Linux 运维常用命令

共 104 条真会敲的命令，参数逐条说明 —— 按「要干什么」分类

# 最新的文件在最上面，带大小和时间
ls -laht --time-style=long-iso

# 按大小找占地方最大的几个（-S）
ls -lhS /var/log | head

# 30 分钟内改过的大文件（排查磁盘暴涨）
find /var -type f -mmin -30 -size +50M -ls

# 批量删除 7 天前的日志
find /var/log -name '*.log.*' -mtime +7 -delete

# 跳过 .git 和 node_modules 再找
find . -path ./node_modules -prune -o -name '*.js' -print

# 在 nginx 配置里找某个 upstream，带前后 3 行
grep -rn -C3 'upstream' /etc/nginx --include='*.conf'

# 多个关键词任一命中（必须 -E）
grep -rnE 'timeout|refused|reset' /var/log/app/error.log

# 只列出含配置的文件名，再逐个看
grep -rli 'proxy_pass' /etc/nginx

# 打包，排除缓存目录
tar -czf app.tar.gz --exclude='node_modules' --exclude='.git' -C /srv app

# 先看内容，再解到指定目录
tar -tzf app.tar.gz | head -20
tar -xzf app.tar.gz -C /tmp/restore

# 安全删除：先确认变量非空，再删
[ -n "$DIR" ] && rm -rf -- "$DIR"

# 完整备份并保留属性
cp -a /srv/app /backup/app-$(date +%F)

# 从根往下逐层找，哪一层突然变大就进去看
du -h --max-depth=1 / 2>/dev/null | sort -h | tail -10

# 已删除但被进程占用的文件（df 满、du 却不大时用）
lsof +L1 2>/dev/null | head

ln -sfn /srv/app/releases/20261029 /srv/app/current

stat -c '%y %s %U:%G %a %n' /etc/nginx/nginx.conf
stat -L -c '%y %s' /srv/app/current        # 看软链接指向的真实文件
file /usr/local/bin/app

sed -n '1,20p' /etc/nginx/nginx.conf              # 只看前 20 行
sed -i.bak 's/listen 80;/listen 8080;/' /etc/nginx/sites-enabled/app
sed -E -i.bak 's/^server_name[[:space:]]+([^;]+);/server_name \1.bak;/' app.conf
sed '/^[[:space:]]*#/d;/^[[:space:]]*$/d' app.conf | head        # 去掉注释与空行

awk -F: '$3>=1000 {print $1, $3}' /etc/passwd
awk '{print $1}' /var/log/nginx/access.log | sort | uniq -c | sort -rn | head
awk -v lim=500 '{ if ($9+0 >= lim) print NR": "$7 }' access.log
ss -tn | awk 'NR>1 {c[$1]++} END {for (k in c) print k, c[k]}'

du -sh /var/log/* | sort -h | tail -5
awk '{print $1}' access.log | sort | uniq -c | sort -rn | head -10
sort -t: -k3 -n /etc/passwd | head

cut -d: -f1,7 /etc/passwd | head
cut -c1-19 /var/log/nginx/access.log | head -3
tr -d '\r' < crlf.txt > lf.txt
df -h | tr -s ' ' | cut -d' ' -f5 | sort -u

find /var/log -name '*.log.*' -mtime +7 -print0 | xargs -0 -r rm -f
find /srv/uploads -type f -print0 | xargs -0 -I {} cp --parents {} /backup
printf '%s\n' a b c | xargs -n1 -t echo

./deploy.sh 2>&1 | tee -a /var/log/deploy-$(date +%F).log
echo 'net.ipv4.ip_forward=1' | sudo tee -a /etc/sysctl.conf

curl -s https://api.example.com/v1/tools | jq -r '.data[].name'
curl -s 'https://api.example.com/v1/list?page=1' | jq -c '.items[] | {id, name}'
jq -r '.[] | select(.status != "ok") | .id' resp.json

diff -u /etc/nginx/nginx.conf.bak /etc/nginx/nginx.conf | head -40
diff -rq /srv/app/releases/20261028 /srv/app/releases/20261029
wc -l /var/log/nginx/access.log
sort a.txt > a.s; sort b.txt > b.s; comm -13 a.s b.s   # 只在 b 里的行

ssh -p 2222 -i ~/.ssh/id_ed25519 deploy@10.0.0.5
ssh -o ConnectTimeout=5 -o BatchMode=yes 10.0.0.5 'uptime; df -h /'
ssh -v -t 10.0.0.5 'sudo systemctl restart app'
ssh -J bastion@1.2.3.4 deploy@10.0.0.5

ssh-keygen -t ed25519 -C 'deploy@icetools' -f ~/.ssh/id_deploy -N ''
ssh-copy-id -i ~/.ssh/id_deploy.pub deploy@10.0.0.5
ssh-keygen -R 10.0.0.5
ssh-keygen -lf ~/.ssh/id_deploy.pub

# ~/.ssh/config  (chmod 600)
Host app
    HostName 10.0.0.5
    User deploy
    Port 2222
    IdentityFile ~/.ssh/id_deploy
    IdentitiesOnly yes
    ServerAliveInterval 30
    ServerAliveCountMax 3

Host db
    HostName 10.0.0.6
    ProxyJump app

Host *
    ServerAliveInterval 30

ssh -N -f -L 15432:127.0.0.1:5432 deploy@10.0.0.5
ssh -N -L 8080:10.0.0.6:80 app
ssh -D 1080 -N -f app
ssh -g -L 8080:127.0.0.1:80 app

scp -P 2222 app.tar.gz deploy@10.0.0.5:/srv/
scp -r -i ~/.ssh/id_deploy ./dist deploy@10.0.0.5:/srv/app/
scp -C -l 8000 backup.tar.gz deploy@10.0.0.5:/backup/
scp -p deploy@10.0.0.5:/var/log/app/error.log ./

sftp -P 2222 -i ~/.ssh/id_deploy deploy@10.0.0.5 <<'EOF'
get -r /srv/app/logs ./
reget backup.tar.gz
put ./dist/app.tar.gz /srv/
EOF

rsync -avzP ./dist/ deploy@10.0.0.5:/srv/app/dist/
rsync -avzP -e 'ssh -p 2222' deploy@10.0.0.5:/var/log/app/ ./logs/
rsync -avn --delete /srv/data/ /backup/data/          # 演练，看清楚再真跑
rsync -avz --bwlimit=2000 --exclude='*.tmp' ./ /mnt/nas/app/

wget -c https://example.com/big.iso
wget -O - https://example.com/install.sh | head -40   # 先看内容再决定要不要跑
wget --limit-rate=1m --tries=3 -c -O app.tar.gz https://example.com/app.tar.gz

chmod 600 ~/.ssh/id_rsa
chmod -R a+X,go-w /srv/app/public
ls -l /srv/app/public | head    # 递归改完抽查一眼

chown -R www-data:www-data /var/www/app
chown --reference=/srv/app/a /srv/app/b

# 审计：列出所有 SUID 程序
find / -xdev -perm -4000 -type f -ls 2>/dev/null

# 共享目录：组内协作 + 只有本人能删
chmod 2770 /srv/share

umask            # 看当前值
umask 077        # 当前会话生效
umask -S         # 用符号形式显示实际默认权限

sudo -l
sudo -u www-data /usr/bin/env      # 看服务账号的环境
visudo -c                          # 只做语法检查

useradd -m -s /bin/bash deploy
usermod -aG docker deploy
id deploy

ps aux --sort=-%cpu | head
ps -eo pid,ppid,rss,pcpu,cmd --sort=-rss | head

top -b -n1 | head -15          # 取一次快照
top -p $(pgrep -d, nginx)      # 只看指定进程

kill -TERM 1234 && sleep 3
kill -0 1234 && kill -9 1234
pkill -HUP nginx               # 重载配置

nohup ./run.sh > /var/log/run.log 2>&1 &
setsid ./worker.sh < /dev/null > /var/log/worker.log 2>&1 &

lsof -i :8080
lsof -n +L1 | sort -k7 -n | tail    # 按大小看被占用的已删文件

nice -n 19 tar -czf backup.tar.gz /srv/data
renice -n 10 -p 1234
taskset -cp 0-3 1234

watch -n 1 -d 'ss -tn state established | wc -l'
watch -d=cumulative -t 'ss -s'

screen -S deploy
# 之后按 Ctrl-a d 脱离
screen -list
screen -r deploy
tmux new -s deploy

ss -tulnp
ss -tnp state established | head
ss -s

curl -sS -o /dev/null -w '%{http_code} %{time_total}s\n' https://example.com/
curl -m 10 --connect-timeout 3 -sS -o /dev/null \
  -w 'dns:%{time_namelookup} conn:%{time_connect} ttfb:%{time_starttransfer} total:%{time_total}\n' \
  https://example.com/api
curl -iL --resolve example.com:443:1.2.3.4 https://example.com/
curl -v -X POST -H 'Content-Type: application/json' -d '{"a":1}' http://127.0.0.1:8080/api

nc -zv -w3 10.0.0.5 5432
echo > /dev/tcp/10.0.0.5/5432 && echo open || echo closed

ip -4 a
ip r
ip -s link show eth0

dig +short example.com
dig @8.8.8.8 example.com A
dig +trace example.com

tcpdump -i any -nn -c 50 'port 443 and host 1.2.3.4'
tcpdump -i eth0 -nn -w /tmp/cap.pcap 'tcp[tcpflags] & tcp-rst != 0'

openssl s_client -connect www.icetools.cn:443 -servername www.icetools.cn </dev/null 2>/dev/null \
  | openssl x509 -noout -dates -subject
openssl s_client -connect example.com:443 -servername example.com -showcerts </dev/null | head -30
openssl s_client -connect example.com:443 -servername example.com -checkend 2592000 </dev/null >/dev/null \
  && echo '30 天内不过期'

firewall-cmd --list-all
firewall-cmd --add-port=8080/tcp --permanent && firewall-cmd --reload
iptables -L INPUT -n -v --line-numbers

df -h; df -i
du -h --max-depth=1 / | sort -h | tail
lsof +L1 2>/dev/null | awk '{s+=$7} END {print s/1024/1024" MB held"}'

lsblk -f
lsblk -o NAME,SIZE,FSTYPE,MOUNTPOINT,UUID

growpart /dev/vda 1
xfs_growfs /            # XFS
resize2fs /dev/vda1     # ext4
df -h /

mount -o remount,rw /
fuser -vm /mnt/data
mount -a                      # 验证 fstab 写法

df -i
find /var -xdev -type f | sed 's#/[^/]*$##' | sort | uniq -c | sort -rn | head

crontab -e
crontab -l
# 每天 3:30 备份，输出进日志
30 3 * * * /srv/app/backup.sh >> /var/log/backup.log 2>&1
# 每 5 分钟探一次健康检查
*/5 * * * * /usr/bin/curl -sS -o /dev/null http://127.0.0.1:8080/health

# /etc/systemd/system/backup.timer
[Unit]
Description=Daily backup

[Timer]
OnCalendar=*-*-* 03:30:00
Persistent=true

[Install]
WantedBy=timers.target

# 启用与检查
systemctl list-timers
systemctl enable --now backup.timer
journalctl -u backup -n 30 --no-pager

date '+%F %T'
date -d '-1 hour' '+%F %T'
timedatectl
timedatectl set-timezone Asia/Shanghai

chronyc tracking
chronyc sources -v
chronyc makestep
ntpq -p          # 老系统（ntpd）

journalctl -u nginx -p err --since '30 min ago' --no-pager
journalctl -u app -f -o short-iso
journalctl --disk-usage

tail -F /var/log/app/error.log
tail -Fn0 /var/log/nginx/access.log | grep --line-buffered -i 500

dmesg -T -l err,warn | tail -30
dmesg -T | grep -iE 'oom|killed process'

dmesg -T | grep -i -A2 'killed process'
systemctl status app --no-pager | head -20
free -h

# /etc/logrotate.d/app
/var/log/app/*.log {
    daily
    rotate 7
    compress
    delaycompress
    missingok
    notifempty
    postrotate
        systemctl reload app > /dev/null 2>&1 || true
    endscript
}

# 先演练，再强制跑一次验证
logrotate -d /etc/logrotate.d/app
logrotate -f /etc/logrotate.d/app

systemctl status app --no-pager
systemctl enable --now app
systemctl list-units --failed

# /etc/systemd/system/app.service
[Unit]
Description=App
After=network-online.target
Wants=network-online.target

[Service]
Type=simple
User=deploy
WorkingDirectory=/srv/app
EnvironmentFile=/etc/app/env
ExecStart=/srv/app/bin/app
Restart=on-failure
RestartSec=5
StandardOutput=journal
StandardError=journal

[Install]
WantedBy=multi-user.target

systemctl status app --no-pager
journalctl -u app -n 50 --no-pager
sudo -u deploy /srv/app/bin/app     # 手跑，看真实报错
ausearch -m avc -ts recent           # SELinux 拒绝记录

systemctl daemon-reload && systemctl restart app
systemctl cat app            # 确认 systemd 眼里这份文件长什么样

[Unit]
Wants=network-online.target
After=network-online.target

# 检查
systemctl list-dependencies app

apt update && apt install -y nginx
apt list --upgradable
apt purge nginx-common

dnf install -y nginx
dnf provides /usr/sbin/ss
dnf history undo last

rpm -qf /usr/bin/ss
dpkg -S /usr/bin/ss
dpkg -L nginx-common | head -20

du -sh /var/cache/apt /var/cache/dnf 2>/dev/null
apt clean && apt autoremove --purge -y
dnf clean all

# 全部容器（含已退出）
docker ps -a --format '{{.Names}}  {{.Status}}'

# 找已退出/反复重启的
docker ps -a --filter status=exited -n 5

# 谁把磁盘吃满了
docker ps -s --format '{{.Names}}  {{.Size}}'

docker logs -f --tail 200 -t myapp
docker logs --since 10m myapp | grep -i error

docker exec -it -u root myapp sh
docker exec myapp env | grep -i database
docker exec -it myapp bash -c 'ls -l /app'

docker inspect -f '{{.State.Status}} exit={{.State.ExitCode}}' myapp
docker inspect -f '{{range .NetworkSettings.Networks}}{{.IPAddress}}{{end}}' myapp
docker inspect --format '{{json .Mounts}}' myapp | jq

docker stats --no-stream --format '{{.Name}} {{.CPUPerc}} {{.MemUsage}}'
docker stats --no-stream -a

docker build -t myapp:1.2.3 .
docker build -f docker/Dockerfile.prod --build-arg NODE_ENV=prod --progress=plain -t myapp:prod .

docker compose -f docker-compose.yml -f docker-compose.prod.yml -p shop up -d --build
docker compose -p shop logs -f --tail 100 api
docker compose -p shop config

docker system df -v
docker image prune -a --filter until=24h
docker system prune --volumes

kubectl get pod -A -o wide
kubectl get pod -n shop -l app=api --show-labels
kubectl get pod -A --sort-by=.status.startTime

kubectl describe pod -n shop api-7d9f-abc12
kubectl describe node k8s-node-2 | tail -30

kubectl logs -f --tail 200 -n shop deploy/api
kubectl logs -n shop api-7d9f-abc12 --previous
kubectl logs -n shop api-7d9f-abc12 -c istio-proxy --since 10m

kubectl exec -it -n shop api-7d9f-abc12 -- sh
kubectl cp -n shop api-7d9f-abc12:/app/logs/app.log ./app.log
kubectl debug -it -n shop api-7d9f-abc12 --image=busybox --target=api

kubectl get events -A --sort-by=.lastTimestamp | tail -20
kubectl get events -n shop --field-selector type=Warning
kubectl get events -n shop --field-selector involvedObject.name=api-7d9f-abc12

kubectl apply -f deploy/api.yaml --dry-run=client -o yaml > api.gen.yaml
kubectl rollout status deploy/api -n shop
kubectl rollout undo deploy/api -n shop --to-revision=3
kubectl rollout restart deploy/api -n shop

kubectl port-forward -n shop svc/api 8080:80
kubectl port-forward -n shop --address 0.0.0.0 svc/api 8080:80
kubectl port-forward -n shop pod/api-7d9f-abc12 5432:5432

kubectl top node
kubectl top pod -A --sort-by=memory --containers
kubectl drain k8s-node-2 --ignore-daemonsets --delete-emptydir-data

strace -p 1234 -T -tt -s 200
strace -f -p 1234 -o /tmp/st.txt
strace -c -p 1234

strace -f -e trace=file -p 1234 -T
strace -f -e trace=network -p 1234 -tt
strace -o net.txt -e trace=openat,connect -f ./app

perf top
perf top -p 1234 -F 99
perf top -g

perf record -F 99 -g -p 1234 -o /tmp/perf.data
perf report -i /tmp/perf.data
perf script -i /tmp/perf.data > /tmp/perf.txt

pidstat -p 1234 1 10
pidstat -d -p ALL 1 5
pidstat -t -p 1234 1

iostat -x 1 5
vmstat 1 5
vmstat -d 1

gdb -p 1234 -ex 'thread apply all bt' -ex detach
gcore -o /tmp/core.1234 1234

vim +120 /etc/nginx/nginx.conf
vim -u NONE /etc/nginx/nginx.conf

:w      保存        :q!     放弃修改退出
:wq     保存退出    :x      有改动才存盘
:e!     重新加载    :saveas /tmp/a.conf  另存为

gg        文件首行            G        文件末行
42G       第 42 行            0        行首
^         行首首个非空白      $        行尾
w / b / e 下词首 / 上词首 / 词尾
Ctrl+f    下一页              Ctrl+b   上一页
%         跳到匹配的括号      ''       回到上次位置

dd / yy / p    删行 / 复制行 / 粘贴
5yy            复制 5 行
u / Ctrl+r     撤销 / 重做
x / r          删字符 / 替换一个字符
cc             改写整行（保留缩进）
.              重复上次修改（最值钱的一个键）
i / a / o / O  前插 / 后插 / 下方新行 / 上方新行

:%s/old/new/g        全文替换（每行所有匹配）
:%s/old/new/gc       每次替换前确认（改配置必加 c）
:10,20s/old/new/g    只替换第 10-20 行
:.,$s/old/new/g      当前行到文件末尾
:s#/usr/local/old#/usr/local/new#g   换分隔符，路径不用转义
:noh                 取消搜索高亮

Ctrl+v  I  Esc      块选中后每行行首插入（批量注释）
Ctrl+v  A  Esc      块选中后每行行尾追加
:g/^#/d             删除所有以 # 开头的行
:g/ERROR/s/old/new/g  只在含 ERROR 的行里替换
:sort u             选中行排序去重

:set paste           粘贴前关掉自动缩进
:set nopaste         粘完恢复
:set ff=unix         去掉 Windows 的 ^M
:set fileencoding=utf-8   修正编码后保存
:w !sudo tee %      忘了 sudo 时强制写回

uptime
free -h
df -h; df -i
vmstat 1 5

vmstat 1 5
pidstat -d 1 5
ps -eo state,pid,cmd | awk '$1=="D"'

free -h
vmstat 1 5    # 看 si / so
ps -eo pid,rss,comm --sort=-rss | head

curl -o /dev/null -s -w 'dns:%{time_namelookup} conn:%{time_connect} ttfb:%{time_starttransfer} total:%{time_total}\n' https://example.com/api
# nginx log_format 里加：
# $request_time $upstream_response_time

ping -c 50 10.0.0.5
mtr -r -c 50 10.0.0.5
ethtool -S eth0 | grep -iE 'err|drop'

echo "== 负载 =="; uptime
echo "== CPU 前 5 =="; ps aux --sort=-%cpu | head -6
echo "== 内存前 5 =="; ps aux --sort=-%mem | head -6
echo "== 内存 =="; free -h
echo "== 磁盘 =="; df -h | grep -vE 'tmpfs|overlay'
echo "== inode =="; df -i | grep -vE 'tmpfs|overlay'
echo "== 监听端口 =="; ss -tulnp
echo "== 失败服务 =="; systemctl list-units --failed --no-pager
echo "== 内核错误 =="; dmesg -T -l err | tail -10