2018-09-24 日常操作cheatsheet

[一些变量]

[strace]
strace -T -tt -v -fp 2>&1 #追踪某个pid下所有线程的syacall

[查找历史指令]
ctrl + R，输入字符查找

[切换到上次的目录]
$cd -

[清屏]
ctrl + L, 相当于clear

[暂停当前进程]
ctrl + Z

[恢复暂停的进程]
fg

[列出目录中大小前5的文件]

du -a | sort -n -r | head -n 5 | awk '{print $1/1024,"MB ", $2}'

也可以 watch

watch "du -a | sort -n -r | head -n 5 | awk '{print \$1/1024,\"MB \", \$2}'"

[vim专题]
进入visual mode并高亮选择： v + h/l;
visual mode 按word选择：v + w 高亮光标所在的word

[查看ip]
ip a | grep inet
ifconfig

[查看某进程的所有线程]
$ ps -T -p

[tcpdump抓某个端口]

1. tcpdump
   tcpdump -i dst and port -X 打印ascii的数据

[查看某进程占用的内存用量]

1. ps -e -o 'pid,comm,args,pcpu,rsz,vsz,stime,user,uid' | grep
2. expr：

pid  -
comm -   command
args -   run_command_parameter
pcpu -  cpu时间占用百分比
rsz  - 常驻内存大小
vsz  - 虚拟内存用量

ps 的rsz和vsz正好对应top的RES和VIRT.

[grep专题]
或 grep -e "expr1" -e "expr2"
非 grep -v "expr"

[top专题]
cpu：
“1” 查看每个核的详细数据， “1” 回到基本视图

I try to explain  these:
us: is meaning of "user CPU time"
sy: is meaning of "system CPU time"
ni: is meaning of" nice CPU time"
id: is meaning of "idle"
wa: is meaning of "iowait" 
hi：is meaning of "hardware irq"
si : is meaning of "software irq"
st : is meaning of "steal time"
中文翻译为：
us 用户空间占用CPU百分比
sy 内核空间占用CPU百分比
ni 用户进程空间内改变过优先级的进程占用CPU百分比
id 空闲CPU百分比
wa 等待输入输出的CPU时间百分比
hi 硬件中断
si 软件中断 
st: 实时（来源http://bbs.chinaunix.net/thread-1958596-1-1.html）

内存：

1. virt vs. res vs. shr

项目	含义
VIRT	程序可访问的内存总量
RES	程序的常驻内存总量
SHR	程序可访问内存总量中的共享部分

• VIRT stands for the virtual size of a process, which is the sum of memory it is actually using, memory it has mapped into itself (for instance the video card’s RAM for the X server), files on disk that have been mapped into it (most notably shared libraries), and memory shared with other processes. VIRT represents how much memory the program is able to access at the present moment.
• RES stands for the resident size, which is an accurate representation of how much actual physical memory a process is consuming. (This also corresponds directly to the %MEM column.) This will virtually always be less than the VIRT size, since most programs depend on the C library.
• SHR indicates how much of the VIRT size is actually sharable (memory or libraries). In the case of libraries, it does not necessarily mean that the entire library is resident. For example, if a program only uses a few functions in a library, the whole library is mapped and will be counted in VIRT and SHR, but only the parts of the library file containing the functions being used will actually be loaded in and be counted under RES.
  http://mugurel.sumanariu.ro/linux/the-difference-among-virt-res-and-shr-in-top-output/

2. 切换内存计量单位
   使内存以MB方式，top -M 或 在top中按E(最上面系统状态中的内存单位会在MiB/GiB等单位切换)

3. 只看某个进程 top -p