reorganise course folders

courses/level101/metrics_and_monitoring/command-line_tools.md

@@ -0,0 +1,101 @@
+##
+
+# Command-line tools
+Most of the Linux distributions today come with a set of tools that
+monitor the system's performance. These tools help you measure and
+understand various subsystem statistics (CPU, memory, network, and so
+on). Let's look at some of the tools that are predominantly used.
+
+-   `ps/top `-- The process status command (ps) displays information
+     about all the currently running processes in a Linux system. The
+     top command is similar to the ps command, but it periodically
+     updates the information displayed until the program is terminated.
+     An advanced version of top, called htop, has a more user-friendly
+     interface and some additional features. These command-line
+     utilities come with options to modify the operation and output of
+     the command. Following are some important options supported by the
+     ps command.
+
+    -   `-p <pid1, pid2,...>` -- Displays information about processes
+         that match the specified process IDs. Similarly, you can use
+         `-u <uid>` and `-g <gid>` to display information about
+         processes belonging to a specific user or group.
+
+    -   `-a` -- Displays information about other users' processes, as well
+         as one's own.
+
+    -   `-x` -- When displaying processes matched by other options,
+         includes processes that do not have a controlling terminal.
+
+ ![Results of top command](images/image12.png) 
+ <p align="center"> Figure 2: Results of top command </p>
+
+-   `ss` -- The socket statistics command (ss) displays information
+     about network sockets on the system. This tool is the successor of
+     [netstat](https://man7.org/linux/man-pages/man8/netstat.8.html),
+     which is deprecated. Following are some command-line options
+     supported by the ss command:
+
+    -   `-t` -- Displays the TCP socket. Similarly, `-u` displays UDP
+         sockets, `-x` is for UNIX domain sockets, and so on.
+
+    -   `-l` -- Displays only listening sockets.
+
+    -   `-n` -- Instructs the command to not resolve service names.
+         Instead displays the port numbers.
+
+![List of listening sockets on a system](images/image8.png) <p align="center"> Figure
+3: List of listening sockets on a system </p>
+
+-   `free` -- The free command displays memory usage statistics on the
+     host like available memory, used memory, and free memory. Most often,
+     this command is used with the `-h` command-line option, which
+     displays the statistics in a human-readable format.
+
+![Memory statistics on a host in human-readable form](images/image6.png) 
+<p align="center"> Figure 4: Memory statistics on a host in human-readable form </p>
+
+-   `df --` The df command displays disk space usage statistics. The
+     `-i` command-line option is also often used to display
+     [inode](https://en.wikipedia.org/wiki/Inode) usage
+     statistics. The `-h` command-line option is used for displaying
+     statistics in a human-readable format.
+
+![Disk usage statistics on a system in human-readable form](images/image9.png) 
+<p align="center"> Figure 5:
+ Disk usage statistics on a system in human-readable form </p>
+
+-   `sar` -- The sar utility monitors various subsystems, such as CPU
+     and memory, in real time. This data can be stored in a file
+     specified with the `-o` option. This tool helps to identify
+     anomalies.
+
+-   `iftop` -- The interface top command (`iftop`) displays bandwidth
+     utilization by a host on an interface. This command is often used
+     to identify bandwidth usage by active connections. The `-i` option
+     specifies which network interface to watch.
+
+![Network bandwidth usage by
+  active connection on the host](images/image2.png) 
+  <p align="center"> Figure 6: Network bandwidth usage by
+active connection on the host </p>
+
+-   `tcpdump` -- The tcpdump command is a network monitoring tool that
+     captures network packets flowing over the network and displays a
+     description of the captured packets. The following options are
+     available:
+
+    -   `-i <interface>` -- Interface to listen on
+
+    -   `host <IP/hostname>` -- Filters traffic going to or from the
+         specified host
+
+    -   `src/dst` -- Displays one-way traffic from the source (src) or to
+         the destination (dst)
+
+    -   `port <port number>` -- Filters traffic to or from a particular
+         port
+
+![tcpdump of packets on an interface](images/image10.png) 
+<p align="center"> Figure 7: *tcpdump* of packets on *docker0*
+interface on a host </p>