formats and displays /var/log/lastlog (last login log file).
This file is a database containing info on the last login of each user.
You should not rotate it. It is a sparse file, its size on the disk is much
smaller than the one reported by ls -l (for real size use
ls -s).
lastlog [options]
By default ~ entries are sorted by their order in
/etc/passwd.
lastlog -u zorg
report when user zorg entered this system last time;
Options
-h --help
-t n,
--time n
show only records for last n days;
-u name,
--user name
show only records for user with the specified login name; -t
overrides -u;
displays contents of text files; its cmd set is based on more
and vi.
less /var/log/messages
browse /var/log/messages system log file;
less [options] [--] [file] ...
Some options
-? --help
-V --version
-a |
start search after the last line displayed on the screen; |
-E |
exit when we reach EOF first time; |
-e |
exit when we reach EOF second time; |
-f |
force non-regular file to be opened; suppress warning when a binary file is opened; |
-i |
ignore case when searching (doesn’t work if pattern contains uppercase letters); |
-I |
ignore case when searching (no matter what pattern contains); |
-N |
show line numbers; |
-n |
suppress line numbers; |
-s |
squeeze consecutive blank lines into a single blank line; |
--shift n, -n
specifies the default number of positions to scroll horizontally in the → / ← arrow keys cmds;
Some commands
h, H
help;
Space, PageDown,
f, CTRL+F
scroll forward n lines, default is one window;
z |
like prev, but if n is specified, it becomes new window size; |
↓, Enter,
e, j
scroll forward n lines, default is 1;
d, CTRL+D
scroll forward n lines, default is one half of the screen size;
if n is specified, it becomes new default for d
and u cmds;
PageUp, b, CTRL+B
scroll backward n lines, default is one window;
w |
like prev, but if n is specified, it becomes new window size; |
↑, y, k,
CTRL+K, CTRL+P
scroll backward n lines, default is 1;
u, CTRL+U
scroll backward n lines, default is one half
of the screen size; if n is specified, it becomes new default
for d and u cmds;
| → | scroll horizontally right n chars, default is half the screen width; |
| ← | scroll horizontally left n chars, default half the screen width; |
r, CTRL+R
repaint the screen;
F |
scroll forward at the EOF (similar to tail –f); |
< |
go to the first line; |
g |
go to the line n (by default first line); |
> |
go to the EOF; |
G |
go to the line n (by default EOF); |
p, %
go to a position n% into the file;
/pattern
search forward for a pattern;
?pattern
search backward for a pattern;
n |
repeat previous search; |
v |
invoke an editor to edit the current file; |
q |
quit; |
creates hard or symbolic links between files and directories.
ln -s libocci.so.11.1 libocci.so
create a symbolic link (libocci.so) for a shared library (libocci.so.11.1); all happens in the current dir; this is a typical method of hiding version differences in lib names;
ln -s linux-2.6.38 linux
create a symlink (linux) for a dir (linux-2.6.38);
ln -s /media media
(assuming that you are in your home dir) create a symlink (media) in your home dir for a convenient access to removable devices mounted in /media (common system dir in root dir);
ln today reports
create a hard link for the file today in the directory reports;
ln today reports/wed
in the directory reports create hard link wed for today;
ln [options] target [link_name]
ln [options] target dir
If link_name is not specified, a link with the same base name as that of the target is created in the current directory. The second form of this command creates links to each target in the directory dir. Hard link is default, symbolic link must be explicitly specified.
Options
--help --version
-b, --backup
make a backup of each existing dest file;
-d, -F, --directory
hard link dirs (only superuser can do this; anyway it may fail due to system restrictions);
-f, --force
remove existing destination files;
-i, --interactive
ask whether to remove destinations;
-n, --no-dereference
treat dest that is a symlink to a dir as if it were a normal file;
-S sfx,
--suffix=sfx
override the usual backup suffix;
-s, --symbolic
make a symlink instead of a hard link;
--target-directory=dir
specify dir in which to create links;
-v, --verbose
print name of each file before linking;
lists directory contents.
ls -al | more
list current directory contents, show all entries (files,
dir, hidden files, hidden dirs) in a long format, filenames in alphabet order,
pipe output through the paging filter more;
ls -l | more
like previous, but don't show hidden entries;
ls -lh | awk '{print $9, $5}'
output only filenames [in alphabet order] and file sizes in human-readable format (i.e., kilobytes and megabytes instead of blocks);
ls -d $HOME/.* | more
show only hidden entries (files and dirs);
ls -ald $HOME/.* | more
show only hidden entries in a long format;
ls -Z
list current dir contents in a long format
(like ls -l) including SELinux security context;
ls -lF
list dir contents in a long format adding type indicator (* for executable file, / for dir, etc);
ls -Flt
list dir contents in a long format, with type indicators, sorted by modification time, last modified goes first;
ls -lt
list all files by modification time (last modified goes first);
ls -l hda*
list files with hda at the beginning of filename;
ls | sort -f
sort filenames in alphabet order ignoring case;
ls -s | sort -n
sort filenames by size (small first);
ls -ls | sort -nr
sort filenames by size (large first);
ls -l | grep '^d'
list directories only;
ls -l | grep '^-'
list regular files only;
ls -al | wc -l
count all files and dirs, including hidden ones;
ls [options] [file] ...
If the filesystem supports POSIX ACL, then a plus sign (+) after
the permission string in the output produced by ls -l means that
this file (dir) has a default ACL or an access ACL containing more than 3
required entries (owner / group / others). See getfacl and
setfacl for details. Also note, that
-Z --lcontext --scontext are available only if SELinux is
supported.
Options
--help --version
-A, --almost-all
do not list implied . and ..;
-a, --all
do not hide entries starting with . (dot);
-B, --ignore-backups
do not list entries ending with ~;
-b, --escape
print octal escapes for non-graphic chars;
--block-size=n
use n-byte blocks;
-C |
list entries by columns (opposite to –x); |
-c |
sort by change time; with -l show ctime; |
--color=when
control whether color is used to distinguish file types (when may be never, always, auto);
-d, --directory
list dir entries instead of contents, and do not dereference symlinks;
-F, --classify
append indicator (one of * / = @ |);
-f |
do not sort, enable -aU, disable -lst; |
-G, --no-group
inhibit display of group information;
-g |
like -l, but do not list owner; |
--full-time
like -l --time-style=full-iso;
-h, --human-readable
show sizes in human readable format;
-I ptn,
--ignore=ptn
do not list entries matching the specified shell pattern;
-i, --inode
print index number of each file;
-k |
like block-size=1K; |
-l |
use a long listing format; |
--lcontext
display security context (use with -l);
-L, --dereference
show info for the file the link references rather than for the link itself;
-m |
fill width with a comma separated list of entries; |
-n, --numeric-uid-gid
like -l, but list numeric UIDs and GIDs instead
of names;
-o |
like -l, but do not list group info; |
-p, --file-type
append indicator (/ = @ |) to entries;
-Q, --quote-name
enclose entry names in double quotes;
-q, --hide-control-chars
show '?' instead of non-graphic chars;
-R, --recursive
list subdirs recursively;
-r, --reverse
reverse sorting order;
-S |
sort by file size; |
-s, --size
show size of each file in blocks;
--scontext
display only security context and file name;
--show-control-chars
show non-graphic chars as is;
--si
like -h, but use powers of 1000, not 1024;
-T n,
--tabsize=n
assume tab stops at each n columns (by default, 8 columns);
-t |
sort by modification time; |
--time-style=style
show times using one of the specified styles:
full-iso, long-iso, iso,
locale, +format
(see date);
-U |
do not sort, list entries in directory order; |
-u |
sort by access time; |
-v |
sort by version; |
-w n,
--width=n
assume screen width n columns;
-X |
sort alphabetically by extension; |
-x |
list entries by lines instead of by columns; |
-Z, --context
display security context so it fits on display;
lists file attributes on an ext2/ext3/ext4 filesystem.
lsattr -a
list attributes of all files in the current dir;
lsattr [options] [file ...]
See chattr for a description
of valid attrubutes.
Options
-V |
version; |
-a |
list all files, including hidden; |
-d |
list dirs like files, rather then listing their contents; |
-R |
recursively list attribs of dirs and their contents; |
-v |
list the file’s version/generation number; |
extracts info on the computer hardware config (mainboard, bus, CPU, memory, firmware versions, etc). It works only on DMI-capable x86 / IA-64 systems and on some PowerPC machines.
lshw -short
list all HW info in a compact format (kind of a device tree);
lshw -class network
list all network interfaces, NICs info, etc;
lshw -class storage
show info about storage controllers;
lshw -class disk
show info about HDDs, CD/DVD, USB flash (if present);
Options
-help -version
-class cls,
-C cls
show the specified class of hardware only (available classes: bridge bus communication disk display memory multimedia power processor storage system volume)
-businfo
show bus info, detailing SCSI, USB, IDE, PCI;
-enable test,
-disable test
enable/disable a test:
| dmi | for DMI / SMBIOS extensions; |
| device-tree | for OpenFirmware device tree; |
| spd | for memory Serial Presence Detect; |
| memory | for memory-size guessing heuristics; |
| cpuinfo | for kernel-reported CPU detection; |
| cpuid | for CPU detection; |
| pci | for PCI / AGP access; |
| isapnp | for ISA PnP extensions; |
| pcmcia | for PCMCIA / PCCARD; |
| ide | for IDE / ATAPI; |
| usb | for USB devices; |
| scsi | for SCSI; |
| network | for network interfaces detection; |
-html
output the device tree as an HTML page;
-numeric
display numeric IDs (for PCI and USB devices);
-quiet
do not display status;
-sanitize
remove potentially sensible info from the output (like IP addresses, serial numbers, etc.);
-short
output the device tree showing the hardware paths;
-X
launch the X11 GUI (if available);
-xml
output the device tree as an XML tree;
~ currently does not detect Firewire (IEEE1394) devices.
Not all architectures supported by GNU/Linux are fully supported (e.g.
CPU detection). "Virtual" SCSI interfaces used for SCSI emulation over
IDE are not reported correctly.
lists open files (regular files, dirs, block/char special, executing
text references, libs, streams, network files). For better results you
should have root privs (e.g. sudo lsof ..).
lsof [options] [names]
Without options ~ lists all open files (usually too much to be
useful), names are path names of specific files to list, the first
name can be separated from the preceding options with '--',
symbolic links are resolved before use.
lsof | head -20
list all open files / show first 20 entries;
lsof /dev/sda5
list all open files on device /dev/sda5;
lsof -p 7280
list all open files belonging to process 7280 (PID = 7280);
lsof -i
list all open TCP and UDP ports;
lsof -i -P
list all open TCP and UDP ports; display ports in numerical form;
lsof -i :27017
what process listens on port 27017?
lsof -i -U
list all open Internet, x.25, Unix domain files;
lsof -i 4 -a -p 5497
list all open IPv4 network files used by process with pid = 5497;
lsof -u oracle
list all open files belonging to processes owned by user oracle;
lsof /home/alice/abc.dat
find the process that has opened /home/alice/abc.dat;
kill -HUP `lsof -t /opt/proj4/index.dat`
send SIGHUP to all processes that have opened file /opt/proj4/index.dat;
lsof -i @mace.cc.perdue.edu
list all files using any proto/port of mace.cc...;
lsof -i @mace.cc.perdue.edu:100-145
list all files using any protocol on ports 100..145 of mace.cc.perdue.edu;
lsof -bw /nfs/mount/point
find processes with open files on NFS filesystem whose server is inaccessible, presuming your mount table supplies device number for /nfs/mount/point, suppress warnings;
lsof -c /^..o.$/i -a -d cwd
list the current working dir of processes running a cmd that is exactly 4 chars long and has 'o' or 'O' at the position 3;
lsof -i @128.210.15.17
find an IPv4 socket file by its associated numeric dot-form address;
lsof -i @[0:1:2:3:4:5:6:7]
find an IPv6 socket file by its associated numeric colon-form address;
Options
-? -h
-v |
version number and misc info about program; | ||||||
-a |
means "AND" selections (default is "OR"); | ||||||
-b |
avoid kernel functions that might block; | ||||||
-c c |
list files for processes executing the cmd that begins
with c-char; multiple cmds may be specified, using multiple
-c options joined by AND/OR; if c goes between
2 slashes, it is interpreted as a regexp:
| ||||||
+c n |
set max num of initial chars in the name of the Unix cmd to be printed in the COMMAND column (default is 9); | ||||||
-C |
disable reporting of any path name components from the kernel’s name cache; |
+D dir
search for all open instances of directory dir and all files/dirs it contains to its complete depth (symlinks are not followed); this may be slow and consuming a large amount of dynamic memory;
-D func
set usage of the device cache file; func may be:
| ? | report device cache file paths; |
| b | build the device cache file; |
| i | ignore the device cache file; |
| r | read the device cache file; |
| u | read and update the device cache file; |
+d dir
search for all open instances of directory dir and files/dirs it contains at its top level; do not descend the dir tree, do not follow symlinks;
-d list
use a comma-separated list of file descriptors to include in or exclude from the output; all file descriptors to exclude must be prefixed with ^; list is either inclusive or exclusive, no mixture is permitted;
-i [addr]
select inet files with addresses matching addr;
-i4, -i6 specifies IP version, while -i
selects both; also you can specify hostname, protocol, port, service, etc
(for example, TCP:25, UDP:dns);
-l |
inhibit conversion of UIDs to login names; |
-L / +L [n]
disable / enable listing of file link counts; if n is specified, only files with link counts less than n will be listed (by default - all);
+M / -M
enable / disable the reporting of portmapper registration for local TCP and UDP ports;
-N |
list NFS files; |
-n |
inhibit conversion of network numbers to host names for network files (program may run faster); |
-o |
display file offset at all times, not file size; |
-o n |
set the number of decimal digits (default is 8) to be printed after 0t for a file offset before the form is switched to 0x...; n = 0 directs to use 0t for all offset output; |
-P |
inhibit conversion of port numbers to port names for network files (program may run a little bit faster); |
-p list
select files for processes specified as a comma-separated list of PIDs;
+r / -r [t]
list files in repeat mode with interval 15 sec or t
sec, if specified; -r runs until terminated; +r
terminates at the first cycle when there are no files to list;
-S t |
set optional time-out for kernel functions lstat, readlink, stat, that might otherwise deadlock (default is 15 sec, min is 2 sec); |
-s |
display file size at all times, not file offset; |
-t |
produce terse output with PIDs only and no header,
so that it can be piped to kill;
this option selects -w; |
-u list
select files for users whose login names or UIDs are supplied in a comma-separated list;
-U |
select the listing of Unix domain socket files; |
-V |
verbose search; |
+w / -w
enable / disable suppression of warning messages;
Output
COMMAND
the first 9 chars of cmd associated with the process
(+c w can change col width);
PID
process ID;
PPID
parent process ID (only displayed if -R specified);
PGID
process group ID (only displayed if -g specified);
USER
UID or login name of the process owner;
| FD | file descriptor (number) of the file or:
FD is followed by mode under which the file is open:
Lock characters:
|
TYPE
type of node associated with file:
|
DEVICE
device numbers;
SIZE/OFF
the size of the file or the file offset in bytes;
NODE
node number of the local file, inode number of an NFS file, Internet protocol type, etc;
NAME
name of the file, mount point, block/char special file, etc;
shows info about all PCI buses in the system and all devices connected to them).
lspci -v
display detailed info about all PCI devices;
lspci [options]
Options
--version
-v, -vv
verbose, more verbose;
-b |
show PCI addresses and IRQ’s as seen by the cards on the PCI bus instead of those seen by CPU (bus-centric view); |
-d [vendor]:[device]
show only selected devices specified by vendor and device ID's (hex);
-i file
use the specified file as PCI ID database instead of default;
-M |
enable "bus mapping" mode which performs a thorough scan of all PCI devices, including those behind misconfigured bridges, etc (risky; only root can use it); |
-m |
dump PCI device data in machine readable form; |
-n |
show numeric ID’s of the PCI vendors and devices; |
-p dir
use the specified dir as containing PCI bus info instead of default /proc/bus/pci;
-s [[[[domain]:]bus]:][slot][.[func]]
display only devices in the specified domain (0..ffff), bus (0..ff), slot (0..1f), function (0..7); each component can be omitted or set to * (meaning "any value");
-t |
show a tree-like diagram of buses, bridges, devices; |
-x |
show hex dump of first 64 bytes of the PCI configuration space (the standard header); useful for debugging; |
-xxx
show hex dump of the whole PCI configuration space (risky; only root can use it);
PCILIB options
-F file
read config data from the specified file;
-G |
increase debug level of the library (PCILIB); |
-H1 |
use direct hardware access via Intel config mechanism 1 (i386-compatible only); |
-H2
|
-P dir
force use of Linux /proc/bus/pci style config access, while using specified dir instead of /proc/bus/pci;
Files
/proc/bus/pci
PCI bus info;
the default PCI IDs database;
shows info about all USB buses in the system and all devices connected to them.
lsusb -v
show info about all USB devices;
lsusb [options]
Options
-V --version
-v --verbose
-D dev
do not scan the /proc/bus/usb dir, display only info about the specified device; dev (device file) must be something like /proc/bus/usb/001/001;
-d vendor[:product]
display only devices with the specified vendor and product IDs (must be in hex);
-p path
use the specified path instead of /proc/bus/usb;
-s [[bus]][:devnum]
display only devices on the specified bus and / or device number (args must be in hex);
-t |
dump the physical USB device hierarchy as a tree; |
Some options are available for root only (-v, -D).
Files
/proc/bus/usb
USB bus info;
a list of all known USB IDs;