1
00:00:00,960 --> 00:00:02,040
In this lesson,

2
00:00:02,040 --> 00:00:05,010
you're going to learn to leverage Linux's modular nature

3
00:00:05,010 --> 00:00:07,200
in order to monitor system processes

4
00:00:07,200 --> 00:00:09,660
and determine if it's operating properly.

5
00:00:09,660 --> 00:00:11,370
You're also going to learn the tools available

6
00:00:11,370 --> 00:00:13,560
for you to be able to monitor kernel modules

7
00:00:13,560 --> 00:00:15,180
and perform fixed operations

8
00:00:15,180 --> 00:00:18,000
without having the overall system impacted.

9
00:00:18,000 --> 00:00:19,560
The first thing we're going to talk about

10
00:00:19,560 --> 00:00:21,450
is the /proc directory,

11
00:00:21,450 --> 00:00:24,750
which is a virtual file system or VFS.

12
00:00:24,750 --> 00:00:27,780
The /proc directory provides significant information

13
00:00:27,780 --> 00:00:30,150
about the kernel's running processes.

14
00:00:30,150 --> 00:00:33,270
Now there are various files in the /proc directory.

15
00:00:33,270 --> 00:00:35,790
We're only going to cover a couple of key ones.

16
00:00:35,790 --> 00:00:39,870
First, let's talk about /proc/cmdline

17
00:00:39,870 --> 00:00:40,773
or /cmdline.

18
00:00:41,670 --> 00:00:44,520
This is a file that contains options passed to the kernel

19
00:00:44,520 --> 00:00:45,480
by the boot loader

20
00:00:45,480 --> 00:00:47,130
when you boot up the system.

21
00:00:47,130 --> 00:00:49,950
This includes things like mounting the kernel as read only,

22
00:00:49,950 --> 00:00:51,450
and things like that.

23
00:00:51,450 --> 00:00:54,510
We also have /proc/cpuinfo.

24
00:00:54,510 --> 00:00:57,420
This is a file that contains CPU information,

25
00:00:57,420 --> 00:00:59,910
such as its architecture, its name,

26
00:00:59,910 --> 00:01:02,280
its clock speed, its cache size,

27
00:01:02,280 --> 00:01:03,990
and more things like that.

28
00:01:03,990 --> 00:01:06,780
We also have /proc/devices.

29
00:01:06,780 --> 00:01:08,400
This is a file that contains a list

30
00:01:08,400 --> 00:01:10,950
of all the character and block device drivers

31
00:01:10,950 --> 00:01:13,740
that are loaded into the currently running kernel.

32
00:01:13,740 --> 00:01:16,530
We also have /proc/filesystems

33
00:01:16,530 --> 00:01:17,520
which is going to have a file

34
00:01:17,520 --> 00:01:20,010
that contains a list of all the file system types

35
00:01:20,010 --> 00:01:22,050
that are being supported by this kernel,

36
00:01:22,050 --> 00:01:24,600
as well as which ones are currently mounted.

37
00:01:24,600 --> 00:01:26,220
If you want to learn about your memory,

38
00:01:26,220 --> 00:01:29,250
you can look at /proc/meminfo.

39
00:01:29,250 --> 00:01:31,170
This is a file that contains information

40
00:01:31,170 --> 00:01:32,640
about your RAM usage,

41
00:01:32,640 --> 00:01:35,220
including your total memory, your free memory,

42
00:01:35,220 --> 00:01:36,870
and so much more.

43
00:01:36,870 --> 00:01:39,960
If you look at the /proc/modules file,

44
00:01:39,960 --> 00:01:41,340
this contains information

45
00:01:41,340 --> 00:01:43,080
about the modules that are currently installed

46
00:01:43,080 --> 00:01:44,160
on the system.

47
00:01:44,160 --> 00:01:46,920
And if you look at the /proc/stat file,

48
00:01:46,920 --> 00:01:49,620
this contains various statistics about the system

49
00:01:49,620 --> 00:01:51,750
since it was last rebooted.

50
00:01:51,750 --> 00:01:54,420
Now depending on the version of the kernel you're using,

51
00:01:54,420 --> 00:01:57,000
you could have impacts to your system functionality.

52
00:01:57,000 --> 00:01:58,440
So it's important to have a file

53
00:01:58,440 --> 00:02:00,600
to validate the version you're using.

54
00:02:00,600 --> 00:02:01,650
To look at this,

55
00:02:01,650 --> 00:02:04,560
you can use /proc/version.

56
00:02:04,560 --> 00:02:05,910
And when you look at that file,

57
00:02:05,910 --> 00:02:08,430
it's going to specify several points of information

58
00:02:08,430 --> 00:02:09,780
about the Linux kernel,

59
00:02:09,780 --> 00:02:11,520
including the version of the Linux kernel

60
00:02:11,520 --> 00:02:12,720
that's currently running,

61
00:02:12,720 --> 00:02:16,650
the version of the GNU Compiler Collection or GCC

62
00:02:16,650 --> 00:02:18,450
that's used to compile that kernel,

63
00:02:18,450 --> 00:02:20,640
the username of the kernel compiler,

64
00:02:20,640 --> 00:02:23,730
and the time the kernel was last compiled.

65
00:02:23,730 --> 00:02:25,770
If you use the dmesg command,

66
00:02:25,770 --> 00:02:28,830
this stands for display message or driver message,

67
00:02:28,830 --> 00:02:31,830
and the dmesg command is used to print any messages

68
00:02:31,830 --> 00:02:34,110
that have been sent to the kernel's message buffer

69
00:02:34,110 --> 00:02:36,420
during or after the system boot.

70
00:02:36,420 --> 00:02:39,690
Device drivers send messages to the kernel all the time

71
00:02:39,690 --> 00:02:42,210
indicating the status of modules and parameters

72
00:02:42,210 --> 00:02:44,280
that the drivers are interacting with.

73
00:02:44,280 --> 00:02:47,250
These drivers can also send diagnostic messages

74
00:02:47,250 --> 00:02:48,083
to the kernel

75
00:02:48,083 --> 00:02:50,160
in case they have any kind of errors.

76
00:02:50,160 --> 00:02:52,350
You can leverage the dmesg command

77
00:02:52,350 --> 00:02:55,080
to look for potential issues with the kernel components

78
00:02:55,080 --> 00:02:57,270
or to validate that certain modules

79
00:02:57,270 --> 00:02:58,920
are actually loaded.

80
00:02:58,920 --> 00:03:00,630
To run the dmesg command,

81
00:03:00,630 --> 00:03:03,660
type in dmesg with whatever options you want.

82
00:03:03,660 --> 00:03:05,640
Now, there's various options for this command

83
00:03:05,640 --> 00:03:06,480
and to see them all,

84
00:03:06,480 --> 00:03:07,830
look at the man pages.

85
00:03:07,830 --> 00:03:09,900
But I'm going to cover a few of them here.

86
00:03:09,900 --> 00:03:13,110
The option -c is going to be used to clear the kernel buffer

87
00:03:13,110 --> 00:03:14,910
after printing its contents.

88
00:03:14,910 --> 00:03:17,340
The option -f and a facility list

89
00:03:17,340 --> 00:03:19,020
is going to be used to restrict output

90
00:03:19,020 --> 00:03:22,290
to a specified comma-separated list of facilities.

91
00:03:22,290 --> 00:03:24,990
A facility is essentially a component category

92
00:03:24,990 --> 00:03:26,430
that's producing messages,

93
00:03:26,430 --> 00:03:29,460
such as user for user level messages.

94
00:03:29,460 --> 00:03:31,470
The option -l with a level list

95
00:03:31,470 --> 00:03:32,670
is used to restrict output

96
00:03:32,670 --> 00:03:35,580
to a specified comma-separated list of levels.

97
00:03:35,580 --> 00:03:36,990
Now I talk about a level,

98
00:03:36,990 --> 00:03:39,720
this defines a message's nature and priority,

99
00:03:39,720 --> 00:03:41,310
such as a notice for messages

100
00:03:41,310 --> 00:03:43,230
that aren't considered critical.

101
00:03:43,230 --> 00:03:45,600
Option -e is going to be used to display

102
00:03:45,600 --> 00:03:47,640
a human-readable version of the time

103
00:03:47,640 --> 00:03:49,980
for each message as well as its delta

104
00:03:49,980 --> 00:03:52,920
or the difference in time between subsequent messages,

105
00:03:52,920 --> 00:03:55,950
option -L is used to color-code messages

106
00:03:55,950 --> 00:03:57,510
for easier readability,

107
00:03:57,510 --> 00:04:02,160
and option -H is used to output in a human-friendly format.

108
00:04:02,160 --> 00:04:06,150
This combines both the -e and the -L options

109
00:04:06,150 --> 00:04:07,980
using a text pager.

110
00:04:07,980 --> 00:04:12,300
Finally, option -h is used to list the available options

111
00:04:12,300 --> 00:04:14,520
as well as the available facilities and levels,

112
00:04:14,520 --> 00:04:16,410
and it gives you some basic help options

113
00:04:16,410 --> 00:04:18,480
for this particular command.

114
00:04:18,480 --> 00:04:19,313
As I said,

115
00:04:19,313 --> 00:04:21,570
there's a lot of other options with dmesg,

116
00:04:21,570 --> 00:04:23,610
and we just barely scratch the surface.

117
00:04:23,610 --> 00:04:25,830
So I do recommend playing with it a little bit

118
00:04:25,830 --> 00:04:27,600
and looking at the man pages as well

119
00:04:27,600 --> 00:04:29,070
so you can get more familiar with it

120
00:04:29,070 --> 00:04:31,110
because it is useful in the real world

121
00:04:31,110 --> 00:04:32,510
when troubleshooting issues.