Helpful unix commands

dmesg.md

Find OOM dmesg records in sosreport.

find  . -type f -name "dmesg" -print0 | xargs -0 grep "oom"

[182564.614033] EcEclPipeline invoked oom-killer: gfp_mask=0x201da, order=0, oom_score_adj=0
[182564.614057]  [<ffffffff85dc252d>] oom_kill_process+0x2cd/0x490
[182564.614166] [ pid ]   uid  tgid total_vm      rss nr_ptes swapents oom_score_adj name
[1532658.426632] liagent invoked oom-killer: gfp_mask=0x201da, order=0, oom_score_adj=0
[1532658.426682]  [<ffffffff85dc252d>] oom_kill_process+0x2cd/0x490
[1532658.426794] [ pid ]   uid  tgid total_vm      rss nr_ptes swapents oom_score_adj name

Find date and time that machine first booted

grep -R "rtc_cmos" *
1299:Aug 26 00:44:17 xxx.yyy.com kernel: rtc_cmos 00:01: setting system clock to 2021-08-26 05:44:17 UTC (1629956657)

Given a dmesg log entry the first field is the relative time, in seconds, since the machine booted. So to get the absolute time we do the below. Where 1532658 is from the log line entry and 1629956657 is from the above rtc_cmos boot time.

date -d @$((1532658 + 1629956657))
Sun Sep 12 07:28:35 PM EDT 2021

sar.MD

Start docker container with specific sysstat version to analyze sar data file

docker run -it -v ${PWD}/.:/sardata --rm --name sar supinf/sysstat:10.1 /bin/bash

Filter free memory < 20%

for f in sa*; do echo "$f" && sar -r -f $f |  tr -s ' ' | cut -d ' ' -f 4 | awk '{if($1<20)print$1}'; done

%memused
sa26
08/26/21



%memused
9.88
9.94
9.91
9.71
9.87
9.92
sa27
08/27/21