Saturday, April 28, 2012

How to use 'ls' command to list only directories?

# ls -ld */
(or)
# ls -lp | grep ^dr
(or)  
# ls -pl | grep /$


To display the size of each folder listed above:

# ls -ld */ | awk '{print $9}' | xargs du -sh

Tuesday, April 24, 2012

How to know File creation time in Linux ?

In Linux or any Unix flavors, file-creation time isn't maintained. It will get change when the file-content changes. I tested and confirmed this 1.5 years before and shared my test results in this post.
http://ashok-linux-tips.blogspot.com/2010/11/finding-file-creation-time-in-linux.html

Now the good news is, with 'EXT4' file-system it is possible to get the File-creation time.

Here's the test results performed on a EXT4 file-system:
root@Linux-Mach # df -h
Filesystem            Size    Used   Avail   Use% Mounted on
/dev/sda2             3.8G  2.2G    1.4G   62%   /
/dev/sda3             4.6G  139M  4.3G    4%     /home
/dev/sda1              46M   11M   33M   25%   /boot
tmpfs                   333M     0      333M  0%    /dev/shm
root@Linux-Mach # cd /opt
root@Linux-Mach # touch sample_file
root@Linux-Mach # ls -l sample_file
-rw-r--r-- 1 root root 0 2012-04-24 18:35 sample_file                    # File-creation time is 18:35

root@Linux-Mach # date
Tue Apr 24 18:40:12 CDT 2012
root@Linux-Mach # cat > sample_file           
This is test file to check creation time of this file.
Ctrl+D
root@Linux-Mach # ls -l sample_file  
-rw-r--r-- 1 root root 29 2012-04-24 18:40 sample_file
root@Linux-Mach # ls -i sample_file  
135528 sample_file                                                                    # inode number  
root@Linux-Mach # debugfs -R 'stat <135528>' /dev/sda2          
Inode 14552801   Type regular    Mode  0644   Flags 0x80000
Generation 340511001    Version 0x0000000000000001
User  1000   Group  1000   Size 29 
File ACL 0    Directory ACL 0 
Links 1   Blockcount 8 
Fragment  Address 0    Number 0    Size 0
 ctime 0x3f1da5b513cbff4 -- Tue Apr 24 18:40:51 2012
 atime 0x3f1da5ec8725434 -- Tue Apr 24 18:40:54 2012
 mtime 0x3f1da5b513cbff4 -- Tue Apr 24 18:40:51 2012
crtime 0x3f1cacc966104fc -- Tue Apr 24 18:35:28 2012             # we could see file creation time    
Size of extra inode fields 28
EXTENTS
(0) 44665199
debugfs 1.41.11 (14-Mar-2010)
root@Linux-Mach #

Please note the entry "crtime"  which displays the file-creation time. In my view, this information would be of great help in certain situations.

Monday, April 23, 2012

Listing and Extracting files from a RPM

As far I know, there are 3 ways available to list the files inside a RPM and they are as follows:
 To list only files:
# rpm -qlp  packagename.rpm

To list files with permission with ownership:
# rpm2cpio packagename.rpm | cpio -tv

 To list files with detailed description about the RPM:
# less packagename.rpm

Next to extract a file from a RPM, we can again use the 'rpm2cpio' command along with 'cpio' with different switches as shown as follows: 

 [root@hostxyx tmp]# rpm2cpio packagename.rpm | cpio -idvm
./etc/blkid
./etc/mke2fs.conf
./sbin/badblocks
./sbin/blkid
./sbin/debugfs
./sbin/dumpe2fs
./sbin/e2image
./sbin/fsck
./sbin/logsave
./sbin/resize2fs
./usr/bin/chattr
.
.
<Output truncated>


The above command will create directories such as ./etc, ./sbin, ./usr under the folder where RPM is kept. Please note this wouldn't install the RPM on the system, it will only extract the files. Once you grab the file that you wish to, just delete all the directories that are created. Never execute this command being in /, as it will mess up the entire file-system.

Thursday, April 12, 2012

How to log commands executed by all the users in Linux?

By adding the following entry in /etc/bashrc, we can log the commands executed by all the users on a Linux machine. 
This would be certainly helpful for tracking commands on Critical servers.

PROMPT_COMMAND='history -a >(logger -t "$USER[$PWD] $SSH_CONNECTION")'

After you add the above entry at the end of /etc/bashrc file, execute the command 'source /etc/bashrc' or logout and login back to your session. Now the commands executed by all the users will be logged in /var/log/messages.
Note: If you wish to log the commands on to a different file, please check the solution given in the comments section.

Sample test result:

Apr 18 13:35:21 Linux-Mach root[/root] 192.168.4.5 51650 172.16.0.252 22: uptime
Apr 18 13:35:24 Linux-Mach root[/opt] 192.168.4.5 51650 172.16.0.252 22: cd /opt
Apr 18 13:35:26 Linux-Mach root[/opt] 192.168.4.5 51650 172.16.0.252 22: ls -lR
Apr 18 13:35:35 Linux-Mach root[/opt] 192.168.4.5 51650 172.16.0.252 22: iostat -x 2
Apr 18 13:35:39 Linux-Mach root[/root] 192.168.4.5 51650 172.16.0.252 22: cd /root
Apr 18 13:35:39 Linux-Mach root[/root] 192.168.4.5 51650 172.16.0.252 22: ls -l
Apr 18 13:35:51 Linux-Mach root[/home] 192.168.4.5 51650 172.16.0.252 22: cd /home
Apr 18 13:35:52 Linux-Mach root[/home] 192.168.4.5 51650 172.16.0.252 22: ls
Apr 18 13:35:56 Linux-Mach root[/home] 192.168.4.5 51650 172.16.0.252 22: httpd -t

Apr 18 13:51:24 Linux-Mach test1[/home/test1] 192.168.6.8 9106 172.16.0.252 22: ls -l
Apr 18 13:53:20 Linux-Mach test1[/var/lock/subsys] 192.168.6.8 9106 172.16.0.252 22: cd /var/lock/subsys
Apr 18 13:53:30 Linux-Mach test1[/var/lock/subsys] 192.168.6.8 9106 10.160.0.252 22: ls -ltr


Updated one:

# echo $PROMPT_COMMAND

RETRN_VAL=$?;logger -p local3.debug "$(whoami)  $remoteip  [$$]: $(history 1 | sed "s/^[ ]*[0-9]\+[ ]*//") [$RETRN_VAL]"


On RHEL 8.x



[root@rhel8 ]# cat /etc/profile.d/prompt.sh 

remoteip=$(who am i | awk '{print $5}' | sed "s/[()]//g")

export PROMPT_COMMAND='RETRN_VAL=$?;logger -p local3.debug "$(whoami)  $remoteip  [$$]: $(history 1 | sed "s/^[ ]*[0-9]\+[ ]*//") [$RETRN_VAL]"'

[root@rhel8 ]#