以实战的角度解读 sort 、uniq、top、ps 、tty、grep 、egrep
# 快速定位占用cpu内存的进程
ps -e -o "comm,rsz,pmem,pcpu" | awk '{rsz[$1] += $2; mem[$1] += $3; cpu[$1] += $4 }END{ for(i in rsz){ print cpu[i],"\t"mem[i],"\t"rsz[i]/1024" MiB","\t"i}}' | awk '{if ($1 > 0 || $2 > 0 || $3 > 0) print $0}' | sort -k 4,4 ; history -c
0 0.2 4.625 MiB rsyslogd
0 0.2 5.41016 MiB dhclient
0 0.2 5.65234 MiB sftp-server
0 0.3 9.47266 MiB bash
0 0.4 15.4688 MiB nginxfrontend
0 0.4 8.05469 MiB vmtoolsd
0 0.4 8.78906 MiB NetworkManager
0 0.5 10.5234 MiB VGAuthService
0 0.6 12.7227 MiB polkitd
0 0.7 14.3594 MiB haproxy
0 0.8 17.0078 MiB tuned
0 1.4 28.8359 MiB firewalld
0 1.4 30.2227 MiB sshd
0 2.7 60.1836 MiB httpd
0 7.3 157.73 MiB php-fpm
sort命令是在Linux里非常有用，它将文件进行排序，并将排序结果标准输出。sort命令既可以从特定的文件，也可以从stdin中获取输入。 # sort将文件/文本的每一行作为一个单位，相互比较，比较原则是从首字符向后，依次按ASCII码值进行比较，最后将他们按升序输出。 # ASCII除特殊字符、标点符号外，按数字、大写字母、小写字母依次输出。 -b：忽略每行前面开始出的空格字符； -c：检查文件是否已经按照顺序排序； -d：排序时，处理英文字母、数字及空格字符外，忽略其他的字符； -f：排序时，将小写字母视为大写字母； -i：排序时，除了040至176之间的ASCII字符外，忽略其他的字符； -m：将几个排序号的文件进行合并； -M：将前面3个字母依照月份的缩写进行排序； -n：依照数值的大小排序； -o<输出文件>：将排序后的结果存入制定的文件； -r：以相反的顺序来排序； -t<分隔字符>：指定排序时所用的栏位分隔字符； +<起始栏位>-<结束栏位>：以指定的栏位来排序，范围由起始栏位到结束栏位的前一栏位。 -u: 去除重复行
sort -rk 1 -t " " sort.txt # 以空格间隔后，反向对第一列逐字符进行排序（实际上是从第1列开始一直到行尾排列下去） sohu 100 4500 guge 50 3000 google 110 5000 baidu 100 5000 sort -t ' ' -k 1.2,1.2 -nrk 3,3 facebook.txt # 以空格间隔后，正向对第1列第2个字符到第1列第2个字符进行排序的，再只对第3列进行逐字符进行反向排序 baidu 100 5000 google 110 5000 sohu 100 4500 guge 50 3000
提醒：如果服务器top显示CPU 1分钟、5分钟、15分钟过高，可能导致ps执行卡死。可以另开一个ssh窗口。kill提一个进程，再马上执行ps，此种情况是因为你还没有定位到原因的临时办法。
[root@VM_0_5_centos ~]# ps --help Usage: ps [options] Try 'ps --help <simple|list|output|threads|misc|all>' # human or 'ps --help <s|l|o|t|m|a>' # simple for additional help text. For more details see ps(1). # 更多详见 man ps
ps的参数控制分为2类：
[root@VM_0_5_centos ~]# ps --help a
Usage:
ps [options]
Basic options: #基本操作 [横向控制参数]
-A, -e all processes
-a all with tty, except session leaders
a all with tty, including other users
-d all except session leaders
-N, --deselect negate selection
r only running processes
T all processes on this terminal
x processes without controlling ttys
Selection by list: [横向控制参数]
-C <command> command name
-G, --Group <GID> real group id or name
-g, --group <group> session or effective group name
-p, p, --pid <PID> process id
--ppid <PID> parent process id
-q, q, --quick-pid <PID>
process id (quick mode)
-s, --sid <session> session id
-t, t, --tty <tty> terminal
-u, U, --user <UID> effective user id or name
-U, --User <UID> real user id or name
The selection options take as their argument either:
a comma-separated list e.g. '-u root,nobody' or
a blank-separated list e.g. '-p 123 4567'
---------------------------------------------------------------#输出显示控制
Output formats: #输出显示控制。 [纵向控制参数]
#以下控制是否输出相应列
-F extra full
-f full-format, including command lines
f, --forest ascii art process tree
-H show process hierarchy
-j jobs format
j BSD job control format
-l long format
l BSD long format
-M, Z add security data (for SELinux)
# 以下输出任意定义列
-O <format> preloaded with default columns
O <format> as -O, with BSD personality
-o, o, --format <format>
user-defined format : ps -e -o pid,rss,comm
# 输出预定义列 [纵向控制参数]
# s u v X 是预定义的几种输出，后文有输出示例
s signal format
u user-oriented format
v virtual memory format
X register format
-y do not show flags, show rss vs. addr (used with -l)
--context display security context (for SELinux)
--headers repeat header lines, one per page
#满屏自动再次添加表头信息（大概在第7行处），不再用向上找对应的表头。简化参数 h有冲突，不建议使用
--no-headers do not print header at all
--cols, --columns, --width <num>
set screen width
--rows, --lines <num>
set screen height
---------------------------------------------------------------#显示多线程信息
Show threads: #显示多线程信息 [纵向控制参数]
H as if they were processes
-L possibly with LWP and NLWP columns
-m, m after processes
-T possibly with SPID column
---------------------------------------------------------------#杂项
Miscellaneous options: # 杂项
-c show scheduling class with -l option
c show true command name
e show the environment after command #显示命令的环境变量 ps e
k, --sort specify sort order as: [+|-]key[,[+|-]key[,...]]
L show format specifiers #显示列标题对应关系（重要，有用）,ps L ,详见下文Appendix
n display numeric uid and wchan
S, --cumulative include some dead child process data
-y do not show flags, show rss (only with -l)
-V, V, --version display version information and exit
-w, w unlimited output width
--help <simple|list|output|threads|misc|all>
display help and exit
For more details see ps(1).
USER - Username : The name of the user associated with the process.PID - Process ID : The unique numeric identifier assigned to the process.%CPU - Percentage of CPU: Time used (total CPU time divided by length of time the process has been running).%MEM - Percentage of RAM Memory: used (memory used divided by total memory available).VSZ - Virtual Memory Size: Size of the process in virtual memory expressed in KiB.RSS - Resident Set Size.TTY - Terminal controlling the process.STAT - Process State - Possible values.START: The date or time at which the process started.TIME: Cumulative CPU time used by the process and the child processes started by the process.COMMAND: Command used to start the process.By default, the result will be in unsorted form. If we want to sort by particular column, we can add –sort option into ps command.
[root@centos77 ]# ps
PID TTY TIME CMD
3424 pts/0 00:00:00 bash
3442 pts/0 00:00:00 bash
7617 pts/0 00:00:00 ps
[root@centos77 ]# ps -e | head
PID TTY TIME CMD
1 ? 00:00:02 systemd
2 ? 00:00:00 kthreadd
4 ? 00:00:00 kworker/0:0H
6 ? 00:00:00 ksoftirqd/0
7 ? 00:00:00 migration/0
[root@centos77 ]# ps -e -L | head
PID LWP TTY TIME CMD
1 1 ? 00:00:02 systemd
2 2 ? 00:00:00 kthreadd
11 11 ? 00:00:00 watchdog/0
[root@centos77 ]# ps -e -f -L | head
# + UID PPID NLWP STIME
UID PID PPID LWP C NLWP STIME TTY TIME CMD
root 1 0 1 0 1 09:53 ? 00:00:02 /usr/lib/systemd/systemd --switched-root --system --deserialize 22
root 2 0 2 0 1 09:53 ? 00:00:00 [kthreadd]
root 4 2 4 0 1 09:53 ? 00:00:00 [kworker/0:0H]
root 11 2 11 0 1 09:53 ? 00:00:00 [watchdog/0]
[root@centos77 ]# ps -e -F -L | head
# + SZ RSS PSR
UID PID PPID LWP C NLWP SZ RSS PSR STIME TTY TIME CMD
root 1 0 1 0 1 47656 3904 0 09:53 ? 00:00:02 /usr/lib/systemd/systemd --switched-root --system --deserialize 22
root 2 0 2 0 1 0 0 3 09:53 ? 00:00:00 [kthreadd]
root 11 2 11 0 1 0 0 0 09:53 ? 00:00:00 [watchdog/0]
STAT 状态过虑参数
| ps -ef r | 只显示 R+运行中的进程，r = running |
| ps -N | -N 输出不带-N时未输出的部分。示例ps -ef = ps -N |
上面的对比可以归结为一句话：“线程快而进程可靠性高”。线程有个别名叫“轻量级进程”，在有的书籍资料上介绍线程可以十倍、百倍的效率快于进程； 而进程之间不共享数据，没有锁问题，结构简单，一个进程崩溃不像线程那样影响全局，因此比较可靠。我相信这个观点可以被大部分人所接受，因为和我们所接受的知识概念是相符的。
THREAD DISPLAY #显示线程
H Show threads as if they were processes.
-L Show threads, possibly with LWP and NLWP columns.
m Show threads after processes.
-m Show threads after processes.
-T Show threads, possibly with SPID column.
[root@centos77 ]# ps -C nginx -L #从输出可以验证nginx是多进程而非多线程的。[一个进程仅一个线程]
PID LWP TTY TIME CMD
7964 7964 ? 00:00:00 nginx
7965 7965 ? 00:00:00 nginx
7966 7966 ? 00:00:00 nginx
7967 7967 ? 00:00:00 nginx
7968 7968 ? 00:00:00 nginx
[root@centos77 ]# ps -C nginx -m O lwp
PID LWP S TTY TIME COMMAND
7964 - - ? 00:00:00 nginx
- 7964 S - 00:00:00 -
7965 - - ? 00:00:00 nginx
- 7965 S - 00:00:00 -
7966 - - ? 00:00:00 nginx
- 7966 S - 00:00:00 -
7967 - - ? 00:00:00 nginx
- 7967 S - 00:00:00 -
7968 - - ? 00:00:00 nginx
- 7968 S - 00:00:00 -
[root@VM_0_5_centos ~]# ps -C docker-proxy -m O lwp #多线程
PID LWP S TTY TIME COMMAND
9056 - - ? 00:00:01 docker-proxy
- 9056 S - 00:00:00 -
- 9057 S - 00:00:01 -
- 9058 S - 00:00:00 -
- 9059 S - 00:00:00 -
- 9060 S - 00:00:00 -
[root@VM_0_5_centos ~]# ps -C dockerd -m O lwp
PID LWP S TTY TIME COMMAND
3703 - - ? 00:08:23 dockerd
- 3703 S - 00:00:00 -
- 3707 S - 00:00:53 -
- 3708 S - 00:00:00 -
- 3709 S - 00:00:00 -
[root@centos77 ~]# ps -e s | head
UID PID PENDING BLOCKED IGNORED CAUGHT STAT TTY TIME COMMAND
0 1 0000000000000000 7be3c0fe28014a03 0000000000001000 00000001800004ec Ss ? 5:46 /usr/lib/systemd/systemd --switched-root --system --deserialize 22
0 2 0000000000000000 0000000000000000 ffffffffffffffff 0000000000000000 S ? 0:00 [kthreadd]
0 4 0000000000000000 0000000000000000 ffffffffffffffff 0000000000000000 S< ? 0:00 [kworker/0:0H]
0 6 0000000000000000 0000000000000000 ffffffffffffffff 0000000000000000 S ? 0:54 [ksoftirqd/0]
[root@centos77 ~]# ps -e u | head
USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND
root 1 0.0 0.2 191144 2920 ? Ss Jan30 5:46 /usr/lib/systemd/systemd --switched-root --system --deserialize 22
root 2 0.0 0.0 0 0 ? S Jan30 0:00 [kthreadd]
root 4 0.0 0.0 0 0 ? S< Jan30 0:00 [kworker/0:0H]
root 6 0.0 0.0 0 0 ? S Jan30 0:54 [ksoftirqd/0]
[root@centos77 ~]# ps -e v | head
PID TTY STAT TIME MAJFL TRS DRS RSS %MEM COMMAND
1 ? Ss 5:46 366 1416 189727 2920 0.2 /usr/lib/systemd/systemd --switched-root --system --deserialize 22
2 ? S 0:00 0 0 0 0 0.0 [kthreadd]
4 ? S< 0:00 0 0 0 0 0.0 [kworker/0:0H]
6 ? S 0:54 0 0 0 0 0.0 [ksoftirqd/0]
[root@centos77 ~]# ps -e X | head
PID STACKP ESP EIP TMOUT ALARM STAT TTY TIME COMMAND
1 b25c59a0 b25c4c00 3bcbfe63 - - Ss ? 5:46 /usr/lib/systemd/systemd --switched-root --system --deserialize 22
2 00000000 00000000 00000000 - - S ? 0:00 [kthreadd]
4 00000000 00000000 00000000 - - S< ? 0:00 [kworker/0:0H]
6 00000000 00000000 00000000 - - S ? 0:54 [ksoftirqd/0]
[root@centos ~]# tty
# man tty - print the file name of the terminal connected to standard input
/dev/pts/1
# 每用putty打开一个到服务器的连接，都将产生一个tty编号。
# echo hello > /dev/pts/2 #可以跨tty输送信息到指定tty，信息将仅输出在另一个tty上，当前tty不输出。
# echo hello > `tty` #输出到当前tty
[root@centos ~]# ps --tty `tty`
PID TTY TIME CMD
21683 pts/1 00:00:00 bash
21704 pts/1 00:00:00 bash
25699 pts/1 00:00:00 ps
[root@centos ~]# ps --tty `tty` -N
PID TTY TIME CMD
1 ? 00:05:53 systemd
2 ? 00:00:00 kthreadd
4 ? 00:00:00 kworker/0:0H
6 ? 00:00:55 ksoftirqd/0
7 ? 00:00:00 migration/0
...省略n多行
1123 tty1 00:00:00 agetty # vmware console
1124 ttyS0 00:00:00 agetty
1142 ? 00:00:00 kworker/u2:2
1226 ? 00:00:18 sgagent
1239 ? 00:00:28 barad_agent
[root@centos ~]# ps
PID TTY TIME CMD
21683 pts/1 00:00:00 bash
21704 pts/1 00:00:00 bash
25720 pts/1 00:00:00 ps
[root@centos77 ~]# ps L %cpu %CPU %mem %MEM _left LLLLLLLL _left2 L2L2L2L2 _right RRRRRRRR _right2 R2R2R2R2 _unlimited U _unlimited2 U2 alarm ALARM args COMMAND atime TIME blocked BLOCKED bsdstart START bsdtime TIME c C caught CAUGHT cgroup CGROUP class CLS cls CLS cmd CMD comm COMMAND command COMMAND context CONTEXT cp CP cpuid CPUID cputime TIME drs DRS dsiz DSIZ egid EGID egroup EGROUP eip EIP esp ESP etime ELAPSED etimes ELAPSED euid EUID euser EUSER f F fgid FGID fgroup FGROUP flag F flags F fname COMMAND fsgid FSGID fsgroup FSGROUP fsuid FSUID fsuser FSUSER fuid FUID fuser FUSER gid GID group GROUP ignored IGNORED intpri PRI ipcns IPCNS label LABEL lastcpu C lim LIM longtname TTY lsession SESSION lstart STARTED
[root@centos77 ~]# ps L # 分栏 续 luid LUID lwp LWP m_drs DRS m_size SIZE m_trs TRS machine MACHINE maj_flt MAJFL majflt MAJFLT min_flt MINFL minflt MINFLT mntns MNTNS netns NETNS ni NI nice NI nlwp NLWP nwchan WCHAN opri PRI ouid OWNER pagein PAGEIN pcpu %CPU pending PENDING pgid PGID pgrp PGRP pid PID pidns PIDNS pmem %MEM policy POL ppid PPID pri PRI ppid PPID pri PRI pri_api API pri_bar BAR pri_baz BAZ pri_foo FOO priority PRI psr PSR rgid RGID rgroup RGROUP rss RSS # RSS - Resident Set Size 实际使用物理内存 rssize RSS rsz RSZ rtprio RTPRIO ruid RUID ruser RUSER s S sched SCH seat SEAT sess SESS session SESS sgi_p P sgi_rss RSS sgid SGID sgroup SGROUP sid SID sig PENDING sig_block BLOCKED sig_catch CATCHED
[root@centos77 ~]# ps L # 分栏 续 sig_ignore IGNORED sig_pend SIGNAL sigcatch CAUGHT sigignore IGNORED sigmask BLOCKED size SIZE slice SLICE spid SPID stackp STACKP start STARTED start_stack STACKP start_time START stat STAT state S stime STIME suid SUID supgid SUPGID supgrp SUPGRP suser SUSER svgid SVGID svgroup SVGROUP svuid SVUID svuser SVUSER sz SZ tgid TGID thcgr THCGR thcount THCNT tid TID time TIME tname TTY tpgid TPGID trs TRS trss TRSS tsig PENDING tsiz TSIZ tt TT tty TT tty4 TTY tty8 TTY ucmd CMD ucomm COMMAND uid UID uid_hack UID uname USER unit UNIT user USER userns USERNS util C utsns UTSNS uunit UUNIT vsize VSZ vsz VSZ wchan WCHAN wname WCHAN zone ZONE # 完。共170余
# yum install glances Dependencies Resolved ================================================================================================================= Package Arch Version Repository Size ================================================================================================================= Installing: glances noarch 2.5.1-1.el7 epel 440 k Installing for dependencies: python-backports x86_64 1.0-8.el7 base 5.8 k python-backports-ssl_match_hostname noarch 3.5.0.1-1.el7 base 13 k python-ipaddress noarch 1.0.16-2.el7 base 34 k python-setuptools noarch 0.9.8-7.el7 base 397 k python2-psutil x86_64 5.6.7-1.el7 epel 399 k Transaction Summary ================================================================================================================= Install 1 Package (+5 Dependent packages) Total download size: 1.3 M Installed size: 6.0 M Is this ok [y/d/N]:
[root@centos76 ~]# glances
centos77 (CentOS Linux 7.7.1908 64bit / Linux 3.10.0-1062.el7.x86_64) Uptime: 15:16:23
CPU [ 0.9%] CPU 0.9% nice: 0.0% MEM 26.8% active: 476M SWAP 0.0% LOAD 4-core
MEM [ 26.8%] user: 0.5% irq: 0.0% total: 1.93G inactive: 480M total: 2.00G 1 min: 0.05
SWAP [ 0.0%] system: 0.3% iowait: 0.0% used: 531M buffers: 2.06M used: 0 5 min: 0.03
idle: 99.2% steal: 0.0% free: 1.42G cached: 852M free: 2.00G 15 min: 0.05
NETWORK Rx/s Tx/s TASKS 169 (190 thr), 1 run, 168 slp, 0 oth sorted automatically by cpu_percent, flat view
ens33 536b 2Kb
ens34 0b 0b CPU% MEM% VIRT RES PID USER NI S TIME+ IOR/s IOW/s Command
lo 256b 256b 3.5 0.8 225M 15.9M 9096 root 0 R 0:00.40 0 0 /usr/bin/python /usr
0.0 0.0 0 0 1904 root 0 S 0:01.28 0 0 kworker/2:0
DISK I/O R/s W/s 0.0 0.1 43.5M 1.85M 582 root 0 S 0:02.39 0 0 /usr/lib/systemd/sys
dm-0 0 1K 0.0 0.0 0 0 29 root -20 S 0:00.00 0 0 netns
dm-1 0 0 0.0 0.0 0 0 38 root -20 S 0:00.00 0 0 edac-poller
dm-2 0 0 0.0 0.1 25.5M 1.75M 795 root 0 S 0:00.59 0 0 /usr/lib/systemd/sys
sda 0 1K 0.0 0.0 0 0 12 root 0 S 0:00.16 0 0 watchdog/1
sda1 0 0 0.0 0.0 0 0 471 root -20 S 0:00.00 0 0 xfs-log/dm-0
sda2 0 1K 0.0 0.1 113M 2.08M 1271 root 0 S 0:02.71 0 0 -bash
sr0 0 0 0.0 0.1 81.6M 1.74M 7964 root 0 S 0:00.00 0 0 nginx: master proces
sr1 0 0 0.0 0.0 0 0 468 root -20 S 0:00.00 0 0 xfs-conv/dm-0
0.0 0.0 0 0 739 root -20 S 0:00.00 0 0 xfs-cil/dm-2
FILE SYS Used Total 0.0 0.0 0 0 473 root 0 S 0:10.65 0 0 xfsaild/dm-0
/ 9.27G 50.0G 0.0 0.4 317M 7.61M 1549 nginx 0 S 0:00.10 0 0 php-fpm: pool pod
/boot 136M 1014M 0.0 0.0 0 0 349 root -20 S 0:00.00 0 0 scsi_tmf_2
/home 32.4M 971G 0.0 0.1 87.8M 2.20M 1701 root 0 S 0:00.42 0 0 /usr/libexec/postfix
0.0 0.0 0 0 18 root 0 S 0:00.30 0 0 migration/2
0.0 0.1 70.3M 2.83M 8917 root 0 S 0:00.10 0 0 /usr/libexec/openssh
0.0 0.0 0 0 47 root 19 S 0:00.52 0 0 khugepaged
0.0 0.2 186M 3.81M 1 root 0 S 0:23.10 0 0 /usr/lib/systemd/sys
0.0 0.3 157M 6.17M 8873 root 0 S 0:00.40 0 0 sshd: root@notty
0.0 0.7 321M 13.8M 3652 nginx 0 S 0:02.60 0 0 php-fpm: pool www
0.0 0.0 0 0 21 root -20 S 0:00.00 0 0 kworker/2:0H
0.0 0.0 118M 732K 9002 root 0 S 0:00.00 0 0 /usr/sbin/anacron -s
0.0 0.2 82.2M 3.27M 7967 nginx 0 S 0:00.11 0 0 nginx: worker proces
0.0 0.0 0 0 741 root -20 S 0:00.00 0 0 xfs-log/dm-2
0.0 0.7 321M 13.9M 1553 nginx 0 S 0:03.62 0 0 php-fpm: pool www
0.0 0.0 0 0 706 root -20 S 0:00.00 0 0 xfs-buf/sda1
0.0 0.8 323M 15.9M 1551 nginx 0 S 0:03.62 0 0 php-fpm: pool www
0.0 0.0 0 0 7200 root 0 S 0:00.65 0 0 kworker/3:2
0.0 0.1 113M 2.07M 8858 root 0 S 0:06.36 0 0 /bin/bash -i
0.0 0.8 323M 16.0M 3617 nginx 0 S 0:03.36 0 0 php-fpm: pool www
0.0 0.0 0 0 16 root -20 S 0:00.00 0 0 kworker/1:0H
0.0 0.0 0 0 36 root -20 S 0:00.00 0 0 kblockd
0.0 0.0 0 0 6 root 0 S 0:00.17 0 0 ksoftirqd/0
0.0 0.0 0 0 10 root -20 S 0:00.00 0 0 lru-add-drain
2020-03-08 10:08:14 No warning or critical alert detected
Dependencies Resolved ============================================================================================ Package Arch Version Repository Size ============================================================================================ Installing: htop x86_64 2.2.0-3.el7 epel 103 k Transaction Summary ============================================================================================ Install 1 Package Total download size: 103 k Installed size: 218 k Is this ok [y/d/N]:
[root@centos76 ~]# htop
1 [ 0.0%] Tasks: 64, 21 thr; 1 running
2 [ 0.0%] Load average: 0.00 0.01 0.05
3 [ 0.0%] Uptime: 15:11:54
4 [ 0.0%]
Mem[||||||||||||||||||||||||||||||| 343M/1.93G]
Swp[ 0K/2.00G]
PID USER PRI NI VIRT RES SHR S CPU% MEM% TIME+ Command
9054 root 20 0 119M 2400 1464 R 0.0 0.1 0:00.01 htop
1 root 20 0 186M 3904 2584 S 0.0 0.2 0:02.89 /usr/lib/systemd/systemd --switched-root --system --
554 root 20 0 38812 5080 4760 S 0.0 0.3 0:02.74 /usr/lib/systemd/systemd-journald
576 root 20 0 185M 1356 968 S 0.0 0.1 0:00.00 /usr/sbin/lvmetad -f
582 root 20 0 44536 1892 1320 S 0.0 0.1 0:01.03 /usr/lib/systemd/systemd-udevd
763 root 16 -4 55256 892 484 S 0.0 0.0 0:00.16 /sbin/auditd
762 root 16 -4 55256 892 484 S 0.0 0.0 0:00.59 /sbin/auditd
785 root 20 0 21412 1300 988 S 0.0 0.1 0:01.55 /usr/sbin/irqbalance --foreground
788 dbus 20 0 57984 2520 1840 S 0.0 0.1 0:02.85 /usr/bin/dbus-daemon --system --address=systemd: --n
811 polkitd 20 0 598M 13028 4944 S 0.0 0.6 0:00.00 /usr/lib/polkit-1/polkitd --no-debug
813 polkitd 20 0 598M 13028 4944 S 0.0 0.6 0:00.74 /usr/lib/polkit-1/polkitd --no-debug
794 polkitd 20 0 598M 13028 4944 S 0.0 0.6 0:01.37 /usr/lib/polkit-1/polkitd --no-debug
795 root 20 0 26148 1796 1472 S 0.0 0.1 0:00.59 /usr/lib/systemd/systemd-logind
799 root 20 0 120M 1524 916 S 0.0 0.1 0:00.05 /usr/sbin/crond -n
804 chrony 20 0 115M 1844 1376 S 0.0 0.1 0:00.11 /usr/sbin/chronyd
805 root 20 0 98952 2676 1996 S 0.0 0.1 0:00.02 login -- root
1217 root 20 0 350M 29528 7044 S 0.0 1.5 0:00.00 /usr/bin/python2 -Es /usr/sbin/firewalld --nofork --
819 root 20 0 350M 29528 7044 S 0.0 1.5 0:04.20 /usr/bin/python2 -Es /usr/sbin/firewalld --nofork --
931 root 20 0 537M 8996 6788 S 0.0 0.4 0:00.64 /usr/sbin/NetworkManager --no-daemon
919 root 20 0 537M 8996 6788 S 0.0 0.4 0:10.14 /usr/sbin/NetworkManager --no-daemon
1122 root 20 0 264M 8248 5216 S 0.0 0.4 0:00.00 /usr/sbin/vmtoolsd
1038 root 20 0 264M 8248 5216 S 0.0 0.4 0:32.13 /usr/sbin/vmtoolsd
1094 root 20 0 66216 10776 7528 S 0.0 0.5 0:00.07 /usr/lib/vmware-vgauth/VGAuthService -s
1271 root 20 0 112M 2128 1644 S 0.0 0.1 0:00.15 -bash
1787 root 20 0 295M 6088 4992 S 0.0 0.3 0:03.21 /usr/sbin/rsyslogd -n
1477 root 20 0 295M 6088 4992 S 0.0 0.3 0:03.78 /usr/sbin/rsyslogd -n
1779 root 20 0 560M 17416 6116 S 0.0 0.9 0:00.00 /usr/bin/python2 -Es /usr/sbin/tuned -l -P
1780 root 20 0 560M 17416 6116 S 0.0 0.9 0:04.16 /usr/bin/python2 -Es /usr/sbin/tuned -l -P
1483 root 20 0 110M 4364 3332 S 0.0 0.2 0:00.01 /usr/sbin/sshd -D
F1 Help F2 Setup F3 Search F4 Filter F5 Tree F6 SortBy F7 Nice -F8 Nice +F9 Kill F10 Quit
#vmstat 帮助
[root@centos76 ~]# vmstat --help Usage: vmstat [options] [delay [count]] Options: -a, --active active/inactive memory -f, --forks number of forks since boot -m, --slabs slabinfo -n, --one-header do not redisplay header -s, --stats event counter statistics -d, --disk disk statistics -D, --disk-sum summarize disk statistics -p, --partition <dev> partition specific statistics -S, --unit <char> define display unit -w, --wide wide output -t, --timestamp show timestamp -h, --help display this help and exit -V, --version output version information and exit For more details see vmstat(8).
# vmstat -s 统计输出结果
[root@centos76 ~]# vmstat -s
2027968 K total memory
336568 K used memory
473460 K active memory
490952 K inactive memory
817128 K free memory
2108 K buffer memory
872164 K swap cache
2097148 K total swap
0 K used swap
2097148 K free swap
4576 non-nice user cpu ticks
6 nice user cpu ticks
9572 system cpu ticks
22016107 idle cpu ticks
981 IO-wait cpu ticks
0 IRQ cpu ticks
552 softirq cpu ticks
0 stolen cpu ticks
691768 pages paged in
320668 pages paged out
0 pages swapped in
0 pages swapped out
3591361 interrupts
5227789 CPU context switches
1583578311 boot time
9268 forks
[root@centos76 ~]#
[root@centos76 ~]# free --help
Usage:
free [options]
Options:
-b, --bytes show output in bytes
-k, --kilo show output in kilobytes
-m, --mega show output in megabytes
-g, --giga show output in gigabytes
--tera show output in terabytes
--peta show output in petabytes
-h, --human show human-readable output
--si use powers of 1000 not 1024
-l, --lohi show detailed low and high memory statistics
-t, --total show total for RAM + swap
-s N, --seconds N repeat printing every N seconds
-c N, --count N repeat printing N times, then exit
-w, --wide wide output
--help display this help and exit
-V, --version output version information and exit
For more details see free(1).
[root@centos76 ~]# free -t -m -h -w
total used free shared buffers cache available
Mem: 1.9G 340M 461M 25M 2.1M 1.1G 1.4G
Swap: 2.0G 0B 2.0G
Total: 3.9G 340M 2.5G
[root@centos76 ~]# free -hw
total used free shared buffers cache available
Mem: 1.9G 344M 458M 25M 2.1M 1.1G 1.4G
Swap: 2.0G 0B 2.0G
使用free命令查看内存信息，最重要的是理解当前系统的可用内存并不是直接看 free 字段就可以看出来的，应该参考的是
可用内存 = free + buffers + cached
除去标题行之后，第一行为 物理内存使用统计：
| 标题 | 说明 |
|---|---|
| total | 物理内存总量 total = used + free |
| used | 已使用内存总量，包含应用使用量+buffer+cached |
| free | 空闲内存总量 |
| shared | 共享内存总量 |
| buffers | 块设备所占用的缓存 |
| cached | 普通文件数据所占用的缓存 |
| available | 当前可用内存总量（可用于分配给应用的，不包含虚拟内存） |
对于
available字段，在内核3.14中，它会从/proc/meminfo中的MemAvailable读取，在内核2.6.27+的系统上采用模拟的方式获取，其它情况下直接与free的值相同。
第二行-/+ buffers/cache 中只有两列used和free有值，它们是物理内存的调整值
| 标题 | 说明 |
|---|---|
| used | 已使用内存（used）减去buffer和cached之后的内存，也就是应用正在使用的内存总量 |
| free | 空闲内存加上buffer和cached之后的内存，也就是真正的可用内存总量 |
第三行为交换分区使用统计
| 标题 | 说明 |
|---|---|
| total | 交换分区内存总量 |
| used | 正在使用的交换分区内存 |
| free | 空闲交换分区内存 |
在上面这些指标中，我们需要注意的是在下面这些情况下，系统是正常的，不需要担心
下面情况说明内存过低，需要注意！
dmesg | grep oom-killer显示有OutOfMemory-killer正在运行