all logged on users. This is the approximate equivalent of who -q.

groups

Lists the current user and the groups she belongs to. This corresponds to the $GROUPS internal variable, but gives the group names, rather than the numbers.

bash$ groups
 bozita cdrom cdwriter audio xgrp
 
 bash$ echo $GROUPS
 501

chown, chgrp

The chown command changes the ownership of a file or files. This command is a useful method that root can use to shift file ownership from one user to another. An ordinary user may not change the ownership of files, not even her own files. [1]

root# chown bozo *.txt

The chgrp command changes the group ownership of a file or files. You must be owner of the file(s) as well as a member of the destination group (or root) to use this operation.
chgrp --recursive dunderheads *.data # The "dunderheads" group will now own all the "*.data" files #+ all the way down the $PWD directory tree (that's what "recursive" means).

useradd, userdel

The useradd administrative command adds a user account to the system and creates a home directory for that particular user, if so specified. The corresponding userdel command removes a user account from the system [2] and deletes associated files.

The adduser command is a synonym for useradd and is usually a symbolic link to it.

usermod

Modify a user account. Changes may be made to the password, group membership, expiration date, and other attributes of a given user's account. With this command, a user's password may be locked, which has the effect of disabling the account.

groupmod

Modify a given group. The group name and/or ID number may be changed using this command.

id

The id command lists the real and effective user IDs and the group IDs of the user associated with the current process. This is the counterpart to the $UID, $EUID, and $GROUPS internal Bash variables.

bash$ id
 uid=501(bozo) gid=501(bozo) groups=501(bozo),22(cdrom),80(cdwriter),81(audio)
 
 bash$ echo $UID
 501

The id command shows the effective IDs only when they differ from the real ones.

Also see Example 9-5.

who

Show all users logged on to the system.

bash$ who bozo tty1 Apr 27 17:45 bozo pts/0 Apr 27 17:46 bozo pts/1 Apr 27 17:47 bozo pts/2 Apr 27 17:49

The -m gives detailed information about only the current user. Passing any two arguments to who is the equivalent of who -m, as in who am i or who The Man.

bash$ who -m localhost.localdomain!bozo pts/2 Apr 27 17:49

whoami is similar to who -m, but only lists the user name.

bash$ whoami bozo

w

Show all logged on users and the processes belonging to them. This is an extended version of who. The output of w may be piped to grep to find a specific user and/or process.

bash$ w | grep startx
 bozo  tty1     -                 4:22pm  6:41   4.47s  0.45s  startx

logname

Show current user's login name (as found in /var/run/utmp). This is a near-equivalent to whoami, above.

bash$ logname
 bozo
 
 bash$ whoami
 bozo

However...

bash$ su
 Password: ......
 
 bash# whoami
 root
 bash# logname
 bozo

While logname prints the name of the logged in user, whoami gives the name of the user attached to the current process. As we have just seen, sometimes these are not the same.

su

Runs a program or script as a substitute user. su rjones starts a shell as user rjones. A naked su defaults to root. See Example A-15.

sudo

Runs a command as root (or another user). This may be used in a script, thus permitting a regular user to run the script.

#!/bin/bash # Some commands. sudo cp /root/secretfile /home/bozo/secret # Some more commands.

The file /etc/sudoers holds the names of users permitted to invoke sudo.

passwd

Sets, changes, or manages a user's password.

The passwd command can be used in a script, but should not be.

Example 13-1. Setting a new password

#!/bin/bash
 #  setnew-password.sh: For demonstration purposes only.
 #                      Not a good idea to actually run this script.
 #  This script must be run as root.
 
 ROOT_UID=0         # Root has $UID 0.
 E_WRONG_USER=65    # Not root?
 
 E_NOSUCHUSER=70
 SUCCESS=0
 
 
 if [ "$UID" -ne "$ROOT_UID" ]
 then
   echo; echo "Only root can run this script."; echo
   exit $E_WRONG_USER
 else
   echo
   echo "You should know better than to run this script, root."
   echo "Even root users get the blues... "
   echo
 fi  
 
 
 username=bozo
 NEWPASSWORD=security_violation
 
 # Check if bozo lives here.
 grep -q "$username" /etc/passwd
 if [ $? -ne $SUCCESS ]
 then
   echo "User $username does not exist."
   echo "No password changed."
   exit $E_NOSUCHUSER
 fi  
 
 echo "$NEWPASSWORD" | passwd --stdin "$username"
 #  The '--stdin' option to 'passwd' permits
 #+ getting a new password from stdin (or a pipe).
 
 echo; echo "User $username's password changed!"
 
 # Using the 'passwd' command in a script is dangerous.
 
 exit 0

The passwd command's -l, -u, and -d options permit locking, unlocking, and deleting a user's password. Only root may use these options.

ac

Show users' logged in time, as read from /var/log/wtmp. This is one of the GNU accounting utilities.

bash$ ac
         total       68.08

last

List last logged in users, as read from /var/log/wtmp. This command can also show remote logins.

For example, to show the last few times the system rebooted:

bash$ last reboot
 reboot   system boot  2.6.9-1.667      Fri Feb  4 18:18          (00:02)    
  reboot   system boot  2.6.9-1.667      Fri Feb  4 15:20          (01:27)    
  reboot   system boot  2.6.9-1.667      Fri Feb  4 12:56          (00:49)    
  reboot   system boot  2.6.9-1.667      Thu Feb  3 21:08          (02:17)    
  . . .
 
  wtmp begins Tue Feb  1 12:50:09 2005

newgrp

Change user's group ID without logging out. This permits access to the new group's files. Since users may be members of multiple groups simultaneously, this command finds little use.

Terminals

tty

Echoes the name of the current user's terminal. Note that each separate xterm window counts as a different terminal.

bash$ tty
 /dev/pts/1

stty

Shows and/or changes terminal settings. This complex command, used in a script, can control terminal behavior and the way output displays. See the info page, and study it carefully.

Example 13-2. Setting an erase character

#!/bin/bash
 # erase.sh: Using "stty" to set an erase character when reading input.
 
 echo -n "What is your name? "
 read name                      #  Try to backspace
                                #+ to erase characters of input.
                                #  Problems?
 echo "Your name is $name."
 
 stty erase '#'                 #  Set "hashmark" (#) as erase character.
 echo -n "What is your name? "
 read name                      #  Use # to erase last character typed.
 echo "Your name is $name."
 
 # Warning: Even after the script exits, the new key value remains set.
 
 exit 0

Example 13-3. secret password: Turning off terminal echoing

#!/bin/bash
 # secret-pw.sh: secret password
 
 echo
 echo -n "Enter password "
 read passwd
 echo "password is $passwd"
 echo -n "If someone had been looking over your shoulder, "
 echo "your password would have been compromised."
 
 echo && echo  # Two line-feeds in an "and list."
 
 
 stty -echo    # Turns off screen echo.
 
 echo -n "Enter password again "
 read passwd
 echo
 echo "password is $passwd"
 echo
 
 stty echo     # Restores screen echo.
 
 exit 0
 
 # Do an 'info stty' for more on this useful-but-tricky command.

A creative use of stty is detecting a user keypress (without hitting ENTER).

Example 13-4. Keypress detection

#!/bin/bash
 # keypress.sh: Detect a user keypress ("hot keys").
 
 echo
 
 old_tty_settings=$(stty -g)   # Save old settings (why?).
 stty -icanon
 Keypress=$(head -c1)          # or $(dd bs=1 count=1 2> /dev/null)
                               # on non-GNU systems
 
 echo
 echo "Key pressed was \""$Keypress"\"."
 echo
 
 stty "$old_tty_settings"      # Restore old settings.
 
 # Thanks, Stephane Chazelas.
 
 exit 0

Also see Example 9-3.

terminals and modes

Normally, a terminal works in the canonical mode. When a user hits a key, the resulting character does not immediately go to the program actually running in this terminal. A buffer local to the terminal stores keystrokes. When the user hits the ENTER key, this sends all the stored keystrokes to the program running. There is even a basic line editor inside the terminal.

bash$ stty -a speed 9600 baud; rows 36; columns 96; line = 0; intr = ^C; quit = ^\; erase = ^H; kill = ^U; eof = ^D; eol = <undef>; eol2 = <undef>; start = ^Q; stop = ^S; susp = ^Z; rprnt = ^R; werase = ^W; lnext = ^V; flush = ^O; ... isig icanon iexten echo echoe echok -echonl -noflsh -xcase -tostop -echoprt

Using canonical mode, it is possible to redefine the special keys for the local terminal line editor.
bash$ cat > filexxx wha<ctl-W>I<ctl-H>foo bar<ctl-U>hello world<ENTER> <ctl-D> bash$ cat filexxx hello world bash$ bash$ wc -c < file 13
The process controlling the terminal receives only 13 characters (12 alphabetic ones, plus a newline), although the user hit 26 keys.

In non-canonical ("raw") mode, every key hit (including special editing keys such as ctl-H) sends a character immediately to the controlling process.

The Bash prompt disables both icanon and echo, since it replaces the basic terminal line editor with its own more elaborate one. For example, when you hit ctl-A at the Bash prompt, there's no ^A echoed by the terminal, but Bash gets a \1 character, interprets it, and moves the cursor to the begining of the line.

Stephan�Chazelas

setterm

Set certain terminal attributes. This command writes to its terminal's stdout a string that changes the behavior of that terminal.

bash$ setterm -cursor off bash$

The setterm command can be used within a script to change the appearance of text written to stdout, although there are certainly better tools available for this purpose.

setterm -bold on echo bold hello setterm -bold off echo normal hello

tset

Show or initialize terminal settings. This is a less capable version of stty.

bash$ tset -r Terminal type is xterm-xfree86. Kill is control-U (^U). Interrupt is control-C (^C).

setserial

Set or display serial port parameters. This command must be run by root user and is usually found in a system setup script.

# From /etc/pcmcia/serial script: IRQ=`setserial /dev/$DEVICE | sed -e 's/.*IRQ: //'` setserial /dev/$DEVICE irq 0 ; setserial /dev/$DEVICE irq $IRQ

getty, agetty

The initialization process for a terminal uses getty or agetty to set it up for login by a user. These commands are not used within user shell scripts. Their scripting counterpart is stty.

mesg

Enables or disables write access to the current user's terminal. Disabling access would prevent another user on the network to write to the terminal.

It can be very annoying to have a message about ordering pizza suddenly appear in the middle of the text file you are editing. On a multi-user network, you might therefore wish to disable write access to your terminal when you need to avoid interruptions.

wall

This is an acronym for "write all", i.e., sending a message to all users at every terminal logged into the network. It is primarily a system administrator's tool, useful, for example, when warning everyone that the system will shortly go down due to a problem (see Example 17-1).

bash$ wall System going down for maintenance in 5 minutes! Broadcast message from bozo (pts/1) Sun Jul 8 13:53:27 2001... System going down for maintenance in 5 minutes!

If write access to a particular terminal has been disabled with mesg, then wall cannot send a message to it.

dmesg

Lists all system bootup messages to stdout. Handy for debugging and ascertaining which device drivers were installed and which system interrupts in use. The output of dmesg may, of course, be parsed with grep, sed, or awk from within a script.

bash$ dmesg | grep hda Kernel command line: ro root=/dev/hda2 hda: IBM-DLGA-23080, ATA DISK drive hda: 6015744 sectors (3080 MB) w/96KiB Cache, CHS=746/128/63 hda: hda1 hda2 hda3 < hda5 hda6 hda7 > hda4

Information and Statistics

uname

Output system specifications (OS, kernel version, etc.) to stdout. Invoked with the -a option, gives verbose system info (see Example 12-5). The -s option shows only the OS type.

bash$ uname -a
 Linux localhost.localdomain 2.2.15-2.5.0 #1 Sat Feb 5 00:13:43 EST 2000 i686 unknown
 
 bash$ uname -s
 Linux

arch

Show system architecture. Equivalent to uname -m. See Example 10-26.

bash$ arch
 i686
 
 bash$ uname -m
 i686

lastcomm

Gives information about previous commands, as stored in the /var/account/pacct file. Command name and user name can be specified by options. This is one of the GNU accounting utilities.

lastlog

List the last login time of all system users. This references the /var/log/lastlog file.

bash$ lastlog root tty1 Fri Dec 7 18:43:21 -0700 2001 bin **Never logged in** daemon **Never logged in** ... bozo tty1 Sat Dec 8 21:14:29 -0700 2001 bash$ lastlog | grep root root tty1 Fri Dec 7 18:43:21 -0700 2001

This command will fail if the user invoking it does not have read permission for the /var/log/lastlog file.

lsof

List open files. This command outputs a detailed table of all currently open files and gives information about their owner, size, the processes associated with them, and more. Of course, lsof may be piped to grep and/or awk to parse and analyze its results.

bash$ lsof COMMAND PID USER FD TYPE DEVICE SIZE NODE NAME init 1 root mem REG 3,5 30748 30303 /sbin/init init 1 root mem REG 3,5 73120 8069 /lib/ld-2.1.3.so init 1 root mem REG 3,5 931668 8075 /lib/libc-2.1.3.so cardmgr 213 root mem REG 3,5 36956 30357 /sbin/cardmgr ...

strace

Diagnostic and debugging tool for tracing system calls and signals. The simplest way of invoking it is strace COMMAND.

bash$ strace df execve("/bin/df", ["df"], [/* 45 vars */]) = 0 uname({sys="Linux", node="bozo.localdomain", ...}) = 0 brk(0) = 0x804f5e4 ...

This is the Linux equivalent of truss.

nmap

Network port scanner. This command scans a server to locate open ports and the services associated with those ports. It is an important security tool for locking down a network against hacking attempts.

#!/bin/bash SERVER=$HOST # localhost.localdomain (127.0.0.1). PORT_NUMBER=25 # SMTP port. nmap $SERVER | grep -w "$PORT_NUMBER" # Is that particular port open? # grep -w matches whole words only, #+ so this wouldn't match port 1025, for example. exit 0 # 25/tcp open smtp

nc

The nc (netcat) utility is a complete toolkit for connecting to and listening to TCP and UDP ports. It is useful as a diagnostic and testing tool and as a component in simple script-based HTTP clients and servers.

bash$ nc localhost.localdomain 25 220 localhost.localdomain ESMTP Sendmail 8.13.1/8.13.1; Thu, 31 Mar 2005 15:41:35 -0700

Example 13-5. Checking a remote server for identd

#! /bin/sh
 ## Duplicate DaveG's ident-scan thingie using netcat. Oooh, he'll be p*ssed.
 ## Args: target port [port port port ...]
 ## Hose stdout _and_ stderr together.
 ##
 ##  Advantages: runs slower than ident-scan, giving remote inetd less cause
 ##+ for alarm, and only hits the few known daemon ports you specify.
 ##  Disadvantages: requires numeric-only port args, the output sleazitude,
 ##+ and won't work for r-services when coming from high source ports.
 # Script author: Hobbit <hobbit@avian.org>
 # Used in ABS Guide with permission.
 
 # ---------------------------------------------------
 E_BADARGS=65       # Need at least two args.
 TWO_WINKS=2        # How long to sleep.
 THREE_WINKS=3
 IDPORT=113         # Authentication "tap ident" port.
 RAND1=999
 RAND2=31337
 TIMEOUT0=9
 TIMEOUT1=8
 TIMEOUT2=4
 # ---------------------------------------------------
 
 case "${2}" in
   "" ) echo "Need HOST and at least one PORT." ; exit $E_BADARGS ;;
 esac
 
 # Ping 'em once and see if they *are* running identd.
 nc -z -w $TIMEOUT0 "$1" $IDPORT || { echo "Oops, $1 isn't running identd." ; exit 0 ; }
 #  -z scans for listening daemons.
 #     -w $TIMEOUT = How long to try to connect.
 
 # Generate a randomish base port.
 RP=`expr $$ % $RAND1 + $RAND2`
 
 TRG="$1"
 shift
 
 while test "$1" ; do
   nc -v -w $TIMEOUT1 -p ${RP} "$TRG" ${1} < /dev/null > /dev/null &
   PROC=$!
   sleep $THREE_WINKS
   echo "${1},${RP}" | nc -w $TIMEOUT2 -r "$TRG" $IDPORT 2>&1
   sleep $TWO_WINKS
 
 # Does this look like a lamer script or what . . . ?
 # ABS Guide author comments: "It ain't really all that bad,
 #+                            rather clever, actually."
 
   kill -HUP $PROC
   RP=`expr ${RP} + 1`
   shift
 done
 
 exit $?
 
 #  Notes:
 #  -----
 
 #  Try commenting out line 30 and running this script
 #+ with "localhost.localdomain 25" as arguments.
 
 #  For more of Hobbit's 'nc' example scripts,
 #+ look in the documentation:
 #+ the /usr/share/doc/nc-X.XX/scripts directory.

And, of course, there's Dr. Andrew Tridgell's notorious one-line script in the BitKeeper Affair:
echo clone | nc thunk.org 5000 > e2fsprogs.dat

free

Shows memory and cache usage in tabular form. The output of this command lends itself to parsing, using grep, awk or Perl. The procinfo command shows all the information that free does, and much more.

bash$ free
                 total       used       free     shared    buffers     cached
    Mem:         30504      28624       1880      15820       1608       16376
    -/+ buffers/cache:      10640      19864
    Swap:        68540       3128      65412

To show unused RAM memory:

bash$ free | grep Mem | awk '{ print $4 }'
 1880

procinfo

Extract and list information and statistics from the /proc pseudo-filesystem. This gives a very extensive and detailed listing.

bash$ procinfo | grep Bootup
 Bootup: Wed Mar 21 15:15:50 2001    Load average: 0.04 0.21 0.34 3/47 6829

lsdev

List devices, that is, show installed hardware.

bash$ lsdev Device DMA IRQ I/O Ports ------------------------------------------------ cascade 4 2 dma 0080-008f dma1 0000-001f dma2 00c0-00df fpu 00f0-00ff ide0 14 01f0-01f7 03f6-03f6 ...

du

Show (disk) file usage, recursively. Defaults to current working directory, unless otherwise specified.

bash$ du -ach
 1.0k    ./wi.sh
  1.0k    ./tst.sh
  1.0k    ./random.file
  6.0k    .
  6.0k    total

df

Shows filesystem usage in tabular form.

bash$ df
 Filesystem           1k-blocks      Used Available Use% Mounted on
  /dev/hda5               273262     92607    166547  36% /
  /dev/hda8               222525    123951     87085  59% /home
  /dev/hda7              1408796   1075744    261488  80% /usr

stat

Gives detailed and verbose statistics on a given file (even a directory or device file) or set of files.

bash$ stat test.cru File: "test.cru" Size: 49970 Allocated Blocks: 100 Filetype: Regular File Mode: (0664/-rw-rw-r--) Uid: ( 501/ bozo) Gid: ( 501/ bozo) Device: 3,8 Inode: 18185 Links: 1 Access: Sat Jun 2 16:40:24 2001 Modify: Sat Jun 2 16:40:24 2001 Change: Sat Jun 2 16:40:24 2001

If the target file does not exist, stat returns an error message.

bash$ stat nonexistent-file nonexistent-file: No such file or directory

vmstat

Display virtual memory statistics.

bash$ vmstat procs memory swap io system cpu r b w swpd free buff cache si so bi bo in cs us sy id 0 0 0 0 11040 2636 38952 0 0 33 7 271 88 8 3 89

netstat

Show current network statistics and information, such as routing tables and active connections. This utility accesses information in /proc/net (Chapter 27). See Example 27-3.

netstat -r is equivalent to route.

bash$ netstat
 Active Internet connections (w/o servers)
  Proto Recv-Q Send-Q Local Address           Foreign Address         State      
  Active UNIX domain sockets (w/o servers)
  Proto RefCnt Flags       Type       State         I-Node Path
  unix  11     [ ]         DGRAM                    906    /dev/log
  unix  3      [ ]         STREAM     CONNECTED     4514   /tmp/.X11-unix/X0
  unix  3      [ ]         STREAM     CONNECTED     4513
  . . .

uptime

Shows how long the system has been running, along with associated statistics.

bash$ uptime
 10:28pm  up  1:57,  3 users,  load average: 0.17, 0.34, 0.27

hostname

Lists the system's host name. This command sets the host name in an /etc/rc.d setup script (/etc/rc.d/rc.sysinit or similar). It is equivalent to uname -n, and a counterpart to the $HOSTNAME internal variable.

bash$ hostname
 localhost.localdomain
 
 bash$ echo $HOSTNAME
 localhost.localdomain

Similar to the hostname command are the domainname, dnsdomainname, nisdomainname, and ypdomainname commands. Use these to display or set the system DNS or NIS/YP domain name. Various options to hostname also perform these functions.

hostid

Echo a 32-bit hexadecimal numerical identifier for the host machine.

bash$ hostid 7f0100

This command allegedly fetches a "unique" serial number for a particular system. Certain product registration procedures use this number to brand a particular user license. Unfortunately, hostid only returns the machine network address in hexadecimal, with pairs of bytes transposed.

The network address of a typical non-networked Linux machine, is found in /etc/hosts.

bash$ cat /etc/hosts 127.0.0.1 localhost.localdomain localhost

As it happens, transposing the bytes of 127.0.0.1, we get 0.127.1.0, which translates in hex to 007f0100, the exact equivalent of what hostid returns, above. There exist only a few million other Linux machines with this identical hostid.

sar

Invoking sar (System Activity Reporter) gives a very detailed rundown on system statistics. The Santa Cruz Operation ("Old" SCO) released sar as Open Source in June, 1999.

This command is not part of the base Linux distribution, but may be obtained as part of the sysstat utilities package, written by Sebastien Godard.

bash$ sar
 Linux 2.4.9 (brooks.seringas.fr) 	09/26/03
 
 10:30:00          CPU     %user     %nice   %system   %iowait     %idle
 10:40:00          all      2.21     10.90     65.48      0.00     21.41
 10:50:00          all      3.36      0.00     72.36      0.00     24.28
 11:00:00          all      1.12      0.00     80.77      0.00     18.11
 Average:          all      2.23      3.63     72.87      0.00     21.27
 
 14:32:30          LINUX RESTART
 
 15:00:00          CPU     %user     %nice   %system   %iowait     %idle
 15:10:00          all      8.59      2.40     17.47      0.00     71.54
 15:20:00          all      4.07      1.00     11.95      0.00     82.98
 15:30:00          all      0.79      2.94      7.56      0.00     88.71
 Average:          all      6.33      1.70     14.71      0.00     77.26

readelf

Show information and statistics about a designated elf binary. This is part of the binutils package.

bash$ readelf -h /bin/bash
 ELF Header:
    Magic:   7f 45 4c 46 01 01 01 00 00 00 00 00 00 00 00 00 
    Class:                             ELF32
    Data:                              2's complement, little endian
    Version:                           1 (current)
    OS/ABI:                            UNIX - System V
    ABI Version:                       0
    Type:                              EXEC (Executable file)
    . . .

size

The size [/path/to/binary] command gives the segment sizes of a binary executable or archive file. This is mainly of use to programmers.

bash$ size /bin/bash text data bss dec hex filename 495971 22496 17392 535859 82d33 /bin/bash

System Logs

logger

Appends a user-generated message to the system log (/var/log/messages). You do not have to be root to invoke logger.
logger Experiencing instability in network connection at 23:10, 05/21. # Now, do a 'tail /var/log/messages'.

By embedding a logger command in a script, it is possible to write debugging information to /var/log/messages.
logger -t $0 -i Logging at line "$LINENO". # The "-t" option specifies the tag for the logger entry. # The "-i" option records the process ID. # tail /var/log/message # ... # Jul 7 20:48:58 localhost ./test.sh[1712]: Logging at line 3.

logrotate

This utility manages the system log files, rotating, compressing, deleting, and/or e-mailing them, as appropriate. This keeps the /var/log from getting cluttered with old log files. Usually cron runs logrotate on a daily basis.

Adding an appropriate entry to /etc/logrotate.conf makes it possible to manage personal log files, as well as system-wide ones.

Stefano Falsetto has created rottlog, which he considers to be an improved version of logrotate.

Job Control

ps

Process Statistics: lists currently executing processes by owner and PID (process ID). This is usually invoked with ax options, and may be piped to grep or sed to search for a specific process (see Example 11-12 and Example 27-2).

bash$  ps ax | grep sendmail
 295 ?	   S	  0:00 sendmail: accepting connections on port 25

To display system processes in graphical "tree" format: ps afjx or ps ax --forest.

pstree

Lists currently executing processes in "tree" format. The -p option shows the PIDs, as well as the process names.

top

Continuously updated display of most cpu-intensive processes. The -b option displays in text mode, so that the output may be parsed or accessed from a script.

bash$ top -b 8:30pm up 3 min, 3 users, load average: 0.49, 0.32, 0.13 45 processes: 44 sleeping, 1 running, 0 zombie, 0 stopped CPU states: 13.6% user, 7.3% system, 0.0% nice, 78.9% idle Mem: 78396K av, 65468K used, 12928K free, 0K shrd, 2352K buff Swap: 157208K av, 0K used, 157208K free 37244K cached PID USER PRI NI SIZE RSS SHARE STAT %CPU %MEM TIME COMMAND 848 bozo 17 0 996 996 800 R 5.6 1.2 0:00 top 1 root 8 0 512 512 444 S 0.0 0.6 0:04 init 2 root 9 0 0 0 0 SW 0.0 0.0 0:00 keventd ...

nice

Run a background job with an altered priority. Priorities run from 19 (lowest) to -20 (highest). Only root may set the negative (higher) priorities. Related commands are renice, snice, and skill.

nohup

Keeps a command running even after user logs off. The command will run as a foreground process unless followed by &. If you use nohup within a script, consider coupling it with a wait to avoid creating an orphan or zombie process.

pidof

Identifies process ID (PID) of a running job. Since job control commands, such as kill and renice act on the PID of a process (not its name), it is sometimes necessary to identify that PID. The pidof command is the approximate counterpart to the $PPID internal variable.

bash$ pidof xclock 880

Example 13-6. pidof helps kill a process

#!/bin/bash
 # kill-process.sh
 
 NOPROCESS=2
 
 process=xxxyyyzzz  # Use nonexistent process.
 # For demo purposes only...
 # ... don't want to actually kill any actual process with this script.
 #
 # If, for example, you wanted to use this script to logoff the Internet,
 #     process=pppd
 
 t=`pidof $process`       # Find pid (process id) of $process.
 # The pid is needed by 'kill' (can't 'kill' by program name).
 
 if [ -z "$t" ]           # If process not present, 'pidof' returns null.
 then
   echo "Process $process was not running."
   echo "Nothing killed."
   exit $NOPROCESS
 fi  
 
 kill $t                  # May need 'kill -9' for stubborn process.
 
 # Need a check here to see if process allowed itself to be killed.
 # Perhaps another " t=`pidof $process` " or ...
 
 
 # This entire script could be replaced by
 #    kill $(pidof -x process_name)
 # but it would not be as instructive.
 
 exit 0

fuser

Identifies the processes (by PID) that are accessing a given file, set of files, or directory. May also be invoked with the -k option, which kills those processes. This has interesting implications for system security, especially in scripts preventing unauthorized users from accessing system services.

bash$ fuser -u /usr/bin/vim /usr/bin/vim: 3207e(bozo) bash$ fuser -u /dev/null /dev/null: 3009(bozo) 3010(bozo) 3197(bozo) 3199(bozo)

One important application for fuser is when physically inserting or removing storage media, such as CD ROM disks or USB flash drives. Sometimes trying a umount fails with a device is busy error message. This means that some user(s) and/or process(es) are accessing the device. An fuser -um /dev/device_name will clear up the mystery, so you can kill any relevant processes.

bash$ umount /mnt/usbdrive umount: /mnt/usbdrive: device is busy bash$ fuser -um /dev/usbdrive /mnt/usbdrive: 1772c(bozo) bash$ kill -9 1772 bash$ umount /mnt/usbdrive

The fuser command, invoked with the -n option identifies the processes accessing a port. This is especially useful in combination with nmap.

root# nmap localhost.localdomain PORT STATE SERVICE 25/tcp open smtp root# fuser -un tcp 25 25/tcp: 2095(root) root# ps ax | grep 2095 | grep -v grep 2095 ? Ss 0:00 sendmail: accepting connections

cron

Administrative program scheduler, performing such duties as cleaning up and deleting system log files and updating the slocate database. This is the superuser version of at (although each user may have their own crontab file which can be changed with the crontab command). It runs as a daemon and executes scheduled entries from /etc/crontab.

Some flavors of Linux run crond, Matthew Dillon's version of cron.

Process Control and Booting

init: The init command is the parent of all processes. Called in the final step of a bootup, init determines the runlevel of the system from /etc/inittab. Invoked by its alias telinit, and by root only.
telinit: Symlinked to init, this is a means of changing the system runlevel, usually done for system maintenance or emergency filesystem repairs. Invoked only by root. This command can be dangerous - be certain you understand it well before using!
runlevel: Shows the current and last runlevel, that is, whether the system is halted (runlevel 0), in single-user mode (1), in multi-user mode (2 or 3), in X Windows (5), or rebooting (6). This command accesses the /var/run/utmp file.
halt, shutdown, reboot: Command set to shut the system down, usually just prior to a power down.

Network

ifconfig

Network interface configuration and tuning utility.

bash$ ifconfig -a
 lo        Link encap:Local Loopback
            inet addr:127.0.0.1  Mask:255.0.0.0
            UP LOOPBACK RUNNING  MTU:16436  Metric:1
            RX packets:10 errors:0 dropped:0 overruns:0 frame:0
            TX packets:10 errors:0 dropped:0 overruns:0 carrier:0
            collisions:0 txqueuelen:0 
            RX bytes:700 (700.0 b)  TX bytes:700 (700.0 b)

The ifconfig command is most often used at bootup to set up the interfaces, or to shut them down when rebooting.

# Code snippets from /etc/rc.d/init.d/network # ... # Check that networking is up. [ ${NETWORKING} = "no" ] && exit 0 [ -x /sbin/ifconfig ] || exit 0 # ... for i in $interfaces ; do if ifconfig $i 2>/dev/null | grep -q "UP" >/dev/null 2>&1 ; then action "Shutting down interface $i: " ./ifdown $i boot fi # The GNU-specific "-q" option to "grep" means "quiet", i.e., producing no output. # Redirecting output to /dev/null is therefore not strictly necessary. # ... echo "Currently active devices:" echo `/sbin/ifconfig | grep ^[a-z] | awk '{print $1}'` # ^^^^^ should be quoted to prevent globbing. # The following also work. # echo $(/sbin/ifconfig | awk '/^[a-z]/ { print $1 })' # echo $(/sbin/ifconfig | sed -e 's/ .*//') # Thanks, S.C., for additional comments.

Notes

[1]	This is the case on a Linux machine or a UNIX system with disk quotas.
[2]	The userdel command will fail if the particular user being deleted is still logged on.
[3]	For more detail on burning CDRs, see Alex Withers' article, Creating CDs, in the October, 1999 issue of Linux Journal.
[4]	The `-c` option to mke2fs also invokes a check for bad blocks.
[5]	Operators of single-user Linux systems generally prefer something simpler for backups, such as tar.
[6]	NAND is the logical not-and operator. Its effect is somewhat similar to subtraction.

Оставьте свой комментарий !

Ваше имя:

Комментарий:

Оба поля являются обязательными

Автор	Комментарий к данной статье