- Check which processes are eating bandwidth - Nethogs
Nethogs is a terminal-based network traffic monitoring tool that shows the bandwidth each process is using, in a visual way.
Download: http://sourceforge.net/projects/nethogs/files/nethogs/0.8/nethogs-0.8.0.tar.gz/download
yum -y install libpcap-devel ncurses-devel
tar zxvf nethogs-0.8.0.tar.gz
cd nethogs
make && make install
nethogs eth0
- Hard disk read performance testing - IOZone
IOZone is a Linux filesystem performance testing tool that can test filesystem read and write performance across different operating systems.
Download: http://www.iozone.org/src/current/
tar xvf iozone3_420.tar
cd iozone3_420/src/current/
make linux
./iozone -a -n 512m -g 16g -i 0 -i 1 -i 5 -f /mnt/iozone -Rb ./iozone.xls
- a runs in fully automatic mode
- n sets the minimum file size for automatic mode (Kbytes).
- g sets the maximum file size available to automatic mode, in Kbytes.
- i specifies which test to run.
- f specifies the name of the test file, which is deleted automatically when the run finishes
- R produces the Excel output on standard output
- b writes the output to the specified file
- Real-time disk IO monitoring - IOTop
The IOTop command is dedicated to displaying hard disk IO, with an interface style similar to the top command.
yum -y install iotop
- Network traffic monitoring - IPtraf
IPtraf is a simple network status analysis tool that runs on Linux.
yum -y install iptraf
- Network traffic monitoring - IFTop
iftop is a real-time traffic monitoring tool similar to top on linux. It is a bit more intuitive than iptraf.
Download: http://www.ex-parrot.com/~pdw/iftop/
tar zxvf iftop-0.17.tar.gz
cd iftop-0.17
./configure
make && make install
iftop
iftop -i eth0
Specify the network interface to monitor
- TX: traffic sent
- RX: traffic received
- TOTAL: total traffic
- Cumm: total traffic since iftop started running
- peak: peak traffic
- rates: the average traffic over the last 2s, 10s and 40s respectively
- Real-time process monitoring - HTop
HTop is an interactive process browser for Linux that can be used in place of the top command.
rpm -ivh http://pkgs.repoforge.org/rpmforge-release/rpmforge-release-0.5.2-2.el6.rf.x86_64.rpm (installs a third-party YUM repository)
yum -y install htop
- System resource monitoring - NMON
NMON is a monitoring and analysis tool widely used on AIX and various Linux operating systems
Download: http://sourceforge.jp/projects/sfnet_nmon/releases/
chmod +x nmon_x86_64_rhel6
mv nmon_x86_64_rhel6 /usr/sbin/nmon
nmon
- Monitoring several logs at once - MultiTail
MultiTail opens multiple windows in the console so you can monitor several log files at the same time, much like the tail command.
rpm -ivh http://pkgs.repoforge.org/rpmforge-release/rpmforge-release-0.5.2-2.el6.rf.x86_64.rpm (installs a third-party YUM repository)
yum -y install multitail
multitail -e "fail" /var/log/secure # filter by keyword to monitor
multitail -l "ping baidu.com" # monitor the command that follows; -l is the command to run
multitail -i /var/log/messages -i /var/log/secure # -i specifies a filename
- SSH brute-force protection - Fail2ban
Fail2ban can watch your system logs, match error messages against regular expressions, and carry out the corresponding blocking action — usually blocking at the firewall
Download: http://www.fail2ban.org/wiki/index.php/Downloads
cd fail2ban-0.8.11
python setup.py install
cd files/
cp ./redhat-initd /etc/init.d/fail2ban
service fail2ban start
chkconfig --add fail2ban
chkconfig fail2ban on
Note: you need a working iptables setup; if you restart iptables you must restart fail2ban as well, because fail2ban works by calling iptables to block outside attacks in real time.
grep -v "^#" /etc/fail2ban/jail.conf | grep -v "^$" [DEFAULT]
ignoreip = 127.0.0.1/8# ignore the local machine's IP
bantime = 600 # how long to block after a rule matches
findtime = 600 # the window in which matches trigger a block, e.g. 3 hits within 600 seconds
maxretry = 3 # maximum number of attempts
backend = auto # log change detection: gamin, polling or auto
usedns = warn [ssh-iptables]
enabled = true# disabled by default
false filter = sshd action = iptables[name=SSH, port=ssh, protocol=tcp] # sendmail-whois[name=SSH,dest=recipient email, sender=sender email, sendername="Fail2Ban"] logpath = /var/log/sshd.log # the corresponding error log is usually at /var/log/secure maxretry = 5 # the number of failed attempts, overriding the global maxretry
Note: all application protections are disabled by default and have to be enabled by hand. The fail2ban.conf file holds logging information, and the jail.conf file holds the configuration for the specific services and actions being protected.
touch /var/log/sshd.log
service fail2ban restart
fail2ban-client status # check that monitoring is enabled Status |- Number of jail: 1 `- Jail list: ssh-iptables
iptables -L # the iptables filter table has one fail2ban rule fail2ban-SSH tcp -- anywhere anywhere tcp dpt:ssh
- Persistent terminal sessions - Tmux
Tmux is an excellent terminal multiplexer similar to GNU Screen, but more convenient, flexible and efficient than Screen. It makes sure that a dropped SSH connection doesn’t affect your running tasks.
rpm -ivh http://pkgs.repoforge.org/rpmforge-release/rpmforge-release-0.5.2-2.el6.rf.x86_64.rpm (installs a third-party YUM repository)
- Showing disk space usage in a web page - Agedu
Download: http://www.chiark.greenend.org.uk/~sgtatham/agedu/
tar zxvf agedu-r9723.tar.gz
cd agedu-r9723
./configure
make && make install
agedu -s / # -s scans
agedu -w --address 192.168.0.10:80 # -w takes a web address
agedu -w --address 192.168.0.108080 --auth none # --auth turns authentication off; without a port number a random one is generated for you to open in a browser
- Security scanning tool - NMap
NMap is a network connection scanning and sniffing toolkit for Linux, used to scan the open network ports of machines on the network.
Download: http://nmap.org/download.html
tar jxvf nmap-6.40.tar.bz2
./configure
make && make install
nmap 192.168.0.10 # get basic information
nmap -O 192.168.0.10 # get OS version information
nmap -A 192.168.0.10 # get comprehensive system information
nmap 192.168.0.0/24 # get basic information about the devices working on a subnet
-sS TCP scan
-sV system version detection
- Web stress testing - Httperf
Httperf is more powerful than ab: it can measure the maximum load a web service can carry and uncover potential problems such as memory usage and stability. Its biggest advantage: you can specify a pattern for the stress test to simulate a real environment.
Download: http://code.google.com/p/httperf/downloads/list
tar zxvf httperf-0.9.0.tar.gz
cd httperf-0.9.0
./configure
make && make install
httperf --hog --server=192.168.0.202 --uri=/index.html --num-conns=10000 --wsess=10,10,0.1
Parameter reference:
—hog: makes httperf create as many connections as possible; httperf generates access connections regularly according to the hardware configuration;
—num-conns: the number of connections, 10000 requests are issued in total;
—wsess: simulates the pattern of users opening web pages; the first 10 means 10 session connections are created, the second 10 means each session connection makes 10 requests, and 0.1 is the interval between requests within a session, in seconds.
Reposted from: https://mp.weixin.qq.com/s/g7BksCQuTbwUorspGR7mcQ
