Getting system information on Linux

Today we're going to look at how to use various Linux utilities to gain information about the system. A quick way to get the picture of the underlying kernel is via the uname command. With the -a switch, it will print all information. On my Kali machine, the output is the following:

uname -a
Linux kali 3.12-kali1-amd64 #1 SMP Debian 3.12.6-2kali1 (2014-01-06) x86_64 GNU/Linux

And to break it up in the components:

Kernel name: Linux

Network node hostname: kali

Kernel release: 3.12-kali1-amd64

Kernel version: #1 SMP Debian 3.12.6-2kali1 (2014-01-06)

Machine architecture: x86_64

Operating system: GNU/Linux

Now we might want to see the processes that are running on the system. There are several ways to do this.

We can use ps to get a snapshot of the current processes. Here's how the output will look (note that it's not the complete list of all the processes because I doubt you would want to scroll down that much. The -e flag stands for all processes and I piped the output to tail to get only the last 10 in the list):

ps -e | tail

 9732 ?        00:00:16 firefox

 9735 ?        00:00:13 idle-python2.7

 9749 ?        00:00:00 at-spi-bus-laun

 9755 ?        00:00:18 python2.7

 9788 ?        00:00:01 gedit

 9920 ?        00:00:00 kworker/0:0

 9925 pts/0    00:00:00 less

 9926 ?        00:00:00 kworker/0:1

 9927 pts/1    00:00:00 ps

 9928 pts/1    00:00:00 tail

Another way is to use top. It produces a dynamic view of the processes that keeps updating as you look at it:

Some of the fields are self-explanatory, like the PID, user and command line field, but others may require additional explanation:

PR refers to the scheduling priority of the task. We can see the majority having a low priority of 20, but there is also a rt, which means it's a real time priority

NI represents the nice value. Negative means higher priority, whereas positive is a lower priority

VIRT is the amount of the virtual memory used by the process

RES is the resident memory size, showing the amount of physical memory that the process is really using

SHR is the shared memory size (memory that could be shared with other processes)

S refers to the status of the process. In this case, we have an R for a running process and an S for the rest of sleeping processes

%CPU - CPU usage

%MEM - memory usage

TIME+ refers to the CPU time in hundredths of a second

To see the disk space usage, we can use df with the -h (for human readable flag):

If we want to know how long the system has been running and to see the currently logged on users, we can use the w command:

Here we can see the local time, the uptime, how many users are logged on and the system load for the past 1, 5 and 15 minutes. For every user, we can look at potentially interesting things, such as  the address they're logging in from (in this case coming from the localhost), the time of login, the idle time or the command line of their current process.

And I think I'll finish with a random fortune cookie from the awesome fortune program:

You will be winged by an anti-aircraft battery.