Linux commands reference: ps, top, kill, df, mount, systemctl, useradd-Elastic Compute Service(ECS)-阿里云帮助中心

Process management

ps

Command

The ps command displays a snapshot of current processes.

Common options

Option	Description
-A	Displays all processes.
-a	Displays all processes on the controlling terminal.
-e	Displays all processes. Equivalent to -A.
-f	Displays a full-format listing, including UID, PPID, C, and STIME columns.
-u	Displays processes by effective user.
-U	Displays processes by real user.
-x	Displays all processes without controlling terminals.

Note

For other options, run man ps.

Examples

Query all processes.
```
ps -ef
```
Query all processes matching a keyword in full format.
```
ps -ef | grep <key_word>
```
Replace <key_word> with an actual keyword.
Query all user processes matching a keyword, including those without controlling terminals.
```
ps -aux | grep <key_word>
```
Replace <key_word> with an actual keyword.
Query a process tree.
```
ps -ejH
```
Query all processes with thread information.
```
ps -eLf
```

Query thread information with user-defined fields.

ps -eo pid,tid,class,rtprio,ni,pri,psr,pcpu,stat,wchan:14,comm

Query a specific metric by PID. In this example, PID 1 with comm= returns the command name.
```
ps -q 1 -o comm=
```

top

Command

The top command displays real-time process activity and system resource usage.

Common options

Option	Description
-d	Specifies the refresh frequency.
-p	Monitors the status of a process by PID.
-s	Runs top in secure mode, disabling potentially dangerous interactive commands.
-i	Ignores idle and zombie processes.
-c	Displays the command line instead of only the command name.

Fields in a top command output

Fields in a top command output (values vary by sampling period):

top - 15:30:29 up  2:11,  1 user,  load average: 0.00, 0.00, 0.00
Tasks:  99 total,   1 running,  98 sleeping,   0 stopped,   0 zombie
%Cpu(s):  0.3 us,  0.2 sy,  0.0 ni, 99.2 id,  0.0 wa,  0.3 hi,  0.0 si,  0.0 st
MiB Mem :   7607.4 total,   6642.1 free,    409.4 used,    801.4 buff/cache
MiB Swap:      0.0 total,      0.0 free,      0.0 used.   7198.0 avail Mem

  PID USER      PR  NI    VIRT    RES    SHR S  %CPU  %MEM     TIME+ COMMAND
  633 root      20   0  474964  29076  13644 S   0.3   0.4   0:09.58 tuned
 1716 root      20   0  131676  23172  16576 S   0.3   0.3   0:28.48 AliYunDunMonito
 1938 root      20   0 1460104  29564  22520 S   0.3   0.4   0:27.93 argusagent
 5525 root      20   0       0      0      0 I   0.3   0.0   0:00.01 kworker/u4:1-events_unbound
    1 root      20   0  103344  11320   8656 S   0.0   0.1   0:01.31 systemd
    2 root      20   0       0      0      0 S   0.0   0.0   0:00.00 kthreadd
    3 root       0 -20       0      0      0 I   0.0   0.0   0:00.00 rcu_gp
    4 root       0 -20       0      0      0 I   0.0   0.0   0:00.00 rcu_par_gp
    5 root      20   0       0      0      0 I   0.0   0.0   0:00.01 kworker/0:0-events
    6 root       0 -20       0      0      0 I   0.0   0.0   0:00.00 kworker/0:0H-events_highpri
    8 root       0 -20       0      0      0 I   0.0   0.0   0:00.00 mm_percpu_wq
   10 root      20   0       0      0      0 S   0.0   0.0   0:00.00 rcu_tasks_rude_
   11 root      20   0       0      0      0 S   0.0   0.0   0:00.00 rcu_tasks_trace
   12 root      20   0       0      0      0 S   0.0   0.0   0:00.00 ksoftirqd/0
   13 root      20   0       0      0      0 I   0.0   0.0   0:00.47 rcu_sched
   14 root      rt   0       0      0      0 S   0.0   0.0   0:00.00 migration/0
   15 root      20   0       0      0      0 S   0.0   0.0   0:00.00 cpuhp/0
   16 root      20   0       0      0      0 S   0.0   0.0   0:00.00 cpuhp/1
   17 root      rt   0       0      0      0 S   0.0   0.0   0:00.07 migration/1
   18 root      20   0       0      0      0 S   0.0   0.0   0:00.01 ksoftirqd/1
   19 root      20   0       0      0      0 I   0.0   0.0   0:00.43 kworker/1:0-events
   20 root       0 -20       0      0      0 I   0.0   0.0   0:00.00 kworker/1:0H-events_highpri
   22 root      20   0       0      0      0 S   0.0   0.0   0:00.00 kdevtmpfs
   23 root       0 -20       0      0      0 I   0.0   0.0   0:00.00 netns
   24 root      20   0       0      0      0 S   0.0   0.0   0:00.00 kauditd
   27 root      20   0       0      0      0 S   0.0   0.0   0:00.00 khungtaskd
   28 root      20   0       0      0      0 S   0.0   0.0   0:00.00 oom_reaper
   29 root       0 -20       0      0      0 I   0.0   0.0   0:00.00 writeback
   30 root      20   0       0      0      0 S   0.0   0.0   0:00.03 kcompactd0
   31 root      25   5       0      0      0 S   0.0   0.0   0:00.00 ksmd
   32 root      39  19       0      0      0 S   0.0   0.0   0:00.06 khugepaged
   33 root       0 -20       0      0      0 I   0.0   0.0   0:00.00 memcg_wmark
   34 root       0 -20       0      0      0 I   0.0   0.0   0:00.00 memcg_pgcache_l
   48 root       0 -20       0      0      0 I   0.0   0.0   0:00.00 cryptd
   83 root       0 -20       0      0      0 I   0.0   0.0   0:00.00 kintegrityd
   84 root       0 -20       0      0      0 I   0.0   0.0   0:00.00 kblockd
   85 root       0 -20       0      0      0 I   0.0   0.0   0:00.00 blkcg_punt_bio
   86 root       0 -20       0      0      0 I   0.0   0.0   0:00.00 tpm_dev_wq
   87 root       0 -20       0      0      0 I   0.0   0.0   0:00.00 md
   88 root       0 -20       0      0      0 I   0.0   0.0   0:00.00 edac-poller
   89 root       0 -20       0      0      0 I   0.0   0.0   0:00.00 devfreq_wq

Fields

Fields in the system information summary and process list

Fields in the system information summary

Field (row)	Description
top	General system information. The current time. up: the system uptime. user: the number of active users. load average: the average run queue length over the previous 1, 5, and 15 minutes.
Tasks	Process statistics by state. total: the total number of processes. running: the number of running processes. sleeping: the number of sleeping processes. stopped: the number of stopped processes. zombie: the number of zombie processes.
%Cpu(s)	CPU utilization breakdown. us: the percentage of CPU time spent running user processes. sy: the percentage of CPU time spent running kernel processes. ni: the percentage of CPU time spent running user processes prioritized by using the nice command. id: the percentage of time for which the CPU remains idle. wa: the percentage of CPU time spent waiting for I/O. hi: the percentage of CPU time spent servicing hardware interrupts. si: the percentage of CPU time spent servicing software interrupts. st: the steal time.
MiB Mem	Memory usage statistics. total: total physical memory. free: available memory. used: used memory. buff/cache: memory used for kernel cache and buffers.
MiB Swap	Swap usage statistics. total: total swap space. free: available swap space. used: used swap space. avail Mem: estimated available memory for starting new applications.

Fields in the process list

Field (column)	Description
PID	The PID.
USER	The username of the process owner.
PR	The scheduling priority of the process. A smaller value indicates a higher priority.
NI	The priority specified by the nice command for the process.
VIRT	The amount of virtual memory used by the process.
RES	The amount of physical memory used by the process.
SHR	The amount of shared memory used by the process.
S	Process status. R: running S: sleeping Z: zombie D: uninterruptible sleep T: traced or stopped
%CPU	CPU usage percentage of the process.
%MEM	Physical memory usage percentage of the process.
TIME+	Total CPU time used by the process.
COMMAND	Command that started the process.

Examples

Query system metrics with a specific sampling frequency

Query system metrics at a 3-second interval:
```
top 3
```
Note
The default sampling interval of top is 5 seconds.

Customize the top command interface

By default, the fields described in the Fields in the system information summary and process list section are displayed. Press f to select which columns to display and rearrange column order.

Fields Management for window 1:Def, whose current sort field is %CPU
   Navigate with Up/Dn, Right selects for move then <Enter> or Left commits,
   'd' or <Space> toggles display, 's' sets sort.  Use 'q' or <Esc> to end!

* PID     = Process Id             USED    = Res+Swap Size (KiB)
* USER    = Effective User Name    nsIPC   = IPC namespace Inode
* PR      = Priority               nsMNT   = MNT namespace Inode
* NI      = Nice Value             nsNET   = NET namespace Inode
* VIRT    = Virtual Image (KiB)    nsPID   = PID namespace Inode
* RES     = Resident Size (KiB)    nsUSER  = USER namespace Inode
* SHR     = Shared Memory (KiB)    nsUTS   = UTS namespace Inode
* S       = Process Status         LXC     = LXC container name
* %CPU    = CPU Usage              RSan    = RES Anonymous (KiB)
* %MEM    = Memory Usage (RES)     RSfd    = RES File-based (KiB)
* TIME+   = CPU Time, hundredths   RSlk    = RES Locked (KiB)
* COMMAND = Command Name/Line      RSsh    = RES Shared (KiB)
  PPID    = Parent Process pid     CGNAME  = Control Group name
  UID     = Effective User Id      NU      = Last Used NUMA node
  RUID    = Real User Id
  RUSER   = Real User Name
  SUID    = Saved User Id
  SUSER   = Saved User Name
  GID     = Group Id
  GROUP   = Group Name
  PGRP    = Process Group Id
  TTY     = Controlling Tty
  TPGID   = Tty Process Grp Id
  SID     = Session Id
  nTH     = Number of Threads
  P       = Last Used Cpu (SMP)
  TIME    = CPU Time
  SWAP    = Swapped Size (KiB)
  CODE    = Code Size (KiB)
  DATA    = Data+Stack (KiB)
  nMaj    = Major Page Faults
  nMin    = Minor Page Faults
  nDRT    = Dirty Pages Count
  WCHAN   = Sleeping in Function
  Flags   = Task Flags <sched.h>
  CGROUPS = Control Groups
  SUPGIDS = Supp Groups IDs
  SUPGRPS = Supp Groups Names
  TGID    = Thread Group Id
  OOMa    = OOMEM Adjustment
  OOMs    = OOMEM Score current
  ENVIRON = Environment vars
  vMj     = Major Faults delta
  vMn     = Minor Faults delta

Keys for managing the top command interface:

Key	Description
↑ and ↓	Scrolls up and down to select fields.
→	Selects an entire column. Press UP or DOWN to move it.
Space	Toggles field visibility. An asterisk (*) indicates the field is displayed.
s	Sets the current column as the sorting column.
q	Exits the top command interface.

Use the top command in interactive mode

In interactive mode, press keys to control the display:

Key	Description
1	Displays per-logical-CPU status.
u	Filters processes by user.
E	Cycles the memory unit: KiB, MiB, GiB, TiB, PiB, or EiB.
x	Highlights the sorting column.
y	Highlights running processes.
?	Displays help information.

Query the names and directories of processes by PID

Run top to find a process PID. In this example, the aliyun-service process has PID 1325.

Run the top command. You can see that the process with PID 1325 is aliyun-service.

Tasks: 188 total,   1 running, 186 sleeping,   0 stopped,   1 zombie
%Cpu(s):  0.2 us,  0.1 sy,  0.0 ni, 99.6 id,  0.0 wa,  0.1 hi,  0.1 si,  0.0 st
MiB Mem : 15468.8 total,  12290.5 free,   1710.8 used,   1783.7 buff/cache
MiB Swap:    0.0 total,      0.0 free,      0.0 used.  13758.1 avail Mem

  PID USER      PR  NI    VIRT    RES    SHR S  %CPU  %MEM   TIME+ COMMAND
15831 root      20   0 1401860  42152  20472 S   0.5   0.3   2:59.24 taihao_exporter
17830 root      20   0 1153952 127996  65356 S   0.5   0.8   2:57.27 ilogtail
  971 root      20   0 2312484  29944  22544 S   0.3   0.2   3:28.78 argusagent
 1325 root      20   0  686276  18700  13028 S   0.3   0.1   0:40.97 aliyun-service
392452 root      20   0       0      0      0 I   0.3   0.0   0:00.36 kworker/u8:3-events_unbound
    1 root      20   0  169452  11824   8644 S   0.0   0.1   0:48.72 systemd

Query the directory of the aliyun-service process:

cd /proc/1352
ls -ail

In the command output, the exe symbolic link points to /usr/local/share/aliyun-assist/2.2.3.857/aliyun-service, which is the executable file path of process 1325.

[root         1325]# ls -ail
total 0
 24390 dr-xr-xr-x   9 root root 0 Jan 22 13:17 .
     1 dr-xr-xr-x 253 root root 0 Jan 22 13:17 ..
3003054 -r--r--r--   1 root root 0 Jan 23 17:01 arch_status
 28694 dr-xr-xr-x   2 root root 0 Jan 22 13:17 attr
3003026 -rw-r--r--   1 root root 0 Jan 23 17:01 autogroup
3003022 -r--------   1 root root 0 Jan 23 17:01 auxv
 28698 -r--r--r--   1 root root 0 Jan 22 13:17 cgroup
3003034 --w-------   1 root root 0 Jan 23 17:01 clear_refs
 26278 -r--r--r--   1 root root 0 Jan 22 13:17 cmdline
 28693 -rw-r--r--   1 root root 0 Jan 22 13:17 comm
3003046 -rw-r--r--   1 root root 0 Jan 23 17:01 coredump_filter
3003042 -r--r--r--   1 root root 0 Jan 23 17:01 cpu_resctrl_groups
3003041 -r--r--r--   1 root root 0 Jan 23 17:01 cpuset
 52865 lrwxrwxrwx   1 root root 0 Jan 22 13:18 cwd -> /
3003021 -r--------   1 root root 0 Jan 23 17:01 environ
 27984 lrwxrwxrwx   1 root root 0 Jan 22 13:17 exe -> /usr/local/share/aliyun-assist/2.2.3.857/aliyun-service
 22392 dr-x------   2 root root 0 Jan 22 13:17 fd
3003019 dr-x------   1 root root 0 Jan 23 17:01 fdinfo
3003048 -rw-r--r--   1 root root 0 Jan 23 17:01 gid_map
 79376                1 root root 0 Jan 22 13:21 io
3003024 -r--r--r--   1 root root 0 Jan 23 17:01 limits
 28697 -rw-r--r--   1 root root 0 Jan 22 13:17 loginuid

Terminate a process by PID

In interactive mode, press k, enter a PID, and press Enter to terminate the process.

top - 17:19:44 up  3:50,  0 user,  load average: 0.00, 0.00, 0.00
Tasks: 117 total,   1 running, 116 sleeping,   0 stopped,   0 zombie
%Cpu(s):  0.3 us,  0.0 sy,  0.0 ni, 99.7 id,  0.0 wa,  0.0 hi,  0.0 si,  0.0 st
MiB Mem :   7414.8 total,   6142.9 free,    471.8 used,   1059.6 buff/cache
MiB Swap:      0.0 total,      0.0 free,      0.0 used.   6943.1 avail Mem
Send pid 4717 signal [15/sigterm]
  PID USER      PR  NI    VIRT    RES    SHR S  %CPU  %MEM     TIME+ COMMAND
 4717 root      20   0  101088  19384  13184 S   0.7   0.3   0:32.65 AliYunDun
 4744 root      20   0  139200  29284  19456 S   0.7   0.4   1:11.93 AliYunDunMonito
 1076 root      20   0  468824  13312  11392 S   0.3   0.2   0:00.19 udisksd
 4574 root      20   0 1244388  25856  23680 S   0.3   0.3   0:38.55 argusagent
    1 root      20   0   22716  13644   9336 S   0.0   0.2   0:03.74 systemd
    2 root      20   0       0      0      0 S   0.0   0.0   0:00.00 kthreadd
    3 root      20   0       0      0      0 I   0.0   0.0   0:00.00 pool_workqueue_release
    4 root       0 -20       0      0      0 I   0.0   0.0   0:00.00 kworker/R-rcu_g
    5 root       0 -20       0      0      0 I   0.0   0.0   0:00.00 kworker/R-rcu_p
    6 root       0 -20       0      0      0 I   0.0   0.0   0:00.00 kworker/R-slub_
    7 root       0 -20       0      0      0 I   0.0   0.0   0:00.00 kworker/R-netns
    9 root       0 -20       0      0      0 I   0.0   0.0   0:00.00 kworker/0:0H-events_highpri
   12 root       0 -20       0      0      0 I   0.0   0.0   0:00.00 kworker/R-mm_pe

kill

Command

The kill command terminates processes by sending signals.

Common options

Option	Description
-l	Displays all available signal names.
-L	Displays all signal names and the corresponding numbers.

Examples

Terminate all processes.
```
sudo kill -9 -1
```
Display the name of the signal whose number is 11.
```
sudo kill -l 11
```
Display all signal names and the corresponding numbers.
```
sudo kill -L
```
Terminate a process by PID.
```
sudo kill -9 <PID>
```
Replace <PID> with an actual PID.

killall

Command

The killall command terminates all processes matching a name.

Common options

Option	Description
-g	Terminates processes in the process group.
-i	Requests user confirmation before terminating a process.
-v	Reports whether the signal is sent.

Examples

Terminate the top process.

sudo killall top

System information

Query system and hardware information with uname and dmidecode.

uname

Command

The uname command displays system information.

Common options

Option	Description
-a	Displays all system information.
-s	Displays the kernel name.
-n	Displays the hostname of the network node.
-r	Displays the kernel release.
-v	Displays the kernel version.
-m	Displays the machine hardware name.
-P	Displays the processor type.
-i	Displays hardware platform information.
-o	Displays operating system information.

Examples

Query all system information.
```
uname -a
```
Run uname -m or arch to query the CPU architecture. Output varies by architecture.

Command output for the Arm architecture
```
[t@iUf682 xxx ~]# uname -m
aarch64
[t@iUf682 xxx ~]# arch
aarch64
```
Command output for the x86 architecture
```
[root@iZbp144wor*** ~]# uname -m
x86_64
[root@iZbp144wor*** ~]# arch
x86_64
```

dmidecode

The dmidecode command extracts hardware information from the system BIOS via the DMI table, including:

System information: vendor, name, version, serial number (SN), and model.
Processor information: model, speed, and core count.
Memory information: slot count, sizes, types, and speeds.
Motherboard information: vendor, version, and SN.
BIOS information: version and release date.
Power supply information: specifications and models.
Device information: hardware components such as network adapters.

Display all hardware information from the DMI table.

sudo dmidecode

Sample command output:

# dmidecode 3.5
Getting SMBIOS data from sysfs.
SMBIOS 2.8 present.
9 structures occupying 451 bytes.
Table at 0x7BBCB000.
Handle 0x0100, DMI type 1, 27 bytes
System Information
        Manufacturer: Alibaba Cloud
        Product Name: Alibaba Cloud ECS
        Version: pc-i440fx-2.1
        Serial Number: a430fe54-aef6-4eae-a1ef-63******beb
        UUID: a430fe54-aef6-4eae-a1ef-63******beb
        Wake-up Type: Power Switch
        SKU Number: Not Specified
        Family: Not Specified
Handle 0x0300, DMI type 3, 21 bytes
Chassis Information
        Manufacturer: Alibaba Cloud
        Type: Other
        Lock: Not Present
        Version: pc-i440fx-2.1
        Serial Number: Not Specified
        Asset Tag: Not Specified
        Boot-up State: Safe
        Power Supply State: Safe
        Thermal State: Safe
        Security Status: Unknown
        OEM Information: 0x00000000
        Height: Unspecified
        Number Of Power Cords: Unspecified
        Contained Elements: 0
Handle 0x0400, DMI type 4, 42 bytes
Processor Information
        Socket Designation: CPU 0
        Type: Central Processor
        Family: Other
        Manufacturer: Alibaba Cloud
        ID: 54 06 05 00 FF FB 8B 1F
        Version: pc-i440fx-2.1
        Voltage: Unknown
        External Clock: Unknown
        Max Speed: Unknown
        Current Speed: Unknown
        Status: Populated, Enabled
        Upgrade: Other
        L1 Cache Handle: Not Provided
        L2 Cache Handle: Not Provided
        L3 Cache Handle: Not Provided
        Serial Number: Not Specified
        Asset Tag: Not Specified
        Part Number: Not Specified
        Core Count: 1
        Core Enabled: 1
        Thread Count: 2
        Characteristics: None
Handle 0x1000, DMI type 16, 23 bytes
Physical Memory Array
        Location: Other
        Use: System Memory
        Error Correction Type: Multi-bit ECC
        Maximum Capacity: 2 GB
        Error Information Handle: Not Provided
        Number Of Devices: 1
Handle 0x1100, DMI type 17, 40 bytes
Memory Device
        Array Handle: 0x1000
        Error Information Handle: Not Provided
        Total Width: Unknown
        Data Width: Unknown
        Size: 2 GB
        Form Factor: DIMM
        Set: None
        Locator: DIMM 0
        Bank Locator: Not Specified
        Type: RAM
        Type Detail: Other
        Speed: Unknown
        Manufacturer: Alibaba Cloud
        Serial Number: Not Specified
        Asset Tag: Not Specified
        Part Number: Not Specified
        Rank: Unknown
        Configured Memory Speed: Unknown
        Minimum Voltage: Unknown
        Maximum Voltage: Unknown
        Configured Voltage: Unknown
Handle 0x1300, DMI type 19, 31 bytes
Memory Array Mapped Address
        Starting Address: 0x00000000000
        Ending Address: 0x0007FFFFFFF
        Range Size: 2 GB
        Physical Array Handle: 0x1000
        Partition Width: 1
Handle 0x2000, DMI type 32, 11 bytes
System Boot Information
        Status: No errors detected
Handle 0x0000, DMI type 0, 26 bytes
BIOS Information
        Vendor: EFI Development Kit II / OVMF
        Version: 0.0.0
        Release Date: 02/06/2015
        Address: 0xE8000
        Runtime Size: 96 kB
        ROM Size: 64 kB
        Characteristics:
                BIOS characteristics not supported
                Targeted content distribution is supported
                UEFI is supported
                System is a virtual machine
        BIOS Revision: 0.0
Handle 0xFEFF, DMI type 127, 4 bytes
End Of Table

To display only entries of a specific type, use the -t option. For example, display memory entries:

sudo dmidecode -t memory

Sample command output:

# dmidecode 3.5
Getting SMBIOS data from sysfs.
SMBIOS 2.8 present.
Handle 0x1000, DMI type 16, 23 bytes
Physical Memory Array
        Location: Other
        Use: System Memory
        Error Correction Type: Multi-bit ECC
        Maximum Capacity: 2 GB
        Error Information Handle: Not Provided
        Number Of Devices: 1
Handle 0x1100, DMI type 17, 40 bytes
Memory Device
        Array Handle: 0x1000
        Error Information Handle: Not Provided
        Total Width: Unknown
        Data Width: Unknown
        Size: 2 GB
        Form Factor: DIMM
        Set: None
        Locator: DIMM 0
        Bank Locator: Not Specified
        Type: RAM
        Type Detail: Other
        Speed: Unknown
        Manufacturer: Alibaba Cloud
        Serial Number: Not Specified
        Asset Tag: Not Specified
        Part Number: Not Specified
        Rank: Unknown
        Configured Memory Speed: Unknown
        Minimum Voltage: Unknown
        Maximum Voltage: Unknown
        Configured Voltage: Unknown

Physical CPU and memory information

Note

Total number of cores = Number of physical CPUs × Number of cores per physical CPU
Total number of logical CPUs = Number of physical CPUs × Number of cores per physical CPU × Hyper-Threading factor

Common commands for querying CPU and memory details:

Query the number of physical CPUs.

cat /proc/cpuinfo| grep "physical id"| sort| uniq| wc -l

Query the number of cores per physical CPU.
```
cat /proc/cpuinfo| grep "cpu cores"| uniq
```

Query the number of logical CPUs.

cat /proc/cpuinfo| grep "processor"| wc -l

Query the CPU model.

cat /proc/cpuinfo | grep name | cut -f2 -d: | uniq -c

Query memory information.
```
cat /proc/meminfo
```

Query CPU details

Run lscpu to query CPU details. Output varies by architecture.

Command output for the Arm architecture

[root@iZuf682tl xxx ~]# lscpu
Architecture:          aarch64
Byte Order:            Little Endian
CPU(s):                4
On-line CPU(s) list:   0-3
Thread(s) per core:    1
Core(s) per cluster:   4
Socket(s):             1
Cluster(s):            1
NUMA node(s):          1
Vendor ID:             ARM
BIOS Vendor ID:        Alibaba Cloud
Model:                 1
Model name:            Neoverse-N1
BIOS Model name:       virt-rhel7.6.0
Stepping:              r3p1
BogoMIPS:              50.00
NUMA node0 CPU(s):     0-3
Flags:                 fp asimd evtstrm aes pmull sha1 sha2 crc32 atomics fphp asimdhp cpuid asimdrdm lrcpc dcpop asimddp ssbs

Command output for the x86 architecture

[root@iZbp14xxxxx ~]# lscpu
Architecture:          x86_64
CPU op-mode(s):        32-bit, 64-bit
Byte Order:            Little Endian
CPU(s):                16
On-line CPU(s) list:   0-15
Thread(s) per core:    2
Core(s) per socket:    8
Socket(s):             1
NUMA node(s):          1
Vendor ID:             GenuineIntel
CPU family:            6
Model:                 106
Model name:            Intel(R) Xeon(R) Platinum 8369B CPU @ 2.90GHz
Stepping:              6
CPU MHz:               2899.998
BogoMIPS:              5799.99
Hypervisor vendor:     KVM
Virtualization type:   full
L1d cache:             48K
L1i cache:             32K
L2 cache:              1280K
L3 cache:              49152K
NUMA node0 CPU(s):     0-15
Flags:                 fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush mmx fxsr sse sse2 ss ht syscall nx pdpe1gb rdtscp lm constant_tsc rep_good nopl xtopology nonstop_tsc cpuid tsc_known_freq pni pclmulqdq monitor ssse3 fma cx16 pdcm pcid sse4_1 sse4_2 x2apic movbe popcnt aes xsave avx f16c rdrand hypervisor lahf_lm abm 3dnowprefetch cpuid_fault invpcid_single ssbd ibrs ibpb stibp ibrs_enhanced fsgsbase tsc_adjust bmi1 avx2 smep bmi2 erms invpcid avx512f avx512dq rdseed adx smap avx512ifma clflushopt clwb avx512cd sha_ni avx512bw avx512vl xsaveopt xsavec xgetbv1 xsaves wbnoinvd arat avx512vbmi avx512_vbmi2 gfni vaes vpclmulqdq avx512_vnni avx512_bitalg avx512_vpopcntdq rdpid fsrm arch_capabilities

Query operating system information

Run cat /proc/version to query operating system information and compiler version. Output varies by architecture.

Command output for the x86 architecture

[xxx@iZbp144wor         ~]# cat /proc/version
Linux version 4.19.91-26.1.al7.x86_64 (mockbuild@x86-003.build.alibaba.cm10) (gcc version 4.8.5 20150623 (Red Hat 4.8.5-44) (GCC)) #1 SMP Tue Jul 26 17:52:28 CST 2022

Command output for the Arm architecture

[root@iZuf682t          ~]# cat /proc/version
Linux version 5.10.134-12.al8.aarch64 (mockbuild@r75e11320.cm10.tbsite.net) (gcc (GCC) 10.2.1 20200825 (Alibaba 10.2.1-3 2.32), GNU ld version 2.35-12.2.al8) #1 SMP Tue Sep 6 07:11:41 UTC 2022

Disk management

df

Command

The df command reports file system disk space usage.

Common options

Option	Description
-a	Includes pseudo, duplicate, and inaccessible file systems.
-B	Scales block sizes by the specified size for output.
-h	Displays sizes in human-readable format using a scale factor of 1,024. Example: 1023M.
-H	Displays sizes in human-readable format using a scale factor of 1,000. Example: 1.1G.
-k	Equivalent to -- block-size=1K.
-l	Displays a list of local file systems.
-t	Displays information about file systems of the specified type.

Examples

Query disk space usage with block sizes in MB.

df -BM

Sample output:

Filesystem     1M-blocks  Used Available Use% Mounted on
tmpfs               742M   22M      721M   3% /run
/dev/vda3         39943M 2542M    35556M   7% /
tmpfs              3708M    0M     3708M   0% /dev/shm
tmpfs                 5M    0M        5M   0% /run/lock
tmpfs               742M    1M      742M   1% /run/user/0

lsblk

Command

The lsblk command displays block device details.

Common options

Option	Description
-a	Displays all devices, including empty and memory disk devices.
-b	Displays sizes in bytes.
-f	Displays file system information.

Examples

Query block devices with file system information.

lsblk -f

Sample output:

NAME   FSTYPE FSVER LABEL UUID                                 FSAVAIL FSUSE% MOUNTPOINTS
vda                                                                           
|-vda1                                                                        
|-vda2 vfat   FAT32       6175-F96E                                           
`-vda3 ext4   1.0         df02e0a1-d28d-41b1-99c2-58f2b684cc79   34.7G     6% /

Query the SN of a disk.

The method varies by Linux distribution. For Alibaba Cloud Linux 3, CentOS 7, or Ubuntu 18:
1. Query block storage devices mounted in the OS.
```
lsblk
```
2. Query the SN of a block storage device. For example, query the SN of /dev/vda:
```
udevadm info --query=all --name=/dev/vda | grep ID_SERIAL
```

blkid

Command

The blkid command displays block device attributes.

Examples

Query the attributes of a block device.

blkid  /dev/vda

Sample output:

/dev/vda: PTUUID="bdee1c7f-46fc-4838-9a74-9exxxxxxxxaf" PTTYPE="gpt"

fdisk

Command

The fdisk command manages disk partition tables.

Common options

Option	Description
-l	Displays the partition tables of the specified devices.
-u	Displays partition information in sectors instead of cylinders.

Examples

Query all disk partition tables with partition information in sectors.

sudo fdisk -lu

Sample output:

Disk /dev/vda: 40 GiB, 42949672960 bytes, 83886080 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disklabel type: gpt
Disk identifier: BDEE1C7F-46FC-4838-9A74-9E57F8FD63AF

Device      Start      End  Sectors  Size Type
/dev/vda1    2048     4095     2048    1M BIOS boot
/dev/vda2    4096   413695   409600  200M EFI System
/dev/vda3  413696 83886046 83472351 39.8G Linux filesystem

mount

Command

The mount command mounts file systems.

Common options

Option	Description
-a	Mounts all file systems configured in the `/etc/fstab` file.
-L	Mounts the partition that has the specified label.
-r	Mounts the file system read-only.
-w	Mounts the file system read/write.
-U	Mounts the partition that has the specified `UUID`.

Examples

Mount all file systems that are configured in the /etc/fstab file.
```
sudo mount -a
```
Mount a file system read/write.
```
sudo mount -w /dev/vdb1 /mnt
```

umount

Command

The umount command unmounts file systems.

Common options

Option	Description
-r	Remounts the file system read-only if unmounting fails.
-a	Unmounts all file systems configured in the `/etc/fstab` file.
-t	Specifies the file system type to unmount. Separate multiple types with commas (,).
-f	Forcefully unmounts the file system.

Examples

Forcefully unmount the file system from a partition.

sudo umount -f /dev/vdb1

Service management

systemctl

Command

The systemctl command manages systemd services and units.

Common options

Option	Description
-a	Displays all loaded units or attributes.

Common unit commands

Command	Description
start	Starts the specified loaded units.
stop	Stops the specified loaded units.
restart	Restarts the specified loaded units.
reload	Reloads the configuration of the specified units.
status	Displays the runtime status of the specified units. Common states: active (running): The service is running. active (exited): The service ran and exited. active (waiting): The service is running and waiting to be triggered by a specific condition or event. inactive: The service is not running.

Common unit file commands

Command	Description
enable	Enables the specified units or unit instances.
disable	Disables the specified units or unit instances.

Examples

Restart the NGINX service.
```
sudo systemctl restart nginx
```
Check the runtime status of the NGINX service.
```
sudo systemctl status nginx
```
Enable the NGINX service to start on boot.
```
sudo systemctl enable nginx
```

List all services enabled to start on boot.

sudo systemctl list-unit-files --type=service --state=enabled

Resource usage

lsof

Command

The lsof command lists open files and their associated processes.

Note

If lsof is not pre-installed, install it with a package manager.

Alibaba Cloud Linux, CentOS, and RHEL: sudo yum install lsof.
Ubuntu and Debian: sudo apt install lsof.

Common options

Option	Description
-p	Displays files opened by a process.
-l	Replaces a user ID with a username in the output.
-u	Displays files opened by a user.
-c	Displays opened files in the `COMMAND` column that include specific keywords.
-d	Displays opened files that include specific file descriptors.
-i	Displays open files matching the specified condition. Options: 46: the IP version, which can be IPv4 or IPv6. protocol: the protocol name, which can be TCP or UDP. hostname: the network hostname. hostaddr: the IP address. service: the service name included in the `/etc/services` file. port: one or more port numbers.

Command output

Sample lsof output:

[ecs-user@hostname ~]$ lsof
lsof: WARNING: can't stat() tracefs file system /sys/kernel/debug/tracing
      Output information may be incomplete.
COMMAND    PID  TID TASKCMD          USER   FD      TYPE DEVICE  SIZE/OFF     NODE NAME
systemd      1                       root  cwd   unknown                          /proc/1/cwd (readlink: Permission denied)
systemd      1                       root  rtd   unknown                          /proc/1/root (readlink: Permission denied)
systemd      1                       root  txt   unknown                          /proc/1/exe (readlink: Permission denied)
systemd      1                       root NOFD                                    /proc/1/fd (opendir: Permission denied)
kthreadd     2                       root  cwd   unknown                          /proc/2/cwd (readlink: Permission denied)
kthreadd     2                       root  rtd   unknown                          /proc/2/root (readlink: Permission denied)
kthreadd     2                       root  txt   unknown                          /proc/2/exe (readlink: Permission denied)
kthreadd     2                       root NOFD                                    /proc/2/fd (opendir: Permission denied)
rcu_gp       3                       root  cwd   unknown                          /proc/3/cwd (readlink: Permission denied)
rcu_gp       3                       root  rtd   unknown                          /proc/3/root (readlink: Permission denied)
rcu_gp       3                       root  txt   unknown                          /proc/3/exe (readlink: Permission denied)
rcu_gp       3                       root NOFD                                    /proc/3/fd (opendir: Permission denied)

Output fields:

Option	Description
COMMAND	Command name.
PID	Process ID.
TID	Thread ID. Blank indicates a process.
TASKCMD	Task name, usually the same as COMMAND.
USER	User ID or logon username.
FD	File descriptor.
TYPE	Node type associated with the file.
DEVICE	Device number.
SIZE/OFF	File size or offset in bytes.
NODE	File node number.
NAME	Mount point and file system name.

Examples

Query files opened by a process.
```
sudo  lsof -p 1
```
Replace 1 with an actual PID.
Query files opened by a user.
```
sudo lsof -u <user-name>
```
Replace <user-name> with an actual username.
Query information about the process that opens a specific file.
```
sudo lsof <file-name>
```
Replace <file-name> with an actual file name.
Query open files for IPv4 network connections.
```
sudo lsof -i 4
```

netstat

Command

The netstat command displays network connections, routing tables, and protocol statistics.

Common options

Option	Description
-t	Displays only TCP options.
-u	Displays only UDP options.
-i	Displays a list of network interfaces.
-n	Displays numerical addresses instead of resolving to hostnames.
-l	Displays only listening sockets.
-p	Displays processes associated with connections.
-s	Displays network statistics.

Examples

Query network statistics for port 8000.
```
netstat -tunlp | grep 8000
```
Replace 8000 with an actual port number.
Query all listening TCP ports and their processes.
```
netstat -ntlp
```

vmstat

Command

The vmstat command reports virtual memory, process, and CPU statistics.

Common options

Syntax:

vmstat [-n] [delay [count]]

Option	Description
-n	Displays the column header only once.
[delay]	Time interval between updates in seconds. Without this option, only one report is printed.
[count]	Number of updates. Without this option and with [delay] specified, vmstat runs indefinitely. Press `Ctrl`+`C` to exit.

Examples

Report CPU usage four times at 1-second intervals:

vmstat -n 1 4

Sample output:

procs -----------memory---------- ---swap-- -----io---- -system-- ------cpu-----
 r  b   swpd   free   buff  cache   si   so    bi    bo   in   cs us sy id wa st
 1  0      0 2684984 310452 2364304    0    0     5    17   19   35  4  2 94  0  0
 0  0      0 2687504 310452 2362268    0    0     0   252 1942 4326  5  2 93  0  0
 0  0      0 2687356 310460 2362252    0    0     0    68 1891 4449  3  2 95  0  0
 0  0      0 2687252 310460 2362256    0    0     0     0 1906 4616  4  1 95  0  0

Key fields:

r: threads waiting for CPU time. A larger value indicates a slower system.
us: CPU time in user mode. Values above 50% suggest the need for program optimization.
sy: CPU time in kernel mode.
wa: CPU time waiting for I/O. High values may indicate excessive random disk access or a disk bottleneck.
id: CPU idle time. If this value stays at 0 and sy is twice us, a CPU resource shortage exists.

User logon information

User logon records are stored in the following files:

User logon information is recorded in /var/run/utmp, /var/log/wtmp, /var/log/btmp, and /var/log/lastlog.
who, w, and users query current logon users from /var/run/utmp.
last queries current and historical logon users from /var/log/wtmp.
lastb queries failed logon attempts from /var/log/btmp.
lastlog queries the most recent logon of each user from /var/log/lastlog.

who

The who command queries current logon users. Sample output:

[root@xxx3Z ~]# who
root    pts/0         2025-01-27 11:22 (1xxx4)
root    pts/1         2025-01-27 11:29 (xxx)

w

The w command queries the current logon user and their active tasks. Sample output:

[xxx ~]# w
 11:30:45 up 2 days, 18:08,  2 users,  load average: 0.04, 0.05, 0.05
USER     TTY      FROM             LOGIN@   IDLE   JCPU   PCPU WHAT
root     pts/0    1xxx4            11:22    7:47   0.02s  0.02s -bash
root     pts/1    xxx              11:29    6.00s  0.02s  0.00s w

users

The users command queries the usernames of current logon users. Sample output:

[root@xxx ~]# users
root root

last

The last command queries all historical logon records. Sample output:

[root@xxx ~]# last
root     pts/1        xxx              Mon Jan 27 11:29   still logged in
root     pts/1        xxx              Mon Jan 27 11:29 - 11:29  (00:00)
root     pts/0        xxx              Mon Jan 27 11:22   still logged in
root     pts/0        xxx              Mon Jan 27 11:14 - 11:21  (00:07)
root     pts/0        xxx              Sun Jan 26 16:42 - 11:14  (18:31)
john     pts/0        xxx              Sun Jan 26 16:30 - 16:42  (00:11)
root     pts/0        xxx              Sun Jan 26 16:30 - 16:30  (00:00)
root     pts/0        xxx              Sun Jan 26 16:25 - 16:30  (00:04)
root     pts/1        xxx              Fri Jan 24 17:20 - 19:33  (02:13)
root     pts/0        xxx              Fri Jan 24 17:06 - 23:20  (06:14)
root     pts/0        xxx              Fri Jan 24 17:06 - 17:06  (00:00)
reboot   system boot  xxx              Fri Jan 24 17:01   still  running

lastb

The lastb command queries failed logon attempts. Sample output:

[r*** ~]# lastb
john    ssh:notty    xxx    '4    Mon Jan 27 11:33 - 11:33  (00:00)
root    ssh:notty    xxx    '4    Mon Jan 27 11:33 - 11:33  (00:00)
root    ssh:notty    xxx    '4    Mon Jan 27 11:33 - 11:33  (00:00)
root    ssh:notty    xxx    '4    Mon Jan 27 11:33 - 11:33  (00:00)
root    pts/0                     Sun Jan 26 16:30 - 16:30  (00:00)

btmp begins Sun Jan 26 16:30:01 2025

lastlog

The lastlog command queries the most recent logon of each user. Sample output:

[rxxx ~]# lastlog
Username         Port     From             Latest
root             pts/1    8xxx       xxx40  Mon Jan 27 11:29:34 +0800 2025
bin                                        Never logged in
daemon                                     Never logged in
adm                                        Never logged in
lp                                         Never logged in
sync                                       Never logged in
shutdown                                   Never logged in
halt                                       Never logged in
mail                                       Never logged in
operator                                   Never logged in
games                                      Never logged in
ftp                                        Never logged in
nobody                                     Never logged in
dbus                                       Never logged in
systemd-coredump                           Never logged in
systemd-resolve                            Never logged in
tss                                        Never logged in
polkitd                                    Never logged in
unbound                                    Never logged in
chrony                                     Never logged in
sshd                                       Never logged in
nscd                                       Never logged in
postfix                                    Never logged in
tcpdump                                    Never logged in
rpc                                        Never logged in
rpcuser                                    Never logged in
squid                                      Never logged in
ecs-instance-connect                       Never logged in
jack                                       Never logged in
john             pts/0                     Mon Jan 27 11:21:25 +0800 2025
john1                                      Never logged in

cat /var/log/secure

The cat /var/log/secure command queries all user logon records. Sample output:

[root@xxx 3Z ~]# cat /var/log/secure
Jan 26 11:18:17 i    3Z sshd[6646]: Accepted password for root from 1.xxx.xxx.xxx 6 port 2090 ssh2
Jan 26 11:18:17 i    3Z systemd[6652]: pam_unix(systemd-user:session): session opened for user root by (uid=0)
Jan 26 11:18:17 i    3Z sshd[6646]: pam_unix(sshd:session): session opened for user root by (uid=0)
Jan 26 13:33:22 i    3Z sshd[6646]: pam_unix(sshd:session): session closed for user root
Jan 26 16:25:44 i    3Z useradd[6815]: new group: name=ecs-instance-connect, GID=992
Jan 26 16:25:44 i    3Z useradd[6815]: new user: name=ecs-instance-connect, UID=995, GID=992, home=/home/ecs-instance-connect, shell=/sbin/nologin
Jan 26 16:25:44 i    3Z sudo[6835]:      root : PWD=/root ; USER=root ; COMMAND=/bin/systemctl daemon-reload
Jan 26 16:25:44 i    3Z systemd[6839]: pam_unix(systemd-user:session): session opened for user root by (uid=0)
Jan 26 16:25:44 i    3Z sudo[6835]: pam_unix(sudo:session): session opened for user root by (uid=0)
Jan 26 16:25:45 i    3Z sudo[6835]: pam_unix(sudo:session): session closed for user root
Jan 26 16:25:45 i    3Z sudo[6876]:      root : PWD=/root ; USER=root ; COMMAND=/bin/systemctl restart sshd
Jan 26 16:25:45 i    3Z sudo[6876]: pam_unix(sudo:session): session opened for user root by (uid=0)
Jan 26 16:25:45 i    3Z sshd[1055]: Received signal 15; terminating.
Jan 26 16:25:45 i    3Z sshd[6881]: Server listening on 0.0.0.0 port 22.
Jan 26 16:25:45 i    3Z sshd[6881]: Server listening on :: port 22.
Jan 26 16:25:45 i    3Z sudo[6876]: pam_unix(sudo:session): session closed for user root
Jan 26 16:25:48 i    3Z sshd[6886]: Accepted publickey for root from 1.xxx.xxx.xxx 74 port 2072 ssh2: ED25519 SHA256:xQdusPE/xxx            jUd5qN0EU
Jan 26 16:25:48 i    3Z sshd[6886]: pam_unix(sshd:session): session opened for user root by (uid=0)
Jan 26 16:26:01 i    3Z useradd[6962]: new group: name=jack, GID=1000
Jan 26 16:26:01 i    3Z useradd[6962]: new user: name=jack, UID=1000, GID=1000, home=/home/jack, shell=/bin/bash
Jan 26 16:26:38 i    3Z useradd[6971]: new group: name=john, GID=1001
Jan 26 16:26:38 i    3Z useradd[6971]: new user: name=john, UID=1001, GID=1001, home=/home/john, shell=/bin/bash
Jan 26 16:26:58 i    3Z passwd[6978]: pam_unix(passwd:chauthtok): password changed for john
Jan 26 16:27:43 i    3Z sudo[6984]:      root : TTY=pts/0 ; PWD=/root ; USER=root ; COMMAND=/sbin/usermod -aG sudo john
Jan 26 16:27:43 i    3Z sudo[6984]: pam_unix(sudo:session): session opened for user root by root(uid=0)
Jan 26 16:27:43 i    3Z sudo[6984]: pam_unix(sudo:session): session closed for user root
Jan 26 16:29:01 i    3Z sudo[6992]:      root : TTY=pts/0 ; PWD=/root ; USER=root ; COMMAND=/sbin/usermod -aG wheel john
Jan 26 16:29:01 i    3Z sudo[6992]: pam_unix(sudo:session): session opened for user root by root(uid=0)

User management

Manage system users and permissions with useradd, wheel, passwd, and userdel.

useradd

Command

The useradd command creates users. Verify with cat /etc/passwd | grep username.

Requires root or sudo permissions.
Set a password for the user after creation.
Primary and supplementary groups must exist before user creation.

Common options

Option	Description
-d	Home directory. Default: `/home/<Username>`.
-m	Creates the home directory. Use with `-d` to specify the path.
-s	Logon shell. Default: `/bin/bash`.
-g	Primary group. The group must exist.
-G	Supplementary groups. Separate multiple groups with commas (,).
-p	Encrypted password. Example: `sudo useradd -p $(openssl passwd -6 '<Password in plaintext>') newusername`
-u	Numeric user ID.
-e	Account expiration date in YYYY-MM-DD format.

Examples

Create user jack with a custom home directory and shell.
```
useradd -m -d /home/jack -s /bin/bash jack
```
Verify the user by running cat /etc/passwd | grep jack:
```
jack:x:1000:1000::/home/jack:/bin/bash
```
Set a password for the user:
```
passwd jack
```
Create user alice in the developers supplementary group.
```
useradd -m -G developers alice
```
Create user bob with user ID 1001.
```
useradd -m -u 1001 bob
```
Create a user with root permissions:

Important
Grant root permissions only when required.
1. Create user john.
```
useradd john
```
2. Set a password.
```
passwd john
```
3. Add the user to the wheel group to grant sudo permissions. Run grep '^wheel:' /etc/group to verify membership.
```
sudo usermod -aG wheel john
```
4. Test sudo permissions. Switch to the new user and run a sudo command.
```
su - john
sudo ls /root
```
  If prompted for a password and the /root directory contents are displayed, the user has sudo permissions and can be used for remote logon.
5. (Optional) Edit the sudoers file to add specific permissions.
```
sudo visudo
```

userdel

Command

The userdel command deletes users.

Common options

Option	Description
-r	Deletes the home directory and its files.
-f	Forcefully deletes the user even if logged on.

Examples

Delete user john.

Switch to root and query the home directory with cat /etc/passwd | grep john:
```
john:x:1001:1001::/home/john:/bin/bash
```
Delete user john but retain the home directory:
```
userdel john
```
Delete user john along with the home directory and files.
```
userdel -r username
```
Forcefully delete a user.
```
userdel -f username
```

wheel

Command

wheel is a user group that controls access to the su command for switching to root.

The wheel group exists by default. If not, create it with sudo groupadd wheel.
By default, any user can run su and enter the root password to switch to root.
To restrict root access, configure the wheel group so only its members can use su to switch to root.

Examples

Check whether a user belongs to the wheel group.
```
groups username
```
Add the user to the wheel group.
```
sudo usermod -aG wheel username
```
Run visudo to edit /etc/sudoers. The line %wheel ALL=(ALL) ALL allows wheel group members to use sudo for all commands.

To allow passwordless sudo for wheel members, change the line to:
```
%wheel ALL=(ALL) NOPASSWD: ALL
```