=====================================================================================================
strace调试进程
查看进程在做那些底层调用
[root@limt01 ~]# ps -ef|grep less
root 10932 10822 0 19:28 pts/2 00:00:00 less install.log
root 10935 10782 0 19:28 pts/1 00:00:00 grep less
[root@limt01 ~]# strace -p 10932
Process 10932 attached - interrupt to quit
read(3,
上面表示进程在做read函数调用
某个进程启动失败
查看ls命令依赖的库
[root@limt01 ~]# ldd /bin/ls
linux-vdso.so.1 => (0x00007fff4e7ff000)
libselinux.so.1 => /lib64/libselinux.so.1 (0x0000003a49200000)
librt.so.1 => /lib64/librt.so.1 (0x0000003a48e00000)
libcap.so.2 => /lib64/libcap.so.2 (0x0000003a4b200000)
libacl.so.1 => /lib64/libacl.so.1 (0x0000003a56e00000)
libc.so.6 => /lib64/libc.so.6 (0x0000003a47e00000)
libdl.so.2 => /lib64/libdl.so.2 (0x0000003a48200000)
/lib64/ld-linux-x86-64.so.2 (0x0000003a47600000)
libpthread.so.0 => /lib64/libpthread.so.0 (0x0000003a48600000)
libattr.so.1 => /lib64/libattr.so.1 (0x0000003a55a00000)
[root@limt01 ~]# mv /lib64/libattr.so.1 /lib64/libattr.so.1.bak
[root@limt01 ~]# ls
ls: error while loading shared libraries: libattr.so.1: cannot open shared object file: No such file or directory
[root@limt01 ~]# strace ls
execve("/bin/ls", ["ls"], [/* 35 vars */]) = 0
brk(0) = 0x19c9000
mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fa4e641a000
access("/etc/ld.so.preload", R_OK) = -1 ENOENT (No such file or directory)
open("/etc/ld.so.cache", O_RDONLY) = 3
fstat(3, {st_mode=S_IFREG|0644, st_size=166426, ...}) = 0
.....
.....
.....
stat("/lib64", {st_mode=S_IFDIR|0555, st_size=12288, ...}) = 0
open("/usr/lib64/tls/x86_64/libattr.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
stat("/usr/lib64/tls/x86_64", 0x7fff5fa94ff0) = -1 ENOENT (No such file or directory)
open("/usr/lib64/tls/libattr.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
stat("/usr/lib64/tls", {st_mode=S_IFDIR|0555, st_size=4096, ...}) = 0
open("/usr/lib64/x86_64/libattr.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
stat("/usr/lib64/x86_64", 0x7fff5fa94ff0) = -1 ENOENT (No such file or directory)
open("/usr/lib64/libattr.so.1", O_RDONLY) = -1 ENOENT (No such file or directory)
stat("/usr/lib64", {st_mode=S_IFDIR|0555, st_size=139264, ...}) = 0
writev(2, [{"ls", 2}, {": ", 2}, {"error while loading shared libra"..., 36}, {": ", 2}, {"libattr.so.1", 12}, {": ", 2}, {"cannot open shared object file", 30}, {": ", 2}, {"No such file or directory", 25}, {"\n", 1}], 10ls: error while loading shared libraries:
libattr.so.1: cannot open shared object file: No such file or directory
) = 114
exit_group(127) = ?
显示无法找到库文件/usr/lib64/libattr.so.1
=====================================================================================================
ldd 查看程序依赖那些库
[root@limt01 lib]# ldd /bin/ls
linux-vdso.so.1 => (0x00007fffe358b000)
libselinux.so.1 => /lib64/libselinux.so.1 (0x0000003a49200000)
librt.so.1 => /lib64/librt.so.1 (0x0000003a48e00000)
libcap.so.2 => /lib64/libcap.so.2 (0x0000003a4b200000)
libacl.so.1 => /lib64/libacl.so.1 (0x0000003a56e00000)
libc.so.6 => /lib64/libc.so.6 (0x0000003a47e00000)
libdl.so.2 => /lib64/libdl.so.2 (0x0000003a48200000)
/lib64/ld-linux-x86-64.so.2 (0x0000003a47600000)
libpthread.so.0 => /lib64/libpthread.so.0 (0x0000003a48600000)
libattr.so.1 => /lib64/libattr.so.1 (0x0000003a55a00000)
=====================================================================================================
查看进程树
[root@limt01 lib]# pstree 1
init─┬─NetworkManager─┬─dhclient
│ └─{NetworkManager}
├─abrtd
├─acpid
├─atd
├─auditd─┬─audispd─┬─sedispatch
│ │ └─{audispd}
│ └─{auditd}
├─automount───4*[{automount}]
├─bonobo-activati───{bonobo-activat}
├─certmonger
├─console-kit-dae───63*[{console-kit-da}]
├─crond
├─cupsd
├─2*[dbus-daemon───{dbus-daemon}]
├─dbus-launch
├─devkit-power-da
├─fcoemon
├─gconfd-2
=====================================================================================================
top 监控进程
[root@limt01 lib]# top
top - 09:29:16 up 11 min, 1 user, load average: 0.00, 0.03, 0.04
Tasks: 193 total, 1 running, 192 sleeping, 0 stopped, 0 zombie
Cpu(s): 0.4%us, 0.8%sy, 0.0%ni, 97.5%id, 1.2%wa, 0.0%hi, 0.0%si, 0.0%st
Mem: 2054116k total, 358856k used, 1695260k free, 40200k buffers
Swap: 4128760k total, 0k used, 4128760k free, 122544k cached
PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND
1 root 20 0 19364 1504 1188 S 0.0 0.1 0:02.08 init
2 root 20 0 0 0 0 S 0.0 0.0 0:00.02 kthreadd
3 root RT 0 0 0 0 S 0.0 0.0 0:00.12 migration/0
4 root 20 0 0 0 0 S 0.0 0.0 0:00.00 ksoftirqd/0
5 root RT 0 0 0 0 S 0.0 0.0 0:00.00 migration/0
6 root RT 0 0 0 0 S 0.0 0.0 0:00.00 watchdog/0
7 root RT 0 0 0 0 S 0.0 0.0 0:00.06 migration/1
=====================================================================================================
查看进程函数调用栈
[root@limt01 lib]# ps -ef|grep less
root 2960 2932 0 09:30 pts/1 00:00:00 less install.log
root 2965 2835 0 09:31 pts/0 00:00:00 grep less
[root@limt01 lib]# pstack 2960
#0 0x0000003a47edb730 in __read_nocancel () from /lib64/libc.so.6
#1 0x0000000000411b26 in ?? ()
#2 0x0000000000415785 in ?? ()
#3 0x0000000000408815 in ?? ()
#4 0x000000000040203e in ?? ()
#5 0x0000003a47e1ed1d in __libc_start_main () from /lib64/libc.so.6
#6 0x0000000000401a49 in ?? ()
#7 0x00007fff4d9b7658 in ?? ()
#8 0x000000000000001c in ?? ()
#9 0x0000000000000002 in ?? ()
#10 0x00007fff4d9b9753 in ?? ()
#11 0x00007fff4d9b9758 in ?? ()
#12 0x0000000000000000 in ?? ()
=====================================================================================================
nm 命令显示关于指定 File 中符号的信息，文件可以是对象文件、可执行文件或对象文件库。
[root@limt01 lib64]# nm -C /lib64/libdl-2.12.so
0000000000000000 A GLIBC_2.2.5
0000000000000000 A GLIBC_2.3.3
0000000000000000 A GLIBC_2.3.4
0000000000000000 A GLIBC_PRIVATE
0000003a48402da0 a _DYNAMIC
0000003a48402fe8 a _GLOBAL_OFFSET_TABLE_
w _Jv_RegisterClasses
0000003a48402d70 d __CTOR_END__
0000003a48402d68 d __CTOR_LIST__
0000003a48402d88 d __DTOR_END__
0000003a48402d78 d __DTOR_LIST__
0000003a48201e40 r __FRAME_END__
0000003a484030a0 b __GI__dlfcn_hook
0000003a48402d90 d __JCR_END__
0000003a48402d90 d __JCR_LIST__
=====================================================================================================
ps 显示进程相关信息
[root@limt01 lib64]# ps -efl|less
F S UID PID PPID C PRI NI ADDR SZ WCHAN STIME TTY TIME CMD
4 S root 1 0 0 80 0 - 4841 poll_s 09:17 ? 00:00:02 /sbin/init
1 S root 2 0 0 80 0 - 0 kthrea 09:17 ? 00:00:00 [kthreadd]
1 S root 3 2 0 -40 - - 0 migrat 09:17 ? 00:00:00 [migration/0]
1 S root 4 2 0 80 0 - 0 ksofti 09:17 ? 00:00:00 [ksoftirqd/0]
1 S root 5 2 0 -40 - - 0 cpu_st 09:17 ? 00:00:00 [migration/0]
5 S root 6 2 0 -40 - - 0 watchd 09:17 ? 00:00:00 [watchdog/0]
1 S root 7 2 0 -40 - - 0 migrat 09:17 ? 00:00:00 [migration/1]
1 S root 8 2 0 -40 - - 0 cpu_st 09:17 ? 00:00:00 [migration/1]
1 S root 9 2 0 80 0 - 0 ksofti 09:17 ? 00:00:00 [ksoftirqd/1]
5 S root 10 2 0 -40 - - 0 watchd 09:17 ? 00:00:00 [watchdog/1]
1 S root 11 2 0 -40 - - 0 migrat 09:17 ? 00:00:00 [migration/2]
1 S root 12 2 0 -40 - - 0 cpu_st 09:17 ? 00:00:00 [migration/2]
1 S root 13 2 0 80 0 - 0 ksofti 09:17 ? 00:00:00 [ksoftirqd/2]
5 S root 14 2 0 -40 - - 0 watchd 09:17 ? 00:00:00 [watchdog/2]
1 S root 15 2 0 -40 - - 0 migrat 09:17 ? 00:00:00 [migration/3]
1 S root 16 2 0 -40 - - 0 cpu_st 09:17 ? 00:00:00 [migration/3]
1 S root 17 2 0 80 0 - 0 ksofti 09:17 ? 00:00:00 [ksoftirqd/3]
5 S root 18 2 0 -40 - - 0 watchd 09:17 ? 00:00:00 [watchdog/3]
1 S root 19 2 0 80 0 - 0 worker 09:17 ? 00:00:00 [events/0]
1 S root 20 2 0 80 0 - 0 worker 09:17 ? 00:00:00 [events/1]
1 S root 21 2 0 80 0 - 0 worker 09:17 ? 00:00:00 [events/2]
1 S root 22 2 0 80 0 - 0 worker 09:17 ? 00:00:00 [events/3]
1 S root 23 2 0 80 0 - 0 worker 09:17 ? 00:00:00 [cgroup]
[root@limt01 lib64]# ps aux|less
USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND
root 1 0.1 0.0 19364 1504 ? Ss 09:17 0:02 /sbin/init
root 2 0.0 0.0 0 0 ? S 09:17 0:00 [kthreadd]
root 3 0.0 0.0 0 0 ? S 09:17 0:00 [migration/0]
root 4 0.0 0.0 0 0 ? S 09:17 0:00 [ksoftirqd/0]
root 5 0.0 0.0 0 0 ? S 09:17 0:00 [migration/0]
root 6 0.0 0.0 0 0 ? S 09:17 0:00 [watchdog/0]
root 7 0.0 0.0 0 0 ? S 09:17 0:00 [migration/1]
root 8 0.0 0.0 0 0 ? S 09:17 0:00 [migration/1]
root 9 0.0 0.0 0 0 ? S 09:17 0:00 [ksoftirqd/1]
root 10 0.0 0.0 0 0 ? S 09:17 0:00 [watchdog/1]
root 11 0.0 0.0 0 0 ? S 09:17 0:00 [migration/2]
root 12 0.0 0.0 0 0 ? S 09:17 0:00 [migration/2]
root 13 0.0 0.0 0 0 ? S 09:17 0:00 [ksoftirqd/2]
root 14 0.0 0.0 0 0 ? S 09:17 0:00 [watchdog/2]
root 15 0.0 0.0 0 0 ? S 09:17 0:00 [migration/3]
root 16 0.0 0.0 0 0 ? S 09:17 0:00 [migration/3]
root 17 0.0 0.0 0 0 ? S 09:17 0:00 [ksoftirqd/3]
root 18 0.0 0.0 0 0 ? S 09:17 0:00 [watchdog/3]
root 19 0.0 0.0 0 0 ? S 09:17 0:00 [events/0]
root 20 0.0 0.0 0 0 ? S 09:17 0:00 [events/1]
root 21 0.0 0.0 0 0 ? S 09:17 0:00 [events/2]
root 22 0.0 0.0 0 0 ? S 09:17 0:00 [events/3]
root 23 0.0 0.0 0 0 ? S 09:17 0:00 [cgroup]
root 24 0.0 0.0 0 0 ? S 09:17 0:00 [khelper]
=====================================================================================================
proc 显示进程相关信息
[root@limt01 lib64]# ps -ef|grep less
root 3062 2932 0 09:42 pts/1 00:00:00 less install.log
root 3065 2835 0 09:42 pts/0 00:00:00 grep less
[root@limt01 lib64]# cd /proc/3062
[root@limt01 3062]# ls
attr clear_refs cpuset fd loginuid mounts numa_maps pagemap schedstat stat task
autogroup cmdline cwd fdinfo maps mountstats oom_adj personality sessionid statm wchan
auxv comm environ io mem net oom_score root smaps status
cgroup coredump_filter exe limits mountinfo ns oom_score_adj sched stack syscall
[root@limt01 3062]# more cmdline
less
=====================================================================================================
显示文件被那个进程占用
[root@limt01 ~]# fuser -v /root
用户 进程号 权限 命令
/root: root 2835 ..c.. bash
root 2932 ..c.. bash
[root@limt01 ~]# fuser -v /root/install.log
用户 进程号 权限 命令
/root/install.log: root 3216 f.... less
[root@limt01 ~]# lsof /root/install.log
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
less 3216 root 4r REG 253,0 89373 1441794 /root/install.log
[root@limt01 ~]# lsof|grep delete
less 3216 root 4r REG 253,0 89373 1441794 /root/install.log (deleted)
上面表示此文件已经被别的进程删除
kill掉打开此文件的进程
[root@limt01 ~]# fuser -k -v /root/install.log1
用户 进程号 权限 命令
/root/install.log1: root 3268 f.... less
显示端口被那个进程占用
[root@limt01 ~]# fuser -v -n tcp 22
用户 进程号 权限 命令
22/tcp: root 2488 F.... sshd
root 2831 f.... sshd
[root@limt01 ~]# netstat -tnp|grep 22
tcp 0 52 192.168.1.104:22 192.168.1.101:51775 ESTABLISHED 2831/sshd