أوامر Linux الأساسية لـ DevOps (الجزء الثاني)

# Legacy (often not installed by default):
ifconfig                        # Display all interfaces

# Modern (iproute2):
ip addr show                    # Show all IP addresses (alias: ip a)
ip addr show eth0               # Show specific interface
ip link set eth0 up             # Bring interface up
ip link set eth0 down           # Bring interface down
ip route show                   # Show routing table (alias: ip r)
sudo ip route add 192.168.0.0/24 via 10.0.0.1  # Add static route (needs root)
ip -s link show eth0            # Per-interface counters (rx/tx packets, errors, drops)

# Legacy (often not installed; slow on hosts with many sockets):
netstat -tlnp                   # Show listening TCP ports + program

# Modern replacement: ss (socket statistics)
ss -tlnp                        # Show listening ports (TCP, listening, numeric, program)
ss -tlnpu                       # Include UDP sockets
ss -atnepo                      # Show all connections with extended info
ss -tan state established       # Show established TCP connections (filter syntax)
ss -tan | grep ESTAB            # Same idea via grep (ss prints ESTAB, not ESTABLISHED)
sudo ss -K dst 192.168.1.100    # Kill matching sockets — capital -K, requires CONFIG_INET_DIAG_DESTROY in kernel

dig example.com                 # Full DNS query
dig example.com +short          # Short answer only
dig example.com MX              # Mail server records
dig @8.8.8.8 example.com        # Query specific nameserver
dig example.com +trace          # Trace entire DNS path
nslookup example.com            # Alternative (older but still useful)

curl https://example.com                    # Simple GET request
curl -I https://example.com                 # Headers only (useful for status codes)
curl -X POST -d '{"key":"value"}' https://example.com  # POST with JSON
curl -H "Authorization: Bearer TOKEN" https://example.com  # Custom headers
curl --resolve example.com:443:192.168.1.100 https://example.com  # Override DNS
curl -w "%{http_code}\n" -o /dev/null https://example.com  # Check status code only

docker ps                       # List running containers
docker ps -a                    # List all containers (including stopped)
docker logs <container_id>      # View container output
docker logs -f <container_id>   # Follow logs in real-time
docker exec -it <container_id> /bin/bash  # Open shell in running container
docker exec <container_id> cat /etc/hosts  # Run command without interactive shell
docker inspect <container_id>   # View detailed container configuration
docker top <container_id>       # View running processes inside container
docker stats                    # Real-time resource usage (memory, CPU)
docker network ls               # List networks
docker network inspect <network>  # Inspect specific network

kubectl exec -it <pod> -- /bin/sh        # Open shell in pod (sh works on minimal/distroless-ish images)
kubectl exec -it <pod> -- /bin/bash      # Use bash if the image actually ships it
kubectl exec <pod> -- cat /var/log/app   # Run a one-shot command in the pod
kubectl logs <pod>                       # View pod logs
kubectl logs -f <pod>                    # Follow pod logs
kubectl logs <pod> -c <container>        # Logs from a specific container
kubectl logs <pod> --tail=50             # Last 50 lines
kubectl logs <pod> --previous            # Logs from the previous (crashed) container instance
kubectl describe pod <pod>               # Detailed pod information (events, conditions, last state)
kubectl get events -n <namespace> --sort-by=.lastTimestamp  # Recent events
kubectl top pod <pod>                    # Resource usage (requires metrics-server)
kubectl port-forward <pod> 8080:8080     # Forward local port to pod
kubectl cp <pod>:/path/to/file ./local   # Copy file from pod
kubectl debug -it <pod> --image=busybox --target=<container>  # Ephemeral debug container (no shell needed in image)

crictl ps                       # List running containers
crictl logs <container_id>      # View container logs
crictl exec -it <container_id> /bin/bash  # Shell into container
crictl inspect <container_id>   # Container details
crictl images                   # List pulled images

htop                            # Interactive process list
htop -p <pid>                   # Monitor specific process
htop -u <username>              # Monitor specific user's processes
# Within htop: press F6 to sort by different columns (CPU, memory, etc.)

btop                            # Full system resource overview
# Shows: CPU, memory, disks, network, processes
# Interactive: sort by column, search processes, kill processes

sudo iotop                      # Real-time disk I/O by process (needs root)
sudo iotop -o                   # Only show processes currently doing I/O
sudo iotop -b -n 5              # Batch mode, 5 iterations (good for logging)
iostat -x 1                     # Extended I/O statistics, refresh every 1 second
dstat -cdn                      # CPU, disk, and network in one view
# Note: the original dstat (by Dag Wieers) is unmaintained. Fedora/RHEL ship a Performance
# Co-Pilot (PCP)-based reimplementation under the same `dstat` name; `dool` is a separate
# community fork of the original that stays source-compatible and is available via pip/apt

nethogs                         # Bandwidth usage by process
nethogs -r                      # Reverse sorting (highest bandwidth first)
iftop                           # Live network bandwidth by host
iftop -P                        # Show ports
nload                           # Simple bandwidth graph

free -h                         # Human-readable memory usage
free -h -s 2                    # Refresh every 2 seconds
ps aux --sort=-%mem | head -10  # Top 10 memory-consuming processes
pmap -x <pid>                   # Memory map of specific process
smem -k -s swap -r              # Per-process memory sorted by swap, descending (apt/dnf install smem)

sudo tcpdump -i eth0                 # Capture all traffic on eth0
sudo tcpdump -i eth0 port 80         # Capture HTTP traffic
sudo tcpdump -i eth0 src 192.168.1.100  # Capture traffic from specific IP
sudo tcpdump -i eth0 -w capture.pcap # Save to file for analysis
sudo tcpdump -i eth0 -A              # Print packet contents (ASCII)

sudo bpftrace -e 'tracepoint:syscalls:sys_enter_openat { printf("%s %s\n", comm, str(args->filename)); }'

ps aux                          # List all running processes
ps aux | grep nginx             # Find specific process
ps -ef --forest                 # Process tree (hierarchical view)
pgrep -a python                 # Find python processes; -a prints full command line (-l prints just the name)
pgrep -f "manage.py runserver"  # Match against full command line, not just process name
pkill -f "old_process"          # Send SIGTERM to processes matching command line
pkill -TERM -f "old_process"    # Same as above, signal made explicit
kill <pid>                      # Send SIGTERM (graceful shutdown)
kill -9 <pid>                   # Send SIGKILL (force kill, last resort)
killall nginx                   # Kill all processes named exactly "nginx" (dangerous on shared hosts!)
fg                              # Bring background job to foreground
bg                              # Resume stopped job in background
jobs                            # List background jobs
wait <pid>                      # Wait for process to complete

uname -a                        # Kernel version and system info
lsb_release -a                  # Linux distribution version
cat /proc/cpuinfo                # CPU information
cat /proc/meminfo               # Memory information
lscpu                           # CPU architecture summary
lsblk                           # Block devices and partitions
lspci                           # PCI devices (GPUs, NICs)
lsusb                           # USB devices