Files
zhuangang/topics/devops/linux/examples/log-analysis/diag.sh
T

40 lines
1.1 KiB
Bash

#!/usr/bin/env bash
# 不自动运行:线上问题的“第一分钟”快照,只读命令,不修改任何东西
# 用法:bash diag.sh [进程名关键字] > diag-$(date +%F-%H%M).txt
set -uo pipefail
keyword="${1:-}"
section() { printf '\n===== %s =====\n' "$1"; }
section "时间和负载"
date
uptime
section "CPU 占用最高的进程"
ps -eo pid,ppid,user,%cpu,%mem,etime,cmd --sort=-%cpu | head -n 10
section "内存"
free -h
section "磁盘空间和 inode"
df -h -x tmpfs -x devtmpfs
df -i -x tmpfs -x devtmpfs | awk 'NR == 1 || $5+0 > 80'
section "监听端口"
ss -lntp 2>/dev/null | head -n 30
section "TCP 连接状态统计"
ss -ant | awk 'NR > 1 {count[$1]++} END {for (s in count) print s, count[s]}'
if [[ -n "$keyword" ]]; then
section "进程:$keyword"
pgrep -af -- "$keyword" || echo "没有找到进程"
fi
section "最近的内核日志(OOM 等)"
if kernel_log="$(journalctl -k --since "1 hour ago" --no-pager 2>/dev/null)" || kernel_log="$(dmesg 2>/dev/null)"; then
grep -iE 'oom|killed process' <<<"$kernel_log" | tail -n 20 || echo "最近没有 OOM 记录"
else
echo "无权限读取内核日志"
fi