阶段2（下）：运维专题 Docker/Nginx/Linux/CI-CD/Git 的课程、企业场景、面试题和可运行示例

topics/devops/linux/examples/log-analysis/diag.sh

@@ -0,0 +1,39 @@
+#!/usr/bin/env bash
+# 不自动运行：线上问题的“第一分钟”快照，只读命令，不修改任何东西
+# 用法：bash diag.sh [进程名关键字] > diag-$(date +%F-%H%M).txt
+set -uo pipefail
+
+keyword="${1:-}"
+section() { printf '\n===== %s =====\n' "$1"; }
+
+section "时间和负载"
+date
+uptime
+
+section "CPU 占用最高的进程"
+ps -eo pid,ppid,user,%cpu,%mem,etime,cmd --sort=-%cpu | head -n 10
+
+section "内存"
+free -h
+
+section "磁盘空间和 inode"
+df -h -x tmpfs -x devtmpfs
+df -i -x tmpfs -x devtmpfs | awk 'NR == 1 || $5+0 > 80'
+
+section "监听端口"
+ss -lntp 2>/dev/null | head -n 30
+
+section "TCP 连接状态统计"
+ss -ant | awk 'NR > 1 {count[$1]++} END {for (s in count) print s, count[s]}'
+
+if [[ -n "$keyword" ]]; then
+  section "进程：$keyword"
+  pgrep -af -- "$keyword" || echo "没有找到进程"
+fi
+
+section "最近的内核日志（OOM 等）"
+if kernel_log="$(journalctl -k --since "1 hour ago" --no-pager 2>/dev/null)" || kernel_log="$(dmesg 2>/dev/null)"; then
+  grep -iE 'oom|killed process' <<<"$kernel_log" | tail -n 20 || echo "最近没有 OOM 记录"
+else
+  echo "无权限读取内核日志"
+fi