howto

HOW TO : Search which package contains a filename

If you are using a Linux system that uses yum for package management (like Fedora, Centos, RHEL), you can use the following command to find out which package contains a file. This is useful when you want to figure out which package to install. For example, dig (DNS utility) doesn’t come pre-installed on the system. And running “sudo yum install dig” doesn’t do anything.

sudo yum whatprovides '*/dig'

This returns

Loaded plugins: fastestmirror
 Loading mirror speeds from cached hostfile
 32:bind-utils-9.8.2-0.47.rc1.el6.x86_64 : Utilities for querying DNS name servers
 Repo : base
 Matched from:
 Filename : /usr/bin/dig

breaking down the command options

whatprovides : Is used to find out which package provides some feature or file. Just use a specific name or a file-glob-syntax wildcards to list the packages available or installed that provide that feature or file.

HOW TO : count lines in windows command line

Say you are using netstat to checl all established network connections on a windows machine (confirmed to work on windows 7+ and windows server 2008+) and want to find out how many connections you have, you can use

netstat -an | find "ESTABLISHED" | find /v /c ""

breaking down the command string

netstat -an : Uses netstat command to display all connections and listening ports (-a) and displays them in numerical form instead of resolving DNS or using common names (-n)

| : piping (passing) output of one command to the next one

find “ESTABLISHED” : Uses find command to filter out to just lines that contain the string “ESTABLISHED”‘

find /c /v “” : exclude blank lines (/v “”) and count the number of remaining lines (/c)

If you wanted to something similar in linux, you can use

netstat -an | grep "ESTABLISHED" | wc -l

HOW TO : Use grep to search for content at end of line

If you want to search for a pattern at the end of a line, you can use

tail -f logfile | grep -v "0$"

breaking down the commands

tail -f : standard tail command. Continuous output to console as the file grows (or until it ends)

grep -v : -v command forces grep to show content that doesn’t match pattern

0$ : This regex is specifically looking for a 0 at the end of the line, which is denoted by $.

HOW TO : Query varnishlogs for requests with 404 responses

varnishlog, one of the tools provided with varnish cache, uses VSL Query Expressions (https://www.varnish-cache.org/docs/trunk/reference/vsl-query.html) to provide some powerful insights into the requests and responses.

Here is a how you can use varnishlog to show all client requests that are ending up with a 404 response.

sudo varnishlog -g request -i ReqURL -q "BerespStatus != 200"

Technically, this particular query shows all client requests with a response other than 200.

Breaking down the commands

-g request : shows all entries related to the request

-i ReqURL : forces varnishlog to only display the Requesting URL

-q “BerespStatus != 200” : query filter to only match non 200 responses. Note that the query has to be enclosed in “”.

HOW TO : Enable wildcard domains in Squid

We were trying to modify some ACL (access control lists) in squid to allow traffic to certain websites. Instead of adding each individual hostnames in a domain, we wanted to add all traffic to a certain domain.

Document on the interwebs is old or not clear on how to achieve this.

After some trial and error, here is what works

say you want to allow all traffic to the google.com domain, you create a access list using dstdomain like below

acl name_of_acl dstdomain .google.com

The “.” before the domain name acts as a wildcard

Then you use the acl to allow http access to it like below

http_access allow name_of_acl

HOW TO : Capture network traffic on a Solaris server

If you don’t have tcpdump installed on your solaris server, you can use the “snoop” system command to capture network traffic.

Here is the command line option to capture 1000 packets of network traffic from IP 192.168.10.10 on a solaris server using inteface e1000g1 and write the output to /tmp/capture.pcap

snoop -d e1000g1 -c 10000 -o /tmp/capture.pcap host 192.168.10.10

Details of the command options

  • -d : Name of the interface you want to capture traffic on
  • -c : Number of packets you want to capture
  • -o : Path to the output file
  • host : IP address of the host you want to capture traffic from and to

More details at https://docs.oracle.com/cd/E23824_01/html/821-1453/gexkw.html

PS : You have to have root privileges to run this command.