命令
常用命令
抓包
- sudo tcpdump -i bond0 -s0 host 106.48.52.51 and port 23456 -nvvv -XX -A
- sudo tcpdump -i eth0 host 172.17.39.8 or host 223.202.197.8 -nvvv -s0 -w jdx.pcap
访问
- curl -vo hls0aa.file --local-port 23456 ‘url’ --resolve audio.itunes.apple.com:80:106.48.52.51 --range 0-2047 -H ‘hostHeader:audio.itunes.apple.com’ -H ‘x-c3-debug:enabled’ -H ‘user-agent:ChinaCache-NOC’
查询30分钟内被访问最多的源站ip
- cclog hpc access 30m|awk ‘{print $9}’ |sort |uniq -c |sort -rn |tail -20
测试30次源站的状态码
for ((i=1;i<31;i++));do curl -I -m 10 -o /dev/null -s -w %{http_code}"\n" http://xxxx -x 152.70.40.23:80;done
-x 代理
查看时间戳
- date -d @“1560066310”
查看201906091300 201906091700 13点到17点中异常状态码最多的IP（也可以直接写分 时）
-
cclog hpc access 201906091300 201906091700 |awk ‘$7~“http://m.chn.lottedfs.cn”&& $4~"/50"{print $9}’|sort|uniq -c |sort -rn
-
cclog hpc access 201906091300 201906091305 |awk ‘$7"http://m.chn.lottedfs.cn"&&$9"152.70.40.21"{print $4}’|sort|uniq -c
1小时内这个域名的状态码数量
- cclog hpc access 1h | grep https://mob-t0.ete.cathaypacific.com | awk ‘{print $4}’ | sort | uniq -c | sort -nr | head
测试url返回状态码
-
while true;do curl -so /dev/null -w "
date +%F\ %T%{http_code}\n" url --resolve assets-origin.itunes.apple.com:80:117.149.250.128 -r 0-0; sleep 2;done -
curl -ksvo /dev/null -H “host:book.cathaypacific.com” https://106.48.55.38/CathayPacificV3/dyn/air/booking/%7B%7BstaticFilesPath%7D%7Dbooking/skin/img/social-login/icon-twitter.png
没有reslvoed测试，设备curl版本不同
-
while true;do curl -so /dev/null -k -H “Host: book.cathaypacific.com” -w "
date +%F\ %T%{http_code}\n"
https://book.cathaypacific.com/CathayPacificV3/dyn/air/booking/%7B%7BstaticFilesPath%7D%7Dbooking/skin/img/social-login/icon-wechat.png ;done -
cclog hpc access 5m|awk ‘$7"iosapps.itunes"&&$4"TCP_MISS/403"{a++;split($7,t,/[_=]/);b=t[2]>$1?“not_expired”:“expired”;s[b]++}END{for(i in s){print i,s[i]};print "total "a}’
输出说明：
- expired url过期数量
- total 403请求总数
- not_expired url未过期但响应状态码是403
筛选url
- awk {‘print $5" "$7’} |awk -F / {‘print $1"//"$3"/"’} | awk ‘{sums[$2] += $1} END { for (i in sums) printf("%s %s\n", sums[i], i)}’ | sort -r -n -k1 | head|awk ‘{a[NR]=$2;x+=(b[NR]=$1)}END{while(++i<=NR)print 100*b[i]/x"%",b[i]/1024/1024"M",a[i]}’|column -t
域名回源验证方法 ：more /usr/local/squid/etc/origin_domain_ip |grep 域名
统计状态码数量：
cclog hpc access 72h |awk '{num[$4]++}END{for(i in num)print num[i],i}' |sort -nr | head
统计访问url次数：
cclog hpc access 5m |awk '{num[$7]++}END{for(i in num)print num[i],i}' |sort -nr | head
5分钟内域名出现403的次数
cclog hpc access 5m|awk '$7~"iosapps.itunes"&&$4~"TCP_MISS/403"{a++;split($7,t,/[_=]/);b=t[2]>$1?"not_expired":"expired";s[b]++}END{for(i in s){print i,s[i]};print "total "a}'
状态码比率：
cclog hpc access 20190823 | awk '$7~"updates-http.cdn-apple.com"&&$4~"/403"' | awk '{ print $7}' | sort | uniq -c | sort -k1nr | head -n20 | awk '{ astrChannel[NR]=$2; nErrSum+=(anChnlErrTotal[NR]=$1); } \
BEGIN { printf("Ratio\trequests\tStaus\n--------\t------------\t------------------------------------------------------------------------------\n"); }
END { while(++nChnlIdx<=NR) printf("%.2f%%\t%d\t%s\n", 100*anChnlErrTotal[nChnlIdx]/nErrSum,anChnlErrTotal[nChnlIdx],astrChannel[nChnlIdx] ); }' | column -t
设备比率：
cclog hpc access 10m |awk -F "|" '{print $2}'|sort|sort -rn| uniq -c | sort -k1nr | head -n20 | awk '{ astrChannel[NR]=$2; nErrSum+=(anChnlErrTotal[NR]=$1); } \
BEGIN { printf("Ratio\trequests\tStaus\n--------\t------------\t------------------------------------------------------------------------------\n"); }
END { while(++nChnlIdx<=NR) printf("%.2f%%\t%d\t%s\n", 100*anChnlErrTotal[nChnlIdx]/nErrSum,anChnlErrTotal[nChnlIdx],astrChannel[nChnlIdx] ); }' | column -t
当前设备流量来源：
cclog hpc access 5m|awk -F 'cc_info=|[ ]+' '{split($(NF-4),a,"|");s[a[2]]++;t[a[2]]+=$5}END{for(i in s){printf("%-15s%-6d%-10s\n",i,s[i],t[i])}}'|sort -k3nr|head -30
当前设备流量排名：
cclog hpc access 10m|awk 'BEGIN{printf("%-50s%-20s%-20s%-20s%-20s\n","ChannelName","SumOfTraffic","TrafficRatio","CountOfRequests","CountRatio")}{split($7,url,"/");h=url[1]"//"url[3];s[h]+=$5;a+=$5;c[h]++;b++}END{for(i in s)printf("%-50s%-20.3e%-20.2f%-20d%-20.2f\n",i,s[i],s[i]*100/a,c[i],c[i]*100/b) |"sort -r -g -k2 |head -20"}'
配置文件：
vim /Application/SSR/GHR/conf/default.conf
grep 'node_bandwidth=' /Application/SSR/GHR/conf/default.conf
启动：
/Application/SSR/GHR/sbin/lighttpd -f /Application/SSR/GHR/conf/lighttpd.conf
#node_bandwidth=http://imp.chinacache.com:8900/api/v3.0/query_node_bandwidth
node_bandwidth=DEV:bond0
sed -i 's/node_bandwidth/#node_bandwidth/g' /Application/SSR/GHR/conf/default.conf
sed -i 's/#node_bandwidth=DEV:bond0/node_bandwidth=DEV:bond0/g' /Application/SSR/GHR/conf/default.conf
查看已经delete状态的文件，杀掉对应的进程号，即可释放(文件僵死)
lsof |grep delete
推送命令：
curl -X GET http://bsp.v3.gslb.cdnservice.cn:9999/ghrconfig/tonameid/rels/put/ -H "Content-Type:application/json" \
-d '[{
"nameid": "act-dl-1-iosapps.ccgslb.com.cn",
"node_name": "ACT-DL-1-CLOUD"
}]'
ab压力测试工具：
ab -n10000 -c 500 -H "iosapps.itunes.apple.com" "url"