Squarebits Blog

Let’s say you want to delete all the "CVS" subdirectories anywhere below a top level "/opt/project" directory.  Here is how you can do this…

1. Execute cd /opt/project to change to the top level directory below which you wish to delete the "CVS" subdirectories
2. Execute find -type d -name 'CVS' -ls to see a preview of all the directories that will be deleted.
3. If the preview seems ok, you can then execute find -type d -name 'CVS' -exec rm -fr {} \; to actually delete all the subdirectories (you’ll get a No such file or directory error when executing but the subdirectories are still deleted).

Obviously, this can work with any subdirectory name as you would just replace CVS above with your subdirectory name.

You can receive the error argument list too long trying to execute a rm -f * in a directory with a lot of files but there is a very simple workaround.  Simply execute this instead to delete the files…

find . -name "*" -type f -maxdepth 1 -exec rm {} \;

Important: Executing a find . -exec rm {} \; is equivalent to executing a rm -f * — be sure you know what you are doing and be sure you are in the right directory when you execute this.

Note that the -name "*" switch avoids deleting system files and the -maxdepth 1 switch avoids deleting files in subdirectories.

If you are running out of disk space under Linux, here are three useful commands to help identify which files and directories are chewing up the most disk space…

1. Show the 50 largest files…find / -path '/proc' -prune -o -size +1000k -printf '%s %p\n' | sort -k1 -g -r | head -50
2. Show the 50 largest directories (excluding files in subdirectories)…du -kS / | sort -k1 -g -r | fgrep -v '/proc' | head -50
3. Show the 50 largest directories (including files in subdirectories)…du -k / | sort -k1 -g -r | fgrep -v '/proc' | head -50

Important: As these commands may take a little while to run, you should not run these commands on a production system where a significant increase in load would have an adverse impact.

You can run this command under Linux (tested with RHEL 3.0) to see the processes with the most threads…

find /proc/*/status -exec gawk '/^Name:/ { n=$2}; /^Threads:/ { t=$2}; END{ printf("%-30s %5d\n", n, t);}' {} \; | sort --key=2 -g -r | head -10

This is especially useful on systems (like VPS hosting accounts) where you might have limits on the total number of threads.

Addendum (12/1/2006 1:48p CST):

Based on feedback, here are a few other tips related to this…

• You can modify the script slightly to also show the process id using this modified version…

  find /proc/*/status -exec gawk '/^Pid:/ { p=$2}; /^Name:/ { n=$2}; /^Threads:/ { t=$2}; END{ printf("%6d %-30s %5d\n", p, n, t);}' {} \; | sort -k3 -g -r | head -10

• You can create a topthreads alias to this long command allowing to you execute it just by typing topthreads by first executing…

  alias topthreads="find /proc/*/status -exec gawk '/^Pid:/ { p=\$2}; /^Name:/ { n=\$2}; /^Threads:/ { t=\$2}; END{ printf(\"%6d %-30s %5d\n\", p, n, t);}' {} \; | sort -k3 -g -r | head -10"
 

Ever have your busy web server go down when you are unavailable to restart it? If so, you can implement a simple script that will restart your web server automatically if there has been no activity in your access log for a period of time…

1. Wherever you wish, create an autorestart.sh that looks like this…
#!/bin/sh

   # Modify the following line to stop your web server
   # /opt/webserver/bin/start.sh stop

   # Wait 3 seconds before restarting
   sleep 3

   # Modify the following line to start your web server
   # /opt/webserver/bin/start.sh start

   # Modify the following line to use your email address
   mail -s “Auto-Restarted Your Web Server” bob@whatever.com < /dev/null

2. Change the permission on autorestart.sh to allow it to execute…chmod +x autorestart.sh
3. Add the following to the “start” part of your existing start/stop script for your web server…
echo "*/5 * * * * root find /opt/webserver/log/access_log -type f -cmin +10 -exec /opt/webserver/bin/autorestart.sh {} \;" > /etc/cron.d/autorestart.cron

   You should modify this command as follows…

   • Replace the “5″ in */5 with how often to check the access log (in minutes)
   • Replace /opt/webserver/log/access_log with the location of the current access log
   • Replace the “10″ in +10 with the number of minutes to wait for no entries in your access log before restarting
   • Replace /opt/webserver/bin/autorestart.sh to point to your autorestart.sh
4. Add this line to the “stop” part of your existing start/stop script for your web server…rm -f /etc/cron.d/autorestart.cron

A few notes…

• Initially, leave the start/stop lines commented out in autorestart.sh for testing. Uncomments the start/stop lines in autorestart.sh if you receive email notifications only at times when your web server should have been restarted.
• The above technique depends on a detecting a lack of activity in your web server’s access log. If you have access logging turned off in your web server then the above technique will not work. If you have relatively few visitors to your website the above technique may not work well.
• The above technique is generic enough to work with almost any web server (Apache, Tomcat, Resin, etc.).

Ideally, this would never be necessary; however, you may have a third-party module loaded in your web server that causes a memory leak, you may run this under a VPS hosting account that runs out of memory occassionally, etc.

As a user or administrator of multiple Linux systems, it is important that you pay very close attention as to what box you are about to issue a command on.  One powerful way to do that is to use a distinct font and/or background color for each server.  This example assumes that you are using the default bash shell on a Red Hat Linux system.

1) Edit the /etc/bashrc using your favorite editor.

2) Search for the string, PROMPT until you reach a statement that looks like:

PROMPT_COMMAND=’echo -ne "\033]0;${USER}@${HOSTNAME%%.*}:${PWD/#$HOME/~}\007"’

3) Insert the string \e[34;1m at the location shown below:

PROMPT_COMMAND='echo -ne "\e[34;1m\033]0;${USER}@${HOSTNAME%%.*}:${PWD/#$HOME/~}\007"’

4) Save the file.

5) Run the command source /etc/bashrc.

By changing the value after the \e[ you can change the font color.  Here is a color list for the font (foreground):

31 = Red
32 = Green
33 = Yellow
34 = Blue
35 = Purple
36 = Aqua
37 = White

The value in the ;1m portion of the string makes the prompt bright.  Alternatively, you can change the value in that portion of the string to change the background color.  Here is a list of background colors:

40 = Black
41 = Red
42 = Green
43 = Yellow
44 = Blue
45 = Purple
46 = Aqua
47 = White

If you do want a colored background, one good color choice might be a yellow font on a blue background: \e[33;44m

If you are using a system other than Red Hat and don’t have an /etc/bashrc file, a good technique for knowing where to insert the prompt is to change to the /etc directory and issue the command grep PROMPT * – that will give you a clue as to where the system’s default prompt is being set.

You can also override just single user’s prompt by editing ~/.bashrc and inserting a similar PROMPT_COMMAND= statement into that file.

On a high traffic Linux server, it is often useful to analyze the connections to understand traffic patterns and to check for unusual activity.  Here are a few commands I find useful to summarize the current connections on a Linux server…

Summarize the number of active connections per IP…

netstat -nta | fgrep "ESTABLISHED" | cut -b 49-75 | cut -d ‘:’ -f1 | sort | uniq -c | sort -n -r –key=1,7 | head -25

Summarize the number of SYN_RECV connections per IP…

netstat
-nta | fgrep
"SYN_RECV" | cut -b 49-75 | cut -d ‘:’ -f1 | sort | uniq -c | sort -n
-r –key=1,7 | head -25

Summarize the number of connections per connection state…

netstat -nta | fgrep ":" | cut -b 77-90 | sort | uniq -c

Any IP with unusually high numbers in the first two checks might be cause for concern — that really depends on your system though and how users interact with your server normally.