Master Server Disk & Network Monitoring with Command‑Line Tools

Every host’s monitoring window displays CPU, memory, disk and network—the four key metrics dictated by a computer’s basic architecture. To keep a server healthy, start by managing disk space and network traffic.

Servers often lack a graphical monitoring UI (cloud servers provide a web console instead), so command‑line tools are used for disk and network inspection.

Operating System: CentOS 7

Network tools: tcpdump, lsof, iftop

Disk tools: iotop, iostat

Disk Management

How to clean disk manually

#查看磁盘占用
df -h
#cd 到指定目录中，查看文件夹占用
du -sh *
#递归删除日志,可以使用正则或者通配符
rm -rf log-2023*
#合并文件？
ls | grep -P "log-2021((0[1-9]{1})|1[0-1]{1})\d{2}.log" | xargs -d "
" rm
#查询指定大小以上的文件？
find / -type f -size +100M -print
#查询滚动日志最近100行
tail -fn 100 myapp.log
#查询滚动日志匹配 test
tail -f myapp.log | grep -i -n "test"
#搜索指定日志中是否有字符串test
grep -C 10 'test' myapp.log
#查询容器中滚动日志
docker logs --tail=10 -f <container-id>
#查询容器滚动日志中匹配test
docker logs <container-id> | grep -C 10 'test'

Use iotop to analyze disk read/write

iotop shows the real‑time read/write size of each process, helping locate services that cause abnormal I/O.

# 安装iotop
yum install iotop
iotop

Reference: using iotop and iostat to monitor disk.

Network Management

iftop monitor network interface

iftop is a top‑like tool for real‑time traffic monitoring.

#使用root权限安装iftop
sudo yum install iftop
#分析流量
iftop -P

iftop -P displays ↔ communication, where “→” indicates sent traffic and “←” received traffic; TX shows transmitted bytes, RX shows received bytes.

lsof analyze service processes

lsof (List Open Files) can query both regular files and network sockets, allowing you to identify which process is using a specific port.

#安装 lsof
yum install lsof
#根据tcp端口查看进程号,如上图56944
lsof -i :<tcp-source-port>
#根据进程号（上面的命令查询出来1073）找到进程信息，此时就能看到进程的端口
ps -p <pid> -f

First use iftop to spot abnormal traffic, then lsof to pinpoint the offending process.

tcpdump analyze packets

tcpdump is the command‑line counterpart of Wireshark, used for packet capture and analysis.

Problem Cases

Real production scenarios encountered during development.

1. Port occupied

macOS

# 查询指定端口
lsof -i tcp:PORT
# 杀掉进程
kill <pid>

Windows

netstat -aon|findstr PORT
taskkill -f -pid <pid>

2. Locate abnormal network traffic

Background: a server was sending requests to a remote host; iftop and lsof identified an outbound flow that needed to be blocked.

#关闭网络出口端口
iptables -A OUTPUT -d <remote-host> -p tcp --dport 9200 -j REJECT
#打开网络出口端口
iptables -D OUTPUT -d <remote-host> -p tcp --dport 9200 -j REJECT

Alternative: edit /etc/hosts to resolve the remote domain to 127.0.0.1, effectively blocking the traffic.

#编辑 hosts 文件
vim /etc/hosts
#添加行
127.0.0.1 <remote-host>

3. Locate abnormal data writes to disk

Background: a production server’s disk usage surged because a component (graphical captcha) logged excessively, writing ~20 MB/s per node, quickly exhausting disk space.

Solution steps:

Clean Docker containers and rotate service nodes to create investigation windows.

Install iotop and identify the process with abnormal disk writes.

Investigate log‑printing behavior.

Exclude the problematic captcha component and adjust Maven dependencies.

Summary: When adding new components, always verify they do not cause high CPU, memory, or disk usage. Docker’s ps -s can reveal container memory usage; memory leaks may trigger swapping, which further increases disk consumption.