Check Running Processes, Login History, Services and Open Ports

Three commands I used to check what was happening on a server.

Before you start

• Some output (for example the process name for each port in netstat -p) is only shown in full when you run as root or with sudo.

My original notes

1. To check all running processes:

   ps aux

   Lists every process on the system. a shows processes of all users, u shows a user-oriented format (owner, CPU %, memory %, start time, command), and x includes processes not attached to a terminal, such as services.

2. To check logs:

   last

   Clarification: last does not show general system logs. It shows the login history: who logged in, from where, and when, plus reboots. It reads the /var/log/wtmp file. For system logs, see “Notes for today” below and my post on common Linux log files.

3. To check list of ports:

   netstat -tupan

   Shows network connections and listening ports:

   • -t TCP
   • -u UDP
   • -p the process (PID and program name) using each port
   • -a all sockets, both listening and connected
   • -n numbers instead of names (faster, and shows real port numbers)

Useful variations

Find one process by name, for example Apache:

ps aux | grep httpd

Show only listening ports (services waiting for connections):

netstat -tulpn

Show the most recent 10 logins only:

last -n 10

Show failed login attempts (needs root; reads /var/log/btmp):

sudo lastb

Notes for today

• netstat is old. It comes from the net-tools package, which is not installed by default on many current distributions. The modern replacement is ss, which accepts the same options used here:

  sudo ss -tupan
  sudo ss -tulpn

• Live view of processes: top shows processes updating in real time, sorted by CPU use (press q to quit). htop is a friendlier version but usually has to be installed.

• Checking services: on older CentOS (5 and 6), service --status-all lists services and their status. On systemd systems (CentOS 7 and later, Rocky Linux, AlmaLinux, current Debian and Ubuntu):

  systemctl list-units --type=service
  systemctl status sshd

  On Debian and Ubuntu the SSH service is called ssh rather than sshd.

• Reading logs on systemd systems: journalctl reads the systemd journal. For example, journalctl -u sshd shows logs for one service and journalctl -f follows new messages as they arrive.

• Currently logged-in users: who or w show who is logged in right now, whereas last shows history.