Skip to content

Linux diagnostic

dmesg ★☆☆

dmesg is a command on most Unix-like operating systems that prints the message buffer of the kernel. The output of this command typically contains the messages produced by the device drivers.

dmesg - man page on man7.org dmesg - man page on ubuntu.com

Syntax: dmesg [-c] [-n level] [-s bufsize] See also: syslog

dmesg typical usage

dmesg -Tw
  • -T: show human readable timestamp
  • -w: wait for new messages
dmesg -el 0,1,2,3
  • -e: show local time and time delta in readable format
  • -l : restrict output to defined levels

journalctl ★☆☆

journalctl may be used to query the contents of the systemd journal as written by systemd-journald.service.

journalctl - man page on freedesktop.org journalctl - man page on ubuntu.com

journalctl -r # or journalctl --reverse
  • More verbose: -x or --catalog - Add message explanations where available
  • Show end of journal: -e or --pager-end - Immediately jump to the end in the pager
journalctl -xe

inxi ★★★

inxi is a command line system information script built for for console and IRC. It is also used for forum technical support, as a debugging tool, to quickly ascertain user system configuration and hardware. inxi shows system hardware, CPU, drivers, Xorg, Desktop, Kernel, GCC version(s), Processes, RAM usage, and a wide variety of other useful information.

inxi - man page on ubuntu.com

Install inxi

This command is not present on all systems, if not install using:

sudo apt install inxi

Before start using it, run the command that follows to check all application dependencies plus recommends, and various directories, and display what package(s) we need to install to add support for a given feature.

inxi --recommends

inxi typical usage

inxi -Fx

fuser ★☆☆

Show which processes use the named files, directories, sockets, or filesystems.

fuser - man page on ubuntu.com

sudo fuser -v FILENAME

An alternative is to use ̀lsof

lsof ★★☆

lsof is a tool that all open files belonging to all active processes.

lsof - man page on ubuntu.com

Show which processes use the named files, directories, sockets, or filesystems.

sudo lsof | grep FILENAME

How-to list files opened by processes belonging to specific user

sudo lsof -u [user-name]

How-to list files based on their Internet address

The tool lets you to list files based on their Internet address. This can be done using the -i command line option. For example, if you want, you can have IPv4 and IPv6 files displayed separately. For IPv4, run the following command:

sudo lsof -i 4 # 4 stand for IPv4, use 6 for IPv6

Same result, but without resolving port and ip.

sudo lsof -i 4 -n

Which Process use a Port

Find Out Which Process Listening on a Particular Port

netstat ★★★

  • Installation
sudo apt install -y net-tools

sudo netstat -ltnp | grep ':80 '
  • -l: tells netstat to only show listening sockets.
  • -t: tells it to display tcp connections.
  • -n: instructs it show numerical addresses.
  • -p: enables showing of the process ID and the process name.

  • grep -w: shows matching of exact string (:80).

  • Result

tcp        0      0 0.0.0.0:80              0.0.0.0:*               LISTEN      32118/nginx: master

lsof ★★☆

  • Installation
sudo apt install -y lsof
  • Usage
sudo lsof -i :80
  • Result
COMMAND   PID     USER   FD   TYPE  DEVICE SIZE/OFF NODE NAME
python   7027  netdata    4u  IPv4 1181102      0t0  TCP localhost:43726->localhost:http (ESTABLISHED)
nginx   32118     root   10u  IPv4  545443      0t0  TCP *:http (LISTEN)
nginx   32119 www-data    5u  IPv4 1181103      0t0  TCP localhost:http->localhost:43726 (ESTABLISHED)
nginx   32119 www-data   10u  IPv4  545443      0t0  TCP *:http (LISTEN)
nginx   32120 www-data   10u  IPv4  545443      0t0  TCP *:http (LISTEN)
nginx   32121 www-data   10u  IPv4  545443      0t0  TCP *:http (LISTEN)
nginx   32122 www-data   10u  IPv4  545443      0t0  TCP *:http (LISTEN)

fuser ★☆☆

  • Installation
sudo apt install -y psmisc # Most of the time already there
  • Usage
sudp fuser 80/tcp
  • Result
80/tcp:              32118 32119 32120 32121 32122

Some useful logs

boot.log

journalctl is not trivial, if you want to see what happening during boot process you can check /var/log/boot.log.

cat /var/log/boot.log

But /var/log/boot.log in certain circumstances does not exists (according to https://askubuntu.com/questions/763638/no-more-boot-logging-since-16-04 it is not an issue), in that situation you need to use journalctl.

syslog

General system log output

cat /var/log/syslog

history.log

apt command history log

cat /var/log/apt/history.log

Bad thinks

Display broken links in a subtree

find . -type l  ! -exec test -e {} \; -print

or to show link target

find . -type l  ! -exec test -e {} \; -ls

Display broken links existing on your system

sudo find / -type l \
  -not -path '/proc/*' \
  -not -path '/run/udev/*' \
  -not -path '/run/user/*' \
  -not -path '/usr/share/help/*' \
  -not -path '/var/lib/flatpak/*' \
  ! -exec test -e {} \; -print

References