HostOnNet Blog

Linux Server Monitoring Commands

To check the recent mail logs use

tail -f /var/log/exim_mainlog

Check for spamming if anybody is using php script for sending mail through home

tail -f /var/log/exim_mainlog | grep home

If anyone is spamming from /tmp

tail -f /var/log/exim_mainlog | grep /tmp

If mysql is causing load so you can check it using following commands.

root@serverxx [~]# mysqladmin -u root processlist
+----------+--------------+-----------+--------------+---------+------+----------------+------------------------------------------------------------------------------------------------------+
| Id       | User         | Host      | db           | Command | Time | State          | Info                                                                                                 |
+----------+--------------+-----------+--------------+---------+------+----------------+------------------------------------------------------------------------------------------------------+
| 12821547 | leechprotect | localhost | leechprotect | Sleep   | 616  |                |                                                                                                      |
| 12826137 | atmbizha_wp  | localhost | atmbizha_wp  | Sleep   | 29   |                |                                                                                                      |
| 12826322 | graamam_mal  | localhost | graamam_mal  | Sleep   | 1    |                |                                                                                                      |
| 12826362 | graamam_mal  | localhost | graamam_mal  | Query   | 6    | Sending data   | SELECT * FROM jos_phocaguestbook_items WHERE catid = 11 AND published = 1 ORDER BY ordering DESC     |
| 12826369 | graamam_mal  | localhost | graamam_mal  | Query   | 5    | Sorting result | SELECT * FROM jos_phocaguestbook_items WHERE catid = 7 AND published = 1 ORDER BY ordering DESC      |
| 12826371 | graamam_mal  | localhost | graamam_mal  | Query   | 5    | Sorting result | SELECT * FROM jos_phocaguestbook_items WHERE catid = 11 AND published = 1 ORDER BY ordering DESC     |
| 12826438 | graamam_mal  | localhost | graamam_mal  | Query   | 3    | Sorting result | SELECT * FROM jos_phocaguestbook_items WHERE catid = 16 AND published = 1 ORDER BY ordering DESC LIM |
| 12826461 | graamam_mal  | localhost | graamam_mal  | Query   | 1    | Sorting result | SELECT * FROM jos_phocaguestbook_items WHERE catid = 15 AND published = 1 ORDER BY ordering DESC LIM |
| 12826471 | root         | localhost |              | Query   | 0    |                | show processlist                                                                                     |
+----------+--------------+-----------+--------------+---------+------+----------------+------------------------------------------------------------------------------------------------------+

mysqladmin version

root@serverxx [~]# mysqladmin version
mysqladmin  Ver 8.42 Distrib 5.5.37, for Linux on x86_64
Copyright (c) 2000, 2014, Oracle and/or its affiliates. All rights reserved.

Oracle is a registered trademark of Oracle Corporation and/or its
affiliates. Other names may be trademarks of their respective
owners.

Server version		5.5.37-cll
Protocol version	10
Connection		Localhost via UNIX socket
UNIX socket		/var/lib/mysql/mysql.sock
Uptime:			21 days 3 hours 58 min 9 sec

Threads: 11  Questions: 319764693  Slow queries: 20120  Opens: 7106938  Flush tables: 1  Open tables: 400  Queries per second avg: 174.860
root@serverxx [~]# 

You can check if any backup is going on, run the following commands

ps aux | grep pkg
ps aux | grep gzip
ps aux | grep backup

We can trace the user responsible for high web server resource usage by the folowing command

cat /etc/httpd/logs/access_log | grep mp3
cat  /etc/httpd/logs/access_log | grep rar
cat  /etc/httpd/logs/access_log | grep wav etc

You can be used to check for DDOS attacks on the server.

cat /etc/httpd/logs/access_log | grep 408 

About Annie

I've been working in Technical Section for over 10 years in a wide range of tech jobs from Tech Support to Software Testing. I started writing blog for my future reference and useful for all.