Optimizing Disk Space: A Visual Guide to Linux's du Command

Understanding how to monitor and manage disk usage is essential for both administrators and power users. One powerful command that stands out for its utility in managing disk space is 

du -hsx /* | sort -rh | head -10

Let's break down this command to understand its functionality and significance.

The command du -hsx /* | sort -rh | head -10 is a pipeline of three commands, each performing a unique function, working together to report the sizes of the top 10 directories that occupy the most space on the root filesystem:

du -hsx /*: The du (disk usage) command estimates file space usage. The flags used here are:

-h (human-readable): Converts the output to a more readable format using the most appropriate unit (KB, MB, GB).

-s (summarize): Displays only a total for each argument.

-x (one file system): Skips directories on different filesystems, focusing only on the root filesystem.

This part of the command scans all directories in the root (/*) and provides a summarized, human-readable output of their sizes, ensuring it only accounts for directories on the root filesystem.

sort -rh: This command sorts the output from the du command.

-r (reverse): Sorts the output in reverse order, placing larger items at the top.

-h (human-readable): Sorts numbers with unit suffixes (K, M, G, etc.), ensuring that 10M is considered larger than 9G.

head -10: This final command in the pipeline takes the sorted list of directory sizes and displays the top 10 entries. This is particularly useful for quickly identifying which directories are using the most disk space, allowing for efficient space management decisions.

This command is especially useful for system administrators and users who need to quickly identify high disk usage directories to clean up or monitor space usage. By focusing on the largest directories, one can efficiently manage disk space, ensuring that the system remains stable and that critical operations have enough space to function correctly.

Linux System is using to much swap memory

A value from 0 to 100 which controls the degree to which the system favors anonymous memory or the page cache. A high value improves file-system performance, while aggressively swapping less active processes out of physical memory. A low value avoids swapping processes out of memory, which usually decreases latency, at the cost of I/O performance.

The default is normally 60 in Linux but devices running custom Linux builds may change the value.

1. Check / Note the default setting
1. SSH in to the unit and switch to root
2. run "cat /proc/sys/vm/swappiness"
2. Lower the value, I normally set it to 10, but 0 would shut the swap process down, 100 would make it swap all the time.
1. run "echo 10 > /proc/sys/vm/swappiness"
2. run "swapoff -a"
3. run "swapon -a"

Retest performance of the unit,  sometimes the swapoff will fail as they is not enough memory to offload the swap data too.  You will need to free up memory or reboot.  Just bear in mind that the command at this time is none permanent and rebooting will switch it back to default.

This is good in case the change kills the device, rebooting will bring it back to normal.  Once you are happy its fixed the issue / runs better you can do two things expand the RAM or make the charge permanent.

1. SSH back in to the unit and switch to root
2. Open /etc/sysctl.conf
3. Add / change "vm.swappiness = 10"
4. Save change

5.5. Tuning Virtual Memory Red Hat Enterprise Linux 6 | Red Hat Customer Portal

SLES 11/12 OS Tuning & Optimization Guide - Part 1 | SUSE Communities

SwapFaq - Community Help Wiki (ubuntu.com)

Service control in Linux (Ubuntu)

 As root or with sudo

List all services
systemctl list-units --all --type=service --no-pager

Start|Stop a service
systemctl start|stop application.service

Restart a service
systemctl restart application.service

Enable|Disable a service
systemctl enable|disable application.service

Quick guide to TCPDUMP writing pcap files for wireshark

 tcpdump -nn -s 0 -i eth0 host <IPADDRESS> -w <FILENAME>.pcap

If you ever find your self working on a Linux based gateway device and you need to trace what is happening.  run the above command and you will be able to take the file and open it in WireShark

<IPADDRESS> change this to the device you are tracking.

<FILENAME> give the file a name.

-nn will remove port and name resolution.

-s 0 capture file will not truncate.

-i sets the interface to listen on.

host sets the ip address to filter.

If you run tcpdump -D it will list the interfaces available to listen on, command is case sensitive