Halfface - User contributions [en-gb]

Ubuntu

2026-04-16T13:05:11Z

Ekaanbj: /* Installed packages. */

==Which package contains file==
apt-file search filename
dpkg -S /usr/sbin/apache2

==List contents of package==
apt-file list packagename
dpkg -c <$package.deb>
dpkg -c pgpool2
dpkg -L <package>

=Update apt-file database=
apt-file update
=updates the list of available packages and their versions=
apt-get update

=upgrade single package=
apt --only-upgrade install apache2
=Is restart of service requirred=
needrestart

=show installed packages in cronological order=
zcat -f /var/log/dpkg.log* | grep "\ install\ " | sort | tail

=Installed packages.=
dpkg-query -W
dpkg --get-selections
apt-get install openssh-client openssh-server

=List packages on one machine and install on another.=
dpkg --get-selections > installed-software
dpkg --set-selections < installed-software
dselect

=Upgrade.=
sudo apt-get -y update
sudo apt-get -y upgrade

=Which package provides.=
http://packages.ubuntu.com/

=List available linux packages.=
apt-cache pkgnames

=install local deb packages=
sudo dpkg -i 1.deb 2.deb
=remove delete uninstall deb package=
apt remove <deb>
dpkg -r <deb>
Remove config files too.
apt purge <deb>
dpkg -P <deb>

=add sources=
find sources.
cat $(find /etc/apt/sources.list{,.d} -type f )| bash_clean_comments | awk '{print $2 " " $3}' | sort | uniq

=install from experimental=
# add next row to /etc/apt/sources.list and do an apt-get update
deb http://ftp.debian.org/debian/ experimental main contrib non-free
# Then install latest version of ekiga.
apt-get -t experimental install ekiga

=which version of debian=
lsb_release

=add gpg key=
gpg --keyserver subkeys.pgp.net --recv-keys AED4B06F473041FA
gpg -a --export AED4B06F473041FA | sudo apt-key add -
=clean /var/cache/apt=
sudo apt-get clean

=which version is available and installed(*** means installed)=
apt-cache policy apache2-bin
=Read values from the debconf database=
debconf-get-selections | grep ^iptables-persistent
=Set value in debconf database=
echo newrelic-php5 newrelic-php5/application-name string "blablabla" | debconf-set-selections
=dowload deb=
sudo apt-get install --download-only --reinstall sudo
apt-get download <package-name>

=verify deb package(changes)=
checksums are stored /var/lib/dpkg/info/elasticsearch.md5sums
dpkg --verify elasticsearch
??5?????? c /etc/elasticsearch/elasticsearch.yml
??5?????? c /etc/elasticsearch/jvm.options

=extract deb=
dpkg-deb -xv elasticsearch_7.9.3_amd64.deb .
=configure networks=
/etc/netplan/10-eth0.yaml
netplan apply
=add static route=
/etc/network/interfaces
#--------------------------------------------#
# Setup eth0 - connected to private LAN/VLAN #
#--------------------------------------------#
auto eth0
allow-hotplug eth0
iface eth0 inet static
address 10.70.201.5
netmask 255.255.255.192
### Ubuntu Linux add persistent route command ###
post-up route add -net 10.0.0.0 netmask 255.0.0.0 gw 10.70.201.6
=add static route netplan way=
network:
ethernets:
enp0s3:
dhcp4: false
addresses: [192.168.1.202/24]
gateway4: 192.168.1.1
nameservers:
addresses: [8.8.8.8,8.8.4.4,192.168.1.1]
routes:
- to: 172.16.0.0/24
via: 192.168.1.100
version: 2
# netplan apply
==multiple interface==
/etc/netplan/50-cloud-init.yaml
network:
version: 2
ethernets:
ens3:
dhcp4: true
dhcp6: true
match:
macaddress: fa:16:3e:84:e6:98
mtu: 1500
set-name: ens3
ens4:
dhcp4: true
dhcp6: false
match:
macaddress: fa:16:3e:20:fa:72
mtu: 1450
set-name: ens4
dhcp4-overrides:
route-metric: 200
ens5:
dhcp4: true
dhcp6: false
match:
macaddress: fa:16:3e:3a:7a:a4
mtu: 1450
set-name: ens5
dhcp4-overrides:
route-metric: 200

=enable sysstat=
apt -y install sysstat
sed -i 's/ENABLED="false"/ENABLED="true"/g' /etc/default/sysstat
systemctl restart sysstat

=automatic update=
Disable automatic updates.
sed -i 's/APT::Periodic::Unattended-Upgrade "1";/APT::Periodic::Unattended-Upgrade "0";/g' /etc/apt/apt.conf.d/20auto-upgrades

[[Category:Applications]]
[[Category:Unix]]

Elasticsearch

2026-04-16T08:41:50Z

Ekaanbj: /* count shards */

=what does it mean=
cdm Continuous Diagnostics Mitigation
cdm client data master

=Add password to .netrc and use curl -n to use creds=
~/.netrc
machine localhost
login <username>
password <password>
=count entries in index=
GET /<indicie>/_count
=get latest content from indicies.=
<pre>
curl -n -sk -X GET "https://localhost:9200/<index>/_search" -H 'Content-Type: application/json' -d '{
"size": 1,
"sort": [
{ "@timestamp": { "order": "desc" } }
]
}'

</pre>

=Stats of elasticsearch=
<pre>
curl -n -sk -X GET "https://localhost:9200/_nodes/stats/jvm?pretty"
</pre>
=Who is master=
<pre>
curl -n -sk -X GET "https://localhost:9200/_cat/master?v"
</pre>
=Are we recovering=
<pre>
curl -n -sk -X GET "https://localhost:9200/_cat/recovery?active_only=true"
</pre>
=List indicies by size=
<pre>
curl -n -sk -X GET "https://localhost:9200/_cat/indices?v&bytes=b&s=store.size:desc"
</pre>
=list shards by size=
<pre>
curl -skn "https://localhost:9200/_cat/shards?h=index,shard,prirep,store,ip,node&bytes=b&s=store:desc"
</pre>

=View 5 log entries from biggest indicie=
<pre>
curl -n -X GET "https://localhost:9200/<indicie>/_search?size=5&pretty"
</pre>
=Search for a string of a log entry in the biggest indicie.=
<pre>
curl -n -X GET "https://localhost:9200/.ds-logs-system.syslog-default-2022.08.22-000006/_search?pretty" -H 'Content-Type: application/json' -d'{
"query": {
"match": {
"message": "<string>"
}
}
}' | jq -r .hits.hits[]._source.message
</pre>
=list snapshot setup=
<pre>
curl -n -sk -X GET "https://localhost:9200/_snapshot?pretty"
</pre>
=Look at snapshots=
<pre>
curl -n -sk -X GET "https://localhost:9200/_snapshot/elastic_snapshots_repo/_all?pretty" | jq -r '.snapshots | sort_by(.end_time)[] | .snapshot'
</pre>
=List indices inside snapshot=
<pre>
curl -n -sk -X GET "https://localhost:9200/_snapshot/elastic_snapshots_repo/daily-snapshots-2025.09.10-ctbhwxs5r4yl4okmthrilq?pretty" | jq -r '.snapshots[].indices | sort[]'
</pre>
=restore index=
<pre>
curl -n -sk -X POST "https://localhost:9200/_snapshot/elastic_snapshots_repo/<snapshot_name>/_restore" -H 'Content-Type: application/json' -d '{
"indices": "<index_to_restore>",
"ignore_unavailable": true,
"include_global_state": false
}'
</pre>
=look at status of recover=
<pre>
curl -n -sk -X GET "https://localhost:9200/_cat/recovery?v&h=index,shard,stage,source_host,target_host,total,recovered,percent,recovery_type&bytes=b"
</pre>
=Remove all indices=
<pre>
curl -n -sk -X GET "https://localhost:9200/_cat/indices?h=index&s=store.size:desc" | while read INDEX ; do echo '*' "${INDEX}" ; echo curl -n -sk -X DELETE "https://localhost:9200/${INDEX}" ; done
</pre>
=Delete empty indices=
<pre>
# Delete empty indices
curl -skn "https://localhost:9200/_cat/indices?h=index,docs.count" | awk '$2 == 0 {print $1}' | while read idx; do
curl -skn -X DELETE "https://localhost:9200/$idx"
done
</pre>

=count shards=
curl -snk "https://localhost:9200/_cat/shards?v" | wc -l
=elastic-agent=
Test config
yq .outputs.default /opt/Elastic/Agent/elastic-agent.yml
curl -u <username:password> <hosts>

Mysql

2026-04-15T15:11:23Z

Ekaanbj: /* Uptime */

=Introduction=

In the structure of MySQL, there are databases, tables, records, and fields. Databases hold together tables, tables hold together records, records hold together fields, which contain the actual information.

=setup database=
mysql_install_db --user=mysql
=select whithout column names=
mysql --skip-column-names

=Create user and grant accsess.=
mysql 5
GRANT [privileges] ON database.* TO '<user>'@'<host>' IDENTIFIED BY '<password>';
mysql -e "grant all privileges on puppetdb.* to puppet@'localhost' identified by 'puppet';FLUSH PRIVILEGES;"
mysql 8
mysql -e "CREATE USER IF NOT EXISTS '<user>'@'%' IDENTIFIED BY '<password>'; GRANT ALL PRIVILEGES ON *.* TO '<user>'@'%'; FLUSH PRIVILEGES;"

=Change root password=
mysqladmin -u root password 'new-password'
=revoke permissions=
mysql -e "REVOKE ALL ON *.* FROM 'user'@'%' ; "
=delete user=
mysql -e "DROP USER 'user'@'%';"

=Clear flush MySQL hosts cache dns=
# Look at current state.
use performance_schema;select host,ip from host_cache;
# Clear the cache with below SQL commands then you are all set.
flush hosts;

=Change password=
==Alternative1.==
use mysql;SET PASSWORD FOR 'user'@'hostname' = PASSWORD('passwordhere');
==Alternative2.==
update mysql.user set password = password('') where user = 'username';
==Alternative3.==
UPDATE mysql.user SET Password=PASSWORD('new-password-here') WHERE User='user-name-here' AND Host='host-name-here';

==Alternative4==
mysql> update user_auth set password=md5('admin') where username='admin';
==aternative5==
UPDATE mysql.user SET authentication_string=password('$Passw0rd') WHERE user='$mysql_user';

=backup databases=
==backup all databases==
mysqldump --all-databases -p > /temp/mysql
==backup single table==
mysqldump db_name table_name > table_name.sql

==backup certain databases.==
mysqldump --opt -uroot -p --databases IPmon IPdiscover IPcollector > all.sql

==backup structure of dabases.==
mysqldump --compact --no-data --all-databases > /tmp/database_structure.txt

==dump database in innodb consistent way.==
mysqldump --single-transaction -u --all-databases > /temp/alldb_june23.sql
# example command to backup single database.
DATABASE=mediawiki ; mysqldump --database ${DATABASE} --single-transaction | gzip > ${DATABASE}.${HOSTNAME}.$(date '+%Y-%m-%d_%H-%M-%S').sql.gz

=restore compressed db=
zcat IPadmin.1478001970.sql.gz | mysql

=Create database=
create database puppetdb;

=Delete mysql database=
drop database puppetdb;

=Delete mysql database table=
drop table if exists recipes;

=Delete row=
delete FROM user WHERE id IN (2);

=Create table. This creates table with two colums, id with datatype int, and data of the type varchar.=
create table testtable (id int, data varchar(100));
CREATE TABLE developers ( name VARCHAR(128), email VARCHAR(128), job VARCHAR(128));

*Connect to mysql database.
mysql -u root -p password -h mysqlhost

=Show databases.=
show databases;

=Choose database to work with.=
use puppetdb;

=Show tables=
show tables;
SHOW TABLES like 'catalog_category_product_index_store%';

=show tables status=
Show more information about tables.
mysql -D jasperserver -e "show table status like 'JIContentResource' \\G"
Show more information about one table.
show table status like 'tablename' \G

=Show columns in table.=
show columns from hosts;

=Show which data is stored in a table in descending order limit to 100=
Reverse sort order.
select * from hosts order by id desc limit 100;

=Show all data from table=
mysql> select * from hosts;

=Show all ip in sort ascending order=
mysql> select * from hosts order by ip asc;

=Show column where page_counter is max in table page. Other values are min, avg, sum=
select max(page_counter) from page;
Select column with highest value.
select * from orderreport where OrderReportId = (select max(OrderReportId) from orderreport)\G

=How many rows are on the table.=
select count(*) from database.table;
SELECT table_name, TABLE_ROWS FROM INFORMATION_SCHEMA.TABLES WHERE TABLE_SCHEMA = '${DATABASE}';

=show value from query=
select * from wp_options where option_name='home';
=match multiple strings=
select * from database.table where name REGEXP 'string1|2string' limit 100;
WHERE (im.Status='open' or im.Status='new' or im.Status='resolved'

=change value in database=
UPDATE wp_options SET option_value='http://www.ongamenetwork.com' WHERE option_name='home';

=Run sql code. Offen used to setup database.=
source /file

=Run command in system.=
system command

=Shows status of database server=
status;

=Show information about table=
describe table;

=Show more information about table, show constrains on tables=
show create table table
show create table database.table \G
=foreign keys to a table or column=
SELECT
TABLE_NAME,COLUMN_NAME,CONSTRAINT_NAME, REFERENCED_TABLE_NAME,REFERENCED_COLUMN_NAME
FROM
INFORMATION_SCHEMA.KEY_COLUMN_USAGE
WHERE
REFERENCED_TABLE_SCHEMA = '${DATABASE}' AND
REFERENCED_TABLE_NAME = '${TABLE}';
=set constrains=
mysql -e 'ALTER TABLE Database ADD Table `Refstate_execution35` FOREIGN KEY (`state_execution_id`) REFERENCES `state_execution` (`state_execution_id`);'

=get auto_increment=
SELECT AUTO_INCREMENT FROM INFORMATION_SCHEMA.TABLES WHERE TABLE_SCHEMA = 'database' AND TABLE_NAME = 'table';"

=Put some data into a table=
INSERT INTO testtable (id,data) VALUES ('66','The beast whas here');

=Change id value 17 to 18 in testtable=
UPDATE testtable set id=18 where id=17 ;

=Show master/slave status.=
show master status \G

=Show master/slave status.=
show slave status \G
=start slave=
START SLAVE;
=stop slave=
stop slave;

=Show permission on database=
select * from information_schema.user_privileges;
SHOW GRANTS FOR 'user'@'%host.com';
==Who has access from which machine.==
use mysql;SELECT host,user FROM user;

=Import sql script to database.=
mysql ongamenetwork < /tmp/ongamenetwork.new.sql

=Delete logs=
# List logs.
show master logs;
# Delete oldest logs.
purge master logs to 'logfil';
=log verbosity before 5.7.2=
SELECT @@log_warnings;
SET GLOBAL log_warnings=2;
=log verbosity 5.7.2=
SELECT @@log_error_verbosity;
SET GLOBAL log_error_verbosity=2

=maxconnections in runtime.=
show variables like '%connect%';
=set maxconnetions in runtime=
mysql -e "SET GLOBAL max_connections = 300;"

=information about mysql connection=
mysql -u test -e '\s'

=What is happening in database. Who is connected to database=
show processlist;
SELECT * FROM INFORMATION_SCHEMA.PROCESSLIST;
mysql -e 'SELECT * FROM INFORMATION_SCHEMA.PROCESSLIST where NOT COMMAND="Sleep";'

=database usage. Is database using myisam or innodb=
show table status;
On all databases
mysql --skip-column-names -e "SELECT DISTINCT SCHEMA_NAME FROM information_schema.SCHEMATA WHERE SCHEMA_NAME NOT IN ('information_schema', 'performance_schema', 'mysql', 'sys') ORDER BY SCHEMA_NAME;" | while read i ; do echo '***' $i ; mysql -e "use $i ; show table status;" ; done | column_tab | less
Table status on all databases.
SELECT * FROM information_schema.tables WHERE table_schema = DATABASE();
SELECT * FROM information_schema.tables WHERE table_schema IN (SELECT DISTINCT SCHEMA_NAME FROM information_schema.SCHEMATA WHERE SCHEMA_NAME NOT IN ('information_schema', 'performance_schema', 'mysql', 'sys') ORDER BY SCHEMA_NAME);

=repair myisam table=
REPAIR TABLE table USE_FRM;

=show date=
select CURRENT_TIMESTAMP;

=show timezone=
show variables like '%time%'

=mysql server version=
select version ();

=Reset mysql root password=
Stop the MySql server.
/usr/bin/mysqld_safe --skip-grant-tables &
mysql -h localhost
use mysql
update user set password = password('.......') where user = 'root' and host='localhost';
quit
Restart the server and run as normal.
For another version.
/usr/bin/mysqld --skip-grant-tables &
use mysql ; update user set authentication_string=password('Sw1LdtkMKnRik') where user='root'; quit ;
Restart the server and run as normal.

=Data types=
==Numerical, signed=could be negative,unsigned==
type Maxvalue
tinyint 255
smallint 65535
mediumint 16777215
int 4294967295
bigint 18446744073709551615
==Strings==
type Maxvalue
varchar 255
char 255
tinyblob,tinytext 256
blob,text 65536
mediumblob,mediumtext 16777216
longblob,longtext 4294967296
==Special==
date
timestamp

=Access types.=
ALL - Gives the all privilege control for the database
CREATE - Allows users to create tables
SELECT - Allows users to query tables
INSERT - Allows users to insert data into a table
SHOW DATABASES - Allows users to see a list of databases
USAGE - User has no privileges
GRANT OPTION - Allows users to grant privileges

=auto submit password=
.my.cnf
[client]
user=user_name
pass=password

=replication master slave=
==Setting the Replication Master Configuration==
/etc/my.cnf
[mysqld]
log-bin=mysql-bin
server-id=1

To get the master status information, follow these steps:
Start the command line client and flush all tables and block write statements by executing the FLUSH TABLES WITH READ LOCK statement:
mysql> FLUSH TABLES WITH READ LOCK;
Leave the client from which you issued the FLUSH TABLES statement running so that the read lock remains in effect. If you exit the client, the lock is released.

mysql> SHOW MASTER STATUS;
+------------------+----------+--------------+------------------+
| File | Position | Binlog_Do_DB | Binlog_Ignore_DB |
+------------------+----------+--------------+------------------+
| mysql-bin.000001 | 98 | | |
+------------------+----------+--------------+------------------+
1 row in set (0.00 sec)

The File column shows the name of the log and Position shows the offset within the file. In this example, the binary log file is mysql-bin.000001 and the offset is 98. Record these values. You need them later when you are setting up the slave. They represent the replication coordinates at which the slave should begin processing new updates from the master.

If the master has been running previously without binary logging enabled, the log name and position values displayed by SHOW MASTER STATUS or mysqldump --master-data will be empty. In that case, the values that you need to use later when specifying the slave's log file and position are the empty string ('') and 4.

mysqldump --all-databases --lock-all-tables >/tmp/dbdump.db

mysql> GRANT REPLICATION SLAVE ON *.* TO 'replication'@'192.168.7.%' IDENTIFIED BY 'slavepass';

==Setting the Replication Slave Configuration==
/etc/my.cnf
[mysqld]
server-id=2

Import the dump file:
shell> mysql < /tmp/dbdump.db

mysql> CHANGE MASTER TO MASTER_HOST='192.168.7.30', MASTER_USER='replication', MASTER_PASSWORD='slavepass', MASTER_LOG_FILE='mysql-bin.000001',MASTER_LOG_POS=98, MASTER_PORT='3307';

Start the slave threads:
mysql> START SLAVE;

Once a slave is replicating, you can find in its data directory one file named master.info and another named relay-log.info.

=setup slave xtrabackup=
https://www.percona.com/doc/percona-xtrabackup/2.3/howtos/setting_up_replication.html
# On master.
xtrabackup --backup --target-dir=/tmp/xtrabackup_$HOSTNAME
xtrabackup --prepare --target-dir=/tmp/xtrabackup_$HOSTNAME
SLAVE=slave.inter.net ; rsync -avpP /tmp/xtrabackup_$HOSTNAME $SLAVE:/tmp/xtrabackup_$HOSTNAME
GRANT REPLICATION SLAVE ON *.* TO 'repl'@'172.30.145.85' IDENTIFIED BY 'P@ssw0rd'; FLUSH PRIVILEGES;
# On slave.
mysql --host=master.inter.net --user=repl --password=P@ssw0rd
systemctl stop mysqld && mv /var/lib/mysql /var/lib/mysql.$(date_file)
xtrabackup --move-back --target-dir=/tmp/xtrabackup_slave/xtrabackup_slave/
chown -Rh mysql:mysql /var/lib/mysql
restorecon -R -v /var/lib/mysql
systemctl start mysql
cat /tmp/xtrabackup_*/xtrabackup_binlog_info
mysql-bin.000022 476974
mysql -e "CHANGE MASTER TO MASTER_HOST='master.inter.net', MASTER_USER='repl', MASTER_PASSWORD='P@ssw0rd', MASTER_LOG_FILE='mysql-bin.000022', MASTER_LOG_POS=476974;"
mysql -e "START SLAVE;"
==rebuild slave mysql way==
# Stop slave on mysql slave server.
mysql -e "STOP SLAVE;"
# Dump remote data to database server.
mysqldump -h <server> -uroot -p'<password>' --add-drop-database --set-charset --skip-lock-tables --single-transaction --default-character-set=utf8mb4 --flush-logs --hex-blob --master-data=1 --databases <data_base> | mysql
# Start slave.
START SLAVE; SHOW SLAVE STATUS \G

=stop slave from being slave=
RESET SLAVE ALL;

=Test to verify functionality of slave database=
the existence of these three lines verifies that the slave is functioning well.
mysql -e 'show slave status\G' |grep -E 'Slave_IO_Running:|Slave_SQL_Running:|Seconds_Behind_Master:'
Slave_IO_Running: Yes
Slave_SQL_Running: Yes
Seconds_Behind_Master: 0

=Usage of database files/size=
This query will output Data_length and Index_length for each table in your database. If you add them all together you can get the size used for your particular database.
show table status;
Usage of database.
SELECT table_schema "Data Base Name", sum( data_length + index_length ) / 1024 / 1024 "Data Base Size in MB" FROM information_schema.TABLES GROUP BY table_schema ;
Show size of every table in database
SELECT
table_schema as `Database`,
table_name AS `Table`,
round(((data_length + index_length) / 1024 / 1024), 2) `Size in MB`
FROM information_schema.TABLES
ORDER BY (data_length + index_length) DESC;

=pager=
Put output to file instead standard output.
\P cat > /tmp/tmp

=fix database/check database=
All databases.
mysqlcheck -c -u root -ppassword --all-databases
Check one database
mysqlcheck -c database -u root -ppassword
=look at health of slave database=
select @@hostname,now();show variables like 'read_only';show slave status\G
=mysqld man page=
/usr/libexec/mysqld --verbose --help
=last row=
SELECT fields FROM table ORDER BY id DESC LIMIT 1;
=enable disable full log=
# WARNING. generates lot of data and slow down database. Enable general_log_file. Logs each queury against database.
mysql -e "SET global log_output = 'FILE'; SET global general_log_file='queries.log'; SET global general_log = 1;"

# can be turned off with
mysql -e "SET global general_log = 0;"

# Look at queries
tail -f /apps/mysql/data/queries.log

# Clean log.
:>/apps/mysql/data/queries.log

# If you dont find logfile do. Has to be enabled at the time.
lsof | grep /queries.log

=kill query=
KILL QUERY "ID";

=Fragmentation=
data_free are the holes in the database.
mysql -e 'select ENGINE, TABLE_NAME,Round( DATA_LENGTH/1024/1024) as data_length , round(INDEX_LENGTH/1024/1024) as index_length, round(DATA_FREE/ 1024/1024) as data_free from information_schema.tables where DATA_FREE > 0;'
=truncate table=
Truncate table
TRUNCATE TABLE table_name
When you want to do something that is more effective then truncate.
mysql -e 'use database;RENAME TABLE sessions TO t1;CREATE TABLE sessions LIKE t1;DROP TABLE t1;'

=explain=
EXPLAIN SELECT * FROM categories\G
Explain described. possible_keys=possible indexes, key=chosen index. rows=rows scanned.
+----+-------------+-----------------+--------+--------------------------------------+--------------------------------------+---------+---------------------------------------+------+-------------+
| id | select_type | table | type | possible_keys | key | key_len | ref | rows | Extra |
+----+-------------+-----------------+--------+--------------------------------------+--------------------------------------+---------+---------------------------------------+------+-------------+
| 1 | SIMPLE | activerada0_ | ALL | NULL | NULL | NULL | NULL | 8425 | NULL |
| 1 | SIMPLE | ticketauto1_ | eq_ref | idx_u_ticket_automaton_status_ticket | idx_u_ticket_automaton_status_ticket | 4 | IPradar.activerada0_.ticket_id | 1 | Using where |
| 1 | SIMPLE | ipmonticke2_ | eq_ref | PRIMARY | PRIMARY | 8 | IPradar.activerada0_.ticket_id | 1 | NULL |
...

=innodb tables list=
list innodb tables
SELECT table_schema, table_name FROM INFORMATION_SCHEMA.TABLES WHERE engine = 'innodb';
=alter table=
Read fragmented innodb file from disk, Lock table, Store table back on disk without holes
ALTER TABLE table ENGINE=INNODB;
Another alternative.
OPTIMIZE TABLE prefilledautomaten.wmsreportedorders_archive;

=optimize execution=
SET SESSION optimizer_search_depth = 5;

=mysql_upgrade=
After updating mysql run the following command to update tables.
mysql_upgrade
=which tables are locked=
show open tables where in_use <> 0;
=unlock tables=
UNLOCK TABLES;

=FOREIGN_KEY=
Disable foreign key constrains temporary
SET FOREIGN_KEY_CHECKS=0;
Enable foreign key contrains.
SET FOREIGN_KEY_CHECKS=1;
=List indexes=
List index for one table.
show index from database.table;
List all indexes.
use information_schema;SELECT * FROM statistics;
mysql -e "use information_schema;SELECT * FROM statistics;" | column -t -s $'\t' | less -ISRM
==how much space does my index take==
mysql -e "SELECT table_schema as database_name,table_name,round(index_length/1024/1024,2) as index_size
FROM information_schema.tables
WHERE table_type = 'BASE TABLE'
and table_schema not in ('information_schema', 'sys','performance_schema', 'mysql')
and table_schema = '$DATABASE'
ORDER BY index_size desc;" | column_tab | head -3
database_name table_name index_size
polar props 1094.75
polar changedescriptors 488.83

=delete index=
DATABASE=x793 ; TABLE=icommerce_original_price ; mysql -D $DATABASE "DROP INDEX 'IDX_ICOMMERCE_ORIGINAL_PRICE_SKU' ON $TABLE;"

=password snooping=
sudo tcpdump -l -i any -w - src or dst port 3306 | strings
=get uniq answers=
"select DISTINCT table.database from table where conn_data LIKE '%value';"

=match rows with multiple equal columns=
select column1, column2, column3, count(*) as NumDuplicates
from database_name.table_name
group by column1, column2, column3
having NumDuplicates > 1;
=search for values matching null=
Search for null
select column from database.table where column_line IS NULL
Search for not null
select * from datebase.table WHERE column IS NOT NULL limit 1;"

=select values bigger then=
select column from database.table where column >= 14586379;

=load blob data=
INSERT INTO table1 VALUES(1, LOAD_FILE('data.png'));
=nestled queries=
Loop through the output of two nestled queries.
select * from connection_data where conn_data_id IN (select conn_data_id from connection_data_attribute where conn_id = (select conn_id from IPdiscover.connection where conn_uuid = "F5122"));
=mysqltuner=
Download. script to optimize mysql database.
wget http://mysqltuner.pl/ -O mysqltuner.pl
wget https://raw.githubusercontent.com/major/MySQLTuner-perl/master/basic_passwords.txt -O basic_passwords.txt
wget https://raw.githubusercontent.com/major/MySQLTuner-perl/master/vulnerabilities.csv -O vulnerabilities.csv

=move row between tables=
A simple INSERT INTO SELECT statement:
INSERT INTO persons_table SELECT * FROM customer_table WHERE person_name = 'tom';
DELETE FROM customer_table WHERE person_name = 'tom';
=date younger than=
SELECT * FROM FOO
WHERE MY_DATE_FIELD >= NOW() - INTERVAL 1 DAY
=comment=
Start with 2 -- and a space/tab.
-- select...
=start transaction/commit/rollback=
START TRANSACTION or BEGIN start a new transaction.
COMMIT commits the current transaction, making its changes permanent.
ROLLBACK
==slow queries==
Show status of slow query log.
SHOW GLOBAL VARIABLES LIKE 'slow\_%';
Modify slow query log settings.
SET GLOBAL slow_query_log_file = '/path/to/slow_query.log';
How long is a slow query.
SET GLOBAL long_query_time = 10;
Enable slow query.
SET GLOBAL slow_query_log = 'ON';
FLUSH LOGS;
=whoami=
select @@hostname,database(),USER(),now();
=how do user authenticate=
SELECT user, host, plugin FROM mysql.user;

=expire_logs_days/expire_logs_seconds=
Set value in /etc/my.cnf
[mysqld]
expire_logs_days=10
What is value after change.
mysql -e "SHOW GLOBAL VARIABLES LIKE 'expire_logs_days';"
mysql -e "SHOW VARIABLES LIKE 'binlog_expire_logs_seconds';"
Purge old binary logs.
PURGE BINARY LOGS BEFORE (date(now()) + interval 0 second - interval 10 day);
Set expire_logs_day
SET GLOBAL expire_logs_days = 1;
flush binary logs;
Expire bin logs after 12 hours. Once.
FLUSH LOGS;
PURGE BINARY LOGS BEFORE NOW() - INTERVAL 12 HOUR;

=queries per second=
mysqladmin status
=find cpu intensive queries=
https://www.percona.com/blog/2020/04/23/a-simple-approach-to-troubleshooting-high-cpu-in-mysql/
pidstat -t -p $(pgrep -f "/mysqld ") | grep -Ev "$HOSTNAME|CPU Command| mysqld" | sort -k 9 -n | tail -n10 | awk '{print $5 " " $9}' | while read PID CPU ; do echo '***' $PID $CPU ; mysql -e "select * from performance_schema.threads where THREAD_OS_ID = $PID \G" ; done
=slave stops fix=
stop slave
stop slave;
Skip troublesome query.
set global sql_slave_skip_counter=1;
start slave;
Oneliner
mysql -e "show slave status\G" > /tmp/show_slave_status.$(date '+%Y-%m-%d_%H-%M-%S')
mysql -e "set global sql_slave_skip_counter=1;start slave;"

=join=
SELECT column_name(s)
FROM table1
INNER JOIN table2
ON table1.column_name = table2.column_name;
=mysql_mode=
SELECT @@sql_mode;
=timeout=
Drop mysql session after. Per session
SHOW VARIABLES LIKE 'wait_timeout';
set timeout per session.
SET wait_timeout=31536000;
Drop mysql session after. Global.
select @@GLOBAL.wait_timeout;
Set timeout globally.
SET @@GLOBAL.wait_timeout=31536000;

=show functions=
SHOW FUNCTION STATUS;
=show stored procedures=
SHOW PROCEDURE STATUS;

=ssl=
Is your database configured for ssl.
show variables like 'have_ssl';
=collation/character set=
# Available collations
mysql -e 'SHOW COLLATION;'
# Available characters
mysql -e 'SHOW CHARACTER SET;'
# The change.
[mysqld]
collation-server = utf8mb4_swedish_ci
init-connect='SET NAMES utf8mb4'
character-set-server = utf8mb4
[mysql]
default-character-set=utf8mb4
# show setting
mysql -e 'SELECT @@collation_server, @@character_set_server;'
=Uptime=
'SELECT VARIABLE_VALUE AS Uptime_seconds, NOW() AS "Now", NOW() - INTERVAL VARIABLE_VALUE SECOND AS "Up since", DATEDIFF(NOW(), NOW() - INTERVAL VARIABLE_VALUE SECOND) AS "Uptime_days" FROM performance_schema.session_status WHERE VARIABLE_NAME = "Uptime";'
=Show binary data as hex=
mysql --binary-as-hex -e "use icingadb; select * from downtime limit 1\G"

Icinga2

2026-04-15T09:21:54Z

Ekaanbj: /* stats */

=nrpe config. /etc/nagios/nrpe.cfg=
log_facility=daemon
debug=0
pid_file=/run/nagios/nrpe.pid
server_port=5666
nrpe_user=nagios
nrpe_group=nagios
allowed_hosts=127.0.0.1,::1
dont_blame_nrpe=0
allow_bash_command_substitution=0
command_timeout=60
connection_timeout=300
disable_syslog=0
command[check_users]=/usr/lib/nagios/plugins/check_users -w 5 -c 10
command[check_load]=/usr/lib/nagios/plugins/check_load -r -w .15,.10,.05 -c .30,.25,.20
command[check_hda1]=/usr/lib/nagios/plugins/check_disk -w 20% -c 10% -p /dev/hda1
command[check_zombie_procs]=/usr/lib/nagios/plugins/check_procs -w 5 -c 10 -s Z
command[check_total_procs]=/usr/lib/nagios/plugins/check_procs -w 150 -c 200
include=/etc/nagios/nrpe_local.cfg
include_dir=/etc/nagios/nrpe.d/
=talk to nrpe=
/usr/lib/nagios/plugins/check_nrpe -H 172.22.65.13
NRPE v4.1.0
==list signing request==
icinga2 ca list
icinga2 ca sign <fingerprint>
==List services==
icinga2 object list --type Service
==List hosts==
icinga2 object list --type Host
==List most==
icinga2 object list
==list checks on remote windows machine==
gc -tail 10 "C:\Program Files\NSClient++\nsclient.ini"
[/settings/external scripts/alias]
check_disk = CheckDriveSize MinWarn=10% MinCrit=5% CheckAll FilterType=FIXED
check_load = check_cpu filter=none warn=90 crit=95
check_io = CheckCounter Counter:DiskIO=\\PhysicalDisk(_Total)\\Disk\ Bytes/sec
alias_memory = check_memory warn=99 crit=100
ipsec_hypergene = check_ping 10.255.255.1
ipsec_sharp = check_ping 192.168.77.1
ipsec_telia = check_ping 192.168.20.1
==list historic events==
ls -c1 -rt /var/log/icinga2/icinga2.log* | while read i ; do zcat -f $i | grep "ElKretsenIpsecTelia" | grep information/Notification | grep oncall-notification ; done
==Custom checks==
/usr/lib64/nagios/plugins/custom/check_ceph_crash.py
/usr/lib64/nagios/plugins/custom/check_ceph_df.py
/usr/lib64/nagios/plugins/custom/check_ceph_health.py
/usr/lib64/nagios/plugins/custom/check_ceph_mgr.py
/usr/lib64/nagios/plugins/custom/check_ceph_mon.py
/usr/lib64/nagios/plugins/custom/check_ceph_osd.py
/usr/lib64/nagios/plugins/custom/check_ceph_rgw_sync_status.py
/usr/lib64/nagios/plugins/custom/check_ceph_scrub.py
/usr/lib64/nagios/plugins/custom/check_ceph_versions.py
==stats==
Why does icinga2 use lots of memory. Look at config and sort by resources
icinga2 daemon -C | grep information/ConfigItem: | sort -k6 -n | tail -5

Icinga2

2026-04-15T09:12:19Z

Ekaanbj: /* Custom checks */

Openstack

2026-04-14T14:32:48Z

Ekaanbj: /* query user_data */

=What does it mean=
aodh Alarming service
barbican REST API designed for the secure storage, provisioning and management of secrets such as passwords, encryption keys and X.509
cinder OpenStack Block Storage
gnocchi Time Series Database as a Service
glance OpenStack Image Service
heat iac. Deploy instances, volumes and other OpenStack services using YAML based templates.
horizon Openstack’s Dashboard, which provides a web based user interface to OpenStack services
ironic bootstrap
keystone identity service
magnum container orchestration engines
mistral workflow service
neutron networking as a service
nfv Network functions virtualization
nova cloud computing instance controller, provision compute instances (aka virtual servers).
octavia Load balancer. Octavia HAProxy Amphora API
rhosp Red Hat OpenStack Platform
swift OpenStack Object Storage
tacker NFV Orchestration
trove Database as a Service
Zaqar multi-tenant cloud messaging service

=bash completion=
. <(openstack complete 2>/dev/null )
=flavor=
Which machine types exist.
gp "General purpose" Well rounded combination of amount of CPUs and the amount of RAM.
hm "High memory" Optimimzed for applications that need a lot of memory.
hp "High performance" High frequenzy cpu.
List suitable flavors
openstack flavor list -f json -c VCPUs -c RAM -c Disk -c Name | jq -r '.[] | [ .Name, .VCPUs, .RAM, .Disk ] | @tsv' | sort -k 2,2n -k 3,3n | grep -vE 'gpu|pinned|nvme' | column_tab
Change flavor of vm
openstack server resize <vm-name-or-id> --flavor <new-flavor-name-or-id> --wait
openstack server resize confirm <vm-name-or-id>

=Manage multiple projects=
export OS_CLIENT_CONFIG_FILE=~/.config/openstack/project1_clouds.yaml
export OS_CLOUD=project1

=list volumes=
openstack volume list
==list volume belonging to <server>==
openstack server volume list <server>
==remove volume from server==
openstack server remove volume <vm_name_or_id> <volume_id>

=install openstack=
dnf install python3-openstackclient
dnf -y install $(dnf -q search python3- client |grep -i OpenStack | grep -v -- -tests| awk '{print $1}')

=get ip addresses of all host=
openstack server list -c Networks -f json | jq -r '.[].Networks[][]'
=long output=
openstack server list --long
=select server depending status=
openstack server list --status ACTIVE

=output=
-f csv,json,table,value,yaml
Get output without headers.
openstack server list -f value

=list all=
openstack command list -f yaml | grep - | grep list | sed 's/^ - /openstack /g' |grep -v "openstack command list" | while read i ; do echo '*' $i ; $i 2>&1 ; done | tee /tmp/openstack_list_resources.${OS_CLOUD}.$(date +%F_%H-%M-%S)
openstack command list -f json | jq -r '.[].Commands[]|select (match("list$"))' | while read i ; do echo '*' openstack $i ; openstack $i 2>&1 ; done | tee /tmp/openstack_list_resources.${OS_CLOUD}.$(date +%F_%H-%M-%S)

=How to reach nodes=
OPENSTACK=$(openstack server list -c Networks -f json | jq -r '.[].Networks[][]') ; OPENSTACK_JUMP=$(grep 185 <<< "${OPENSTACK}") ; NODES=$(grep -v 185 <<< "${OPENSTACK}") ; for NODE in ${NODES} ; do echo ssh -J core@${OPENSTACK_JUMP} core@${NODE} ; done
=create server=
openstack server create --flavor gp.1x2 --availability-zone europe-se-1a --image fedora-37-x86_64 --boot-from-volume 100 --network abjorklund-01-5tsbc-openshift --security-group ssh_allow --key-name abjorklund_ed25519 abjorklund_$(date_file)
With setting password.
cat << EOF > user-data
#cloud-config
password: Password123!
chpasswd: {expire: False}
ssh_pwauth: True
EOF
openstack server create --flavor gp.1x2 --availability-zone europe-se-1a --image rocky-8-x86_64 --boot-from-volume 30 --network abjorklund-01-bmc7w-openshift --security-group ssh_allow --key-name abjorklund_ed25519 abjorklund_$(date_file) --user-data user-data
With existing network port
openstack server create --flavor gp.1x2 --block-device source=volume,id=<volume-id>,dest=volume,bootindex=0,delete_on_termination=false --nic port-id=<existing-port-id> --key-name <your-keypair> <new-server-name

=router=
==List routers==
openstack router list
==Get external ip.==
openstack router show abjorklund-01-5tsbc-external-router -c external_gateway_info -f json | jq '.external_gateway_info.external_fixed_ips[0].ip_address'
==Remove subnet from router==
openstack router remove subnet <router> <subnet>
==add route to router==
openstack router add route --route destination=10.8.1.0/24,gateway=10.111.222.254 <router>

=list available images=
openstack image list
=Download image=
Get info about image.
openstack image list | grep -i nord-ic-
| 98c03b69-4ba8-4276-8695-b6c3f006cf20 | nord-ic-bc84t-rhcos | active |
glance image-download --file nord-ic-bc84t-rhcos --progress 98c03b69-4ba8-4276-8695-b6c3f006cf20

=Upload image=
https://cloud-images.ubuntu.com/focal/current/
openstack image create --disk-format qcow2 --container-format bare --file focal-server-cloudimg-amd64.img Focal_Fossa.$(date_file)

=security=
==Create security group.==
openstack security group create <group>
openstack security group create ssh_allow

==Get security groups.==
openstack security group list -c Name -f json | jq -r '.[].Name'
==Get all security groups with rules.==
openstack security group list -c Name -f value | while read SECURITY ; do openstack security group show "$SECURITY" ; done > /temp/${OS_CLOUD##*/}}_openstack_security_group_list_openstack_security_group_show.$(date_file).log
==Get rules from one security group.==
openstack security group rule list <group>
==Add rule to allow traffic from ip.==
openstack security group rule create --proto tcp --dst-port 6443 --remote-ip 185.53.164.10/32 --ingress <group>
openstack security group rule create --proto tcp --dst-port 22 --remote-ip 0.0.0.0/0 --ingress <security group>
openstack security group rule create ssh_allow --remote-ip 0.0.0.0/0 --protocol tcp --dst-port 22 --ingress
openstack security group rule create <rule> --remote-ip 100.120.0.0/21 --protocol tcp --dst-port 22 --ingress <security group>

==Allow nfs4 traffic==
# List group to add too.
openstack security group list | grep rw-core
openstack security group rule create --proto tcp --dst-port 2049 --remote-ip 10.2.0.0/16 rw-core-p9dq6-master
==Add security group to server==
openstack server add security group <server_name_or_id> <security_group_name_or_id>
Example of adding a group with a rule.
openstack security group create ssh-vpn
openstack security group rule create ssh-vpn --remote-ip 100.120.0.0/21 --protocol tcp --dst-port 22 --ingress
openstack server add security group RW01 ssh-vpn

=create block device=
openstack volume create --size 50 --type ssd --description "nfs storage block device 0" nfs_storage_abjorklund-01
Resize block device.
os volume set --size 60 nfs_storage_abjorklund-01 --os-volume-api-version 3.42

=set physical ip on host=
openstack port list
List in different view.
openstack port list -f json | jq -r '.[]|[.ID, .Name, .Status, ."Fixed IP Addresses"[].ip_address]| join("\t")' | column -t -s $'\t'

=Change security group on port=
Remove if existing port does not exist.
openstack port set --no-security-group a7434863-fc4d-46ad-b93e-b0f2f717023f
openstack port set --security-group 3723f737-280f-453e-af0b-50aca4ce1b0d a7434863-fc4d-46ad-b93e-b0f2f717023f
=create port=
openstack port create --network abjorklund-01-h4sxm-openshift --fixed-ip subnet=4bb2ab0c-f8f9-4346-b238-5f992f0bcf56,ip-address=10.1.0.5 abjorklund-01-h4sxm-api-port

=manage loadbalancer aurora/haproxy=
openstack loadbalancer
openstack loadbalancer list
openstack loadbalancer show test-lb -c listeners -f value
=listerners and l7policy=
Identify listener
openstack loadbalancer listener list --loadbalancer test-lb | grep frontend_https
List l7policy on listener
openstack loadbalancer l7policy list --listener cdae695d-04fe-41e7-b927-88b5f32b9ed8 -f json
Let traffic through
openstack loadbalancer l7policy set --disable cdae695d-04fe-41e7-b927-88b5f32b9ed8
Maintenance mode
openstack loadbalancer l7policy set --enable cdae695d-04fe-41e7-b927-88b5f32b9ed8

=view limits=
If you have problems to create something in openstack it could be worth verifying you are within limits.
openstack limits show --absolute -f value | grep -E 'RAM|Cores'
openstack quota show --usage -c Resource -c Limit -c "In Use"

=count resources=
openstack quota show --usage -c Resource -c "In Use" -f json | jq -r '.[] | select(.Resource == "cores" or .Resource == "ram" or .Resource == "gigabytes" )| [.Resource, ."In Use"] | @tsv' | column -t -s $'\t'

=get project id=
openstack project list -f value -c ID
=manage s3/swift=
==create s3 credentials==
openstack ec2 credentials create
openstack ec2 credentials list
==Create s3 bucket==
aws s3api create-bucket --bucket <bucket>
swift post <bucket>
openstack container create <bucket>

==list s3 storage==
swift list
swift list <bucket>
swift list --long <container>
swift stat <bucket>
aws s3api list-buckets
openstack container list
==download file==
swift download elastic_snapshots elasticsearch-snapshots/snap-symvtlMpRIetTyfCDsHIVg.dat

==mount s3 bucket==
export AWS_ACCESS_KEY_ID=$AWS_ACCESS_KEY_ID ; export AWS_SECRET_ACCESS_KEY=$AWS_SECRET_ACCESS_KEY ; export AWS_DEFAULT_REGION=us-west-2 ; s3fs -f -d openshift-region /mnt/openshift-region/ -o endpoint=europe-se-1 -o "host=https://object-eu-se-1a.binero.cloud" -o use_path_request_style
==copy file to s3==
openstack server show $(openstack server list -f value | head -1 | awk '{print $2}') -c project_id -f value

=whoami=
openstack configuration show -f json | jq -r '."auth.username"'
=sort=
Sort on column name.
openstack network list --sort-column Name
=selected columns=
Select column name only
openstack server list -c Name -c Status -f table

=create ssh public key(keypair)=
openstack keypair create --public-key /home/abjorklund/.ssh/id_ed25519.pub abjorklund_id_ed25519
List keys
openstack keypair list
Delete kaypair
openstack keypair delete <keypair>

=create floating ip=
openstack floating ip create europe-se-1-1a-net0
=remove floating ip=
openstack floating ip delete 193.93.251.72

=assign floating ip to port=
openstack floating ip set --port abjorklund-01-h4sxm-ingress-port 193.93.251.233
=unassign floating ip to server=
openstack server remove floating ip ocp-13-nkvgn-master-0 193.93.251.72

=assign ip to server=
openstack server add floating ip abjorklund_dns-lookup 193.93.248.34

=restart server=
openstack server reboot <server>
openstack server reboot --hard <server>
=view events/log from server=
openstack server event list <server>
openstack server event show <server> <requestid>

=recovery of server using iso=
Upload iso recovery.
export ISO=ubuntu-22.04.4-live-server-amd64.iso ; openstack image create $ISO --property hw_rescue_device=cdrom --property hw_rescue_bus=scsi --disk-format iso --file $ISO --private --progress
If special properties are not set then set them.
openstack image set --property hw_rescue_device=cdrom --property hw_rescue_bus=scsi <image>
Boot server with recovery iso.
export SERVER=<server> ISO=<iso>; openstack --os-compute-api-version 2.87 server rescue --image $ISO $SERVER
When done disable rescue mode.
openstack server unrescue SERVER

=subnet=
List subnets
openstack subnet list
=hypervisor=
Which underlying hypervisor is used.
Not of your business. Ask worthy person.
=volume backups=
openstack volume backup list
=create snapshot=
SERVER=<server> openstack server image create --name "backup-${SERVER}-$(date_file)" ${SERVER}
=volume snapshot=
openstack volume snapshot list
openstack volume snapshot list -c ID -f value | while read SNAPSHOT ; do echo '*' $SNAPSHOT ; openstack volume snapshot delete $SNAPSHOT ; done

=dns=
# openstack dns https://docs.binero.com/dns.html
# List zones
openstack zone list
# Create zone
openstack zone create --email anden@halfface.se binero.halfface.se.
# Add entries.
openstack recordset create --record <ip> --type A <zone> <name>
# list enries.
openstack recordset list <zone>
# Delete entries.
openstack recordset delete <zone> <name>
# show values for one entry
openstack recordset show <zone> <name>

=Networking explained=

1. openstack_networking_network_v2
- Purpose: Represents a network in OpenStack.
- Interaction: This is the top-level network entity. You create a network to provide a layer 2 domain for your instances.

2. openstack_networking_subnet_v2
- Purpose: Represents a subnet within a network.
- Interaction: A subnet is associated with a network. It defines a range of IP addresses, and optionally, DHCP settings.

3. openstack_networking_router_v2
- Purpose: Represents a virtual router.
- Interaction: Routers are used to route traffic between different subnets or networks. They can also be used to provide external network access to instances.

4. openstack_networking_router_interface_v2
- Purpose: Connects a router to a subnet.
- Interaction: This resource is used to add an interface to a router, effectively connecting the router to a subnet, enabling routing between that subnet and others.

5. openstack_networking_port_v2
- Purpose: Represents a port on a network.
- Interaction: Ports are attachment points for devices (like instances) on a network. They have associated IP addresses and MAC addresses.

6. openstack_networking_port_secgroup_associate_v2
- Purpose: Associates security groups with a port.
- Interaction: Security groups define the firewall rules applied to ports. Associating a security group with a port applies the security group's rules to that port.

7. openstack_networking_secgroup_v2
- Purpose: Represents a security group.
- Interaction: Security groups contain a set of rules that define the allowed ingress and egress traffic to and from ports.

8. openstack_networking_secgroup_rule_v2
- Purpose: Represents a rule within a security group.
- Interaction: Security group rules define specific ingress or egress traffic allowed to the instances associated with ports to which the security group is applied.

9. openstack_networking_floatingip_v2
- Purpose: Represents a floating IP.
- Interaction: Floating IPs are IP addresses that can be dynamically associated with instances. They provide external access to instances.

10. openstack_networking_floatingip_associate_v2
- Purpose: Associates a floating IP with a port.
- Interaction: This resource links a floating IP to a port, providing the instance with an external IP address that is accessible from outside the OpenStack cloud.

Interaction Summary
1. Network and Subnet Creation:
- Create a network using `openstack_networking_network_v2`.
- Create a subnet within this network using `openstack_networking_subnet_v2`.

2. Router Configuration:
- Create a router using `openstack_networking_router_v2`.
- Add an interface to this router to connect it to a subnet using `openstack_networking_router_interface_v2`.

3. Instance Connectivity:
- Create a port on the network using `openstack_networking_port_v2`.
- Attach this port to an instance.

4. Security:
- Create security groups using `openstack_networking_secgroup_v2`.
- Define rules for the security group using `openstack_networking_secgroup_rule_v2`.
- Associate security groups with the port using `openstack_networking_port_secgroup_associate_v2`.

5. External Access:
- Create a floating IP using `openstack_networking_floatingip_v2`.
- Associate the floating IP with the port attached to the instance using `openstack_networking_floatingip_associate_v2`.
=Extend disk=
Look at usage from beginning.
df -lh
Extend partition partprobe
openstack volume set --size <new_size> <volume> --os-volume-api-version 3.42
Grow partition that you intend to grow. This part can be ignored if using disk as raw partion(/dev/sd?)
growpart /dev/sdb 1
Resize filesystem.
resize2fs /dev/sdb1
Look at usage after extend.
df -lh
=affinity=
affinity Put servers on same hypervisor.
anti-affinity Dont put servers on same hypervisor.
soft-affinity Put servers on same hypervisor if possible.
soft-anti-affinity Put server on hypervisor if possible

=Are hosts located on same hypervisor=
openstack server list -f value -c ID | while read i ; do openstack server show $i -f value -c hostId -c name | xargs ; done | sort -n
=Define how server should be handled regarding affinity=
openstack server group list
==create server group name with soft affinity==
openstack server group create --policy soft-anti-affinity <name>

=install openstack cli on rhel7/8=
yum install centos-release-openstack-train.noarch
yum install python-openstackclient
sed -i 's/^mirrorlist/#mirrorlist/g' /etc/yum.repos.d/*
sed -i 's%^#baseurl=http://mirror.centos.org%baseurl=http://vault.centos.org%g' /etc/yum.repos.d/*
=remove network with dependencies=
export ROUTER=93b6d9c1-67db-4e04-9aaf-dad208def3c4
export NETWORK=9b86febc-f46f-4990-96c8-ef2e4bc8e139
openstack router remove subnet ${ROUTER} $(openstack route show ${ROUTER} -f json | jq -r '.interfaces_info[].subnet_id')
openstack router unset --external-gateway ${ROUTER}
for port in $(openstack port list --network ${NETWORK} -f value -c ID); do
openstack port delete "$port"
done
for subnet in $(openstack subnet list --network ${NETWORK} -f value -c ID); do
openstack subnet delete "$subnet"
done
openstack network delete ${NETWORK}
openstack router delete ${ROUTER}
=delete nic/network from server=
openstack port list --server <vm-name-or-id>
openstack server remove port <vm-name-or-id> <port-id>

=openstack version=
openstack major miro version.
openstack version show
openstack version show -f json | jq -r '.[] | select(.Status == "CURRENT") | [."Service Type", .Version, .Endpoint]|@tsv' | column_tab
=download volume to you where you want=
Create an image.
openstack image create --volume <volume name> --private --progress <image name>
Download it using.
openstack image save --file <local filename> <image name>
=application credentials=
<pre>
# Login via working cli session. Create application credentials with read permissions. Create config file with output from the command.
openstack application credential create reader_3 --role reader -c id -c secret -f value | xargs | while read ID SECRET ; do cat > clouds.yaml <<EOF
clouds:
${OS_CLOUD}:
auth_type: "v3applicationcredential"
auth:
auth_url: https://auth.binero.cloud:5000
application_credential_id: "${ID}"
application_credential_secret: "${SECRET}"
region_name: europe-se-1
interface: public
identity_api_version: 3
volume_api_version: 3
EOF
done
# To be able to use above config file you have to set OS_CLOUD variable and have the clouds.yaml file in either your working directory or ~/.config/openstack/clouds.yaml.
</pre>
=manage certs=
==List secrets==
openstack secret list
==Add new cert. Content type p12==
openssl pkcs12 -export -in sulzer.pem -out sulzer.p12 -passout pass:
openstack secret store --name star-sulzer-com-lb-cert-2026-10-23 --secret-type opaque --payload-content-type 'application/octet-stream' --payload-content-encoding base64 --payload "$(base64 /temp/sulzer.p12)"

==Download cert==
openstack secret get https://api-eu-se-1.binero.cloud:9311/v1/secrets/8c0e090c-6cf4-4767-94ce-a55417e56429 --payload_content_type 'application/octet-stream' --file /tmp/tmp
==Look at cert==
openstack secret get https://api-eu-se-1.binero.cloud:9311/v1/secrets/8c0e090c-6cf4-4767-94ce-a55417e56429 --payload_content_type 'application/octet-stream' --payload -f value | python3 -c "import sys; sys.stdout.buffer.write(eval(sys.stdin.read()))" | openssl pkcs12 -nodes -info -passin pass:
==Add cert to listener==
openstack loadbalancer listener set <listener_id> --default-tls-container-ref <certificate_secret_id>
=dhcp options provided by cloud-init=
/var/log/cloud-init.log
=List hypervisor=
openstack hypervisor list -f json | jq -r '.[]|select(.State == "up")|."Hypervisor Hostname"' | sort -n | while read i ; do echo "$i(){ ssh root@$i "'"${@}" ; }' ; done
openstack hypervisor list -f json | jq -r '[.[] | select(.State == "up")] | sort_by(."Hypervisor Hostname" | match("([0-9]+)").captures[0].string | tonumber) | .[]."Hypervisor Hostname"'| while read i ; do echo "$i(){ ssh root@$i "'"${@}" ; }' ; done
=query user_data=
<pre>
curl -sv http://169.254.169.254/openstack/latest/user_data -o - | cat -v
</pre>

Openstack

2026-04-14T14:31:16Z

Ekaanbj: /* List hypervisor */

=What does it mean=
aodh Alarming service
barbican REST API designed for the secure storage, provisioning and management of secrets such as passwords, encryption keys and X.509
cinder OpenStack Block Storage
gnocchi Time Series Database as a Service
glance OpenStack Image Service
heat iac. Deploy instances, volumes and other OpenStack services using YAML based templates.
horizon Openstack’s Dashboard, which provides a web based user interface to OpenStack services
ironic bootstrap
keystone identity service
magnum container orchestration engines
mistral workflow service
neutron networking as a service
nfv Network functions virtualization
nova cloud computing instance controller, provision compute instances (aka virtual servers).
octavia Load balancer. Octavia HAProxy Amphora API
rhosp Red Hat OpenStack Platform
swift OpenStack Object Storage
tacker NFV Orchestration
trove Database as a Service
Zaqar multi-tenant cloud messaging service

=bash completion=
. <(openstack complete 2>/dev/null )
=flavor=
Which machine types exist.
gp "General purpose" Well rounded combination of amount of CPUs and the amount of RAM.
hm "High memory" Optimimzed for applications that need a lot of memory.
hp "High performance" High frequenzy cpu.
List suitable flavors
openstack flavor list -f json -c VCPUs -c RAM -c Disk -c Name | jq -r '.[] | [ .Name, .VCPUs, .RAM, .Disk ] | @tsv' | sort -k 2,2n -k 3,3n | grep -vE 'gpu|pinned|nvme' | column_tab
Change flavor of vm
openstack server resize <vm-name-or-id> --flavor <new-flavor-name-or-id> --wait
openstack server resize confirm <vm-name-or-id>

=Manage multiple projects=
export OS_CLIENT_CONFIG_FILE=~/.config/openstack/project1_clouds.yaml
export OS_CLOUD=project1

=list volumes=
openstack volume list
==list volume belonging to <server>==
openstack server volume list <server>
==remove volume from server==
openstack server remove volume <vm_name_or_id> <volume_id>

=install openstack=
dnf install python3-openstackclient
dnf -y install $(dnf -q search python3- client |grep -i OpenStack | grep -v -- -tests| awk '{print $1}')

=get ip addresses of all host=
openstack server list -c Networks -f json | jq -r '.[].Networks[][]'
=long output=
openstack server list --long
=select server depending status=
openstack server list --status ACTIVE

=output=
-f csv,json,table,value,yaml
Get output without headers.
openstack server list -f value

=list all=
openstack command list -f yaml | grep - | grep list | sed 's/^ - /openstack /g' |grep -v "openstack command list" | while read i ; do echo '*' $i ; $i 2>&1 ; done | tee /tmp/openstack_list_resources.${OS_CLOUD}.$(date +%F_%H-%M-%S)
openstack command list -f json | jq -r '.[].Commands[]|select (match("list$"))' | while read i ; do echo '*' openstack $i ; openstack $i 2>&1 ; done | tee /tmp/openstack_list_resources.${OS_CLOUD}.$(date +%F_%H-%M-%S)

=How to reach nodes=
OPENSTACK=$(openstack server list -c Networks -f json | jq -r '.[].Networks[][]') ; OPENSTACK_JUMP=$(grep 185 <<< "${OPENSTACK}") ; NODES=$(grep -v 185 <<< "${OPENSTACK}") ; for NODE in ${NODES} ; do echo ssh -J core@${OPENSTACK_JUMP} core@${NODE} ; done
=create server=
openstack server create --flavor gp.1x2 --availability-zone europe-se-1a --image fedora-37-x86_64 --boot-from-volume 100 --network abjorklund-01-5tsbc-openshift --security-group ssh_allow --key-name abjorklund_ed25519 abjorklund_$(date_file)
With setting password.
cat << EOF > user-data
#cloud-config
password: Password123!
chpasswd: {expire: False}
ssh_pwauth: True
EOF
openstack server create --flavor gp.1x2 --availability-zone europe-se-1a --image rocky-8-x86_64 --boot-from-volume 30 --network abjorklund-01-bmc7w-openshift --security-group ssh_allow --key-name abjorklund_ed25519 abjorklund_$(date_file) --user-data user-data
With existing network port
openstack server create --flavor gp.1x2 --block-device source=volume,id=<volume-id>,dest=volume,bootindex=0,delete_on_termination=false --nic port-id=<existing-port-id> --key-name <your-keypair> <new-server-name

=router=
==List routers==
openstack router list
==Get external ip.==
openstack router show abjorklund-01-5tsbc-external-router -c external_gateway_info -f json | jq '.external_gateway_info.external_fixed_ips[0].ip_address'
==Remove subnet from router==
openstack router remove subnet <router> <subnet>
==add route to router==
openstack router add route --route destination=10.8.1.0/24,gateway=10.111.222.254 <router>

=list available images=
openstack image list
=Download image=
Get info about image.
openstack image list | grep -i nord-ic-
| 98c03b69-4ba8-4276-8695-b6c3f006cf20 | nord-ic-bc84t-rhcos | active |
glance image-download --file nord-ic-bc84t-rhcos --progress 98c03b69-4ba8-4276-8695-b6c3f006cf20

=Upload image=
https://cloud-images.ubuntu.com/focal/current/
openstack image create --disk-format qcow2 --container-format bare --file focal-server-cloudimg-amd64.img Focal_Fossa.$(date_file)

=security=
==Create security group.==
openstack security group create <group>
openstack security group create ssh_allow

==Get security groups.==
openstack security group list -c Name -f json | jq -r '.[].Name'
==Get all security groups with rules.==
openstack security group list -c Name -f value | while read SECURITY ; do openstack security group show "$SECURITY" ; done > /temp/${OS_CLOUD##*/}}_openstack_security_group_list_openstack_security_group_show.$(date_file).log
==Get rules from one security group.==
openstack security group rule list <group>
==Add rule to allow traffic from ip.==
openstack security group rule create --proto tcp --dst-port 6443 --remote-ip 185.53.164.10/32 --ingress <group>
openstack security group rule create --proto tcp --dst-port 22 --remote-ip 0.0.0.0/0 --ingress <security group>
openstack security group rule create ssh_allow --remote-ip 0.0.0.0/0 --protocol tcp --dst-port 22 --ingress
openstack security group rule create <rule> --remote-ip 100.120.0.0/21 --protocol tcp --dst-port 22 --ingress <security group>

==Allow nfs4 traffic==
# List group to add too.
openstack security group list | grep rw-core
openstack security group rule create --proto tcp --dst-port 2049 --remote-ip 10.2.0.0/16 rw-core-p9dq6-master
==Add security group to server==
openstack server add security group <server_name_or_id> <security_group_name_or_id>
Example of adding a group with a rule.
openstack security group create ssh-vpn
openstack security group rule create ssh-vpn --remote-ip 100.120.0.0/21 --protocol tcp --dst-port 22 --ingress
openstack server add security group RW01 ssh-vpn

=create block device=
openstack volume create --size 50 --type ssd --description "nfs storage block device 0" nfs_storage_abjorklund-01
Resize block device.
os volume set --size 60 nfs_storage_abjorklund-01 --os-volume-api-version 3.42

=set physical ip on host=
openstack port list
List in different view.
openstack port list -f json | jq -r '.[]|[.ID, .Name, .Status, ."Fixed IP Addresses"[].ip_address]| join("\t")' | column -t -s $'\t'

=Change security group on port=
Remove if existing port does not exist.
openstack port set --no-security-group a7434863-fc4d-46ad-b93e-b0f2f717023f
openstack port set --security-group 3723f737-280f-453e-af0b-50aca4ce1b0d a7434863-fc4d-46ad-b93e-b0f2f717023f
=create port=
openstack port create --network abjorklund-01-h4sxm-openshift --fixed-ip subnet=4bb2ab0c-f8f9-4346-b238-5f992f0bcf56,ip-address=10.1.0.5 abjorklund-01-h4sxm-api-port

=manage loadbalancer aurora/haproxy=
openstack loadbalancer
openstack loadbalancer list
openstack loadbalancer show test-lb -c listeners -f value
=listerners and l7policy=
Identify listener
openstack loadbalancer listener list --loadbalancer test-lb | grep frontend_https
List l7policy on listener
openstack loadbalancer l7policy list --listener cdae695d-04fe-41e7-b927-88b5f32b9ed8 -f json
Let traffic through
openstack loadbalancer l7policy set --disable cdae695d-04fe-41e7-b927-88b5f32b9ed8
Maintenance mode
openstack loadbalancer l7policy set --enable cdae695d-04fe-41e7-b927-88b5f32b9ed8

=view limits=
If you have problems to create something in openstack it could be worth verifying you are within limits.
openstack limits show --absolute -f value | grep -E 'RAM|Cores'
openstack quota show --usage -c Resource -c Limit -c "In Use"

=count resources=
openstack quota show --usage -c Resource -c "In Use" -f json | jq -r '.[] | select(.Resource == "cores" or .Resource == "ram" or .Resource == "gigabytes" )| [.Resource, ."In Use"] | @tsv' | column -t -s $'\t'

=get project id=
openstack project list -f value -c ID
=manage s3/swift=
==create s3 credentials==
openstack ec2 credentials create
openstack ec2 credentials list
==Create s3 bucket==
aws s3api create-bucket --bucket <bucket>
swift post <bucket>
openstack container create <bucket>

==list s3 storage==
swift list
swift list <bucket>
swift list --long <container>
swift stat <bucket>
aws s3api list-buckets
openstack container list
==download file==
swift download elastic_snapshots elasticsearch-snapshots/snap-symvtlMpRIetTyfCDsHIVg.dat

==mount s3 bucket==
export AWS_ACCESS_KEY_ID=$AWS_ACCESS_KEY_ID ; export AWS_SECRET_ACCESS_KEY=$AWS_SECRET_ACCESS_KEY ; export AWS_DEFAULT_REGION=us-west-2 ; s3fs -f -d openshift-region /mnt/openshift-region/ -o endpoint=europe-se-1 -o "host=https://object-eu-se-1a.binero.cloud" -o use_path_request_style
==copy file to s3==
openstack server show $(openstack server list -f value | head -1 | awk '{print $2}') -c project_id -f value

=whoami=
openstack configuration show -f json | jq -r '."auth.username"'
=sort=
Sort on column name.
openstack network list --sort-column Name
=selected columns=
Select column name only
openstack server list -c Name -c Status -f table

=create ssh public key(keypair)=
openstack keypair create --public-key /home/abjorklund/.ssh/id_ed25519.pub abjorklund_id_ed25519
List keys
openstack keypair list
Delete kaypair
openstack keypair delete <keypair>

=create floating ip=
openstack floating ip create europe-se-1-1a-net0
=remove floating ip=
openstack floating ip delete 193.93.251.72

=assign floating ip to port=
openstack floating ip set --port abjorklund-01-h4sxm-ingress-port 193.93.251.233
=unassign floating ip to server=
openstack server remove floating ip ocp-13-nkvgn-master-0 193.93.251.72

=assign ip to server=
openstack server add floating ip abjorklund_dns-lookup 193.93.248.34

=restart server=
openstack server reboot <server>
openstack server reboot --hard <server>
=view events/log from server=
openstack server event list <server>
openstack server event show <server> <requestid>

=recovery of server using iso=
Upload iso recovery.
export ISO=ubuntu-22.04.4-live-server-amd64.iso ; openstack image create $ISO --property hw_rescue_device=cdrom --property hw_rescue_bus=scsi --disk-format iso --file $ISO --private --progress
If special properties are not set then set them.
openstack image set --property hw_rescue_device=cdrom --property hw_rescue_bus=scsi <image>
Boot server with recovery iso.
export SERVER=<server> ISO=<iso>; openstack --os-compute-api-version 2.87 server rescue --image $ISO $SERVER
When done disable rescue mode.
openstack server unrescue SERVER

=subnet=
List subnets
openstack subnet list
=hypervisor=
Which underlying hypervisor is used.
Not of your business. Ask worthy person.
=volume backups=
openstack volume backup list
=create snapshot=
SERVER=<server> openstack server image create --name "backup-${SERVER}-$(date_file)" ${SERVER}
=volume snapshot=
openstack volume snapshot list
openstack volume snapshot list -c ID -f value | while read SNAPSHOT ; do echo '*' $SNAPSHOT ; openstack volume snapshot delete $SNAPSHOT ; done

=dns=
# openstack dns https://docs.binero.com/dns.html
# List zones
openstack zone list
# Create zone
openstack zone create --email anden@halfface.se binero.halfface.se.
# Add entries.
openstack recordset create --record <ip> --type A <zone> <name>
# list enries.
openstack recordset list <zone>
# Delete entries.
openstack recordset delete <zone> <name>
# show values for one entry
openstack recordset show <zone> <name>

=Networking explained=

1. openstack_networking_network_v2
- Purpose: Represents a network in OpenStack.
- Interaction: This is the top-level network entity. You create a network to provide a layer 2 domain for your instances.

2. openstack_networking_subnet_v2
- Purpose: Represents a subnet within a network.
- Interaction: A subnet is associated with a network. It defines a range of IP addresses, and optionally, DHCP settings.

3. openstack_networking_router_v2
- Purpose: Represents a virtual router.
- Interaction: Routers are used to route traffic between different subnets or networks. They can also be used to provide external network access to instances.

4. openstack_networking_router_interface_v2
- Purpose: Connects a router to a subnet.
- Interaction: This resource is used to add an interface to a router, effectively connecting the router to a subnet, enabling routing between that subnet and others.

5. openstack_networking_port_v2
- Purpose: Represents a port on a network.
- Interaction: Ports are attachment points for devices (like instances) on a network. They have associated IP addresses and MAC addresses.

6. openstack_networking_port_secgroup_associate_v2
- Purpose: Associates security groups with a port.
- Interaction: Security groups define the firewall rules applied to ports. Associating a security group with a port applies the security group's rules to that port.

7. openstack_networking_secgroup_v2
- Purpose: Represents a security group.
- Interaction: Security groups contain a set of rules that define the allowed ingress and egress traffic to and from ports.

8. openstack_networking_secgroup_rule_v2
- Purpose: Represents a rule within a security group.
- Interaction: Security group rules define specific ingress or egress traffic allowed to the instances associated with ports to which the security group is applied.

9. openstack_networking_floatingip_v2
- Purpose: Represents a floating IP.
- Interaction: Floating IPs are IP addresses that can be dynamically associated with instances. They provide external access to instances.

10. openstack_networking_floatingip_associate_v2
- Purpose: Associates a floating IP with a port.
- Interaction: This resource links a floating IP to a port, providing the instance with an external IP address that is accessible from outside the OpenStack cloud.

Interaction Summary
1. Network and Subnet Creation:
- Create a network using `openstack_networking_network_v2`.
- Create a subnet within this network using `openstack_networking_subnet_v2`.

2. Router Configuration:
- Create a router using `openstack_networking_router_v2`.
- Add an interface to this router to connect it to a subnet using `openstack_networking_router_interface_v2`.

3. Instance Connectivity:
- Create a port on the network using `openstack_networking_port_v2`.
- Attach this port to an instance.

4. Security:
- Create security groups using `openstack_networking_secgroup_v2`.
- Define rules for the security group using `openstack_networking_secgroup_rule_v2`.
- Associate security groups with the port using `openstack_networking_port_secgroup_associate_v2`.

5. External Access:
- Create a floating IP using `openstack_networking_floatingip_v2`.
- Associate the floating IP with the port attached to the instance using `openstack_networking_floatingip_associate_v2`.
=Extend disk=
Look at usage from beginning.
df -lh
Extend partition partprobe
openstack volume set --size <new_size> <volume> --os-volume-api-version 3.42
Grow partition that you intend to grow. This part can be ignored if using disk as raw partion(/dev/sd?)
growpart /dev/sdb 1
Resize filesystem.
resize2fs /dev/sdb1
Look at usage after extend.
df -lh
=affinity=
affinity Put servers on same hypervisor.
anti-affinity Dont put servers on same hypervisor.
soft-affinity Put servers on same hypervisor if possible.
soft-anti-affinity Put server on hypervisor if possible

=Are hosts located on same hypervisor=
openstack server list -f value -c ID | while read i ; do openstack server show $i -f value -c hostId -c name | xargs ; done | sort -n
=Define how server should be handled regarding affinity=
openstack server group list
==create server group name with soft affinity==
openstack server group create --policy soft-anti-affinity <name>

=install openstack cli on rhel7/8=
yum install centos-release-openstack-train.noarch
yum install python-openstackclient
sed -i 's/^mirrorlist/#mirrorlist/g' /etc/yum.repos.d/*
sed -i 's%^#baseurl=http://mirror.centos.org%baseurl=http://vault.centos.org%g' /etc/yum.repos.d/*
=remove network with dependencies=
export ROUTER=93b6d9c1-67db-4e04-9aaf-dad208def3c4
export NETWORK=9b86febc-f46f-4990-96c8-ef2e4bc8e139
openstack router remove subnet ${ROUTER} $(openstack route show ${ROUTER} -f json | jq -r '.interfaces_info[].subnet_id')
openstack router unset --external-gateway ${ROUTER}
for port in $(openstack port list --network ${NETWORK} -f value -c ID); do
openstack port delete "$port"
done
for subnet in $(openstack subnet list --network ${NETWORK} -f value -c ID); do
openstack subnet delete "$subnet"
done
openstack network delete ${NETWORK}
openstack router delete ${ROUTER}
=delete nic/network from server=
openstack port list --server <vm-name-or-id>
openstack server remove port <vm-name-or-id> <port-id>

=openstack version=
openstack major miro version.
openstack version show
openstack version show -f json | jq -r '.[] | select(.Status == "CURRENT") | [."Service Type", .Version, .Endpoint]|@tsv' | column_tab
=download volume to you where you want=
Create an image.
openstack image create --volume <volume name> --private --progress <image name>
Download it using.
openstack image save --file <local filename> <image name>
=application credentials=
<pre>
# Login via working cli session. Create application credentials with read permissions. Create config file with output from the command.
openstack application credential create reader_3 --role reader -c id -c secret -f value | xargs | while read ID SECRET ; do cat > clouds.yaml <<EOF
clouds:
${OS_CLOUD}:
auth_type: "v3applicationcredential"
auth:
auth_url: https://auth.binero.cloud:5000
application_credential_id: "${ID}"
application_credential_secret: "${SECRET}"
region_name: europe-se-1
interface: public
identity_api_version: 3
volume_api_version: 3
EOF
done
# To be able to use above config file you have to set OS_CLOUD variable and have the clouds.yaml file in either your working directory or ~/.config/openstack/clouds.yaml.
</pre>
=manage certs=
==List secrets==
openstack secret list
==Add new cert. Content type p12==
openssl pkcs12 -export -in sulzer.pem -out sulzer.p12 -passout pass:
openstack secret store --name star-sulzer-com-lb-cert-2026-10-23 --secret-type opaque --payload-content-type 'application/octet-stream' --payload-content-encoding base64 --payload "$(base64 /temp/sulzer.p12)"

==Download cert==
openstack secret get https://api-eu-se-1.binero.cloud:9311/v1/secrets/8c0e090c-6cf4-4767-94ce-a55417e56429 --payload_content_type 'application/octet-stream' --file /tmp/tmp
==Look at cert==
openstack secret get https://api-eu-se-1.binero.cloud:9311/v1/secrets/8c0e090c-6cf4-4767-94ce-a55417e56429 --payload_content_type 'application/octet-stream' --payload -f value | python3 -c "import sys; sys.stdout.buffer.write(eval(sys.stdin.read()))" | openssl pkcs12 -nodes -info -passin pass:
==Add cert to listener==
openstack loadbalancer listener set <listener_id> --default-tls-container-ref <certificate_secret_id>
=dhcp options provided by cloud-init=
/var/log/cloud-init.log
=List hypervisor=
openstack hypervisor list -f json | jq -r '.[]|select(.State == "up")|."Hypervisor Hostname"' | sort -n | while read i ; do echo "$i(){ ssh root@$i "'"${@}" ; }' ; done
openstack hypervisor list -f json | jq -r '[.[] | select(.State == "up")] | sort_by(."Hypervisor Hostname" | match("([0-9]+)").captures[0].string | tonumber) | .[]."Hypervisor Hostname"'| while read i ; do echo "$i(){ ssh root@$i "'"${@}" ; }' ; done
=query user_data=
curl -sv http://169.254.169.254/openstack/latest/user_data -o - | cat -v

Commands

2026-04-09T15:06:18Z

Ekaanbj: /* strace multiple processes */

=7za=
decompress file
7za e myfiles.7z
=ab=
apache benchmarking
ab -n 50 https://www.halfface.se/photos/
ab -n 1000 -c 10 https://www.halfface.se/wiki/index.php/Halfface

=abcde=
Rip cd.
abcde
=adb android=
# install adb
dnf install android-tools
# enable debug. On phone. Settings. about phone. build version. Click until prompted. Enable debug via selector.
# Connect phone via usb.
# List phones.
adb devices
# Get shell on phone.
adb shell
# list installed packages.
pm list packages -f
adb shell pm list packages -f | grep game
# Uninstall
adb shell pm uninstall -k --user 0 com.samsung.android.game.gos
adb shell pm uninstall -k --user 0 com.samsung.android.game.gametools
adb shell pm disable-user --user 0 com.sec.android.app.samsungapps

=agrep=
Aproximate grep. 3 differences from andreas
agrep -3 andreas /var/log/messages
=alacritty(Terminal emulator hw accellerated)=
Terminal copy mode.
CTRL + SHIFT + SPACE
=alsactl=
Reload alsa drivers
systemctl restart alsa-state
sudo alsactl restore

=alternatives=
alternatives --set mta /usr/sbin/sendmail.postfix
sudo alternatives --config java

=antiword=
antiword bad.doc > pure.txt

=arecord=
List soundcards.
arecord -l
Chose source.
alsamixer
Create mp3 from source.
arecord -f cd -d 5 -t raw | lame -x -r - out.mp3
=arp-scan=
Scan ip addresses on local subnet
arp-scan --localnet | sort -n -k4 -t. | grep ^[0-9]

=at=
Run command at specific time. Look at queue.
echo '/usr/bin/espeak -s120 "I will say this only once."' | at -t $(date +%Y%m%d%H%M --date="+2 min")
atq
List at jobs.
atq ; atq | awk '{print $1}' | while read i ; do echo '***' $i ; at -c $i 2>&1 | tail -3 | head -1 ; done
2 Sun May 17 04:00:00 2020 a root
*** 2
/usr/bin/systemctl restart springboot_uc_supportrouter.service

=authselect=
Redhat command to manage connection to underlying services and features.
# To change content of nsswitch.conf do to your used profile.
vim /usr/share/authselect/default/local/nsswitch.conf
authselect select local --force

=base64=
base64 -d /tmp/html | elinks --dump | less -ISRM
No wrapping
base64 --wrap=0
base64 -w 0
=bash=
curl
exec 3<>/dev/tcp/localhost/8080 ; echo -e "GET /health HTTP/1.1\r\nHost: localhost\r\nConnection: close\r\n\r\n" >&3 ; cat <&3

=bbk_cli_...=
Bredbandskollen via cli.
bbk_cli_linux_amd64-1.0

=bc=
Simplify using bercerly calculator
calc(){ echo -e "scale=8\n${@}\nquit\n" | bc ; }
To the power of(upphöjt i)
2^10 = 1024
scientific (aka exponential) notation
echo 1.6945991213315015e+09 | sed -E 's/([+-]?[0-9.]+)[eE]\+?(-?)([0-9]+)/(\1*10^\2\3)/g' | bc
=bitwarden=
# Install bw.
curl -L -o /tmp/bw.zip 'https://vault.bitwarden.com/download/?app=cli&platform=linux' ; (cd /usr/local/bin ; sudo unzip -o /tmp/bw.zip)
# Remove bitwarden config.
unset BW_CLIENTID BW_CLIENTSECRET BW_SESSION
\rm -r /home/abjorklund/.config/Bitwarden*
# Set bitwarden server.
bw config server https://halfface.se/vaultwarden/
# api login
bw login --apikey
# sso login. When web server opens write "Binero SSO"
bw login
# Unlock
bw unlock
# Sync from server.
bw sync
# List items.
bw list items | jq -r '.[].name'
# get totp
bw_halfface get totp ginatricot_user
# get login info.
bw get item bareos-webui | jq .login
# which version
curl https://halfface.se/vaultwarden/api/version
podman image inspect docker.io/vaultwarden/server | jq -r '.[].Config.Labels."org.opencontainers.image.version"'

=bluetoothctl=
Enable bluetooth
sudo systemctl enable bluetooth --now
Scan
bluetoothctl scan on
Pair
bluetoothctl pair <MAC address>
Connect
bluetoothctl connect <MAC address>
Trust
bluetoothctl trust <MAC address>
Remove
bluetoothctl remove <MAC address>
List paired devices
bluetoothctl devices
Get info about paired device
bluetoothctl info 00:00:00:00:3E:E2

=blkid=
Get uuid of disk.
blkid /dev/sdb1
/dev/sdb1: UUID="64cd54f7-5330-425d-81e5-a0e473a5f5e7" TYPE="ext4" PARTLABEL="primary" PARTUUID="21f38e48-af2d-4fdd-854a-5910f392a6e0"

=bonnie++=
Report performance on disk. benchmark
bonnie++ -u 0:0
On machine running out of disk
sudo bonnie++ -d ./ -s 400 -r 200 -u root
Example command.
bonnie++ -d /storage/temp/ -s 32G -n 0 -m TEST -f -b -u abjorklund

=boot=
Booting singe user mode.
kernel ... single

=bootchart=
Analyze startup times.

=bootgraph=
How to use.
Kernel later than 2.6.28
kernel option initcall_debug
dmesg | /usr/src/linux-headers-2.6.28-11-generic/scripts/bootgraph.pl > /tmp/bootgraph.svg
=bpftrace=
run code at each system call
#!/usr/bin/bpftrace

interval:s:5
{
exit();
}

kprobe:do_sys_open
{
printf("%s %s\n", comm, str(arg1));
}
=busctl=
busctl may be used to introspect and monitor the D-Bus bus.

=bzip2=
Extract keep original
bzip2 -dk /compressed_file.bz2 and extract standard out via tar.
Extract bunzip2 file and extract via tar from standard out.
bzip2 -c /compressed_file.bz2 | tar -xivf -

=cdrecord=
Blank cd/dvd rw
cdrecord -v gracetime=2 dev=/dev/cdrom -eject blank=all -force
=certutil=
Test password. Password should be part of file called by -f
certutil -K -d /etc/dirsrv/slapd-halfface -f /tmp/pin.txt
Remove cert if it already exist.
certutil -D -n "Self-Signed-CA" -d /etc/dirsrv/slapd-halfface/ -f /tmp/pin.txt
Create new certificate.
certutil -S -n Self-Signed-CA -s CN=ssca.389ds.halfface,O=halfface,L=389ds,ST=Stockholm,C=SE -x -t "CT,," -v 480 -d /etc/dirsrv/slapd-halfface/ -k rsa -g 2048 -f /tmp/pin.txt
List certificates
certutil -L -d /etc/dirsrv/slapd-halfface/
Look at a specific certificate
certutil -L -d /etc/dirsrv/slapd-halfface/ -n "Self-Signed-CA"
Remove orphan key
certutil -F -d /etc/dirsrv/slapd-halfface/ -f /tmp/pin.txt -k 27e0fcb7a201cf0f0c3674eae03c8d94b47b4de0
Generate a new csr
certutil -R -s "CN=www.halfface.se,O=halfface,L=389ds,ST=Stockholm,C=SE" -o server.csr -d /etc/dirsrv/slapd-halfface/ -k rsa -g 2048 -f /tmp/pin.txt --extSAN "dns:www.halfface.se,dns:ldap.halfface.se" -v 240
sign certificate
certutil -C -i server.csr -o server-cert.crt -c "Self-Signed-CA" -d /etc/dirsrv/slapd-halfface/ -f /tmp/pin.txt
Import signed cert
certutil -A -n "Server-Cert" -t "u,u,u" -i server-cert.crt -d /etc/dirsrv/slapd-halfface/ -f /tmp/pin.txt
==Add certs to chrome==
for i in $(ls) ; do echo '*' $i ; certutil -d sql:${HOME}/.pki/nssdb -A -t "C,," -n "vSphere Root CA $i" -i $i ; done

=cfdisk=
Disk partitioning via ncurses interface. like fdisk.
=chage=
List password properties of user
chage -l abjorklund
Unlimited login
chage -I -1 -m 0 -M 99999 -E -1 sftponly

=chattr/lsattr=
Set extendet attributes of files.
# Lock file for most activities.
chattr +i file
# Unlock file
chattr -i file
# recursive lsattr looking for imutable.
lsattr -aR -- .//. 2>/dev/null | sed -rn '/i.+\.\/\/\./s/\.\/\///p'

=chmod=
Sticky bit on directory. Only owners of files are able to delete.
chmod 1755 /file.
-rwxr-xr-t
GUID on file. binaries started will have the group set to the defined group.
chmod 2755 /file
-rwxr-sr-x
SUID on file.
chmod 4755 /file
-rwsr-xr-x
Remover permissions for others
chmod o-rwx

=chntpw=
# Change windows passwords offline
mkdir /mnt/disk ; mount /dev/sd1 /mnt/disk; cd /mnt/disk/Windows/System32/config
# List local users.
chntpw -l SAM
# clear password on user.
chntpw -u Administrator SAM
=chrony=
# setup time sync via ntp.
/etc/chrony.conf
# look at status
chronyc tracking
# List ntp sources.
chronyc sources
.-- Source mode '^' = server, '=' = peer, '#' = local clock.
/ .- Source state '*' = current synced, '+' = combined , '-' = not combined,
| / '?' = unreachable, 'x' = time may be in error, '~' = time too variable.
|| .- xxxx [ yyyy ] +/- zzzz
|| Reachability register (octal) -. | xxxx = adjusted offset,
|| Log2(Polling interval) --. | | yyyy = measured offset,
|| \ | | zzzz = estimated error.
|| | | \
MS Name/IP address Stratum Poll Reach LastRx Last sample
===============================================================================
#? PHC0 0 3 0 19d +41ns[ +349ns] +/- 104ns
Force syncronize
sudo chronyc -a 'burst 4/4'
Make a big step. Did not work for me.
chronyc -a makestep
Verify clock
chronyd -q 'server pool.ntp.org iburst'

=chvt=
From a script change to a virtual interface and connect script to that terminal.
chvt 3 exec < /dev/tty3 > /dev/tty3

=cacafire=
View some fire in ascii.

=clean=
Clean file from comments and blank lines.
sed '/ *#/d; /^ *$/d'

=codepage=
Change codepage of file.
convmv -f cp850 -t iso-8859-1 --notest *
convmv -f utf8 -t iso8859-1 -r --notest *
convmv -f iso8859-1 -t en_US.UTF-8 -r --notest .
Change codepage of file.
iconv --from-code=ISO-8859-15 --to-code=UTF-8 document.csv > document_iconv.csv
View nfo files
iconv -f CP437 -t UTF-8 KaOs.nfo

=column=
Create nice column. Use tab as delimiter.
column -t -s $'\t' /file.tsv
=compgen=
List all commands
compgen -A function -abck

=convert=
Convert Image to 8 bit grey with threshold for white.
for tif in *.tif; do convert -depth 8 -white-threshold 70% ${tif} ${tif%%.*}.png;done
Resize image
convert -resize 25% -gamma 1.5 2011-08-03_11-09-43.jpg 2011-08-03_11-09-43_new.jpg
Multipage pdf.
convert -adjoin -page A4 -compress jpeg Infineon1.tif Infineon2.tif Infineon.pdf
pdfunite RegionUppsala01.pdf RegionUppsala02.pdf RegionUppsala03.pdf RegionUppsala04.pdf RegionUppsala.pdf
Prepare photos for printing.
convert -rotate 90 -gamma 1.5 -resize 25% -compress jpeg -quality 80 -adjoin -page A4 * print.pdf
Resize change aspect.
convert Slide1.PNG -resize 1920x1080\! slide01.png
animated gif
convert -delay 100 -loop 0 *.jpg animation.gif
Create multipage pdf of photos.
convert -resize 25% -adjoin -page A4 -rotate 90 -compress jpeg *.jpg test.pdf ; pdfjam test.pdf --no-landscape --frame true --nup 2x2 --suffix 4up --outfile /temp/photos/Alva/test_2x2.pdf
For vertical stacking (top to bottom):
convert -append 1.jpg 2.jpg out.jpg
For horizontal stacking (left to right):
convert +append 1.jpg 2.jpg out.jpg
Remove transparancy
convert image.png -background white -flatten image.jpg

=cpio=
Copy wanted partitions.
#!/bin/bash
ssh root@192.168.2.148 "(cd /boot/ ; find ./ -xdev -depth -print0 | cpio -o -0Hnewc )" | (cd /mnt/sysimage/boot ; cpio -idvuma )
ssh root@192.168.2.148 "(cd / ; find ./ -xdev -depth -print0 | cpio -o -0Hnewc)" | (cd /mnt/sysimage ; cpio -idvuma )
# -o copy out mode.
# -0 terminated by null character.
# -Hnewc som storing format.
# -i extract copy in mode.
# -d make directories.
# -v verbose.
# -V print dot.
# -u replace all files.
# -m preserve modification time.
# -a preserve access time.
=cpulimit=
Limit application cpu usage to 25% cpu utilization. Inherit limit to spawned processes.
cpulimit -i -l 25 /apps

=crash=
Troubleshoot hung Redhat vm.
Dump vm.
virsh dump <vm> --memory-only --verbose /tmp/<vm>.core
Login to machine you dump:ed and rebooted. Verify kernel version. uname -r
Setup vm similar to the one you dumped.
Install rpm:s to be able to debug.
export UNAME_R=5.14.0-554.el9.x86_64
dnf install --enablerepo=* crash kernel-modules-${UNAME_R} kernel-core-${UNAME_R} kernel-${UNAME_R} kernel-modules-core-${UNAME_R} kernel-debuginfo-common-x86_64-${UNAME_R} kernel-debuginfo-${UNAME_R}
Tips to find rpm:s.
<pre>
https://kojihub.stream.centos.org/koji/builds -> Dropdown: builds -> Search: kernel-5.14.0-554.el9
https://kojihub.stream.centos.org/kojifiles/packages/kernel/ -> find your way down the tree.
</pre>
Start crash. Write help to give advice. LLMS are quite useful for troubleshooting advice.
crash /usr/lib/debug/lib/modules/${UNAME_R}/vmlinux /tmp/<vm>.core
Scripting with crash
cd /temp/ ;cat commands.txt ; for i in $(ls instance-0002da2b_osc-compute27-sto1-prod.cloud.binero.net_okd01-ppj65-master-0_2025-04-15_15-03-04*) ; do crash -i commands.txt /usr/lib/debug/lib/modules/5.14.0-554.el9.x86_64/vmlinux /temp/instance-0002da2b_osc-compute27-sto1-prod.cloud.binero.net_okd01-ppj65-master-0_2025-04-15_15-03-04.core > $i.log </dev/null ; done
ps
runq

=cronie=
Start cronie in foreground. Write what it is doing.
/usr/sbin/crond -n -x sch

=crontab/cron=
crontab.
* * * * * command to be executed
- - - - -
| | | | |
| | | | +----- day of week (0 - 6) (Sunday=0)
| | | +------- month (1 - 12)
| | +--------- day of month (1 - 31)
| +----------- hour (0 - 23)
+------------- min (0 - 59)
0 Sunday
1 Monday
2 Tuesday
3 Wednesday
4 Thursday
5 Friday
6 Saturday
@reboot "run command at reboot"
If you need % in crontab escape it. \%

Run command every 10 minutes.
*/10 * * * * command

Run command at 12:00 and 24:00 hours.
00 0,12 * * * command

Run command between 8-17 every 2 hours.
0 8-17/2 * * * /path/command
0 8,10,12,14,16 * * * /path/command

Start program under crontab.
#!/bin/bash
COMMAND="screen -L -d -m ping www.dn.se"
if [ "$(ps -ef | grep -i ping | grep -v grep)" ]
then
echo "\"${COMMAND}\" already running."
else
echo "Starting \"${COMMAND}\"."
cd /tmp
${COMMAND}
fi

=crudini=
Edit ini files och cli.
crudini --set /lib/systemd/system/icinga2.service Service Nice -10 ; systemctl daemon-reload ; systemctl restart icinga2.service

=cryptsetup=
luks. Process to unlock disk. Mount it and unmount and encrypt.
cryptsetup luksOpen /dev/nvme0n1p3 secure
mount /dev/mapper/secure /mnt
umount /mnt
cryptsetup luksClose secure
==create luks encrypted disk==
# Add block device and add gpt label. Create partition.
cfdisk /dev/sde
# Encypt partition
sudo cryptsetup luksFormat /dev/vdb1
# open encrypted disk
sudo cryptsetup open /dev/vdb1 encrypted-disk
# Format disk
sudo mkfs.ext4 /dev/mapper/encrypted-disk
# Info about partition
sudo blkid /dev/vdb1
/dev/vdb1: UUID="cb2e7238-8245-41cb-9811-6804f602e5e8" TYPE="crypto_LUKS" PARTUUID="56b829b6-8295-4963-9562-29e8937819a8"
# Setup crypttab if you want to decrypt at boot splash
echo 'encrypted-disk UUID=cb2e7238-8245-41cb-9811-6804f602e5e8 none luks' | sudo tee -a /etc/crypttab
# Manually unlock luks partition
sudo cryptsetup luksOpen UUID=cb2e7238-8245-41cb-9811-6804f602e5e8 encrypted-disk
# Manuall lock luks partition
sudo cryptsetup luksClose encrypted-disk
# Add disk to fstab
echo '/dev/mapper/encrypted-disk /mnt/encrypted-disk ext4 noauto 0 2' | sudo tee -a /etc/fstab
# Create mount point
sudo mkdir /mnt/encrypted-disk ; sudo chmod 777 /mnt/encrypted-disk
# mount disk
sudo umount /mnt/encrypted-disk
# Change password of luks partition
sudo cryptsetup luksAddKey UUID=cb2e7238-8245-41cb-9811-6804f602e5e8
sudo cryptsetup --test-passphrase -v open UUID=cb2e7238-8245-41cb-9811-6804f602e5e8
sudo cryptsetup luksRemoveKey UUID=cb2e7238-8245-4

=cups=
Install cups
dnf install cups
enable cups
systemctl enable cups.service --now
Configure printer in cups.
http://localhost:631/

=cut=
Cuf everything from field 5.
cut -f5- -d ' '

=curl=
==Get http return code.==
curl --connect-timeout 3 --max-time 9 -ksL -w '%{http_code}\n' 'http://www.dn.se' -o /dev/null
==get external ip. what is my ip==
curl ifconfig.me
==get external ip and all related browser information.==
curl ifconfig.me/all
==Alternative address for domain.==
<pre>
curl -sk --resolve www.halfface.se:80:127.0.0.1 http://www.halfface.se
curl http://127.0.0.1/ -H "Host: halfface.se" -H "X-Forwarded-Proto: https" -I
</pre>

==Get header / mime type==
curl -I http://url.se
==post file==
curl -X POST -d @myfilename http://user:pass@myhost/hudson/job/_jobName_/postBuildResult
==post file via ftp using proxy==
curl -p --proxy http://proxy.example.se:3128 -v -T backup.tar ftp://user:password@ftp.example.se/directory/

==cookie format. tab delimited.==
domain - The domain that created AND that can read the variable. .halfface.se
flag - A TRUE/FALSE value indicating if all machines within a given domain can access the variable. This value is set automatically by the browser, depending on the value you set for domain.
path - The path within the domain that the variable is valid for.
secure - A TRUE/FALSE value indicating if a secure connection with the domain is needed to access the variable.
expiration - The UNIX time that the variable will expire on. UNIX time is defined as the number of seconds since Jan 1, 1970 0:00:00 GMT.
name - The name of the variable.
value - The value of the variable.

==add certificate authority to openssl==
Redhat based os:es this file gets updated. /etc/pki/ca-trust/extracted/openssl/ca-bundle.trust.crt
cp /tmp/ca.crt /etc/pki/ca-trust/source/anchors/
update-ca-trust
Debian based
cp /tmp/ca.crt /usr/share/ca-certificates/extra
update-ca-certificates
Debian 2
cp foo.crt /usr/local/share/ca-certificates/foo.crt
update-ca-certificates

==curl ipv6==
<pre>
curl -6 -g "http://[::1]:80/"
curl -g "http://[2001:9b1:402d:0:ffff:f038:ec3e:b5d4]/"
</pre>

==proxy==
curl --proxy http://proxy.se:3128 -sk "http://mirrorlist.centos.org"
===no_proxy===
export https_proxy=http://proxy.se:3128 ; export http_proxy=$https_proxy ; export HTTPS_PROXY=$https_proxy ; export HTTP_PROXY=$https_proxy ; export no_proxy=localhost,127.0.0.1,.inter.net,$(echo 10.217.{4..5}.{1..254}, 10.217.5.255) ; export NO_PROXY=$no_proxy
===time spent===
-w "time_namelookup: %{time_namelookup}, time_connect: %{time_connect}, time_appconnect: %{time_appconnect}, time_pretransfer: %{time_pretransfer}, time_redirect: %{time_redirect}, time_starttransfer: %{time_starttransfer}, time_total: %{time_total}\n"
==which isp==
curl -s http://ip-api.com/json/${IP} | grep -o '"isp":"[^"]*"' | cut -d '"' -f4

=Is it a free day?=
<pre>
curl -sk https://sholiday.faboul.se/dagar/v2.1/2023 | jq -r '.dagar[] |select(."arbetsfri dag"=="Ja")|.datum'
</pre>

=qr code=
encode
qrencode "Andreas" -o /tmp/qr_Andreas.png
decode
zbarimg /tmp/qr_Andreas.png

=date=
Get date in requested format.
date '+%Y-%m-%d %H:%M'
date +%Y-%m-%d-%H%M
date "+%F_%T" # 2017-01-16_19:41:41

date 033121422003.55
Mon Mar 31 21:42:55 PST 2003
date MMDDhhmmCCYY.ss

Whats the date in 1000 years. Or any other increment.
date --date="+1000 years" +%C%y-%m-%d
date --date="-2 hour" +%C%y-%m-%d\ %H:%M
TZ=CEST date --date="-2 hour" +%C%y-%m-%d\ %H:%M

What is the time in other timezone given in unixtime/epoch.
TZ=GMT date -d '@1345064585'
Wed Aug 15 21:03:05 GMT 2012

Unix time.
date +%s
Unix to normal
date -d @1234567890

scew clock by a second.
DATE_OFF=$(date --date="-5 second" +%C%y-%m-%d\ %H:%M:%S\ %Z) ; date --set="${DATE_OFF}"
Set clock
date '+%Y-%m-%d %T %Z' -s "2008-11-28 08:08:08 UTC"
=datefudge=
Fake date for command.
datefudge "2020-04-01 10:23" date

=dateseq=
Create date sequense.
dateseq 2017-04-01 2017-04-05

=db2=
Empty catalog remove node
for DB2 in $(db2 list node directory | grep "Node name" | awk '{print $4}') ; do db2 uncatalog node $DB2;done
Empty catalog remove db
for DB2 in $(db2 list db directory | grep "Database name" | awk '{print $4}') ; do db2 uncatalog db $DB2;done
# Load db2 environment.
. /home/db2/sqllib/db2profile

# Connect to database.
db2 connect to ${database_name} user ${user} using ${password}

# Test query.
SELECT service_level, fixpack_num, bld_level FROM TABLE (sysproc.env_get_inst_info()) as A;

# System Database Directory
db2 list db directory

# Node Directory
db2 list node directory

# setup directory
db2 "catalog tcpip node db2datan remote 1.2.3.4 server 5000"
db2 "catalog db db2datadb as db2datadb at node db2datan"

# Drop connection.
db2 terminate

=dbus-monitor=
dbus-monitor # Monitor activity on the dbus to see what system and sessions are doing.

=dd=
output your microphone to a remote computer's speaker
dd if=/dev/dsp | ssh -c arcfour -C username@host dd of=/dev/dsp
Add 2GB to disk image.
dd if=/dev/zero of=/system_image.img bs=1M oflag=append conv=notrunc count=2000
dd with progress bar.
dd if=kali.iso of=/dev/sdc status=progress
pv -ptre /install/backup/machine/raspberry/ipcenter_view.img | sudo dd of=/dev/mmcblk0 bs=1M
dd to position on disk
dd of=/dev/disk1 if=/dev/urandom obs=500000 seek=1 bs=1MB count=1 conv=notrunc
==consume 100GB ram==
mount -o remount,size=300G /dev/shm
dd if=/dev/zero of=/dev/shm/$(date '+%Y-%m-%d_%H-%M-%S') bs=1073741824 count=100 status=progress

=debugfs=
ctime: Shows file change time.
atime: Shows file access time.
mtime: Shows file modification time.
crtime: Shows file creation time. Birth.
Example
debugfs -R 'stat /etc/exports.bkp-2021-11-17_10-07-46' /dev/mapper/vg_rbnetstorage0-lv_root
debugfs 1.41.12 (17-May-2010)
Inode: 924905 Type: regular Mode: 0644 Flags: 0x80000
Generation: 2068409071 Version: 0x00000000:00000001
User: 0 Group: 0 Size: 4775
File ACL: 0 Directory ACL: 0
Links: 1 Blockcount: 16
Fragment: Address: 0 Number: 0 Size: 0
ctime: 0x6194c662:deae4368 -- Wed Nov 17 10:07:46 2021
atime: 0x6193bd7f:c4faf658 -- Tue Nov 16 15:17:35 2021
mtime: 0x61925419:34c06f18 -- Mon Nov 15 13:35:37 2021
crtime: 0x6194c662:deae4368 -- Wed Nov 17 10:07:46 2021
Size of extra inode fields: 28
Extended attributes stored in inode body:
selinux = "unconfined_u:object_r:etc_t:s0\000" (31)
EXTENTS:
(0-1): 3718194-3718195
=ddclient=
Debug
ddclient -daemon=0 -debug -verbose -noquiet

=df=
df output one per line. Without header.
df -Plk / /apps | tail -n+2

=dhclient=
[root@wall sysconfig]# cat /etc/dhclient.conf
interface "eth0" {
prepend domain-name-servers 127.0.0.1;
supersede domain-name "bltprojektering.se";
}

=dialog=
Create dialog in terminal. Example a progressbar.
for i in {0..100} ; do echo $i | dialog --gauge "Please wait" 7 70 1 ; sleep .1 ; done
=diff=
sdiff <(echo -e 'hej\nda\nvi\nses\ni\nmorgon') <(echo -e 'hej\ndå\nvi\nSES\ni\nmorgon')
Only show files that differ.
-q --brief
Only show change between files.
diff -u file1.txt file2.txt | grep -vE '^(---|\+\+\+|@@|\+|-)'

=dig=
==Get all dns information about host.==
dig any www.halfface.se
==Trace dns lookups from root dns. Use 8.8.8.8 for lookups.==
dig +trace @8.8.8.8 www.halfface.se
==Recursive lookup.==
dig -tAXFR halfface.se
==backward resolve==
dig -x 89.253.75.84
==get ttl==
dig +nocmd +multiline +noall +answer any halfface.se
==Get external ip.==
dig +short myip.opendns.com @resolver1.opendns.com
==Get txt record.==
dig google.com txt
==You can find the authoritative servers by asking for the NS records for a domain==
dig example.com NS
==dig using alternative port==
dig +short -p 5353 halfface.se @10.130.0.35

=digitemp=
digitemp_DS9097 -c /etc/.digitemprc -t0

=disk=
disk usage
baobab
foremost
recover deleted files.
=disown=
Disconnect process(pid) so that is survives a logout.
disown %2

=display=
Change resolution
xrandr --output LVDS --mode 1280x800
xrandr --output default --mode 1280x1024
Query graphics card capabilities.
xrandr -q
Change dpi
xrandr --dpi 138/eDP1
=du=
du -amx / | sort -n | tail -5
=duplicity=
Encrypted backups over rsync

=dmesg=
dmesg with iso time format
dmesg --ctime --time-format iso
Write to dmesg
echo "$USER $(date '+%Y-%m-%d %H:%M:%S %Z')" | sudo tee /dev/kmsg

=dmidecode=
List memory banks
sudo dmidecode -t 17

=dnf=
install skip if not exist
sudo dnf install --setopt=strict=0 $(sort -u /temp/other_machine_rpm)
==update system==
dnf -y upgrade --refresh
reboot
dnf -y install dnf-plugin-system-upgrade
dnf -y system-upgrade download --refresh --allowerasing --releasever=43
# Before 42:
dnf -y system-upgrade reboot
# From 42 and onward
dnf5 offline reboot
# broken deps.
dnf repoquery --unsatisfied
# look for duplicates
dnf repoquery --duplicated
# which rpms do not exit in repo.
dnf list extras
# remove no longer used.
dnf autoremove
dnf remove $(rpm -qa| grep \.fc23)
# reinstall rpm
dnf reinstall sssd-common

==auto update==
# Install auto updates.
dnf install dnf-automatic
# Enable auto update.
sed -i "s/apply_updates = no/apply_updates = yes/g;s/email_from = root@example.com/email_from = root@${HOSTNAME}/g;s/email_to = root/email_to = anden@halfface.se/g" /etc/dnf/automatic.conf
# Enable timer.
systemctl enable dnf-automatic.timer && systemctl start dnf-automatic.timer
# Trigger timer.
systemctl start dnf-automatic.timer
# Check status of dnf-automatic:
systemctl list-timers *dnf-*
==build environment==
dnf group install "C Development Tools and Libraries"
==update to specific version==
View available version.
dnf --showduplicates list gitlab-ee
Update to specific version
dnf install gitlab-ee-13.12.15-ee.0.el8

=Setup dnsmasq on ubuntu=
<pre>
# Install dnsmasq
apt install dnsmasq
systemctl enable dnsmasq --now
# Disable systemd-resolved.
sudo systemctl disable --now systemd-resolved
# Make NetworkManager ignore dns.
sudo tee /etc/NetworkManager/conf.d/no-dns.conf <<'EOF'
[main]
dns=none
EOF
systemctl restart NetworkManager
# Fix /etc/resolv.conf
sudo \rm /etc/resolv.conf
sudo tee /etc/resolv.conf <<'EOF'
nameserver 127.0.0.1
search int.redbridge.se halfface.se cloud.binero.net
options timeout:1 attempts:1
EOF
# Create config
sudo tee /etc/dnsmasq.d/custom.conf <<'EOF'
listen-address=127.0.0.1
bind-interfaces
server=/redbridge.se/185.53.164.25
#server=/halfface.se/10.111.222.2
server=8.8.8.8
EOF
# Restart dnsmasq
systemctl restart dnsmasq
</pre>

=dovecot=
# List files with doveadm
MAIL=mbox:/var/vmail/fordonskontroll.app doveadm mailbox list
# Remove mails with doveadm
MAIL=mbox:/var/vmail/fordonskontroll.app doveadm expunge -u n

=dovecot=
# List files with doveadm
MAIL=mbox:/var/vmail/fordonskontroll.app doveadm mailbox list
# Remove mails with doveadm
MAIL=mbox:/var/vmail/fordonskontroll.app doveadm expunge -u n

=dracut=
Dracut is a tool used to create an initial RAM filesystem (initramfs) for Linux systems.

=dvgrab=
Capture dv material
dvgrab -f dv2 -i -showstatus -s 0 -timestamp California-2

=e2fsck=
Scan for bad blocks.
e2fsck -ycv /dev/VolGroup00/LogVol00

=edid/ddc=
startx -- -logverbose 5.
The EDID information turns up in /var/log/Xorg.0.log.
=enca=
detect and convert encoding of text files. (codepage utf)
enca -L none /temp/locale2
=esmtp=
# Install dependency
dnf install procmail
# Put the following config in either /etc/esmtprc or more specific ~/.esmtprc. chmod 644.
SMTP_SERVER=halfface.se
cat << EOF > ~/.esmtprc
hostname = $SMTP_SERVER:25
# Set the Mail Delivery Agent (MDA)
mda = "/usr/bin/procmail -d %T"
EOF
chmod 0710 ~/.esmtprc

=etckeeper=
Keep your /etc/ directory under git revision control.
What has happened.
git log -p /etc/resolv.conf
Wipe /etc/.git
etckeeper uninit
etckeeper init

=ethtool=
show-features
ethtool -k <device>
generic-segmentation-offload = gso
tcp-segmentation-offload = tso
...
Enable wake on lan magic package.
ethtool --change <interface> wol g
Permanently add wol
find /sys/class/net -type l -not -lname '*virtual*' -printf '%f\n' | while read i ; do INTERFACE_INFO=$(ip address show $i) ; MAC=$(grep link/ether <<< "${INTERFACE_INFO}" | awk '{print $2}') ; echo "# /etc/systemd/network/50-wired.link
[Match]
MACAddress=$MAC

[Link]
NamePolicy=kernel database onboard slot path
MACAddressPolicy=persistent
WakeOnLan=magic" ; done

=exiftool=
Change meta data for files, exif, jpg, mp3...
Get info from file.
exiftool $file.mp4
gps format
41°24'12.2"N 2°10'26.5"E
gps format known to maps.google.com
exiftool -c "%.6f" 2022-03-06_10-39-40.mp4 | grep -i gps

=exportfs=
Install server
dnf install nfs-utils
Start nfs server
systemctl enable nfs-server --now
Reexport everything.
exportfs -avr
Example export.
*(rw,no_root_squash,async,insecure)
rw rewritable
no_root_squash Allow root on remote machine same permissions as local root
async
insecure NFS version 2 and 3 servers only provide (insecure) host-based authentication: Hosts are allowed/denied based on hostnames and/or IP addresses. Authorization of users is controlled on the clients using the permissions of the files based on user/group IDs. allows clients with NFS implementations that don't use a reserved port for NFS

=fdupes=
Find duplicate files.
fdupes -r /home
=feh=
Image viewer

=ffmpeg=
ffmpeg
ffmpeg -y -deinterlace -aspect 16:9 -author "Andreas Bjorklund" -title "Tanzania" -year 2007 -i Tanzania.m2t -acodec mp3 -vcodec mpeg4 -b 3000k -s 720x540 test.avi
Create swf/flv from mpeg2 stream
ffmpeg -deinterlace -i VTS_01_1.VOB -ab 56 -ar 22050 -b 500000 -r 15 -s 360x288 sisyfos.swf
Create horse movie.
ffmpeg -deinterlace -i /temp/VTS_01_1.VOB -ab 100 -ar 22050 -b 1200000 -r 25 -s 360x288 3horses.swf
Cut video from command prompt.
ffmpeg -i video.avi -vcodec copy -acodec copy -ss 00:00:00 -t 00:00:04 trimmed_video.avi
Record desktop.
ffmpeg -f alsa -ac 2 -i pulse -f x11grab -r 5 -s 1920x1080 -i :0.0 -acodec pcm_s16le -vcodec libx264 -threads 0 -y output.mkv
ffmpeg -f x11grab -s $(xrandr | grep \*+|awk '{print $1}') -r 25 -i :0.0 -sameq /tmp/out.mpg
Change container.
ffmpeg -i film.mov -vcodec copy -acodec copy film.mp4
Transcode to h264 aac
ffmpeg -i original.avi -vcodec libx264 -acodec aac -strict experimental new_file.mp4
Transcode mp3 to ogg vorbis
for file in *.mp3; do ffmpeg -i "${file}" -acodec libvorbis "${file/%mp3/ogg}";done
Take one photo from video stream.
ffmpeg -ss 00:00:01 -i <video input> -frames:v 1 -q:v 2 <photo created>
Take photo
ffmpeg -f video4linux2 -s 1280x720 -i /dev/video0 -f image2 snapshot.jpg
ls /dev/video* | while read i ; do echo $i ; ffmpeg -f video4linux2 -i $i -vframes 1 -q:v 2 /tmp/${i//\//%}.$(date +%F_%H-%M-%S).jpg ; done ; ls -la /tmp/%*
Take a photo from a video steam every 10 seconds.
ffmpeg -i video.mp4 -r 0.1 -f image2 %03dandreas.jpg
Take a photo every 1 put it in a file.
ffmpeg -y -i http://balcony.halfface.se:8080 -r 1 -f image2 -update 1 stream_image.jpg -probesize 5e+07
Rotate 180 degrees.
ffmpeg -i input.mp4 -filter:v "transpose=1,transpose=1" output.mp4
Change rotation without transcoding.
ffmpeg -i IMG_0703.MOV -metadata:s:v rotate="" -codec copy rotate_IMG_0703.MOV
Concaternate videos.
ffmpeg -f concat -safe 0 -i mylist.txt -c copy output

=find=
==Find exluding directory==
find . -wholename '/var/' -prune -o -ls
==Find text file in directoy execpt directory. Grep for text in that file and show it with colours in less==
find /opt/ongame/ -wholename '/opt/ongame/napsjb/server/naps/tmp' -prune -o -type f -exec grep --color=always -r '/fraud' /dev/null {} \; | less -SR
==Find excluding several directories==
find / -type d $ -path /proc -o -path /dev -o -path /net $ -prune -o -gid 1002 -exec chgrp -h 1001 {} \;
==Find excluding svn==
find . -path '*/.svn' -prune -o -type f -print
==Searches for files modified up to 4 days ago==
find ./ -type f -mtime -4
==Searches for files modified between certain dates. Here for files older than 30 days but younger than 60 (penultimate month)==
find ./ -type f -mtime -60 ! -mtime -30
sudo find . -newermt "2014-10-19 09:30" ! -newermt "2014-10-19 09:35"
==Find which dir is consuming inodes==
find /var -xdev -printf '%h\n' | sort | uniq -c | sort -k 1 -n
for i in $(ls) ; do echo $(find $i | wc -l) $i ; done | sort -n
==How much data is consumed by pattern==
export NFS_DIR=/netstorage/cam/ocp-01 ; find ${NFS_DIR} -maxdepth 1 | grep ^${NFS_DIR}/archived- | while read NFS_DIR_REMOVE ; do du -sk "${NFS_DIR_REMOVE}" ; done | awk '{ SUM += $1} END { print SUM "KiB" }' | numfmt --from=auto --to=iec-i --suffix=B
==find search small files==
find . -type f -size -1M -exec grep -H 'your_search_pattern' {} +
=find physical network interfaces=
find /sys/class/net -type l -not -lname '*virtual*' -printf '%f\n'

=findmnt=
view the mount tree
findmnt

=flash=
When firefox is complaining about outdated flash plugin
rm pluginreg.dat
=flatpak=
=Install flatpak=
sudo apt install -y flatpak gnome-software-plugin-flatpak
sudo flatpak remote-add --if-not-exists flathub https://dl.flathub.org/repo/flathub.flatpakrepo
=Install flatpak application and replace system binary=
sudo flatpak install -y flathub com.freerdp.FreeRDP
cat <<'EOF' | sudo tee /usr/local/bin/xfreerdp
#!/bin/bash
flatpak run com.freerdp.FreeRDP "$@"
EOF
sudo chmod 755 /usr/local/bin/xfreerdp
hash -r
=Run other binary from flatpack=
flatpak run --command=xfreerdp com.freerdp.FreeRDP

=List installed applications.=
flatpak list --app

=flock=
used to use cript that only used 1 time concurrently.
flock

=fmt=
Join lines
ifconfig -a | fmt -w 300

=fold=
Fold long lines. Break at 80 and blank spaces.
fold -w 80 -s text.txt
=forward traffic=
service x11
{
disable = no
socket_type = stream
protocol = tcp
wait = no
user = root
server = /usr/bin/nc
server_args = 172.28.37.152 6000
}
=fping=
fping --timeout=10 --elapsed --netdata <fqdn>
Example of testing connectivity.
for i in $(grep -E 'ocp-[0-9]{2}-' /etc/hosts | awk '{print $2}') ; do echo -e "$(fping --timeout=10 --elapsed $i)\t$(nc -v -w1 $i 22 </dev/null 2>&1 | strings | xargs)" ; done | column -t -s $'\t'

=free=
You have 15956MB physical ram. 9033MB is used by applications. 6922MB is free.
free -m
total used free shared buffers cached
Mem: 15956 15755 200 0 300 6421
-/+ buffers/cache: 9033 6922
Swap: 19998 2405 17593

=free new=
Total memory 8076624k and 5169152 free.
total used free shared buff/cache available
Mem: 8076624 2536328 1069132 284152 4471164 5169152
Swap: 7815164 2809244 5005920

Free memory usage from /proc/zoneinfo and /proc/meminfo
awk -v low=$(grep low /proc/zoneinfo | awk '{k+=$2}END{print k}') '{a[$1]=$2} END{print a["MemFree:"]+a["Active(file):"]+a["Inactive(file):"]+a["SReclaimable:"]-(12*low);}' /proc/meminfo
5168456
==physical memory==
Show physical memory in machine. Consider points below.
grep MemTotal /proc/meminfo
meminfo:
Provides information about distribution and utilisation of memory. This varies by architecture and compile options...
MemTotal:
Total usable ram (i.e. physical ram minus a few reserved bits and the kernel binary code)
Gives more information not really sure how.
dmesg|grep Memory:
==List memory modules==
dmidecode -t memory
lshw -class memory

=fstab=
Use ram for some logfiles.
none /var/log/ tmpfs defauls,noatime,size=10% 0 0
none /tmp/ tmpfs defauls,noatime,size=10% 0 0
none /var/tmp/ tmpfs defauls,noatime,size=10% 0 0
none /var/spool/ tmpfs defauls,noatime,size=10% 0 0

=fswebcam=
Capture photo.
fswebcam -r 1920x1080 --jpeg 85 -D 1 --quiet --no-banner shot.jpg
fswebcam -d /dev/video0 -i 0 -r 2592x1944 -p YUYV /net/10.111.222.1/storage/temp/logitech.jpg
=fwupdmgr=
fwupdmgr get-devices --show-all-devices
fwupdmgr get-upgrades
fwupdmgr update $device_id

=genisoimage=
genisoimage -o nuc.iso nuc
=gnome-font-viewer=
view fonts
gnome-font-viewer /file.woff2
=gnome-monitor-config=
Set one monitor. Disable all others.
gnome-monitor-config set -LpM HDMI-2
Get monitor settings
WINDOWS + p

=gpg=
Password encryption decryption with gnupg.
gpg -c --force-mdc /temp/shadow
echo "$(gpg -qd /temp/shadow.gpg)"
==create keys==
gpg --full-generate-key
==list secret keys==
gpg --list-secret-keys --keyid-format LONG
==delete secret keys==
gpg --delete-secret-key liza

==list public keys==
gpg --list-public-keys --keyid-format LONG

==export public key==
gpg --armor --export 3AA5C34371567BD2
==export private key==
gpg --armor --export-secret-keys 3AA5C34371567BD2
==export secret subkey==
gpg --armor --export-secret-subkeys 3AA5C34371567BD2
==import keys==
gpg --import pub.key
gpg --import sec.key
gpg --import sub.key
==add trust to private key==
gpg --edit-key 6252FC9A029A2669 trust quit # 5 y

==edit gpg key==
gpg --edit-key 6252FC9A029A2669
==send gpg key==
gpg --send-key 6252FC9A029A2669
==delete public key==
gpg --delete-key "User Name"
==change trust level on all keys==
gpg --list-keys --fingerprint |grep pub -A 1|egrep -Ev "pub|--"|tr -d ' ' | awk 'BEGIN { FS = "\n" } ; { print $1":6:" } ' | gpg --import-ownertrust
==get info about gpg encrypted file==
gpg --list-packets crypto-text.pgp
==list keys in gpg file==
gpg --list-packets crypto-text.pgp # | grep keyid
==get public key from command above==
gpg --recv-keys 754817487F42735A
==encrypt file==
gpg --encrypt --recipient user1@inter.net --recipient user2@inter.net --recipient user3@inter.net file.txt

==decrypt gpg file==
gpg --decrypt vpn-0ea602e33ab9c49fd.txt.gpg

==who has encrypted file==
gpg --pinentry-mode cancel --list-packets file.gpg
==remove expired public keys==
for i in $(gpg --list-public-keys --keyid-format LONG 2>&1 | grep -A1 -B1 expired | grep -Ev '^$|^pub|^uid') ; do gpg --delete-key $i ; done

=pgpdump=
pgpdump <(curl -sS https://download.spotify.com/debian/pubkey_C85668DF69375001.gpg)
=gphoto2=
Capture photo from the command line linux.
gphoto2 --camera='Canon EOS 40D (PTP mode)' --port=usb: --capture-image-and-download

=graphviz=
Create graph.
dot -Tps /flow -o /tmp/flow.ps

=grep=
Colorize grep output.
grep --color=always -r '10\.7\.' /opt/ongame/
Show non comment lines ending with a blank.
find . -name '*.properties' -exec grep --color=always -E '^[^#].*\ $' {} \; | less -SR
grep ipaddress from message file.
sudo grep DHCP /var/log/messages | grep -oir --color=always '192\.168\.[0-9]*\.[0-9]*' | sort -u
grep -E '([0-9]|[1-9][0-9]|1([0-9][0-9])|2([0-4][0-9]|5[0-5]))\.([0-9]|[1-9][0-9]|1([0-9][0-9])|2([0-4][0-9]|5[0-5]))\.([0-9]|[1-9][0-9]|1([0-9][0-9])|2([0-4][0-9]|5[0-5]))\.([0-9]|[1-9][0-9]|1([0-9][0-9])|2([0-4][0-9]|5[0-5]))'
grep ipaddress from file
grep -E '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}'
grep for tab
grep 10.199.2.1$'\t' /etc/hosts
grep from word containing regex space separated.
grep -oE '\S*regex\S*' /file
When grep start to complain about file being binary run the following command to define where.
grep -Pa '\x00' /temp/file_name
Remove binary part of file.
sed -i 's/\x00//g' /temp/file_name
Grep email addresses.
grep -E -o "\b[a-zA-Z0-9.-]+@[a-zA-Z0-9.-]+\.[a-zA-Z0-9.-]+\b" filename.txt
Grep for exact string like \
grep -F \\ blabla.json
=grepcidr=
grepcidr -v 10.0.0.0/8,172.16.0.0/12,192.168.0.0/16

=growpart=
growpart /dev/vda 5
btrfs filesystem resize max /

=gsettings=
Emulate 3 button mouse
gsettings set org.gnome.settings-daemon.peripherals.mouse middle-button-enabled true
Blinking cursor disable
gsettings set org.gnome.Terminal.Legacy.Profile:/org/gnome/terminal/legacy/profiles:/:$(gsettings get org.gnome.Terminal.ProfilesList default|tr -d \')/ cursor-blink-mode off
List settings
gsettings list-recursively

=gsync=
Install gsync
git clone https://github.com/iwonbigbro/gsync.git
cd gsync/
sudo python setup.py install
Download data.
gsync -u -r -t -v --progress --delete -l -s drive://motion/ /temp/motion2/

=gzip=
Compress a stream.
find . | gzip -9 > /tmp/file_list.gz

=gscan2pdf=
Scan and ocr pdf dokuments

=Handbrake=
Compress dvd
#Rip dvd.
sudo vobcopy -o /storage/temp/ -v -x -l
#compress video.
HandBrakeCLI -e x264 -Z Normal -i source.vob -o destination.mkv -a 2 -r 25 -E faac -f mkv -d -S 600 --crop 0:0:0:0
#Create film for android.
HandBrakeCLI -i 01.Alla.Vi.Barn.I.Bullerbyn.1986.SWEDiSH.vob -o 01.Alla.Vi.Barn.I.Bullerbyn.1986.SWEDiSH.mp4 -x level=30:bframes=0:cabac=0:ref=1:vbv-maxrate=1500:vbv-bufsize=2000:analyse=all:me=umh:no-fast-pskip=1 -e x264 --vb 300 -E faac --ab 128 --maxWidth 320 -2 -T -d
# Compress.
SOURCE=/ssd/temp ; DESTINATION=/temp ; for FILM in $(cd ${SOURCE}; ls *.mov | sed 's/\.mov$//g'); do HandBrakeCLI -e x264 -q 20 -B 160 -i ${SOURCE}/${FILM}.mov -o ${DESTINATION}/${FILM}.mp4 ;done
# High profile
HandBrakeCLI -i DVD -o ~/Movies/movie.mp4 -e x264 -q 20.0 -a 1 -E faac -B 160 -6 dpl2 -R Auto -D 0.0 -f mp4 --strict-anamorphic -m -x ref=2:bframes=2:subme=6:mixed-refs=0:weightb=0:8x8dct=0:trellis=0
=hashid=
Identify hash strings.
hashid

=heif-convert=
heif-convert image.HEIC new-image.jpg
=hostnamectl=
hostnamectl set-hostname rocky_8_1

=htmldoc=
Convert html document to pdf
htmldoc --webpage -f php_html_doc.pdf /home/andreasbj/php_manual_en.html 2>/tmp/htmldoc
=htpasswd=
Add user to htpasswd file.
htpasswd -b /etc/httpd/conf/htpasswd <username> <password>

=hunspell=
hunspell -d sv_SE swedish.txt
=hydra=
Password checking.
hydra -l root -P /etc/passwdknown -t 5 192.168.29.62 ssh2

=ifconfig=
Configure network.
ifconfig eth0 192.168.0.1 netmask 255.255.255.0 up
ip address alias
ifconfig eth0:0 192.168.1.2 netmask 255.255.255.0
Network configuration Full config.
echo -e "options timeout:1 attempts:1
domain halfface.se
nameserver 84.246.88.10
nameserver 84.246.88.20" > /etc/resolv.conf
ifconfig eth0 89.253.75.84 netmask 255.255.255.224 up
route add default gw 89.253.75.65 eth0
Vip on loopback /etc/sysconfig/network-scripts/ifcfg-lo:ipdbm
DEVICE=lo:ipdbm
IPADDR=192.168.122.2
NETMASK=255.255.255.255
NETWORK=192.168.122.0
ONBOOT=yes
Setting up multiple addresses. ifcfg-eth0-range0
TYPE=Ethernet
IPADDR_START=192.168.122.3
IPADDR_END=192.168.122.15
ifcfg-eth0
DEVICE=eth0
BOOTPROTO=static
ONBOOT=yes
TYPE=Ethernet
IPADDR=10.111.222.2
NETMASK=255.255.255.0
GATEWAY=10.111.222.1
DNS1=10.111.222.253
DNS2=10.111.222.254
DOMAIN="halfface.se subdomain.halfface.se"

=imv=
Image viewer for wayland
imv . -f -s full

=ilo=
log in to ilo
env -u LANG ssh -v Ongame@10.1.1.94
restart ilo
reset map1
start system
start system1

=install=
Crete directory
install -d --mode=755 --owner=user --group=group /apps/IP/IPim/var/log
Create empty file
install -o 0664 -o user -g group /dev/null ${ALFRESCO_DIR}/logs/catalina.out
=inotifywathc=
Se what access /dev/random
inotifywatch -v -t 60 /dev/random

=inxi=
inventory report.
inxi -Frmxx
=iostat=
iostat -xtc 5
-x extended statistics.
-t print time for each report.
-c display the cpu utalization report.
-y Omit first report with statistics since the system boot
==iostat -xty 5 1 dm-3==
Linux 2.6.32-573.7.1.el6.x86_64 (machine.se) 12/30/2021 _x86_64_ (12 CPU)
12/30/2021 11:47:42 AM
avg-cpu: %user %nice %system %iowait %steal %idle
0.12 0.00 2.01 4.23 0.00 93.65
Device: rrqm/s wrqm/s r/s w/s rsec/s wsec/s avgrq-sz avgqu-sz await svctm %util
dm-3 0.00 0.00 5806.20 0.00 1485056.00 0.00 255.77 1.54 0.27 0.17 97.44

# Explained.
rrqm/s The number of read requests merged per second that were queued to the device.
wrqm/s The number of write requests merged per second that were queued to the device.
r/s The number of read requests that were issued to the device per second.
w/s The number of write requests that were issued to the device per second.
rsec/s The number of sectors read from the device per second.
wsec/s The number of sectors written to the device per second.
avgrq-sz The average size (in sectors) of the requests that were issued to the device.
avgqu-sz The average queue length of the requests that were issued to the device.
await The average time (in milliseconds) for I/O requests issued to the device to be served. This includes the time spent by the requests in queue and the time spent servicing them.
svctm The average service time (in milliseconds) for I/O requests that were issued to the device. Warning! Do not trust this field any more. This field will be removed in a future sysstat version.
%util Percentage of elapsed time during which I/O requests were issued to the device (bandwidth utilization for the device). Device saturation occurs when this value is close to 100%.

=iotop=
iotop with dates for output to logfile.
DATE=$(date '+%Y-%m-%d %H:%M:%S %Z') ; sudo iotop -kbon1 | head -2 | while read i ; do echo $DATE $i ; done

=ip=
==Add vlan 23==
ip link add link eno1 name eno1.23 type vlan id 23
==View vlan protocol==
ip -d link show eno1.23
==Configure vlan==
ip addr add 10.151.23.101/24 brd 10.151.23.255 dev eno1.23
ip link set dev eno1.23 up
==create default route==
ip route add default via 192.168.1.254
==show routing==
ip route show
more info
ip route show table all
==Add static route==
ip route add 10.10.20.0/24 via 192.168.50.100 dev eth0
==Remove static route.==
ip route del 10.10.20.0/24
==which outgoing interfaces are available.==
ip r l| awk '/src/{print $9}'
==Which route is used for ip.==
ip route get 192.168.122.252
==route subnet over interface.==
sudo ip route add 145.251.242.0/24 dev tun0
==Show ipaddress on interface tun0==
ip address show tun0
==vlan tag interface.==
ip link add link eth0 name eth0.8 type vlan id 8
==set ip on interface.==
ip addr add 192.168.50.5 dev eth1
ip addr add 192.168.50.5/24 dev eth1
==set secondary ip on interface==
ip addr add 192.168.1.2/24 dev eth0
==remove ip address.==
ip addr del 192.168.50.5/24 dev eth1
==enable interface==
ip link set eth1 up
==disable interface==
ip link set eth1 down
==list arp entries.==
ip neigh show
==local routing table==
ip route list table local
==rule base routing. List rules==
ip rule show
==show multicast networks==
ip maddr show
==Disable traffic to an ipaddress.==
ip route add blackhole 10.151.19.151
==dynamic/random mac wifi disable==
MAC=$(ip link show | grep link/ | grep -v 00:00:00:00:00:00 | awk '{print $2}') ; nmcli -f TYPE,NAME connection show | grep ^wifi | sed 's/^wifi *//g' | while read i ; do echo '*' $i ; nmcli connection modify "${i}" 802-11-wireless.cloned-mac-address $MAC ; done
==change mtu==
sudo ip link set dev ens3 mtu 1400
==network namespaces==
ip netns list

=ip2location=
ip2location -d /usr/share/IP2Location/IP2LOCATION-LITE-DB5.BIN -p $IP -e country_name,city_name,ip --format TAB
sed 's/ \+/\t/g' haproxy.log | cut -f 9 | sort -u | while read IP ; do ip2location -d /usr/share/IP2Location/IP2LOCATION-LITE-DB5.BIN -p $IP -e country_name,city_name,ip --format TAB | tail -n1 ; done | column_tab | sort
=ipcalc=
ipcalc -n 192.121.85.96/27 -m

=iperf=
start server on client A.
iperf -s
start measure from the other host. Limit bandwidth to 10k.
iperf -c 10.20.30.40 --bandwidth 10K
==Multicast test.==
On the listener side:
iperf -s -u -B 224.1.1.1 -i 1
On sender
iperf -c 224.1.1.1 -u -T 32 -t 3 -i 1

=ipmitool=
What is the power consumtion of dell server.
ipmitool -I lanplus -H 127.0.0.1 -U root -P calvin delloem powermonitor
ipmitool lan print
ipmitool sdr list

=iptables=
==Show iptables OUTPUT, PREROUTING and POSTROUTING==
iptables --table nat --list --exact --verbose --numeric --line-number
==Show config==
iptables -L -t nat -n
==Dnat to localhost.==
iptables -t nat -I PREROUTING --source 131.115.115.53 -p tcp --dport 22 -j REDIRECT --to-ports 222
iptables -t nat -I OUTPUT --source 131.115.115.53 --destination 127.0.0.1 -p tcp --dport 22 -j REDIRECT --to-ports 222
==Flush all rules.==

iptables -F
iptables -X
iptables -t nat -F
iptables -t nat -X
iptables -t mangle -F
iptables -t mangle -X
iptables -P INPUT ACCEPT
iptables -P FORWARD ACCEPT
iptables -P OUTPUT ACCEPT

==Block==
iptables -A OUTPUT -p tcp -d 131.115.248.82 --dport 8080 -j DROP
iptables -A OUTPUT -p tcp -d 131.115.248.82 --dport 8080 -j REJECT

==Block outgoing mail==
iptables -A OUTPUT -p tcp --dport 25 -o $INTERFACE -j REJECT

==Block all traffic except ssh in/out log to syslog.==
iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -P FORWARD DROP
iptables -A INPUT -m tcp -p tcp --dport 22 -j ACCEPT
iptables -A INPUT -m tcp -p tcp --sport 22 -j ACCEPT
iptables -A INPUT -m state --state NEW -m tcp -p tcp -j LOG --log-level info --log-prefix "dropped-in"
iptables -A OUTPUT -m tcp -p tcp --dport 22 -j ACCEPT
iptables -A OUTPUT -m tcp -p tcp --sport 22 -j ACCEPT
iptables -A OUTPUT -m state --state NEW -m tcp -p tcp -j LOG --log-level info --log-prefix "dropped-out"

==Block traffic on certain port.==
iptables -A INPUT -p tcp --dport 7009 -j REJECT
==Fake source==
iptables -t nat -A POSTROUTING -d "${DST}" -p udp --dport 162 -j SNAT --to "${SRC}" &>/dev/null
# Remove the current rules
iptables -t nat -D POSTROUTING -d "${DST}" -p udp --dport 162 -j SNAT --to "${SRC}"
==redirect ip==
Send traffic destined for one ip and port to another ip and port.
iptables -t nat -A OUTPUT -p tcp -d 146.213.6.7 --dport 1023 -j DNAT --to-destination 10.199.150.111:1023
iptables -t nat -A OUTPUT -p icmp -d 146.213.6.7 -j DNAT --to-destination 10.199.150.111
==allow trafic from subnet==
iptables -A INPUT -s 172.16.27.0/24 -j ACCEPT
==allow ssh from all==
iptables -A INPUT -p tcp -dport 22 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p tcp -dport 22 -m conntrack --ctstate ESTABLISHED -j ACCEPT
or
-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 22 -j ACCEPT
==find which rule is blocking by removing one at a time. Better way is to enable logging==
iptables -L -n --line-numbers
iptables -D <line-number>
==List rules from OUTPUT chain with line number==
iptables -t filter -L OUTPUT --line-numbers -n

==Add rule to specific row number==
iptables -I OUTPUT $ROW_NUMBER -d 54.72.175.186/32 -p tcp -m tcp --dport 443 -j ACCEPT

=irc=
Close private messages
/window close
Close public messages
/window close
Close a query
/q
=jmtpfs=
Mount disk
jmtpfs /mnt/mtp
Umount disk
fusermount -u /mnt/mtp

=john=
Test performance
john -test
Recover passwords with password list.
john -wordlist:password.lst passfile.txt
=journalctl=
==View log from last day.==
journalctl --since yesterday
==List all units.==
systemctl list-unit-files
==Current disk usage.==
journalctl --disk-usage
==Show only certain error level. (err crit)==
journalctl -p err
==List boots==
journalctl --list-boots
==Show events between two time stamps.==
journalctl --since "2017-01-23 05:56:42" --until "2017-01-23 07:56:42"
==show entries for one unit.==
journalctl -u openvpn-server@server
journalctl -u sshd -f
==iptables logs==
journalctl -k -f | grep -i iptables
==wipe logs==
journalctl --vacuum-time=1h
==compare two different boots==
journalctl --since "$(date '+%F %H:%M:%S' --date '-10 hour')" -u NetworkManager -b -1 -o cat | sed 's/\[[0-9.]*\]//g'

==persistent logging==
Enable persistent logging in systemd-journald. grep journal /usr/lib/tmpfiles.d/systemd.conf. Install syslog instead.
mkdir /var/log/journal
chmod 2755 /var/log/journal
chown root:systemd-journal /var/log/journal
killall -USR1 systemd-journald

=jpegtran=
# to lossless cut a file.
jpegtran -crop 700x400+2150+1500 2012-05-19_20-39-35.jpg > /photos/Sweden/2012/2012-05-19/2012-05-19_20-39-35.jpg
# Rotate counter clockwise.
jpegtran -copy all -rotate 270 2012-08-18_15-06-43.jpg > 2012-08-18_15-06-43_270.jpg
=kdump=
Change action to dump memory.
/etc/kdump.conf
core_collector true
Reload config.
systemctl restart kdump
=keepass=
Create database
printf '%s\n' 'P@55Word'{,} | keepassxc-cli db-create -p -q keepassxc_abjorklund.kdbx
Add entry to database.
keepassxc-cli add keepassxc_abjorklund.kdbx abjorklund
Copy password from password entry
keepassxc-cli clip keepassxc_abjorklund.kdbx abjorklund

=keyboard=
keymaps
dumpkeys
loadkeys sv-latin1
loadkeys us
setxkbmap en
setxkbmap -layout se -variant nodeadkeys
reset corrupt keyboard after using vmware.
setxkbmap

=kill=
suspend/resume a jobb.
# kill -STOP PID
# kill -CONT PID
=kpartx=
# Create device files from disk image.
sudo kpartx -av disk_image.raw
# Remove device files.
sudo kpartx -d disk_image.raw

=lastb=
Show failed ssh logins.
lastb
=less=
Toggle line wrap
- -> S
tail with less. CTRL + c = scroll around. SHIFT + f = to tail again.
less +F -B /tmp/tmp
=lftp=
lftp -u <user>,<password> <ftp_server>
With proxy.
lftp -e "set ftp:proxy http://<url>:3128 ; set ssl:verify-certificate no; open -u user,password ftp://ftp.example.se/"
Workaround.
lftp -e 'set ftp:use-feat false; set ftp:ssl-allow false' -u user,passwor ftp.example.se
Run commands from cli.
lftp -u '<user>,<password>' -e 'set ssl:verify-certificate no ; ls -la ; quit' <ftp_server>

=ln=
Create link even if it exists.
ln -sfT /destination link

=locale=
To show 24 hour format.
LC_ALL=C
=localectl=
Change keyboard.
localectl list-keymaps
localectl set-keymap se-nodeadkeys
localectl set-x11-keymap se-nodeadkeys

=lock=
locking keyboard under linux.
lock-keyboard-for-baby
=logging=
bash create log.
#!/bin/bash
exec > /logfile
alternative
exec 2>/tmp/log
Read logs on system.
tail -f $(lsof | grep log$ |awk '{ print $NF }' | sort -u |xargs)
=logrotate=
Test dry run logrotate file. -d=debug -f=force
logrotate -d -f /etc/logrotate.conf
Force logrotate in verbose mode.
logrotate -v -f /etc/logrotate.conf
Create logrotate config entry.
# Configure log rotation.
cat << EOF > /etc/logrotate.d/ipmonperfj_cleanupdaemon
/directory/logs/cleanupdaemon.log {
copytruncate
size 100M
rotate 60
compress
missingok
olddir old
}
EOF
Disable logrotate. Look for file extension to ignore.
man logrotate.conf, you can read find tabooext
Ex. mv /etc/logrotate.d/mysql{,.rpmsave}

=losetup=
Create loopback devices for partitions in image. Force the kernel to scan the partition table on a newly created loop device
losetup -P /dev/loop2 harddrive.img
Set up next available device read only.
losetup -f -r /temp/rb-slog05/sda6
Show all
losetup -a
detatach
losetup -d /dev/loop2

=ls=
ls -la --time-style="+%Y-%m-%d %H:%M:%S" *.3gp
List processes in epoch date
( cd /proc; ls -rtd --full-time --time-style=+%s [0123456789]*; )
=lsblk=
lsblk -d -o NAME,ROTA,MODEL
=lshw=
==List memory modules==
lshw -C memory

==Is cpu 32 or 64bit.==
lshw -class processor

=lsof=
List recurivly all process that have a path open.
lsof +D /apps/
which ports has a process opened?
lsof -Pan -p 13354 -i
=lspci=
List devices without drivers.
lspci -nnk

=which process listen to port=
lsof -i :443

=mail=
command line mail with changed from
echo message$(date +%F_%H-%M-%S) | mail -s Subject$(date +%F_%H-%M-%S) -r from@inter.net reciever@inter.net
command line mail with changed from with attachment
echo message | mail -s Subject -r from@inter.net -a /attach.ment reciever@inter.net
Change default sender.
# ~/.mailrc
# From address for mailx.
set from="root degn.redbridge.se <abjorklund@redbridge.se>"
set replyto="root degn.redbridge.se <abjorklund@redbridge.se>"

=man=
man correct caracters.
LANG=C man passwd

man clean for output to file.
man [manual] | col -b > file.txt
Read from section 5
man man.5

=mbr=
backup mbr.
# dd if=/dev/sdX of=/temp/sdx-mbr bs=512 count=1

restore mbr
# dd if=/temp/sdx-mbr of=/dev/sdX bs=446 count=1
=mdadm=
Add disk that was lost
mdadm /dev/md125 -a /dev/vda1

=minimodem=
Transmit file via audio.
minimodem -t 200
Recieve file via audio
minimodem -r 200

=mkfs=
Create fat32 file system.
dd if=/dev/zero of=/tmp/sdb bs=32M status=progress conv=fdatasync count=10
fdisk /tmp/sdb
n
<accept all defaults>
t
b
p
w
mkfs.vfat -F 32 -n MYDRIVE /tmp/sdb1
==mkfs.ext4==
Create ext4 filesystem. Overwrite. Label and root reserved to 0.
mkfs.ext4 -F -L looted_storage -m 0 /dev/sda1

=mkpasswd=
Create a password hash
echo password | mkpasswd -m sha-512 -s

=mogrify=
Resize, crop... a file. Removes original.
mogrify -resize 800 *.jpg
=mokutil(secure boot/secureboot=
mokutil --sb-state

=mount=
Mount a temporary ram partition
mount -t tmpfs tmpfs /mnt -o size=1024
Mount a cifs filesystem and change owner on mountpoint.
mount.cifs -o credentials=/home/user/cifs.credentials,gid=1004,uid=1004 //server/c$ /mnt/cifs
Disallow normal user to ps. If not belonging to gid 1001.
*/etc/fstab
proc /proc proc defaults,hidepid=2,gid=1001 0 0

=movgrab=
List available formats
movgrab -T http://youtu.be/ucivXRBrP_0
Get version listed.
movgrab -f mp4:1920x1080 http://www.youtube.com/v/ucivXRBrP_0

=mplayer=
mplayer in ascii mode.
mplayer -monitoraspect 4:3 -vo aa LinaFreestyler.avi
mplayer -vo aa -monitorpixelaspect 0.5 *.mp4
mplayer on second soundcard.
mplayer -ao oss:/dev/dsp *.mp3
mplayer -ao alsa:device=hw=0.0 *.mp3
Or, to specify a non-default (secondary) device either of the following commands can be used.
mplayer -ao oss:/dev/dsp1 *.mp3
mplayer -ao alsa:device=hw=1.0 *.mp3
play from v4l
mplayer -tv device=/dev/video:driver=v4l:input=1:width=640:height=480:norm=ntsc:adevice=/dev/dsp tv://1 -zoom -aspect 4:3
mplayer -fps 15 tv:// -tv driver=v4l2:width=640:height=480:device=/dev/video0play hdv material.
mplayer -monitoraspect 16:9 -vf pp=lb
play dvd image.
mplayer dvd://1 -dvd-device DVD.iso
play h264 webcam
mplayer -fps 24 tv:// -tv driver=v4l2:width=1920:height=1080:device=/dev/video0:outfmt=0x34363248 -aspect 16:10 -fs
play mjpeg webcam
mplayer -fps 24 tv:// -tv driver=v4l2:outfmt=mjpeg:width=1920:height=1080:device=/dev/video0 -aspect 16:10 -fs
play mp3 in different speed keep pitch.
mplayer -speed 1.5 -af scaletempo /mp3/music.mp3
# list chapters.
mplayer dvd://1 -dvd-device /dev/sr0 -identify -novideo -nosound
# dump chapters.
mplayer -dvd-device /dev/sr0 dvd://3 -dumpstream -dumpfile 3.vob

=MP4Box=
Combine mp4 files
MP4Box -add file1.mp4 -add file2.mp4 output.mp4
=mpv=
Video player. Enable hardware accelleration.
# Install packages.
dnf install intel-media-driver libva libva-utils gstreamer1-vaapi ffmpeg intel-gpu-tools mesa-dri-drivers mpv
# Top for intel gpu
sudo intel_gpu_top
# Enable hardware accelleration for mpv.
CONFIG_FILE=~/.config/mpv/mpv.conf ; if ! grep -q ^hwdec=auto ${CONFIG_FILE} ; then echo hwdec=auto ${CONFIG_FILE} ; fi
# Create new initramfs
sudo dracut --force
# Look at browser.
chrome://gpu/

=mpstat=
top like output of system usage
mpstat 5 5

=mtr=
ping and traceroute combined.
mtr -rc 10 8.8.8.8

=mutt=
Put the followin in .muttrc to change From.
set realname="Joe User"
set from="user@host"
set use_from=yes
command line mail with attachment
mutt -s subject -a syslogs.tar.gz admin@domain.org < /dev/null
Change sender from command line.
export EMAIL=address@inter.net && mutt -s "Subject Test" anden@halfface.se < /dev/null
echo "Test message" | mutt -s "Subject test" -e "set realname=\"Real Name\"" -e "set from=\"anden@halfface.se\"" -e "set use_from=yes" anden@halfface.se
Change envolope from
export REPLYTO=email@inter.net
export EMAIL=email@inter.net
echo "email@inter.net testing" | mutt -e "set envelope_from=yes" email@inter.net -a /tmp/attachment
oneliner
export EMAIL=email@inter.net;export REPLYTO="${EMAIL}";echo "email@inter.net testing" | mutt -e "set envelope_from=yes" email@inter.net -a /tmp/attachment
export EMAIL=email@inter.net;export REPLYTO="${EMAIL}";echo "${EMAIL} testing on ${HOSTNAME}" | mutt -e "set envelope_from=yes" -s "${EMAIL} testing on ${HOSTNAME}" "${EMAIL}"
Dont trigger out of Out Of Office reply.
echo "email@inter.net testing" | mutt -e "unignore list-id" email@inter.net
=multilog=
split standard output to logfiles. In this case keep specific size. t means to prepend a TAI timestamp on each line. 10000B. 5 logfiles. tai64nlocal program simply reads stdin and replaces TAI timestamps with human-readable ones. http://blog.teksol.info/pages/daemontools/best-practices. Compress rotated logfiles.
mkdir /tmp/myapp ; ./myapp | multilog t s10000 n5 '!tai64nlocal' '!gzip' /tmp/myapp 2>&1

=nc (netcat)=
==Check communication.==
listen on port 3333.
nc -kl 3333
talk to port 3333.
nc 192.168.0.1 3333

==Transfer data==
Cat file, calculate size listen on port 3333.
cat backup.iso | pv -b | nc -l 3333
Receive file.
nc 192.168.0.1 3333 | pv -b > backup.iso

==Setup telnet server==
nc -L -l -p1234 -d -e cmd.exe

==Test connection.==
nc -w2 -znv 10.1.22.31 7222

==tunnel==
On the server, we open a listener on the TCP port 6667 which will forward data to UDP port 53 of a specified IP. If you want to do DNS forwarding like me, you can take the first nameserver's IP you will find in /etc/resolv.conf - in this example, this is 192.168.1.1. But first, we need to create a fifo. The fifo is necessary to have two-way communication between the two channels. A simple shell pipe would only communicate left process' standard output to right process' standard input.

mkfifo /tmp/fifo
nc -l -p 6667 < /tmp/fifo | nc -u 192.168.1.1 53 > /tmp/fifo

==Dont eat up standard output.==
nc -v --send-only --recv-only localhost 22

==Talk to pop3 server over ssl.==
nc --ssl mail.tele2.se 995
==Talk to pop server==
nc -C mail.tele2.se 25

==Talk to web server==
URL_SSL=halfface.se ; echo -e "HEAD / HTTP/1.1\nHost: ${URL_SSL}\n\n" | nc --ssl ${URL_SSL} 443
echo -e 'GET /users/password/new HTTP/1.1\r\nHost: localhost\r\nConnection: Close\r\n\r\n' | nc localhost 80 | head
To overcome problems with nc closing connection too fast.
(echo -en 'GET / HTTP/1.1\r\nHost: 172.30.156.15\r\nConnection: close\r\n\r\n'; sleep .1) | nc 172.30.156.15 80 | head -30
nc --no-shutdown -v 172.30.156.15 80 <<<$(echo -en 'GET / HTTP/1.1\r\nHost: 172.30.156.15\r\nConnection: close\r\n\r\n')

=ncdu=
disk usage. Stay in one filesystem.
ncdu -x /
=net=
Start service via samba.
net rpc service start ipremote -I 172.17.255.99 -U 'domain/user%password'

=netstat=
Look at network connections. tcp/ip4.
netstat -4anpt
Look at multicast groups
netstat -g
What does it mean?=
ESTABLISHED
The socket has an established connection.
SYN_SENT
The socket is actively attempting to establish a connection.
SYN_RECV
A connection request has been received from the network.
FIN_WAIT1
The socket is closed, and the connection is shutting down.
FIN_WAIT2
Connection is closed, and the socket is waiting for a shutdown
from the remote end.
TIME_WAIT
The socket is waiting after close to handle packets still in the
network.
CLOSE The socket is not being used.
CLOSE_WAIT
The remote end has shut down, waiting for the socket to close.
LAST_ACK
The remote end has shut down, and the socket is closed. Waiting
for acknowledgement.
LISTEN The socket is listening for incoming connections. Such sockets
are not included in the output unless you specify the
--listening (-l) or --all (-a) option.
CLOSING
Both sockets are shut down but we still don't have all our data
sent.
UNKNOWN
The state of the socket is unknown.
==statistics==
netstat -s
netstat -s | retransmit

=nft=
nftables list config
nft -j list ruleset | jq .
=nmap=
Scan for open ssh ports.
nmap -p 22 --open -sV 10.0.0.*
nmap -p 22 -sV --open -oG - $(ip -4 a s $(ip route show default | awk '{print $5}') | grep inet | awk '{print $2}') | awk '/\/open\// {print $2,$3}'
Syn scan.
nmap -P0 -sS -p1023 www.halfface.se
Ping scan. Do not resolve.
nmap -sn -n 10.127.254.1-254
Which ciphers are allowed.
nmap --script ssl-enum-ciphers -p 465 www.halfface.se
arp scan.
nmap -PR 192.168.0.0/24
which kex_algorithms server_host_key_algorithms encryption_algorithms compression_algorithms
nmap --script ssh2-enum-algos -sV -p 22 ssh.server.inter.net
Which manufacturer.
nmap -sn 10.111.222.0/24

=nmcli=
==List connections==
nmcli con
==rename connection==
nmcli connection modify <old_name> con-name <new_name>

==manage network from cli==
http://fedoraproject.org/wiki/Networking/CLI
==Connect to a configured connection by name==
nmcli connection up WireLess
==Disconnection by name==
nmcli connection down Wireless
==Connect to remembered network.==
nmcli con up '[-_-] halfface 5'
==List available wireless networks.==
nmcli device wifi list
==Generate list of available wireless networks.==
nmcli device wifi rescan
sudo nmcli device wifi list --rescan yes

==Create connection for wireless network.==
nmcli device wifi connect Bredband password P4ssM0rd
==Connect to specific bssid==
nmcli connection modify MyWifiConnection 802-11-wireless.bssid 00:11:22:33:44:55

==List networks on specific interface.==
nmcli device wifi list ifname wlp0s18f2u4
==Disconnect network interface.==
nmcli device disconnect wlp0s18f2u4
==Manually setup interface.==
nmcli con add con-name "static-ens32" ifname ens32 type ethernet ip4 xxx.xxx.120.44/24 gw4 xxx.xxx.120.1
nmcli con mod "static-ens32" ipv4.dns "xxx.xxx.120.1,8.8.8.8"
nmcli con up "static-ens32" iface ens32
==list devices.==
nmcli device status
==list connections.==
nmcli connection show
==delete connection==
nmcli con delete "Wired connection 1"
==add connection with static ip.==
nmcli con add con-name ens224 ifname ens224 type ethernet ip4 172.30.109.16/24
==show properties for connection==
nmcli dev show ens224
==set dns server==
nmcli connection modify enp1s0 ipv4.dns "10.111.222.2,8.8.8.8"
==edit==
nmcli con edit $connection
print all
==autostart==
nmcli connection modify IFNAME connection.autoconnect yes|no
==dhcp option==
ip -4 addr show | grep -Ev "127.0.0.1|LOOPBACK" | awk '/^[0-9]+:/ {sub(/:/,"",$2); print $2}' | sort -u | while read NIC ; do echo '*' $NIC ; nmcli -f DHCP4 device show $NIC ; done

==Make network a bridge interface==
sudo nmcli con add ifname br0 type bridge con-name br0
sudo nmcli con add type bridge-slave ifname <network_card> master br0
sudo nmcli con modify br0 bridge.stp no
sudo nmcli con down "Wired connection 1"
sudo nmcli con up br0
==modify(change) vlan id==
nmcli connection modify <connection_name> vlan.id <new_id>

=nohup=
Start binary under nohup and tail log.
nohup ./run.sh & sleep 1 ; tail -1000f nohup.out
Start process and log to specified file.
nohup daemon > /path/daemon.log &

=nping=
nping -c 1 --tcp -p 80 www.halfface.se

=nth=
Name That Hash
nth --text '$y$j9T$jogs61gwDHB6L1oEwHeR00$L4cfYqkxKzS8dtkC5hPXFRMOIcEl6q5VKIkngrRGFM0'
=ntfs-3g=
mount ntfs filesystem. read and write.
yum install fuse fuse-libs ntfs-3g
mount /dev/sda1 /media/c_drive -t ntfs-3g -r -o umask=0222,locale=en_US
mount /dev/sda1 /media/c_drive -t ntfs-3g -rw -o umask=0000,locale=en_US
fstab read and write.
/dev/sda3 /media/e_drive ntfs-3g ro,defaults,umask=0222 0 0
/dev/sda1 /media/c_drive ntfs-3g rw,defaults,umask=0000 0 0
Create ntfs partition.
fdisk 7/gdisk 0700
mkfs.ntfs /dev/sdx1 -Q

=numbers=
series of numbers
bash:
echo {1..10}
=numfmt=
iec=accept optional single letter suffix. No output suffix. Remove B from input. change format of output, mb ,gb and so on.
numfmt --from=iec --to=none --suffix=B 8.7KB

=nwipe (dban)=
Wipe your disk
nwipe --nogui --nowait --autonuke /dev/sdb

=omping=
multicast ping
omping -c10 10.111.222.118 10.111.222.121
=openvpn3=
==Install openvpn fedora 38+ /etc/yum.repos.d/_copr\:copr.fedorainfracloud.org\:dsommers\:openvpn3-devsnapshots.repo==
[copr:copr.fedorainfracloud.org:dsommers:openvpn3-devsnapshots]
name=Copr repo for openvpn3-devsnapshots owned by dsommers
baseurl=https://download.copr.fedorainfracloud.org/results/dsommers/openvpn3-devsnapshots/fedora-$releasever-$basearch/
type=rpm-md
skip_if_unavailable=True
gpgcheck=1
gpgkey=https://download.copr.fedorainfracloud.org/results/dsommers/openvpn3-devsnapshots/pubkey.gpg
repo_gpgcheck=0
enabled=1
enabled_metadata=1
==Install package from above.==
dnf install openvpn3-client
==Add configuration==
OPENVPN_CONFIG=<name> ; openvpn3 config-import --name "$OPENVPN_CONFIG" --persistent --config "$OPENVPN_CONFIG".ovpn
==List configs==
openvpn3 configs-list
openvpn3 configs-list --verbose

==Remove config==
openvpn3 config-remove --config <config-name>
==show full config==
openvpn3 config-dump --config <config-name>

==Connect==
openvpn3 session-start --config <config-name>
==Disconnect==
openvpn3 session-manage --config <config-name> --disconnect
==Connect to the log with debug enabled. This can be run in a different terminal window after the connection has been started.==
openvpn3 log --config <config-name> --log-level 6
==Show active sessions==
openvpn3 sessions-list
==Show statistics for an active session==
openvpn3 session-stats --config <config-name>
==Show configuration settings==
openvpn3 config-manage --config <config-name> --show
==sessions disconnect==
openvpn3 sessions-list | grep Path | awk '{print $2}' | while read OPENVPN_PATH ; do echo $OPENVPN_PATH ; openvpn3 session-manage --session-path $OPENVPN_PATH --disconnect ; done
==View config files==
sudo find /var/lib/openvpn3/configs/ -type f

=openssl=
==Grab the public key.==
openssl s_client -connect www.halfface.se:443 </dev/null 2>/dev/null | sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p'
==What does the ssl cert look like.==
HOST=www.halfface.se ; PORT=443 ; echo | openssl s_client -connect ${HOST}:${PORT} -servername ${HOST}| openssl x509 -ext subjectAltName -noout -startdate -enddate -subject -issuer -nameopt RFC2253,sep_comma_plus_space

==What does crl look like. (Certificate Revocation List)==
openssl crl -inform PEM -text -noout -in crl.pem

==Connect to ssl server==
echo hello | openssl s_client -connect www.halfface.se:8140
==Connect to ssl server -cipher NULL,LOW==
echo hello | openssl s_client -connect www.halfface.se:8140
==Connect with openssl v3==
openssl s_client -ssl3 -connect ipmon01.dupont:443
==Connect with low security cipher==
echo X | openssl s_client -cipher NULL,LOW -connect www.halfface.se:8140
==PEM convert to DER==
openssl x509 -inform PEM -in /file.pem -outform DER file.der
==p12 to cer==
openssl pkcs12 -in infile.p12 -out outfile.cer -nodes
Export public
openssl pkcs12 -in path.p12 -out newfile.crt.pem -clcerts -nokeys -passin pass:<password>
export CERT=<cert>.p12 ; export PASS=<pass> ; openssl pkcs12 -in $CERT -out ${CERT}.pem -clcerts -nokeys -passin pass:${PASS}
Export private
openssl pkcs12 -in path.p12 -out newfile.key.pem -nocerts -nodes -passin pass:<password>
export CERT=<cert>.p12 ; export PASS=<pass> ; openssl pkcs12 -in $CERT -out ${CERT}.key -clcerts -nodes -passin pass:${PASS}
==p7b to pem==
openssl pkcs7 -print_certs -in <certificate>.p7b -out certificate.pem
==pem to p12==
Using file containing private, public and chain.
openssl pkcs12 -export -in sulzer.pem -out sulzer.p12 -passout pass:

==pfx to pem==
env FILE="<file>" PASSWORD="<password>" bash -c 'openssl pkcs12 -in "$FILE" -out "${FILE//\//_}.pem" -nodes -password pass:"$PASSWORD"'
Complete file.
openssl pkcs12 -in filename.pfx -out cert.pem -nodes
Get private cert. Then remove password. Decrypt
openssl pkcs12 -in filename.pfx -nocerts -out key.pem
openssl rsa -in key.pem -out server.key
Get public cert.
openssl pkcs12 -in filename.pfx -clcerts -nokeys -out cert.pem

==Extract p12 password protected keys in==
openssl pkcs12 -in /file.p12 -passin file:/password -nokey -nodes -out /file.nokeys
openssl pkcs12 -info -in </path/to/file.pfx> -passin pass:<pfx's password>

==Encrypt file==
openssl aes-256-cbc -a -salt -in file -out file,encoded -passin file:passfile
==Decrypte file==
openssl aes-256-cbc -d -a -salt -in file -out file,encoded -passin file:passfile
==Install new root ca==
# Change to the directory:
cd /etc/pki/tls/certs
# Next download the College root certificate:
wget https://icca2.ic.ac.uk/certenroll/ic-root.crt
# Convert the certificate to PEM format:
openssl x509 -inform der -in ic-root.crt -out ic-root.pem
# Create a link with the certificate hash:
ln -s ic-root.pem `openssl x509 -hash -noout -in ic-root.pem`.0
# Create sha256 base64 encoded hash
openssl dgst -binary -sha256 | openssl base64
# Verify root ca.
openssl verify -CApath /etc/pki/tls/certs ic-inter-root.pem
icrootca.cer: OK
The server certificate is the first certificate returned, and will be PEM formatted. The CA certificate is the final certificate returned, and is also PEM formatted.
openssl': echo | openssl s_client -connect www.sslsite.com:443 -showcerts
Check ca store files.
find . -name '*.pem' | while read PEM ; do echo '###' ${PEM} '###';ls -la "${PEM}" ; set -x ; curl --cacert "${PEM}" https://site.test.net/index.htm.
==Verify pop3 connectivity.==
openssl s_client -crlf -connect mail.tele2.se:110 -starttls pop3
USER yiming
PASS foobar
LIST – lists the messages available in the user’s account, returning a status message and list with each row containing a message number and the size of that message in bytes
STAT – returns a status message, the number of messages in the mailbox, and the size of the mailbox in bytes
RETR [message_num] – returns the message identified by the message number, which is the same as the message number shown in the LIST command output
TOP [message_num] [n] – returns the top n lines of the message denoted by message number.
QUIT command will end the session.
==Create wildcard self signed certificate.==
openssl req -x509 -nodes -days 3650 -newkey rsa:2048 -keyout wildcard.test.internal.zone.key -out wildcard.test.internal.zone.crt
Common Name (eg, your name or your server's hostname) []:*.test.internal.zone
==Verify certificate chain==
openssl verify -CAfile Thawte_Primary_Root_CA.pem -untrusted thawte_SSL_CA_G2.cer www.halfface.se.pem
Look at certificate chain.
openssl s_client -connect www.halfface.se:443
CONNECTED(00000003)
depth=2 O = Digital Signature Trust Co., CN = DST Root CA X3
verify return:1
depth=1 C = US, O = Let's Encrypt, CN = Let's Encrypt Authority X3
verify return:1
depth=0 CN = www.halfface.se
verify return:1
---
Certificate chain
0 s:CN = www.halfface.se
i:C = US, O = Let's Encrypt, CN = Let's Encrypt Authority X3
1 s:C = US, O = Let's Encrypt, CN = Let's Encrypt Authority X3
i:O = Digital Signature Trust Co., CN = DST Root CA X3
---
Verify chain.
openssl s_client -showcerts -verify 5 -connect www.halfface.se:443 < /dev/null 2>&1

==Connect to smtp server via ssl.==
openssl s_client -crlf -ign_eof -connect www.halfface.se:25 -starttls smtp -quiet
EHLO halfface.se
AUTH LOGIN
$(echo -n "username" | base64)
$(echo -n "password" | base64)
MAIL FROM:anden@halfface.se
RCPT TO:<anden@halfface.se>
DATA
Subject: Test from cli.

This is a test email.
.
QUIT

==Connect to imap==
openssl s_client -crlf -connect www.halfface.se:993
openssl s_client -showcerts -connect www.halfface.se:143 -starttls imap
Login
tag login abjorklund ${PASSWORD}
List mailboxes
tag LIST "" "*"
Log out
tag LOGOUT

==compare two certifactes==
Compare the use case for the certificate.
sdiff <(openssl x509 -in server.crt -noout -issuer -subject -enddate -purpose) <(openssl x509 -in uc_activemq.crt -noout -issuer -subject -enddate -purpose)| less
==create a csr==
openssl req -new -sha256 -nodes -out www.halfface.se.csr -newkey rsa:2048 -keyout www.halfface.se.key -config <(
cat <<-EOF
[req]
default_bits = 2048
prompt = no
default_md = sha256
req_extensions = req_ext
distinguished_name = dn
[ dn ]
O=Organisation: halfface
C=SE
ST=Stockholm
L=Stockholm
CN = www.halfface.se
[ req_ext ]
subjectAltName = @alt_names
[ alt_names ]
DNS.1 = halfface.se
DNS.2 = ldap.halfface.se
DNS.3 = mqtt.halfface.se
EOF
)

==csr information==
openssl req -noout -text -in file.csr | grep -vE ' [0-9A-Fa-f]{2}:[0-9A-Fa-f]{2}:'

==look at content of private key==
openssl rsa -text -noout -in key.pem

==confirm that public private and csr match==
# For your SSL certificate:
CERT_PUBLIC=$(ls *.crt)
echo $(openssl x509 -noout -modulus -in "${CERT_PUBLIC}" | openssl md5 | awk '{print $2}'),"${CERT_PUBLIC}",public cert.
# For your RSA private key:
CERT_PRIVATE=$(ls *.key)
echo $(openssl rsa -noout -modulus -in "${CERT_PRIVATE}" | openssl md5 | awk '{print $2}'),"${CERT_PRIVATE}",private key
# For your CSR:
CERT_CSR=$(ls *.csr)
echo $(openssl req -noout -modulus -in "${CERT_CSR}" | openssl md5 | awk '{print $2}'),"${CERT_CSR}",certificate signing request

==connect with ca private and public key==
openssl s_client -CAfile ca.pem -cert public.crt -key private.key -connect 10.12.118.184:1023 -tls1_2
==create a ca==
===Create ca and certificates.===
# Create folder structure.
mkdir /root/ca/
mkdir /root/ca/certs/
mkdir /root/ca/crl/
mkdir /root/ca/newcerts/
mkdir /root/ca/private/
mkdir /root/ca/requests/
touch /root/ca/index.txt
echo 1000 > /root/ca/serial
chmod 600 /root/ca
# Create private key for the CA certificate. pass phrase: $(pwgen 15)
cd /root/ca/
openssl genrsa -aes256 -out private/cakey.pem 4096
# Create a public certificate for the CA.
openssl req -new -x509 -key /root/ca/private/cakey.pem -out cacert.pem -days 36525

Country Name (2 letter code) [AU]:SE
State or Province Name (full name) [Some-State]:Stockholm
Locality Name (eg, city) []:Stockholm
Organization Name (eg, company) [Internet Widgits Pty Ltd]:Company
Organizational Unit Name (eg, section) []:Company
Common Name (e.g. server FQDN or YOUR name) []:Certificate Authority
Email Address []:anden@halfface.se

# Copy system openssl.cnf to /root/ca dir. Then change dir in config.
vim openssl.cnf
[ CA_default ]
dir = /root/ca # Where everything is kept

===Create signed certificate keypair===
cd requests/
# Create csr
openssl req -new -newkey rsa:2048 -nodes -keyout <client>.key -out <client>.csr -config ../openssl.cnf
# Issue certificate for csr.
openssl ca -in <client>.csr -out <client>.crt -config ../openssl.cnf -days 36525

==talk http via openssl==
openssl s_client -crlf -quiet -connect www.halfface.se:443 <<EOF
GET / HTTP/2.0
Host: www.halfface.se

EOF

==look at cert==
openssl asn1parse -in rb-ca.crt.2021-02-28
==performance testing==
openssl speed -evp aes-256-ecb
==confirm that ca is correct==
echo | openssl s_client -CAfile Sectigo_RSA_Domain_Validation_Secure_Server_CA.pem -no-CAfile -no-CApath -tls1_2 -connect 172.30.32.141:5044 2>&1 | grep Verification
Verification: OK
==openssl s_server==
Setup server listening as http server.
openssl s_server -status_verbose -HTTP -cert host.inter.net.crt -key host.inter.net.key
Setup https server listening on https on port 4433 providing complete chain
openssl s_server -status_verbose -HTTP -cert halfface.se.pem -cert_chain halfface.se.intermediate.pem -key halfface.se.key -accept 4433

==othername:<unsupported>==
You will have to locate the "OCTET STRING" line just below the "OBJECT :X509v3 Subject Alternative Name" line then strpars
# print section offset via
openssl asn1parse -in yourcert.pem
# parse otherName from "OCTET STRING" <offset> is the value in the beginning of the line.
openssl asn1parse -in yourcert.pem -strparse <offset>
Another way of seeing same data is through
openssl asn1parse -in /tmp/tmp -dump -strictpem

=create password string=
openssl passwd -6 -salt $RANDOM $PASSWORD

=pactl=
Pulse Audio cli tool.
List output devices.
pactl list short sinks
Set default output device
pactl set-default-sink $i
List where applications send output.
pactl list short sink-inputs
Move application to other output device.
pactl move-sink-input $applicaiton $sink

=pam=
Troubleshooting pam.
/etc/syslog.conf
# Get debugging data.
*.debug /var/log/debug.log
Create logfile and restart *syslog.
touch /var/log/debug.log
service syslog restart
Put pam in debug mode.
touch /etc/pam_debug
OR you can enable debugging only for the modules you're interested in by adding "debug" to the end of the relevant lines in /etc/pam.d/system-auth or the other /etc/pam.d/* files:
login auth required pam_unix.so debug
Debugging is found in /var/log/debug.log.

=pam_tally2=
Configured here.
/etc/pam.d/password-auth:auth required pam_tally2.so file=/var/log/tallylog onerr=fail per_user deny=6 no_magic_root
What is status from account?
pam_tally2 --user=user1
Login Failures Latest failure From
user1 8 04/20/15 11:39:54 192.168.1.1

=parallel=
Run command 10 times in parallel.
seq 10 | parallel -n0 echo "Hello, World"
Run command 10 times in parallel dryrun.
seq 10 | parallel --dry-run -n0 echo "Hello, World"
Compress logfiles in parallel.
parallel gzip ::: *.log
=partprobe=
Rescan block device to setup device files
partprobe /dev/sde
=partx=
partx /dev/sda -l ; partx /dev/sda -u ; partx /dev/sda -l

=paste=
Combine to files to one in multiple column. Replace tab with spaces.
paste /tmp/check_name_nagios /tmp/filename | column -t -s $'\t'
Combine every second line with a space in between.
paste -d' ' - -

=pcregrep=
Multiline grep
pcregrep -M 'pattern: line1\nPattern lin2' /temp/files_*
=pdftotext=
grab text from pdf document.
pdftotext document.pdf
=pdftk=
Rotate clockwise
PDF=<file.pdf> ; pdftk "${PDF}" cat 1-endwest output "${PDF}".rotate
Rotate counter clockwise
PDF=<file.pdf> ; pdftk "${PDF}" cat 1-endeast output "${PDF}".rotate
Create one pdf from others.
pdftk <file.pdf>* cat output <file_combo.pdf>
Extract one page from pdf.
pdftk input.pdf cat 11 output page11.pdf
Extract series of pages from pdf
pdftk input.pdf cat 3-7 output pages_3-7.pdf

=pidof=
which pids has a program stared. Find pid.

=ping=
Ping ipv6 loopback
ping6 ::1 -c1
Ping ipv6 broadcast
ping6 ff02::1%2 | cut -d\ -f4
Ping short output
export ADDRESS=2001:4860:4860::8888 ; PING=$(ping6 -w1 -q -c1 -i10 ${ADDRESS} 2>&1) ; RTT=$( grep rtt <<<"${PING}" | awk -F/ '{print $6}') ; RECEIVED=$(grep received <<<"${PING}") ; echo $ADDRESS $RECEIVED, rtt=${RTT}
Ping to discover mtu. 1460, 1450. When reply increase with 2. when found highest value increase with 28 to get mtu.
ping -M do -s 1472 123.45.56.78

=pip=
==which versions of django exist==
pip install pylibmc
==which versions are installed==
pip list

==which files does pip package provide.==
pip show -f $package
==Uppgrade package.==
pip install $package --upgrade
==where your own packages might end up==
/usr/local/lib/python3.9
/usr/lib/python2.7/site-packages/
==upgrade pip==
ls -la /usr/lib64/libldap_r.so /usr/lib64/libldap.so
==do not use cache==
pip3 install -r requirements.txt --no-cache-dir

=pgrep=
Grep any processlines including 1066
pgrep -lf 1066
=pmap=
Look at memory usage of process.
sudo pmap 2258

=postfix=
remove mails in queue.
mailq | grep ^[A-F0-9] | awk '{print $1}' | postsuper -d -
list mails in queue
mailq | grep "^[A-F0-9]"
Get mails in better output to better decide what to do with mails.
mailq | grep -v -- "-Queue ID-" | sed 's/^$/\x0/g' | tr -d '\n' | sed 's/\x0/\n/g'
Remove stuck emails.
postsuper -d ALL deferred
List email
postcat -q E55692442F
Read mail
postcat -vq [message-id]

=pr=
Print two files between each other.
pr -w200 -m -t /tmp/1 /tmp/2
=printf=
Convert octal to utf-8
printf '\360\237\222\200'
decimal to integral
printf "%.0f" <decimal>

=printscreen=
import -window root test.png
Gnome copy graphics to paste buffer. Copy selected portion of screen.
gnome-screenshot -a

=/proc=
*/proc/meminfo
MemTotal — Total amount of physical RAM, in kilobytes.

MemFree — The amount of physical RAM, in kilobytes, left unused by the system.

Buffers — The amount of physical RAM, in kilobytes, used for file buffers.

Cached — The amount of physical RAM, in kilobytes, used as cache memory.

SwapCached — The amount of swap, in kilobytes, used as cache memory.

Active — The total amount of buffer or page cache memory, in kilobytes, that is in active use. This is memory that has been recently used and is usually not reclaimed for other purposes.

Inactive — The total amount of buffer or page cache memory, in kilobytes, that are free and available. This is memory that has not been recently used and can be reclaimed for other purposes.

HighTotal and HighFree — The total and free amount of memory, in kilobytes, that is not directly mapped into kernel space. The HighTotal value can vary based on the type of kernel used.

LowTotal and LowFree — The total and free amount of memory, in kilobytes, that is directly mapped into kernel space. The LowTotal value can vary based on the type of kernel used.

SwapTotal — The total amount of swap available, in kilobytes.

SwapFree — The total amount of swap free, in kilobytes.

Dirty — The total amount of memory, in kilobytes, waiting to be written back to the disk.

Writeback — The total amount of memory, in kilobytes, actively being written back to the disk.

Mapped — The total amount of memory, in kilobytes, which have been used to map devices, files, or libraries using the mmap command.

Slab — The total amount of memory, in kilobytes, used by the kernel to cache data structures for its own use.

Committed_AS — The total amount of memory, in kilobytes, estimated to complete the workload. This value represents the worst case scenario value, and also includes swap memory.

PageTables — The total amount of memory, in kilobytes, dedicated to the lowest page table level.

VMallocTotal — The total amount of memory, in kilobytes, of total allocated virtual address space.

VMallocUsed — The total amount of memory, in kilobytes, of used virtual address space.

VMallocChunk — The largest contiguous block of memory, in kilobytes, of available virtual address space.

HugePages_Total — The total number of hugepages for the system. The number is derived by dividing Hugepagesize by the megabytes set aside for hugepages specified in /proc/sys/vm/hugetlb_pool. This statistic only appears on the x86, Itanium, and AMD64 architectures.

HugePages_Free — The total number of hugepages available for the system. This statistic only appears on the x86, Itanium, and AMD64 architectures.

Hugepagesize — The size for each hugepages unit in kilobytes. By default, the value is 4096 KB on uniprocessor kernels for 32 bit architectures. For SMP, hugemem kernels, and AMD64, the default is 2048 KB. For Itanium architectures, the default is 262144 KB. This statistic only appears on the x86, Itanium, and AMD64 architectures.

=ps=
==Process list in tree view.==
ps axfww
==Process sort by cpu usage.==
ps auxwww --sort -%cpu | head
==How long has process been running.==
ps -p 1 -o etime=
==Process list sorted after memory usage.==
ps aux --sort=size
==Process show memory usage... sort...==
ps axo rss,%cpu,pid,euser,cmd | sort -nr | head -n 10 | less -ISRM
==Process sort by mem usage.==
ps auxwww --sort -rss | head
==Processes sorted by time running.==
ps aux --sort -time
==Processes sorted by time started==
ps -auxwww --sort=start_time
==ps showing threads.==
ps -efL
==How long has process been running.==
echo -n $(( ($(date +%s) - $( stat -c%X /proc/$(pgrep -f [a]ctivemq.jar))) / 3600 ))
==ps long usernames==
ps axo user:20,pid,pcpu,pmem,vsz,rss,tty,stat,start,time,comm
==ps including nice==
ps -eo pid,user,ni,comm

=pstack=
print a stack trace of a running process

=pulseaudio=
# Is pulseaudio running?
ps uxawww| grep -E pulseaudi[o]
# stop pulseaudio
pulseaudio -k
# start pulseaudio as found by ps | grep pulseaudio
/usr/bin/pulseaudio --start --log-target=syslog

=putty=
Run putty from cli with login
"C:\Program Files\PuTTY\putty.exe" -l <username> -pw <password> <host_url>
Always setup stay alive.
connection -> keepalive -> 60
set up tunnel
putty -load blt.homeip.net -l bjorklun -pw password -L 19242:192.168.0.42:3389 blt.homeip.net
putty without taking tty.
plink -load www.halfface.se -l user_name -pw password -R *:3389:localhost:3389 -2 -4 -N
reverse tunnel. Connect remote host 3400 to machine running putty localhost:3389.
connection -> ssh -> tunnels -> "Source Port" = 3400 -> destination = localhost:3389 -> remote.
socks server.
connection -> ssh -> tunnels -> Source port: 3128 , Destination: localhost:3128, Dynamic:true -> add -> apply.
Change font size
echo Windows Registry Editor Version 5.00 > putty.reg && echo [HKEY_CURRENT_USER\Software\SimonTatham\PuTTY\Sessions\Default%20Settings] >> putty.reg && echo "Font"="Courier New" >> putty.reg && echo "FontHeight"="12" >> putty.reg && reg import putty.reg

=pv=
throughput in pipe. speed.
pv
pv -cN
make a dd and limit througput to 20MB/s.
dd if=${HOST}.qcow2 bs=4k conv=noerror,sync | pv -L 20M | dd of=${HOST}.dd_noerror.qcow2
=pwgen=
Create less complicated password.
pwgen -sy 15 -r \'\"\^\`\~\;\[\]\{\}\,

=qalculate=
qalc
> 40 euro to SEK
40 * euro = approx. SEK 417.36
=readpst=
output pst file in separate files in out directory
readpst -S -o out/ outlook.pst
=reboot=
Hard reboot mean that shutdown scripts will not run and machine reboot immediately without syncing hard disk drives.
This commands enable sysrq and after this call fast reboot.
echo 1 > /proc/sys/kernel/sysrq
echo b > /proc/sysrq-trigger
Force shutdown
echo 1 > /proc/sys/kernel/sysrq
echo o > /proc/sysrq-trigger
Kernel panic
echo c > /proc/sysrq-trigger
==List last reboots==
last --time-format iso reboot

=rename=
Recursive lowercase to uppercase
for i in $(find * -depth); do (mv $i $(echo $i | sed 's%[^/][^/]*$%%')$(echo $i | sed 's!.*/!!' | tr [:upper:] [:lower:])); done
Upper to lower case
for f in `find .`; do mv -v "$f" "`echo $f | tr '[A-Z]' '[a-z]'`"; done

=reposync=
reposync -n -c /etc/yum/yum.conf -p /repos/centos6 -d -r base -r updates -r extras -r centosplus -r contrib
createrepo -g /repos/centos6/base/repodata/comps.xml /repos/centos6/base
createrepo /repos/centos6/updates
createrepo /repos/centos6/extras
createrepo /repos/centos6/centosplus
halfface -> sync repo. -d delete what is not on remote, -n only newest version, -p store here, -r which repos to sync
reposync -d -n -p /install/system/linux/fedora/24/repo/ -r updates -r fedora -r rpmfusion-free -r rpmfusion-free-updates -r rpmfusion-nonfree -r rpmfusion-nonfree-updates
halfface -> create repository
REPODIR=/install/system/linux/fedora/24/repo ; for REPO in $(cd $REPODIR; ls) ; do echo $REPO ; createrepo_c ${REPODIR}/${REPO} ;done
=reptyr=
Reparent a running program to a new terminal. (move tty)

=rfcomm=
list usb devices
hcitool scan
What properties does the device have.
sdptool browse 00:0D:B5:30:07:79
connect bluetooth device virtual servial.
rfcomm bind /dev/rfcomm0 00:0D:B5:30:07:79 1
=rkhunter=
Run rkhunter full scan no keypresses needed
sudo rkhunter --checkall --skip-keypress -x
Update database
sudo rkhunter --propupd
Search for what triggered alarm.
sudo grep -E 'Warning|Suspicious' /var/log/rkhunter/rkhunter.log

=dnf update rkhunter. Update dnf after rkhunter scan=
tail -1 /etc/sysconfig/rkhunter
sleep 300 && ( dnf -e 0 -y update ; rkhunter --propupd ) >> /tmp/dnf_update_rkhunter--propupd.$(date +%F_%H-%M-%S).log 2>&1 &

=rotatelogs=
Write standard output to logfile. Rotate at 100M. Keep 3 files.
your_script.sh | rotatelogs -n3 /var/log/your.log 100M
=route=
The route to a network is behind 10.111.222.7
route add -net 10.111.223.0 netmask 255.255.255.0 gw 10.111.222.7
Add default route
route add default gw 192.168.122.1
Permanent route under redhat
/etc/sysconfig/static-routes
any net 198.18.129.0/24 gw 10.240.175.12
/etc/sysconfig/network-scripts/route-eth1
1.2.3.4/23 via 1.2.3.1
Drop packages to ip.
route add -host 192.168.1.51 reject
Remove reject rule.
route del -host 192.168.1.51 reject
Remove route
route -n
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
192.168.122.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0
169.254.0.0 0.0.0.0 255.255.0.0 U 1002 0 0 eth0
10.0.0.0 0.0.0.0 255.0.0.0 U 0 0 0 eth0
0.0.0.0 192.168.122.1 0.0.0.0 UG 0 0 0 eth0
route del -net 10.0.0.0 gw 0.0.0.0 netmask 255.0.0.0 dev eth0

=rpm=
==install src.rpm==
rpmbuild --rebuild alien-6.51-1.src.rpm
rpm -i /usr/src/redhat/RPMS/x86_64/alien-6.51-1.rpm
==List contents of rpm.==
rpm -qlp myfile.rpm
==Extract single file from rpm.==
rpm2cpio package.rpm | cpio -idv ./search_path_to_file_from_listing_above.txt
==List information about non installed rpm.==
rpm -qip foo.rpm
==Extract contents of rpm.==
rpm2cpio *.rpm | cpio -i --make-directories
==Which version of rpm is installed.==
/etc/rpm/macros ~/.rpmmacros
%_query_all_fmt %%{name}-%%{version}-%%{release}.%%{arch}
==list architecture==
rpm -qa --qf "%{n}-%{v}-%{r}.%{arch}\n"
==List only name of installed rpms.==
rpm -qa --qf "%{NAME}\n"
==Extract rpms in subdirectories.==
for RPM in $(ls *|sed 's_\.rpm$__g');do echo $RPM; mkdir $RPM; rpm2cpio $RPM.rpm | (cd $RPM && cpio -i --make-directories);done
==Verify content of rpm==
rpm -V package
# What does those cryptic letters mean from rpm -V:
S file Size differs
M Mode differs (includes permissions and file type)
5 MD5 sum differs
D Device major/minor number mismatch
L readlink(2) path mismatch
U User ownership differs
G Group ownership differs
T mTime differs
==Reinstall rpm==
rpm -iv --replacepkgs package.rpm
==Dependencies of rpm==
rpm -qpR ${rpm}
rpm -qR ${packagename}
rpm -qp mypackage.rpm --provides
rpm -qp mypackage.rpm --requires
==Rebuild rpm database.==
\rm /var/lib/rpm/__db*
rpm --rebuilddb

==Update minor release.==
yum --releasever=6.11 update sl-release
yum clean all
yum update
==Downgrade rpm.==
rpm -Uvh --oldpackage /tmp/app.x86_64.rpm
==Which rpm:s are required by rpm. Can be used to install rpm on machine without access to yum repo.==
PKG=openssh-server ; yum install --downloadonly --installroot=/tmp/$PKG-installroot --releasever=7 --downloaddir=/tmp/$PKG $PKG
==CVE:s fixed by rpm==
rpm -qi --changelog openssh-server | grep -i CVE

=rsync=
Syncronize folders. Delete non existing files on remote host. Compress.
rsync --delete -az -e ssh bjorklun@semco.homeip.net:/install/program/windows/
Syncronize files over ssh on port 2222. Show progress. Syncronize even empty directories.
rsync -Pae 'ssh -p 2222' localhost:/opt/techops/bin/ /opt/techops/bin/
rsync with total progress bar.
rsync -a --info=progress2 /dir1/ /dir2/
Run rsync in both ends but transfer data with normal user.
sudo rsync -aP /tmp/andreas/ andreasbj@localhost:/tmp/andreas2/ --rsync-path='sudo rsync'
rsync with limit of 8 MB/s.
rsync -aP --bwlimit=8000 /source/ /destination/
rsync excluding directory
rsync -r --exclude=.svn /source/ /destination/
rsync including selinux information. Preserve hard links.
rsync -aPXH /source /destination
rsync don't keep links. Copy files referenced.
rsync -rLP /source/ /destination
Record which files to sync.
rsync -r -ptgo --delete -P --size-only -n www.halfface.se:/mp3/ /mp3/ -n | tee /temp/mp3_$(date +%Y-%m-%d)_diff.txt
Rsync new files.
rsync -RDa0P --files-from=<(find /sourcedir -mtime -7 -print0) . /targetdir/
rsync ignore existing files.
rsync -P --ignore-existing /source/* /destination/ -n
rsync excluding directories matching pattern.
SOURCE=/apps/IP400 ; DESTINATION=/apps/IP400.$(date '+%Y-%m-%d_%H-%M-%S') ; rsync -aP "${SOURCE}"/ "${DESTINATION}"/ --exclude-from=<(cd "${SOURCE}" ; find -type d -name log | sed -e 's|./||')
Sync files partially.
rsync -avz --partial --inplace
which files differ between hosts.
rsync -nrlptDqv --delete --exclude napsjb/server/naps/tmp/ /opt/ongame/ 10.6.21.11:/opt/ongame | less
-n dry run.
-r recursive
-l copy symlinks av symlinks.
-p preserve permission
-t preserve tims.
-D --device --special. Keep special files.
-q quiet
-v verbose

=sar=
Old sar information.
sar -f /var/log/sa/sa25 -s 00:00:00 -e 23:59:00
load average.
sar -q -f /var/log/sa/sa25 -s 00:00:00 -e 23:59:00
All information.
sar -A -f /var/log/sa/sa25 -s 00:00:00 -e 23:59:00
View network statistics.
LANG=c sar -n DEV | grep eth0
realtime summary.
sar 4 5
=script=
Run command under shell even if it does not exist.
script -q -f -c "commands or scripts to run"
Run session under screen in script.
screen -dm bash -c 'script --timing=script1.tm script1.out'
Replay script recorded file
scriptreplay --timing script1.tm --typescript script1.out
=scp=
Limit to 1.2MB/s.
scp -l 10240 Rocky-8.5-x86_64-minimal.iso halfface.se:/temp/

=search&replace=
perl
grep -rsl '10.6.4.102' * | xargs perl -pi -e 's/10.6.4.102/10.6.4.103/'
sed
find . -type f -exec sed -i 's/string1/string2/g' {} \;
Grep for regexp starting with CN= and stop at first occurrence of ,. not greedy
grep -oE 'CN=[^,]*,'
=set=
Look at current settings. Expanded or simple view.
set -o
echo $-

=setfacl=
Add rwx permission for user_name recursivly from /directory
setfacl -Rm u:user_name:rwx /directory
Remove acl:s
setfacl -bn foobar
=setpriv=
Dump your privileges.
setpriv -d

=shred=
Recurse remove dir
find /tmp/secret -type f -exec shred {} \;

=shuf=
Pick random line in file.
shuf -n1 /file
Get random number
shuf -i 10-120 -n1

=sms=
Mail to sms gateway.
tele2
07XXXXXXXX@sms.tele2.se

Comviq
467xxxxxxxx@sms.comviq.se

Europolitan
4670xxxxxxx@europolitan.se

=snmptrap=
# send more than one string.
snmptrap -v 2c -Ci -u user -c community localhost "" .1.3.6.1.4.1.5089.1.0.1 1 s "This is the first string" 2 s "This is the second string"
snmptrap -v 2c -Ci -u user -c community localhost '' .1.3.6.1.4.1.5089.1.0.1 1 s "This is the first string" 2 s "This is the second string"
snmptrap -v 2c -c xxxxxxx localhost '' .1.3.6.1.4.1.5089.1.0.1 .1.3.6.1.4.1.5089.2.0.999 s "Hej Hej"
Simple trap
snmptrap -v 1 -c public localhost '' 0 0 ''

=snmptrapd=
# Enable logfile. /etc/sysconfig/snmptrapd
OPTIONS="-Lf /var/log/snmptrapd.log"
# Disable authorization and put in logfile. /etc/snmp/snmptrapd.conf
disableAuthorization yes
authCommunity log public

=snmpwalk=
Get information from an oid.
snmpwalk -v 1 -c public snmp.device.net .1.3.6.1.4.1.2021.84
Do tcpdump while running.
tcpdump -i eth0 -n -s0 -v host snmp.device.net and port snmp
=socat=
Create a tunnel between localhost 2222 to remote host 2222
socat TCP-LISTEN:2222,fork TCP:10.111.222.2:2222
socat TCP-LISTEN:22,fork,bind=127.0.0.1 TCP:192.168.0.15:5900
socat TCP-LISTEN:2222,fork TCP:10.8.110.20:22,bind=172.19.14.251
Listen on 10.120.50.12:9090 and forward to 127.0.0.1:9090
socat TCP-LISTEN:9090,bind=10.120.50.12,fork TCP:127.0.0.1:9090
Create tunnel via systemctl
Create file similar to this. /etc/systemd/system/socat_win.service
[Service]
ExecStart=/usr/bin/socat TCP-LISTEN:3389,fork TCP:192.168.122.204:3389
[Install]
WantedBy=multi-user.target
Enable new file.
systemctl daemon-reload
Start new daemon
systemctl start socat_win

=sort=
Sort ip address.
sort -t. +0n -1 +1n -2 +2n -3 +3n -4
sort -t . -k 1,1n -k 2,2n -k 3,3n -k 4,4n
sort on fift column
sort -t, -k5n,5 /tmp/gfp
Get a list of configured ip for a set of hosts. Sort on domain then hostname
pdsh ^/host_list 'ip route get 8.8.8.8 | awk "NR==1 {print \$NF}"' | sort -t . -k 2 -k 1
Sort on first column only.
sort -n -k 1,1

=spawn=
Encode wav to ogg in parallel.
# ls -1 *.wav | while read ; do echo "oggenc -q6 \"$REPLY\"" ; done | spawn -j4
=split=
Devide file into parts containing 100 lines.
split -l 100 create_updated_2013-10-29_sort_created_ci_id_name.txt --numeric-suffixes --suffix-length=3 Cleanup.
Devide file in 10 parts. Suffix length 4.
split -n 10 -a 3 bigfile.tar.gz

=sqlite=
Is db broken?
sqlite3 mydata.db "PRAGMA integrity_check"
recover db
sqlite3 mydata.db ".dump" | sqlite3 new.db
sqlite3 stellar.db .recover | sqlite3 stellar_2.db
Show databases
sqlite> .databases
main: /var/lib/tuptime/tuptime.db
List tables
sqlite> .tables
tuptime
Run sql command
sqlite> select * from tuptime;
1544984636|2387765.42|-1|0|0.0|Linux-4.19.8-200.fc28.x86_64-x86_64-with-fedora-28-Twenty_Eight
exit|quit
.quit
==vacuum==
/usr/local/openvpn_as/bin/sqlite3 /usr/local/openvpn_as/etc/db/log.db "VACUUM"
==count tables==
DB=files.db ; for TABLE in $( sqlite3 $DB ".tables") ; do echo -e $TABLE\\t$(sqlite3 $DB "SELECT COUNT(1) FROM $TABLE;") ; done | column_tab

=ss=
List all connections.
ss -an
List processes and which port they listen too. Grep process.
ss -tulpn | grep 5405

=ssh=
==ssh-keygen==
Create key pair without input.
<pre>
KEYNAME=cluster-info-reporting ; KEYNAME_PATH=/tmp/${KEYNAME}-$(date '+%Y-%m-%d_%H-%M-%S') ; ssh-keygen -q -t ed25519 -N '' -C $KEYNAME <<< $'\ny' >/dev/null 2>&1 -f "${KEYNAME_PATH}" ; echo Keys: $(ls "${KEYNAME_PATH}"*)
</pre>

==which private ssh keys are password protected==
ls ${HOME}/.ssh/* | grep -Ev 'pub$|authorized_keys|config|known_hosts|ssh-agent.sock' | while read i ; do SSH_PASSWORD=$(ssh-keygen -y -P "" -f "$i" 2>&1 | grep "incorrect passphrase supplied to decrypt private key") ; if [ -z "${SSH_PASSWORD}" ] ; then echo No password encrypted ssh private key: $i ; fi ; done

==Remove pass phrase==
ssh-keygen -p [-P old_passphrase] [-N new_passphrase] [-f keyfile]

==view fingerprint==
ssh-keygen -l -E md5 -f /tmp/ssh-keygen.pub

==change the name of private key==
ssh-keygen -c -C "first.lastname@example.com" -f ~/.ssh/id_ed25519

==Copy public key to authorized_keys==
ssh-copy-id user@host
List supported ciphers
ssh -Q cipher
List supported MACs
ssh -Q mac
List supported public key type
ssh -Q key
List supported key exchange algorithms
ssh -Q kex
List supported ciphers, macs and kexalgorithms.
sshd -T | grep "$ciphers\|macs\|kexalgorithms$"
Run command each time you login via ssh.
$HOME/.ssh/rc

==Tunnel==
sudo ssh -nNTx -R 2222:localhost:22 andreasbj@www.halfface.se
Reverse tunnel.
ssh -D \*:666 www.halfface.se
ssh -N ipmon10.ny1.ip-soft.net -L43389:ippc01.ongame.ip-soft.net:3389
-n Dont take console. Good for background.
-N Do not execute a remote command
-T Disable pseudo-tty allocation.
-x Disables X11 forwarding.
-R port:host:hostport
sudo ssh -N -L 2222:www.halfface.se:22 www.halfface.se
sudo ssh -nNTx -R 2222:www.halfface.se:22 www.halfface.se
sudo ssh -nNTx -R 443:satellite.ongame.com:443 root@10.0.254.30 # Tunnel 443 over ssh from remote host via local host.
Open tunnel on remote host. Start remote proxy server forwarding to internal network.
ssh remotehost -R remoteport:localhost:localport "ssh -D 9050 localhost:remoteport"
Multiple reverse tunnel controled by autossh. (-M)Control port,(-f)background, (-N) no remote command, reverse tunnel (-R)
autossh -M 41000 -f -N -R 0.0.0.0:8001:192.168.1.10:80 -R 0.0.0.0:8002:192.168.1.20:80 user@remotehost

==reverse tunnel bound to all interfaces==
The config has to allow to bind to * interface. /etc/ssh/sshd_config GatewayPorts yes
sudo ssh -i ${HOME}/.ssh/id_dsa -N -R \*:2222:localhost:22 ${USER}@www.halfface.se

==Create an ssh tunnel link==
https://help.ubuntu.com/community/SSH_VPN
echo 1 > /proc/sys/net/ipv4/ip_forward
vim /etc/ssh/sshd_config PermitTunnel=yes
sudo ssh -NTCf -w 0:0 1.2.3.4
sudo ssh -v -w any:any www.halfface.se
###
local:
ip link set tun0 up
ip addr add 169.254.0.1/32 peer 169.254.0.2 dev tun0
ip route add 192.168.0/24 via 169.254.0.2
remote:
ip link set tun1 up
ip addr add 169.254.0.2/32 peer 169.254.0.1 dev tun1
arp -sD 169.254.0.2 eth1 pub
### Change default gateway. In this case, 192.168.0.1 is Machine B's current default gateway; it is the gateway on Network B that provides internet connectivity
ip route add 1.2.3.4/32 via 192.168.0.1
ip route replace default via 10.0.0.1

==Limit ssh access with pam_access==
/etc/security/access.conf

==Proxycommand without nc==
Host server1
Hostname 10.0.1.1
ProxyCommand ssh -q -x jumphost -W %h:22

==ssh over ipv6 via 2 network interface.==
ssh -6 fe80::1ec1:deff:fecb:6ce%2

==ssh options==
None interactive. Dont ask for password.
-o BatchMode=yes
Accept all keys.
-o StrictHostKeyChecking=no

==ssh via proxy/squid==
ssh -o 'ProxyCommand nc --proxy proxy.inter.net:3128 --proxy-type http %h %p' host.inter.net hostname
ssh -o 'ProxyCommand nc -X connect -x proxy.inter.net:3128 %h %p' host.inter.net hostname

==brow.sh==
browser in terminal window.
ssh brow.sh

==jail==
/etc/sshd/sshd_config
Match group mychroot
ChrootDirectory /jail/
X11Forwarding no
AllowTcpForwarding no

==sshd debug==
Start deamon once in debug mode and put output to your console.
/etc/sysconfig/sshd
OPTIONS="-ddd"
Kill of sshd which is listening for new connections. Start sshd with the following command. Debug level can bee changed.
/usr/sbin/sshd -De -o LogLevel=DEBUG3

==ssh multiple jumps one cli==
Jump through host1.net to get to host2.net
ssh -t host1.net ssh -t host2
Jump through host1.net to host2.net and bring port 8080 with you.
ssh -t host1.net -L 8080:localhost:8080 ssh -t host2.net -L 8080:localhost:8080

==ssh force password login==
ssh -o StrictHostKeyChecking=no -o ControlPath=none -o ControlMaster=no -o PubkeyAuthentication=no user@host

==ssh via jumphost==
ssh -J core@1.1.1.1 core@2.2.2.2

==socks==
# Setup socks server exiting on remote host
ssh -D '*:3128' halfface.se
# Use socks setup above.
curl --socks5 localhost:3128 https://ifconfig.me

==Create public key from private==
ssh-keygen -y -f <private_key_with_return_at_end>

=sshfs mount filesystem over ssh=
sshfs name@server:/path/to/folder /path/to/mount/point
=sshpass=
ssh with password provided on the command line.
sshpass -p P@ssW0rd ssh -t -o ControlPath=none -o PreferredAuthentications=password -o PubkeyAuthentication=no -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o LogLevel=Error user@localhost hostname
=specify key=
ssh -o "IdentitiesOnly=yes" -i <private key>

=sshuttle=
create a network route over ssh.
sshuttle -D -r user@remotehost:2222 192.168.1.0/24

=stat=
View file permissions only.
stat -c "%a %n" /usr/bin/bash
Access - the last time the file was read
Modify - the last time the file was modified (content has been modified)
Change - the last time meta data of the file was changed (e.g. permissions)
Copy permissions from one location to another.
rpm -qlp package.rpm | while read FILE ; do echo chmod $(stat -c "%a" $FILE) \"$FILE\";done > /tmp/copy_permissions.sh

=strace=
==File open activity.==
strace -e open -f ls -la /temp/
==File open activity under directory.==
strace -e open -P /temp/ -f ls -la /temp/
==More file activity.==
strace -e trace=file -p 1234
strace -e trace=desc -p 1234
==Trace network activity.==
sudo strace -f -e trace=network -p 1476
# 1024 long strings.
sudo strace -s 1024 -f -e trace=network -p 1476
# strace follow process with matching regex.
strace -f -e poll,select,connect,recvfrom,sendto -p $(pgrep -f login-sync.xml)
# trace nework activity
strace -f -e trace=network -s 1000000 nc localhost 3333

==Memory usage==
sudo strace -f -e trace=memory -p $(pgrep -f firefox)
==What is taking time==
[root@util01 abjorklund]# strace -f -c -p 9657
% time seconds usecs/call calls errors syscall
------ ----------- ----------- --------- --------- ----------------
88.11 11.614155 1644 7065 1565 futex
9.94 1.310794 16183 81 73 restart_syscall
1.86 0.245018 86 2850 recvfrom
0.05 0.006784 30 228 poll
0.03 0.004006 2 1838 sendto
0.00 0.000271 1 253 sched_yield
0.00 0.000134 12 11 mmap
0.00 0.000107 0 5176 ioctl
0.00 0.000026 0 148 148 stat
0.00 0.000000 0 1 read
0.00 0.000000 0 254 write
0.00 0.000000 0 44 mprotect
0.00 0.000000 0 1 rt_sigreturn
------ ----------- ----------- --------- --------- ----------------
100.00 13.181295 17950 1786 total

==strace multiple processes==
export PIDSEARCH=3366006 ; sudo strace -s 1024 -f $(echo $PIDSEARCH $(pgrep -P $PIDSEARCH) | sed 's/$[0-9]*$/-p \1/g' )

==strace to hex output. Convert to utf8.==
strace -xx -f -o/tmp/strace -s0 echo bajskorv
cat /tmp/strace | while read -r line; do printf "%b\n" "$line" ; done

=stty=
List settings
stty -a
speed 38400 baud; rows 50; columns 200; line = 0;
intr = ^C; quit = ^\; erase = ^?; kill = ^U; eof = ^D; eol = <undef>; eol2 = <undef>; swtch = <undef>; start = ^Q; stop = ^S; susp = ^Z; rprnt = ^R; werase = ^W; lnext = ^V; discard = ^O; min = 1; time = 0;
-parenb -parodd -cmspar cs8 -hupcl -cstopb cread -clocal -crtscts
-ignbrk -brkint -ignpar -parmrk -inpck -istrip -inlcr -igncr icrnl ixon -ixoff -iuclc -ixany -imaxbel -iutf8
opost -olcuc -ocrnl onlcr -onocr -onlret -ofill -ofdel nl0 cr0 tab0 bs0 vt0 ff0
isig icanon iexten echo echoe echok -echonl -noflsh -xcase -tostop -echoprt echoctl echoke -flusho -extproc
Set terminal properties.
stty rows 50 cols 200

=sudo=
Enable sudo logging
sed -i "$(( $(grep -n ^Defaults /etc/sudoers | tail -1 | awk -F: '{print $1}') + 1 ))iDefaults log_output\nDefaults log_input" /etc/sudoers
Command above adds the following to /etc/sudoers
Defaults log_output
Defaults log_input
List sudo-io logs.
sudoreplay -l
Search for string in logs.
zgrep search_string $(find /var/log/sudo-io/ -type f)
Replay session. Max wait 1s. 5 times the speed.
sudoreplay -m1 -s5 000002
Replay session including stdin
sudo sudoreplay -m1 -s5 -f stdin,stdout,stderr,ttyin,ttyout 000001
Which rules apply to user
sudo -l -U username
==Add user to sudoers.d so you do not need to add password for that user.==
SUDO_USER=<user> ; echo -e "# Adding $SUDO_USER user to sudo users.\n$SUDO_USER ALL=(ALL) NOPASSWD:ALL" > /etc/sudoers.d/90-${SUDO_USER//./_} ; chmod 440 /etc/sudoers.d/90-${SUDO_USER//./_}

=swapon/swapof=
Free swap
(swapoff -a; swapon -a) & watch free -m

=sysbench=
cpu test.
sysbench cpu --cpu-max-prime=20000 --threads=32 run | grep "events per second"
ram test
sysbench memory --threads=32 run | grep sec
disk test
RAM_TWO=$(( $(grep MemTotal /proc/meminfo | awk '{print $2}') * 2 ))kb
sysbench fileio --file-total-size=${RAM_TWO} prepare > /dev/null
sysbench fileio --file-total-size=${RAM_TWO} --file-test-mode=rndrw --time=300 --max-requests=0 run|grep -E ' read, | written, '
sysbench fileio --file-total-size=${RAM_TWO} cleanup > /dev/null

=sysctl=
Rename machine.
sysctl kernel.hostname=ipmonxx.${CLIENT}.ip-soft.net
Set tcp keepalive
$ sysctl -a | grep tcp_keepalive
net.ipv4.tcp_keepalive_time = 1800
net.ipv4.tcp_keepalive_probes = 9
net.ipv4.tcp_keepalive_intvl = 75
sudo sysctl -w net.ipv4.tcp_keepalive_time=60 net.ipv4.tcp_keepalive_probes=3 net.ipv4.tcp_keepalive_intvl=10
net.ipv4.tcp_keepalive_time = 60
net.ipv4.tcp_keepalive_probes = 3
net.ipv4.tcp_keepalive_intvl = 10
Reload config files
sysctl --system

=systemctl=
==init 3==
systemctl isolate runlevel3.target
systemctl isolate multi-user.target
systemctl set-default multi-user.target

==init 5==
systemctl isolate runlevel5.target
systemctl isolate graphical.target
systemctl set-default graphical.target

==When you have made changes to /etc/systemd/system/*.service==
systemctl daemon-reload

==List all units==
systemctl list-unit-files
==List units with problems==
systemctl list-units --failed
==create service==
cd /etc/systemd/system ; vim $service.service ; systemctl daemon-reload
[Unit]
Description=Set laptop brightness
After=multi-user.target

[Service]
Type=forking
ExecStart=/bin/sh -c 'echo 1000 > /sys/class/backlight/intel_backlight/brightness'
LimitNOFILE=65535
LimitNPROC=65535

[Install]
WantedBy=default.target

==Add groups to processes started by services script==
[Service]
SupplementaryGroups=33 518
==takes a long time to login==
systemctl daemon-reexec
systemctl restart systemd-logind

=strace process started by systemctl=
strace -f -o /tmp/strace.log -s 2048 -p 1 & systemctl restart httpd.service
=systemctl show puma=
Show variables of service
systemctl show puma

=systemd-analyze=
What takes time at startup.
systemd-analyze plot > /tmp/systemd-analyze-plot.svg ; chrome /tmp/systemd-analyze-plot.svg
=systemd-resolved=
resolvectl status
clear cache.
sudo systemd-resolve --flush-caches
Look at stats.
systemd-resolve --statistics
==restart daemon to apply settings==
systemctl daemon-reload
systemctl restart systemd-networkd
systemctl restart systemd-resolved
=systemctl show=
will show all available properties
systemctl show $service

=tail=
Tail from line number 21.
tail -n +21 /file
=talk=
Talks swedish.
espeak -v swedish -f /tmp/file

=tar=
Make a backup of a directory or disk.
server: tar -cpsf - $dir | pv -b | nc -l 3333
client: nc server 3333 | pv -b | tar -xpst -
Inline tar archive.
awk '/^__ARCHIVE_FOLLOWS__/ { print NR + 1; exit 0; }' $0
tail -n $0 > archive.tar # tail -n +347 Filename
Backup dir but exclude files within
tar zcf /tmp/backup_$(date '+%Y-%m-%d_%H-%M-%S').tar.gz /apps/app --exclude=/apps/app/var/* --exclude=/apps/app/logs/*
extract files remove 5 path element components.
tar xf archive.tar --strip-components 5
extract to other directory.
tar -xzf bar.tar.gz -C foo
extract files excluding path.
tar xf $file.tar.gz --transform='s/.*\///'

=tcpdump=
dump trafic information, -e Print the link-level header on each dump line, -vvv verbose.
tcpdump -e -vvv port 21
dump all trafic to and from machine. -w write to file, -s0 size of package, host to listen from.
time tcpdump -w ssl_dump -s0 host test.x30.webservices.itsfogo.com
dump all trafic into files of max 100MB. 270MB in reality.
tcpdump -w snoop -s0 -C 100000000
dump all trafic. compress logfiles. Create 10 files which are 10 MB big. Dont convert numbers to names. Dont truncate frames create logfile with this name.
tcpdump -z gzip -i wlan0 -C 10 -W 10 -n -s0 -w /tmp/tcpdump.log
Which machines send a syn packet.
sudo tcpdump -nn -i eth0 'tcp[13] = 2'
Show information about all traffic on interface.
tcpdump -s0 -i eth1 -vv
Show information about communication over port 514
tcpdump -Xni any port 514
listen on port 1023 for incoming trafic. disable local subnets.
sudo tcpdump -n -i eth0 tcp and dst host 172.17.17.6 and not src net 172.17.17.0/24 and not src net 158.0.0.0/8 and 'port 1023'
listen after torrent traffic.
sudo tcpdump -Xni any portrange 6882-6999
View content of http trafic
sudo tcpdump -i any -A -s 1500 dst 89.253.75.84 and port 80
View post in utf-8 format.
<pre>
sudo tcpdump -lnp -i any -A -s 1500 dst 89.253.75.84 and port 80 -w - | tr -t '[^[:print:]]' ''
</pre>
Get cookie
tcpdump -i lo -A -l dst port 8000 | grep "^Cookie: "
To create cookie for curl: https://xiix.wordpress.com/2006/03/23/mozillafirefox-cookie-format/
Look at traffic from specific ip
tcpdump -n -i any -n host 198.18.130.9
Eavesdrop password
tcpdump -i any -A -s0 port 8030 | grep Authorization:
==flags==
tcpdump -enni eth0 host 172.30.142.11 port 5432
F - FIN
S - SYN
R - RST
P - PSH
U - URG
E - ECN Echo
W - ECN Cwnd Reduced
. - ACK only
==get ftp username/password==
sudo tcpdump -n -vvv -i any -A -f "port 21" | grep -i "user\|pass"

=tcptraceroute=
tcptraceroute -n -q 1 192.168.0.1 -p 22
=teamdctl=
teamdctl team0 state view -v
=tee=
Feed tee with an unbuffered stream.
sar -n DEV 2 | stdbuf -oL grep wlp0s20f3 | tee /temp/sar_-n_wlp0s20f3.$(date)

=telnet=
Look at world map. a - z zoom.
telnet mapscii.me
=testssl=
test ssl certificate
testssl www.halfface.se

=tftp=
# Download test.file
tftp -v 172.17.17.6 -c get test.file
# Upload file.
tftp -v 172.17.17.6 -c put /tmp/test.put test.put
# Enable upload file in in.tftpd
/etc/xinetd.d/tftp
server_args = -c -s /var/lib/tftpboot
=tibco=
show permissions.
help permissions
Create user
create user surveillance "Surveillance user" password=surveillance
Grant user permission to view all
grant admin user=surveillance view-all
=tif=
cli image viewer.
tif $IMAGE.jpg

=time=
Time in a loop.
{ time sleep 2 >> ${LOG} ; } 2>> ${LOG}
How long did a command take
TIME=$( { /usr/bin/time -f "%e" sleep 1.5 ;} 2>&1 ) ; echo $TIME
Built in time command. 3 decimals in seconds.
TIMEFORMAT='%3R'; time ( sleep 61.22222 )
=timedatectl=
Show info how clock is synced.
timedatectl timesync-status
Which time zones exist
timedatectl list-timezones | cat -v | grep -i stockholm
Set timezone.
timedatectl set-timezone "Europe/Stockholm"
Show ntp servers
timedatectl show-timesync --all
Sync clock
timedatectl set-ntp true
Enable clock sync.
systemctl enable systemd-timesyncd --now

=timeout=
limit waiting for a period.
timeout 2s sleep 100
Run function under timeout
export -f my_function ; timeout 1 bash -c 'my_function options'
Run loop for some time then exit.
timeout 172800 bash -c -- 'while true ; do echo $(TZ=UTC date "+%Y-%m-%d %H:%M:%S %Z") $(ping -w1 -q -c1 -i10 192.168.10.120 | grep received) ; sleep 1 ; done| tee /tmp/ping_192.168.10.120.log'

=tnef=
List content of winmail.dat. Remove options to extract to current dir.
tnef -t -f winmail.dat
=toilet=
Generate graphics text similar to banner.
toilet -F gay -f mono12 "Some Funky Text"
=tor=
Select outgoing country. https://en.wikipedia.org/wiki/ISO_3166-1_alpha-2
Set country in:
torrc
One or several exit countries.
ExitNodes {us}
ExitNodes {kr},{ru},{sy},{cn}
test exit node
ifconfig.me
=toolbox=
toolbox create --distro rhel --release 9.5
==running rocky==
podman pull docker.io/rockylinux/rocky-toolbox:9
toolbox create --image docker.io/rockylinux/rocky-toolbox:9

=top(the command)=
Top batch mode run one iteration
top -bn1
Sort by memory usage
for i in {1..10};do date; top -c -b -o +%MEM | head -n 17|tail -11;sleep 5;done
Top used in openshift.
top -bcn1 -w512 | less -ISRM

=top derivates=
apachetop
dnstop
iftop
latencytop
glances

=touch=
touch -am 0910120003 Give a new access time on a file 0910120003MMDDhhmmyy
linux
touch -t 197102162324 *

=tput=
No line wraps
tput rmam
Line wraps
tput smam
invisible cursor
tput civis
visible cursor
tput cnorm
reset is a good command to reset shell
reset

=tr=
translate capital to lower letter.
tr '[:upper:]' '[:lower:]'
null character to new line
tr '\000' '\n' < /proc/3575/environ
Remove unprintable characters.
<pre>
tr -dc '[[:print:]]'
</pre>

=trickle=
Speed limit for download
rsync -ae "trickle -d 80 ssh" user@host:/src/ /dst/
Speed limit for upload.
rsync -ae "trickle -u 80 ssh" user@host:/src/ /dst/
Limit wget to 64kbit upload and download.
trickle -d 64 -u 64 wget "https://www.halfface.se/file.txt"
=ts=
timestamp
ls -la | ts '%F %H:%M:%S'

=tune2fs(tunefs)=
tune2fs -m 0 /dev/sdb1

=type=
What kind of command do we use. builtin or some file?
type ls

=udevadm=
Monitor udev events.
udevadm monitor
udevadm info --query=all --name=sda
look at values for disk. Can be used to locate san source.

=udr=
rsync over udp.
udr -a 57621 -b 57631 rsync -rP host.inter.net:/source/ /destination/
=ulimt=
Look at current limits for logged in user.
ulimit -a
Look at limits for process with pid 12345.
cat /proc/12345/limits
=unalias=
Unalias all aliases
unalias -a
=unhide=
Find hidden ports.
unhide -v proc

=unetbootin=
Boot iso image from usb memory.
=update-crypto-policies=
Change crypt policies so that I am able to start openvpn connection.
sudo update-crypto-policies --set DEFAULT:SHA1

=upower=
# Powerstatus of the system. battery charge.
upower --dump
=uptime=
Uptime in seconds.
awk -F . '{print $1}' /proc/uptime

=urldecode/urlencode=
Encode
perl -pe's/([^-_.~A-Za-z0-9])/sprintf("%%%02X", ord($1))/seg'
jq -sRr @uri
Decode
perl -pe 's/%([0-9a-f]{2})/sprintf("%s", pack("H2",$1))/eig'
jq -r @uri

=useradd=
useradd --uid 666 --gid 666 --comment 'devil' devil && echo 'devil:VerySecretPassword' | chpasswd

=v4l2=
Video player
qv4l2
List available formatats and resolutions.
v4l2-ctl --list-formats-ext
List available formats
v4l2-ctl --list-formats
Set camera to h264
v4l2-ctl --set-fmt-video=width=800,height=448,pixelformat=1
Set framerate.
v4l2-ctl --set-parm=30
List video parameters
v4l2-ctl --get-fmt-video
List video output
v4l2-ctl --all
Disable autofocus
v4l2-ctl --verbose --set-ctrl=focus_auto=0
v4l2-ctl --verbose --set-ctrl=focus_absolute=0
=version of linux=
cat /etc/os-release

=vi=
:set ignorecase
:set list show all keys.
:set nolist show their representative.
=wipefs=
Wipe removes information about file system without removing actual data.
wipefs -a /dev/sdc

=vmstat=
top over time.
vmstat -n 5
Description:
r=procs waiting for cpu time.
b=procs in sleep mode.
swpd=virtual memory in use in swap.
free=memory free.
buff=memory used by buffers
cache=memory used as cache.
si=swap in.
so=swap out.
bi=io block in.
bo=io block out.
in=interups
cs=contex switching.
us=cpu user space
sy=cpu system usage to serve.
id=cpu idle
wa=cpu waiting for input output. iowait.
st=cpu time stolen from a virtual machine

procs -----------memory---------- ---swap-- -----io---- --system-- -----cpu-----
r b swpd free buff cache si so bi bo in cs us sy id wa st
2 1 814984 167992 26820 999460 0 0 1 0 2467 5088 2 2 95 1 0
0 0 814984 168100 26820 999540 0 0 2 150 2467 5026 1 2 97 0 0
=w3m(elinks)=
curl -s https://google.com | w3m -T text/html -dump

=wget=
wget -r -nH -np --cut-dirs=1 --no-check-certificate -U Mozilla --user={uname} --password={pwd} https://my-host/my-webdav-dir/my-dir-in-webdav
wget to standard output.
wget --no-check-certificate -S -O- http://inter.net
Special heather
wget 'http://halfface.se' --header='Cookie: has_js=1'
Mirror
wget 'https://halfface.se/test' -r -l 3 --convert-links -o log --html-extension

=whois=
# When does a domain expire.
whois -h whois.iana.org sivberg.se
# which ipranges does an ipaddress belong too. In this case looking at google.
whois -h whois.radb.net -- "-i origin $(whois -s -h whois.radb.net 172.217.26.68 | grep ^origin | awk '{print $2}' | tail -1)" | grep ^route | awk '{print $2}'
# Who to find address range for site.
host www.facebook.com
whois 157.240.194.35 | grep CIDR

=wireshark=
find packet
packet details
string
==ssl decryption==
export SSLKEYLOGFILE=/tmp/sslkeylog ; curl -sv -d "blablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablabla" https://www.halfface.se
wireshark. Edit - Preferences - Protocols - TLS - (Pre) -master-Secret log file.
==tshark==
cli version
tshark -V -r $dump.pcap
=wlr-randr=
Change dpi in wayland.
wlr-randr --output eDP-1 --scale 2
Change resolution
wlr-randr --output DP-1 --mode 1920x1080

=wodim=
Burning disks.
wodim -scanbus # Scan scsi bus for burners.
wodim --devices # Discover basic information.
wodim -checkdrive # Information about burner.
wodim -tao speed=0 dev=/dev/sr0 -v -data /temp/files/ # Burn disk containing structure from /temp/files/
wodim -eject -tao speed=0 dev=/dev/scd0 -v -data /my/directory/image.iso # Burn image to disc.
=write=
Send message to someone via tty.
who | grep user
write message end with CTRL + d
write abjorklund pts/2

=xargs=
locate case insensetive, regular expression. xargs string to replace imput. Print output to standard error.
locate -ir ".*\.crt$" | xargs -I '{}' -t cp {} /temp/ssl/
Do something on everything from standard input.
ls -la | xargs -i% echo '# beginning #' % '# end of line #'
split several lines into groups.
for i in {00..99} ; do echo $i, ; done | xargs -L 20

=xdotool=
When you have to move your mouse but you dont want to push it.
xdotool mousemove_relative -- -1 -1
xdotool mousemove_relative 1 1
Send ab to window.
xdotool search --onlyvisible --name freerdp key a key b
=xfs=
xfs_repair -L /dev/mapper/vg00-root

=xinput=
# List xinputs.
xinput list
# List properties.
xinput list-props "Logitech Unifying Device. Wireless PID:400e"
# Middle button emulation.
xinput set-prop "Logitech Unifying Device. Wireless PID:400e" "Evdev Middle Button Emulation" 1
xinput set-prop 12 "libinput Middle Emulation Enabled" 1
=xkill=
Kill xorg process with id 0xb6ffa0
xkill -id 0xb6ffa0
List x applictions
xwininfo
Get recursive list of x applications.
xwininfo -root -tree

=xmllint=
prettify xml
xmllint --format -

=xset=
Disable screen saver
xset -dpms ; xset s noblank ;xset s off
Disable repeat
xset r off
Enable repeat
xset r on

=xxd=
Hex to binary
xxd -r -p hex.txt output.bin
Hex to binary in pipe
echo "$HEX" | xxd -r -p -
=yum=
download src rpm
yumdownloader --source net-snmp
Reinstall default repos.
yum reinstall yum-conf-sl6x-1-2
This will give you a directory with all rpm:s that are required to install rpm.
PKG=openssh-server ; yum install --downloadonly --installroot=/tmp/$PKG-installroot --releasever=6 --downloaddir=/tmp/$PKG $PKG
==broken repos==
yum install bareos-client --disablerepo=* --enablerepo=bareos
==search for different versions==
yum --showduplicates search percona-xtrabackup
==Add repos to centos 6==
curl https://www.getpagespeed.com/files/centos6-eol.repo --output /etc/yum.repos.d/CentOS-Base.repo
curl https://www.getpagespeed.com/files/centos6-epel-eol.repo --output /etc/yum.repos.d/epel.repo
==fix yum in Centos 7, 8==
<pre>
sed -i 's%^enabled=.%enabled=0%' /etc/yum/pluginconf.d/subscription-manager.conf
sed -i 's/^mirrorlist/#mirrorlist/g' /etc/yum.repos.d/*
sed -i 's%^#baseurl=http://mirror.centos.org%baseurl=http://vault.centos.org%g' /etc/yum.repos.d/*
</pre>

==Get variables to test /etc/yum-repos.d/<file>.conf files==
export releasever=$(lsb_release -r | awk '{print $NF}' | awk -F . '{print $1}')
export basearch=$(uname -m)

=zip=
Zip directory exclude files .svn directory.
zip -r /temp/ssl.zip . -x ".svn/*"
List contents of zip archive.
unzip -l archive.zip
Unzip single file
unzip file.zip file/you/want/to/extract/the_file.txt
unzip excluding path.
unzip -j file.zip

=zdump=
View information from timezone tz.
zdump -v /etc/localtime
Change timezone on host
ln -sfT ../usr/share/zoneinfo/Europe/Stockholm localtime

=zfs=
==Get sync==
zfs get sync datapool/netstorage/dog/prod
NAME PROPERTY VALUE SOURCE
datapool/netstorage/dog/prod sync standard default
==set sync==
zfs set sync=disabled datapool/netstorage/dog/prod
==List snapshots(can take time)==
zfs list -t snapshot
==List snapshots for one mount point.==
zfs list -r -t snapshot -o name,creation datapool/netstorage/bro/prod
==Displays the detailed health status==
zpool status
==List datasets==
zfs list
==Create dataset==
zfs create datapool/netstorage/media
==zdb==
display zpool debugging and consistency information
zdb -d dataset
==zpool list==
Lists the given pools along with a health status and space usage.
==iostat==
Get iostat with values since last second.
zpool iostat are -y 1 -l

[[Category:Applications]]
[[Category:Unix]]
[[Category:Commands]]

Icinga2

2026-04-09T13:27:10Z

Ekaanbj: /* list historic events */

Openstack

2026-04-09T10:53:39Z

Ekaanbj: /* manage loadbalancer aurora/haproxy */

Openshift

2026-04-02T11:56:08Z

Ekaanbj: /* list operatorhub/catalogsources */

=What does it mean?=
acme Automated Certificate Management Environment
annotations Key=value pairs. That provides metadata for object.
atomic Operation or process is indivisible, meaning it is performed as a single, uninterruptible unit, it either completes successfully in its entirety, or it has no effect at all — there is no partial execution or intermediate state.
ceph Delivers object, block, and file storage in one unified system.
ceph-osd object storage daemon for the Ceph distributed file system. It is responsible for storing objects on a local file system and providing access to them over the network.
clbo CrashLoopBackOff
clo Cluster Logging Operator
cmo Cluster Monitoring Operator
cncf Cloud Native Computing Foundation
cni Container Network Interface (OVNKubernetes OpenShiftSDN)
cns Cloud Native Storage
cnv Container-native Virtualization, add-on to OpenShift Container Platform that allows virtual machine workloads to run and be managed alongside container workloads.
co Cluster Operator
ControllerRevision API object used primarily by controllers that manage versioned, declarative resources such as StatefulSets and DaemonSets. It stores a snapshot of the configuration.
cpi Cloud Provider Interface
cr Custom Resource. (I found it like something added by enabling something. You get it from "oc api-resources")
crd Custom Resource Definition. The name of a CRD object must be a valid DNS subdomain name.
cri Container Runtime Interface
cri-o Lightweight container runtime for kubernetes.
csi Container Storage Interface
csm Container Storage Modules
csv cluster service version. OLM manifest that defines version of an Operator and its metadata, deployment requirements, and permissions.
cvo Cluster Version Operator
cvss Common Vulnerability Scoring System
daemonset Ensures that all (or some) Nodes run a copy of a Pod
deployment You describe a desired state in a Deployment. Deployment object describes how to create or modify pods that hold a containerized application by defining the desired state of a particular component. Deployments create and manage how ReplicaSets are deployed.
eo ElasticSearch Operator
ephemeral Short lived, temporary
eus Extended Update Support
evict remove, preempt.
Fluentd data collector designed to handle logging by unifying and processing data from various sources.
fluent bit lightweight and high-performance data collector. logs but can handle metrics too.
fsgroup Group which Kubernetes will change the permissions of all files in volumes to when volumes are mounted by a pod.
geneve Generic Network Virtualization Encapsulation OVN-Kubernetes uses Geneve.
grcp Google Remote Procedure Call, framework that brings performance benefits and modern features to client-server applications. Like RPC
hpa Horizontal Pod Autoscaler, automatically scales the number of pods in a deployment, stateful set, or replica set based on CPU, memory, or custom metrics.
icsp ImageContentSourcePolicy. Blocking a payload registry.
idp identity provider
idps identity providers
implicit indirect, hinted,
ingressclass use multiple ingress controllers managing network traffic routing within a cluster.
ipc namespace Each IPC namespace has its own set of System V IPC identifiers and its own POSIX message queue filesystem. .
ipi Installer-Provisioned Infrastructure
kcs Knowledge Centered Support, Red Hat's way of offering solutions and articles for known questions or problems.
kubelet Kubelet is the primary "node agent" that runs on each node. Takes a set of PodSpecs (primarily through the apiserver) and ensures the containers described are running and healthy.
kvdb key-value store (portworx)
machineset Managing a set of machines with similar characteristics, manage a group of machines. Desired number of machines.
manifest Manifest is a YAML or JSON file that describes the desired state of a Kubernetes object.
mco machine-config-operator
mcp machine config pools
Metricbeat leightweight shipper for metrics
noobaa data service for cloud environments, providing S3 object-store interface with flexible tiering, mirroring, and spread placement policies, over any storage resource that allows GET/PUT including S3,GCS..
nsfs virtual filesystem making Linux-kernel namespaces available.
oadp openshift api data protection
oci Open Container Initiative
ocm OpenShift Cluster Manager
ocp OpenShift Container Platform
ocs OpenShift Container Storage
odf OpenShift Data Foundation
oidc OpenID Connect, is an identity layer on top of the OAuth 2.0 protocol.
olm Operator Lifecycle Manager
osm Open Service Mesh. Lightweight, extensible, cloud native service mesh
ovnk Open Virtual Network Kubernetes
pdb Pod Disruption Budget. poddisruptionbudgets
pvc Persistent volume claim. binding between a Pod and Persistent Volume.
pv Persistent volume. Persistent storage. low level representation of a storage volume.
preempt higher priority pod cannot be scheduled due to insufficient resources, preempt (evict) one or more lower-priority pods to free up resources for higher-priority pod
prometheus Prometheus is a time-series database (TSDB). handle the collection, storage, and querying of time-series data. Alerting
provisioner A StorageClass object contains a provisioner that decides which volume plugin is used to provision PersistentVolumes.
quay.io builds, analyzes, distributes your container images. Owned by IBM
ReadWriteMany Storage read/write for many.
Reconciliation Mechanism that ensures the cluster behaves as intended by comparing the current state of resources with the desired state specified in your manifests or custom resources.
register Container registry is a storage and distribution system for container images. In Kubernetes, container images are the building blocks for deploying applications. A registry is used to store, manage, and distribute these images.
registrar The node-driver-registrar is a sidecar container that registers the CSI driver with Kubelet using the kubelet plugin registration mechanism.
replicaset Maintain a stable set of replica Pods running at any given time
rhacm Red Hat Advanced Cluster Management for Kubernetes
rhcos Red Hat Enterprise Linux CoreOS
rhcp Red Hat Ceph Storage
rhcs Red Hat Cluster Suite
rhocp Red Hat OpenShift Container Platform
rhol Red Hat OpenShift Logging
rook Operator. File, block, and object storage for your cloud native environment and is based on battle tested ceph storage.
rosa Red Hat OpenShift Service on AWS
runc run container. Container runtime that implements the OCI runtime specification.
s2i source-to-image
sa Service Account
scc security context constraints
sc security context
seccomp Secure computing mode profiles can be associated with a container to restrict available system calls.
SelfLink URL representing the given object.
service Logical abstraction for a deployed group of pods in a cluster (which all perform the same function).
skopeo Command line utility used to interact with local and remote container images and container image registries
StatefulSet Workload object to manage stateful applications. Deployment and scaling Pods, ordering and uniqueness of Pods.
Storage Class allows for dynamic provisioning of Persistent Volumes.
svc service
taint Taints ensure that pods are scheduled onto appropriate nodes. You can apply one or more taints on a node.
tekton Container-native way to manage CI/CD. It's also the basis for OpenShift Pipelines.
thanos Long-Term storage for your Prometheus Metrics on OpenShift
toleration You can apply tolerations to pods. Tolerations allow the scheduler to schedule pods with matching taints.
ubi Universal Base Images OCI-compliant container base operating system images with complementary runtime languages and packages that are freely redistributable.
upi User-Provisioned Infrastructure
uts Unix Timesharing System namespace. Controls the hostname and the NIS domain.
uWSGI Project aims at developing a full stack for building hosting services.
vxlan virtual extensible LAN, The OpenShift SDN uses OpenvSwitch tunnels, OpenFlow rules, and iptables.
wwn world wide names. Fiber channel

=where do I start=
. <(oc completion bash) Get bash completion running.
oc help Get commands
oc api-resources What can you use commands on.
oc options Which options apply to all commands

=read=
https://kubernetes.io/docs/concepts/overview/working-with-objects/kubernetes-objects/
=Projects that I have read about but forgotten=
OpenEBS Storage solution. Possible backends. local, nfs, zfs, nvme. CStor to serve iSCSI block storage using the underlying disks or cloud volumes in a cloud native way

=files of value=
metadata.json File created during install. Used by openshift-install destroy cluster

=oc get=
Available resources to ask about.
oc api-resources
Get everything
oc api-resources -o name --no-headers | while read i ; do echo '***' $i ; oc get $i -A -o yaml 2>&1 ; done > /tmp/oc_api-resourece.$(oc whoami --show-server | awk -F ':|/' '{print $4}').$(date +%F_%H-%M-%S)

=login=
oc login --username developerhttps://openshift:6443
=switch user=
oc login --username developer
=which clusters have you logged into=
oc config get-clusters

=List projects=
oc projects
oc get projects

=select project=
oc project $project
kubectl config set-context --current --namespace=kube-public

=create project/namespace=
oc create namespace redis

=list pods=
oc get pods
oc get pods --all-namespaces
oc get pods -o wide
wide will give you on which node pod is running.
oc get pods -o wide --all-namespaces
Get pods that are not runing.
oc get pods --field-selector status.phase!=Running --all-namespaces
oc get pods -A --no-headers | grep -v Completed | while read LINE ; do PODS=$(awk '{print $3}' <<< "${LINE}") ; if [ "${PODS%%/*}" != "${PODS##*/}" ] ; then echo "${LINE}" ; fi ; done
Get pods matching two states
oc get pods --field-selector=status.phase!=Running,spec.restartPolicy=Always
oc get nodes --no-headers --selector='node-role.kubernetes.io/worker,!node-role.kubernetes.io/infra'
Get pods running on specific node
oc get pods -A -o wide --field-selector spec.nodeName=<node>
Get pods with label name=portworx-proxy
oc get pods -A -l name=portworx-proxy
Get pods with several labels
oc get pod -l 'app in (rook-ceph-mon,rook-ceph-operator,rook-ceph-osd,rook-ceph-rgw,rook-ceph-mgr,rook-ceph-mds,rook-ceph-crashcollector)'
Get pods with extra column port.
kubectl get pods --output=custom-columns=NAME:.metadata.name,NAMESPACE:.metadata.namespace,IP:.status.podIPs[*].ip,POD_PORT:.spec.containers[*].ports[*].containerPort
Get pods with column restarts
oc get pods -o custom-columns='NAMESPACE:.metadata.namespace,POD:.metadata.name,RESTART:.status.containerStatuses[*].restartCount' -A | sort -k3 -n | tail -10

=Endpoint=
An Endpoint is an object that represents the IP addresses and ports of the Pods that back a Service. When a Service is created, Kubernetes automatically creates an associated Endpoints object.
=EndpointSlices=
EndpointSlices offer a scalable, efficient, and feature-rich alternative to traditional Endpoints, topology.

=get shell on node=
It is possible to debug more than nodes. (deployment, build, or job)
oc debug node/infra-2.ocpdev.lkl.ltkalmar.se
Get working env
chroot /host
Connect to node in eks.
kubectl debug node/<node> -it --image=halfface/rockylinux-toolbox:v3

=get debug information from oc=
oc debug --loglevel=10 node/$node
=debug pod run as root disable health checks=
oc debug deployment/my-deployment-name --as-root

=get nodes=
oc get nodes
oc get nodes -o jsonpath='{.items[*].metadata.name}'
# Get nodes without headears. name, cpu:s, disk size, mem, ip address.
oc get nodes --no-headers --selector="node-role.kubernetes.io/worker" -o=custom-columns='NAME:.metadata.name,CPU:.status.capacity.cpu,DISK:.status.capacity.ephemeral-storage,MEM:.status.capacity.memory,IP:.status.addresses[?(@.type=="InternalIP")].address'
# Get node name and ip address.
oc get nodes --no-headers --selector="node-role.kubernetes.io/worker" -o=custom-columns='NAME:.metadata.name,IP:.status.addresses[?(@.type=="InternalIP")].address'
=ip address of node=
Outside pod.
oc get pod --template '{{.status.podIP}}' openshift-gitops-application-controller-0
Inside pod.
echo $POD_IP

=get nodes that are overcommited=
oc get nodes -o jsonpath='{range .items[*]}{@.metadata.name}:{range @.status.conditions[*]}{@.type}={@.status};{end}{end}' | sed 's/:/=node;/g' | sed 's/;/\n/g' | grep -vE 'MemoryPressure=False|DiskPressure=False|PIDPressure=False|Ready=True'
Does any node stick out.
oc get nodes --no-headers -o=custom-columns=NAME:.metadata.name,CONDITIONS:.status.conditions

=connect to pod=
oc rsh $pod bash
=list containers in pod=
oc get pod/router-default-6b76b87c6-5m7h6 -n openshift-ingress -o json | jq -r '.spec.containers[].name'
router
logs
=list all containers running in a cluster=
<pre>
kubectl get pods --all-namespaces -o jsonpath="{.items[*].spec['initContainers', 'containers'][*].image}" | tr -s '[[:space:]]' '\n' | sort | uniq -c
</pre>

=connect to container in pod=
oc rsh -c router pod/router-default-6b76b87c6-5m7h6

=get logs from all containers excluding namespace ^openshift from last 24 hours with timestamp=
oc get pods --no-headers --field-selector status.phase=Running -A -o custom-columns=NAMESPACE:.metadata.namespace,POD:.metadata.name | grep -v ^openshift | while read NAMESPACE POD ; do for CONTAINER in $(oc get pod $POD -n $NAMESPACE -o json | jq -r '.spec.containers[].name') ; do echo oc logs -n ${NAMESPACE} ${POD} -c ${CONTAINER} ; oc logs -n ${NAMESPACE} $POD -c $CONTAINER --since=24h --timestamps=true 2>&1 | grep "Error: getaddrinfo EAI_AGAIN " ; done ; done

=get all container logs(good for pods stuck in init)=
oc logs <pod> --all-containers
=tail logs for pods matching label=
oc logs -n openshift-storage -l app=csi-cephfsplugin -c driver-registrar -f --max-log-requests 8 --tail=1
oc logs -n openshift-cluster-storage-operator -l name=vsphere-problem-detector-operator --tail=-1
oc logs -f --tail=0 router-default-6c666984fd-ct8zf logs
oc logs -f --namespace openshift-gitops deployment/openshift-gitops-server

=Search for log entries locally on node=
ls -la $(ls -la $(grep -l EAI_AGAIN /var/log/containers/*) | awk '{print $NF}')
grep -rl EAI_AGAIN /var/log/pods/

=execute command in pod=
oc exec pod/router-default-545ffb97db-4h9rx -- $command
kubectl exec --stdin --tty shell-demo -- /bin/bash

=execute command on all nodes=
oc get nodes -o name | xargs -I {} oc debug {} -- chroot /host sh -c 'echo $HOSTNAME && chronyc sources'

=execute command in all containers=
oc get pods --no-headers -o 'custom-columns=:.metadata.namespace,:.metadata.name' -A | while read NAMESPACE POD ; do
for CONTAINER in $(oc get -n $NAMESPACE pod/$POD -o json | jq -r '.spec.containers[].name') ; do
echo '***' $NAMESPACE $POD $CONTAINER
echo $(oc exec -c $CONTAINER -n $NAMESPACE $POD -- curl -m1 -skv https://inter.net 2>&1 | tr -d '\n')
done
done | tee /tmp/$(oc whoami --show-server | awk -F ':|/' '{print $4}').$(date +%F_%H-%M-%S)

=where am i=
POD_NAME=rook-ceph-operator-6c86f788d5-f8mqf
POD_NAMESPACE=openshift-storage

=describe pods=
oc describe pods
oc describe pod stage-sales-62-qjd

=To get (almost) all object with a specific label from the current project, execute:=
oc get all -l '<label_name>=<label_value>'
oc get pods -n openshift-storage -o name -l app=rook-ceph-operator

=get config from pod in yaml format=
oc get pods router-default-545ffb97db-kgsdb -o yaml
=get deployments=
oc get deployments --all-namespaces

=set environment variable in pod=
oc set env dc/your-app-name COLOR=blue
=unset environment variable in pod=
oc set env dc/your-app-name COLOR-

=list environment variables=
oc set env pod/router-default-545ffb97db-lj2t5 --list

=list templates=
oc get templates -n openshift
=Custom resource definitions.(crd)=
oc get crd
=sort=
CREATED AT
oc get crd --sort-by=.metadata.creationTimestamp
=edit=
oc edit deployment.apps/router-default
Watch changes taking place.
watch -n1 oc get all
=grant permission to project=
oc adm policy add-role-to-user view developer -n mysecrets
=grant permission to group=
oc adm policy add-cluster-role-to-group cluster-admin admin
==grant a user cluster-admin permissions through group==
# create a new group.
oc adm groups new cluster-admin
# Bind cluster-admin Role to the Group
oc adm policy add-cluster-role-to-group cluster-admin cluster-admin
# Add user to group
oc adm groups add-users cluster-admin T1.anbj15

=grant unrestriced access to service account=
oc adm policy add-scc-to-user privileged system:serviceaccount:isilon:isilon-node
...
oc adm policy add-scc-to-user anyuid -z ak-authentik
oc adm policy add-scc-to-user privileged -z ak-authentik

=which pods use scc?=
oc get project -o=custom-columns='NAME:.metadata.name' --no-headers | grep -v openshift | while read NAMESPACE ; do echo '*' $NAMESPACE ; oc get pods -o=custom-columns='NAME:.metadata.name,SCC:.metadata.annotations.openshift\.io\/scc' --no-headers -n $NAMESPACE | grep restricted-v2 ; done
oc get pods --all-namespaces -o=jsonpath='{range .items[*]}{@.metadata.name}{"\t"}{@.metadata.namespace}{"\t"}{@.metadata.annotations.openshift\.io/scc}{"\n"}' | column_tab | less

=crictl=
==List running containers==
crictl ps
crictl ps --all | grep -i coredns

==List all pods==
crictl pods
==List all images==
crictl images
==Execute a command in a running container==
crictl exec -it 1f73f2d81bf98 /bin/sh
==crictl logs==
crictl logs

=nsenter=
run program in different namespaces
=which version=
Get version of various objects
oc version
Only get cluster version
oc get clusterversion
oc get clusterversion -o json|jq -r '.items[0].spec| .channel, .desiredUpdate.version'

=copy files from pod=
Copy session keys locally.
oc rsync caas-2-8s6cl:/tmp/sslkeylog .
=tcpdump from nodes=
ssh $node
toolbox
=rm toolbox=
toolbox rm --force <container>

=oc get route -A=
get routing.
=oc describe route sales -n hlt-prod=
Name: sales
Namespace: hlt-prod
Created: 13 months ago
Labels: <none>
Annotations: haproxy.router.openshift.io/balance=roundrobin
haproxy.router.openshift.io/disable_cookies=true
Requested Host: sales.prod.bobcat.hlt.se
exposed on router default (host apps.ocpprod.lkl.ltkalmar.se) 13 months ago
Path: <none>
TLS Termination: edge
Insecure Policy: <none>
Endpoint Port: port-8000-tcp

Service: sales
Weight: 100 (100%)
Endpoints: 10.160.7.166:8000, 10.160.7.167:8000, 10.160.7.168:8000 + 35 more...
=oc get pods (selecting specific pods)=
Only name without headers
oc get pods -o custom-columns=POD:.metadata.name --no-headers -A
Describe Failing pods.
oc get pods -A --field-selector=status.phase=Failed --no-headers | while read NAME_SPACE POD REST_OF_LINE ; do echo '*' $POD ${NAME_SPACE} ; oc describe pod $POD -n "${NAME_SPACE}" ; done | less -ISRM

=get pod label:s=
oc get pods --show-labels

=get subscriptions=
oc get subscriptions -A
=delete subscription=
oc delete subscription openshift-gitops-operator -n openshift-operators
=get available channels for subscription=
oc get PackageManifest $OPERATOR -o json | jq -r '.status.channels[] | .name,.currentCSV'
=update channel=
oc patch subscriptions -n $NAMESPACE $OPERATOR --type merge -p '{"spec": {"channel": "stable-4.12"}}'

=delete clusterserviceversion=
oc delete clusterserviceversion openshift-gitops-operator.v1.7.4

=whoami=
oc whoami
oc config current-context
oc whoami --show-console=true --show-context=true
Which is the console url?
oc whoami --show-console
Which is the api url?
oc whoami --show-server

=get instance url=
oc get routes -n openshift-console console

=create an htpasswd user=
kubernetes create htpasswd user
oc create user imageregistry
oc create identity htpasswd:imageregistry
oc create useridentitymapping htpasswd:imageregistry imageregistry
Create user/password to feed kubernetes with.
htpasswd -c -B -b htpasswd imageregistry P@ssW0rd
oc create secret generic htpass-secret --from-file=htpasswd=htpasswd -n openshift-config
Get htpasswd users.
oc get secret htpass-secret -ojsonpath={.data.htpasswd} -n openshift-config | base64 --decode
Enable htpasswd login.
oc edit oauth cluster
apiVersion: config.openshift.io/v1
kind: OAuth
metadata:
name: cluster
spec:
identityProviders:
- name: htpasswd
mappingMethod: claim
type: HTPasswd
htpasswd:
fileData:
name: htpass-secret
look at oauth config.
oc get oauth cluster -o yaml
Create service account.
https://docs.openshift.com/container-platform/4.13/authentication/understanding-and-creating-service-accounts.html
=get list of user=
oc config view -o jsonpath='{.users[*].name}'

=list contexts=
oc config get-contexts

=use-context=
oc config use-context openshift-marketplace/api-abjorklund-01-rbcloud-net:6443/kube:admin

=oc explain pv=
oc explain pv
=oc get configmap cluster-monitoring-config=

=put node offline=
Mark a node as unschedulable.
oc adm cordon node1
Drain a node in preparation for maintenance.
oc adm drain --force --delete-local-data --ignore-daemonsets --grace-period=30 <node>
oc adm drain --force --delete-emptydir-data --ignore-daemonsets <node>
oc adm drain --force --delete-emptydir-data --ignore-daemonsets --grace-period=1 <node>
Mark node as online.
oc adm uncordon node1
Extend memory on node.
# Add memory to master nodes.
NODE=costest-ph9l4-master-1
oc adm cordon $NODE
oc adm drain $NODE --force --delete-emptydir-data --grace-period=1 --ignore-daemonsets
timeout 10 oc debug node/$NODE -- chroot /host sh -c 'echo $HOSTNAME && sudo shutdown -P now'
govc vm.power -off /RGK/vm/costest-ph9l4/$NODE
govc vm.info /RGK/vm/costest-ph9l4/$NODE
govc vm.change -vm /RGK/vm/costest-ph9l4/$NODE -m 20480
govc vm.power -on /RGK/vm/costest-ph9l4/$NODE
oc adm uncordon $NODE
oc adm top nodes -l node-role.kubernetes.io/master

=Get pv:s=
oc get pv
Sorted by size.
oc get pv --sort-by=.spec.capacity.storage -A
Get more info about a pv.
oc describe pv $PV
=Access modes for pv:s. AccessMode=
RWO - ReadWriteOnce the volume can be mounted as read-write by a single node
ROX - ReadOnlyMany the volume can be mounted read-only by many nodes
RWX - ReadWriteMany the volume can be mounted as read-write by many nodes
RWOP - ReadWriteOncePod the volume can be mounted as read-write by a single Pod.

=get pvc:s=
oc get pvc --all-namespaces | less
sort by
oc get pvc --sort-by=.spec.resources.requests.storage -A
=list pvc by creation time=
oc get pvc --all-namespaces -o custom-columns="NAMESPACE:.metadata.namespace,NAME:.metadata.name,CREATED:.metadata.creationTimestamp"

=create pvc=
# oc create pvc
cat <<EOF | oc apply -f -
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: abjorklund-pvc1
spec:
accessModes:
- ReadWriteMany
resources:
requests:
storage: 5Gi
EOF
=use pvc. Create pod using pvc=
# Create test pod.
cat <<EOF | oc apply -f -
apiVersion: v1
kind: Pod
metadata:
name: abjorklund-test-pvc-claim1-pod
spec:
volumes:
- name: abjorklund-test-pvc
persistentVolumeClaim:
claimName: abjorklund-test-pvc
containers:
- name: abjorklund-test-pvc
image: halfface/rockylinux-toolbox:v3
volumeMounts:
- mountPath: "/mnt/abjorklund-test-pvc"
name: abjorklund-test-pvc
command: ["sleep"]
args: ["infinity"]
EOF

=extend/increase pvc=
Set new size
PVC=<pvc> ;NAMESPACE=<namespace> ; oc patch pvc ${PVC} --type=merge -p '{"spec":{"resources":{"requests":{"storage": "2Gi"}}}}' -n ${NAMESPACE}

=which pods are using pvc=
oc get pods --all-namespaces -o=json | jq -c '.items[] | {name: .metadata.name, namespace: .metadata.namespace, claimName:.spec.volumes[]? | select( has ("persistentVolumeClaim") ).persistentVolumeClaim.claimName }'
List pvc:s with the pod using them.
kubectl describe pvc -A | awk '/^Name:/ {name=$2} /^Namespace:/ {namespace=$2} /^Used By:/ {usedby=$3; print namespace "\t" name "\t" usedby}' | column -t -s $'\t'

=create storage class and create pvc=
==Install nfs csi==
helm repo add nfs-subdir-external-provisioner https://kubernetes-sigs.github.io/nfs-subdir-external-provisioner/
helm install nfs-provisioner nfs-subdir-external-provisioner/nfs-subdir-external-provisioner \
--set nfs.server=10.111.222.1 \
--set nfs.path=/storage/temp/kafka_nfs_root \
--set storageClass.name=nfs
==Make storage class default==
oc patch storageclass nfs -p '{"metadata": {"annotations":{"storageclass.kubernetes.io/is-default-class":"true"}}}'
==Create pvc using sc==
kubectl apply -f - <<EOF
apiVersion: v1
kind: PersistentVolumeClaim
metadata: {name: nfs-pvc, namespace: kafka}
spec: {accessModes: [ReadWriteOnce], resources: {requests: {storage: 1Gi}}, storageClassName: nfs}
EOF

=kubectl=
List contexts
kubectl config get-contexts
Select context
kubectl config use-context default/api-blabla-halfface-se:6443/kube:admin
=permissions=
==list groups==
oc get groups -o wide
==list cluserroles==
oc get clusterrole --all-namespaces
==list clusterrolebindings==
oc get crb
oc get clusterrolebindings

=scale=
oc scale --replicas=2 rc/postgresql-1
oc scale -n abjorklund deployment stress-hm-6x32 --replicas=0
oc scale --replicas=3 machineset <machineset> -n openshift-machine-api

=top(disable wikimedia top)=
oc adm top pods --use-protocol-buffers --all-namespaces
oc adm top pods --use-protocol-buffers --all-namespaces --sort-by=cpu | head -20| cut -c -200
oc adm top nodes --sort-by=cpu
oc adm top nodes --sort-by=memory

=get memory usage of all running pods in MB=
oc get pods -o custom-columns=POD:.metadata.name --no-headers --field-selector status.phase=Running| while read POD ; do echo $POD $(( $(oc exec -it $POD -- cat /sys/fs/cgroup/memory/memory.usage_in_bytes </dev/null 2>/dev/null) / 1024 / 1024 )) MB ; done
oc get pods -A -o wide --no-headers --field-selector spec.nodeName=ocp-04-9lxgz-worker-wlw9p --field-selector status.phase=Running | while read NAMESPACE POD NULL ; do oc project $NAMESPACE >/dev/null 2>&1 ; oc adm top pod $POD --containers --no-headers ; done | sort -k 4 -n| less
Get memory usage per pod on specific node.
NODE=ocp-01-4dfqx-worker-4n6mk ; oc get pods -A -o wide --no-headers --field-selector "spec.nodeName=${NODE},status.phase=Running" | while read NAMESPACE POD NULL ; do oc project $NAMESPACE >/dev/null 2>&1 ; oc adm top pod $POD --containers --no-headers ; done | sed 's/ */\t/g' | sort -k 4 -n | column -t -s $'\t'
=get memory usage of all nodes in % of total available ram=
oc get nodes -o name | xargs -I % oc debug % -- chroot /host sh -c 'BUFFER=($(free | grep Mem:)) ; echo $HOSTNAME $(( $(( ${BUFFER[1]} - ${BUFFER[6]} )) / $(( ${BUFFER[1]} / 100 )) ))' 2>/dev/null

=oc get crd=
Get Custom Resource Definitions.
oc get crd
=operators=
Automatically setup of a instances.
=list installed operators=
oc get ClusterServiceVersions -A
oc get csv -A
oc get operators -o json | jq -r '.items[].status.components.refs[]?|select(.kind=="ClusterServiceVersion")|.name'
Search all namespaces. Exclude namespace.
oc get csv -A -o=custom-columns='NAME:.metadata.name,VERSION:.spec.version,DISPLAY:.spec.displayName' --no-headers | sort | uniq

=list available operators=
oc get packagemanifests
=delete operator=
Delete via gui. If traces are left. Or unable to install again.
https://access.redhat.com/solutions/6762071 Remove potentially blocking references.
https://access.redhat.com/solutions/7026146 Remove label so operator is not recreated.
oc get operator prometheus.prometheus -o yaml -n openshift-operators | grep -i CustomResourceDefinition -A1 //It will list the CRDs
currently being referenced by the operator
oc edit crd thanosrulers.monitoring.coreos.com
-----------output truncated------------
labels:
operators.coreos.com/prometheus.prometheus: "" //Remove this line and then save and exit
# Remove possibly broken jobs.
oc get jobs.batch -n openshift-marketplace | grep -i 0/1
# If job was not broken then remove all references to that operator. Remove jobs and configmaps.
oc get job -n openshift-marketplace -o json | jq -r '.items[] | select(.spec.template.spec.containers[].env[].value|contains ("elasticsearch-operator")) | .metadata.name' | while read i ; do echo oc delete job $i -n openshift-marketplace ; echo oc delete configmap $i -n openshift-marketplace ; done
=delete operator=
export OPERATOR=gitops ; oc get csv,subscriptions -n openshift-operators | grep "${OPERATOR}" | awk '{print $1}' | while read i ; do oc_script_log_yaml_kubectl-neat oc get $i -n openshift-operators </dev/null; echo oc delete $i ; done ; oc get installplan -n openshift-operators --sort-by=.metadata.creationTimestamp | grep "${OPERATOR}" | tail -n1 | awk '{print $1}' | while read i ; do oc_script_log_yaml_kubectl-neat oc get installplan $i -n openshift-operators </dev/null ; echo oc delete installplan $i; done

=Select channel=
oc patch clusterversion version --type merge -p '{"spec": {"channel": "candidate-4.12"}}' # candidate-... channel offers unsupported early access to releases as soon as they are built.
oc patch clusterversion version --type merge -p '{"spec": {"channel": "fast-4.12"}}' # As soon as version as a general availability (GA) release. Fully supported. Used in production environments.
oc patch clusterversion version --type merge -p '{"spec": {"channel": "stable-4.12"}}' # Delay from fast. Looking at quality from fast. If found good then moved to stable
oc patch clusterversion version --type merge -p '{"spec": {"channel": "eus-4.12"}}' # Extended Update Support

=find if image exitst=
oc adm release info quay.io/openshift-release-dev/ocp-release:4.15.38-x86_64
=Upgrade to version that you found on github okd=
oc adm upgrade --to-image=

=oc adm upgrade=
Upgrade okd images.
=Launch a new instance of a pod for gathering debug information. Compress and deliver in support case=
cd /tmp && oc adm must-gather && tar czf /tmp/must-gather.$(oc whoami --show-server | awk -F ':|/' '{print $4}').$(date +%F_%H-%M-%S).tar.gz must-gather.local.*
=Must gather for odf=
DATE=$(date +%F_%H-%M-%S)
mkdir /tmp/${DATE} ; cd /tmp/${DATE} && oc adm must-gather --image=registry.redhat.io/odf4/odf-must-gather-rhel9:v$(oc version -o json | jq -r .openshiftVersion | grep -o '^[0-9]*\.[0-9]*')
tar czf /tmp/must-gather.$(oc whoami --show-server | awk -F ':|/' '{print $4}').${DATE}.tar.gz /tmp/${DATE}/

=oc adm certificate approve <csr_name>=
Approve csr certificate
==Approve all csr==
oc get csr --no-headers | grep -vE 'Pending|Issued' | awk '{print $1}' | xargs -r oc adm certificate approve

=certmanager=
==cert-manager design==
( +---------+ )
( | Ingress | ) Optional ACME Only!
( +---------+ )
| |
| +-------------+ +--------------------+ | +-------+ +-----------+
|-> | Certificate |----> | CertificateRequest | ----> | | Order | ----> | Challenge |
+-------------+ +--------------------+ | +-------+ +-----------+
==look at cert-manager cr==
oc api-resources | grep cert | awk '{print $1}' | while read i ; do echo '*' $i ; oc get $i -A ; done
==list certificates==
oc get certificate -A
==list ClusterIssuer==
oc get ClusterIssuer -A
==list orders by date==
oc get orders -n openshift-config --sort-by=.metadata.creationTimestamp
==install cmctl==
<pre>
curl -fsSL https://github.com/cert-manager/cert-manager/releases/latest/download/cmctl-linux-amd64.tar.gz | (cd /usr/local/bin/ ; sudo tar zxf - cmctl)
</pre>

==completion==
. <(cmctl completion bash)
==renew cert==
cmctl renew -n openshift-config cert-api
==status of cert==
cmctl status certificate -n openshift-ingress le-wildcard-apps-certificate
=cert-utils=
==cert check==
<pre>
apiVersion: monitoring.coreos.com/v1
kind: PrometheusRule
metadata:
name: cert-utils-operator-certificate-rule-alerts
namespace: cert-utils-operator
spec:
groups:
- name: cert-utils-operator-recording-rules
rules:
- expr: certutils_certificate_expiry_time - certutils_certificate_issue_time
record: cert:validity_duration:sec
- expr: certutils_certificate_expiry_time - time()
record: cert:time_to_expiration:sec
- name: cert-utils-operator-alerting-rules
rules:
- alert: CertificateApproachingExpiration
annotations:
message: Certificate {{ $labels.namespace }}/{{ $labels.name }} has less than 30 days left.
summary: Certificate {{ $labels.namespace }}/{{ $labels.name }} is approaching expiration (30 days left).
expr: |
cert:validity_duration:sec >= 7776000 and cert:time_to_expiration:sec < 2592000
labels:
severity: warning
- alert: CertificateIsAboutToExpire
annotations:
message: Certificate {{ $labels.namespace }}/{{ $labels.name }} has less than 15 days left.
summary: Certificate {{ $labels.namespace }}/{{ $labels.name }} is about to expire (15 days left).
expr: |
cert:validity_duration:sec >= 7776000 and cert:time_to_expiration:sec < 1296000
labels:
severity: critical
</pre>

=oc adm release info=
# Show information about the cluster's current release
oc adm release info
# Show the source code that comprises a release
oc adm release info 4.2.2 --commit-urls
# Show the source code difference between two releases
oc adm release info 4.2.0 4.2.2 --commits
# Show where the images referenced by the release are located
oc adm release info quay.io/openshift-release-dev/ocp-release:4.2.2 --pullspecs
# Show release info about a release
oc adm release info 4.10.47 --pullspecs
=release notes=
find changes between ocp versions / release note.
https://access.redhat.com/labs/ocpupgradegraph/update_path
Select source and destination.
At bottom there is graphical display.
Press each bubble and read rhba.
Point releases in the end.
https://docs.openshift.com/container-platform/4.12/release_notes/ocp-4-12-release-notes.html

=oc adm node-logs=
Look at logs from crio from master nodes.
oc adm node-logs --role master -u crio
Get logs from one node from unit crio
oc adm node-logs abjorklund-01-5tsbc-worker-0-kcr54 -u crio
Look at specific log
oc adm node-logs --role master --path=openshift-apiserver/audit.log
List logs
oc adm node-logs --role=master --path=/
List logs from specific node.
oc adm node-logs nord-ic-bc84t-master-0 --path=/oauth-server/
Logs since older reboots
oc adm node-logs --role=master --path=/
Search recursive where log file exist.
oc_debug_run_command_all_nodes 'find /var/log 2>&1 | grep <name_pod>'
==download logfile==
CONTAINER_PATH="/containers" ; SEARCH_STRING="rabbit" ; oc adm node-logs --role=worker --path="${CONTAINER_PATH}" | grep "${SEARCH_STRING}" | while read NODE LOGFILE ; do echo $NODE --path="${CONTAINER_PATH}/${LOGFILE}" ; oc adm node-logs $NODE --path="${CONTAINER_PATH}/${LOGFILE}" > ${NODE}:${CONTAINER_PATH//\//%}%${LOGFILE} ; done

=openshift upgrade path=
https://access.redhat.com/labs/ocpupgradegraph/update_path?channel=stable-4.9&arch=x86_64&is_show_hot_fix=false&current_ocp_version=4.9.15&target_ocp_version=4.10.11
=Upgrade openshift/okd=
https://docs.okd.io/latest/updating/preparing_for_updates/updating-cluster-prepare.html
Run below and look to se if api:s that are being removed has a count.
oc get apirequestcounts

=upgrade openshift=
# look for existing alerts.
# look for troublesome pods.
oc get pods -A | grep -Ev ' Running | Completed '
# Set channel
oc patch clusterversion version --type merge -p '{"spec": {"channel": "stable-4.10"}}'
oc adm upgrade --to=4.10.47
oc adm upgrade --include-not-recommended
oc adm upgrade --allow-not-recommended --to=4.10.0 --include-not-recommended
oc get clusterversion -o json|jq ".items[0].spec"
# View openshift version history.
oc get clusterversion -o json | jq -r '.items[0].status.history[] | [.version, .startedTime, .completionTime] | join(" ")'
# View progress of update.
watch -n1 oc whoami --show-console \; oc adm upgrade
watch -cn1 "oc get clusteroperators | grep --color=always -E \"$(oc get clusterversions.config.openshift.io version -o json | jq -r .status.desired.version)|\""
# Upgrade all operators
oc get installplan -A | grep Manual | grep false
oc patch installplan $INSTALLPLAN -n $NAMESPACE --type merge --patch '{"spec":{"approved":true}}'

=upgrade okd=
==Get upgrade path.==
Look here to find latest version https://github.com/okd-project/okd/releases
(cd /usr/local/bin/ ; sudo curl -s -O https://gist.githubusercontent.com/Goose29/ca7debd6aec7d1a4959faa2d1b661d93/raw/4584d89c49d4af197480539bdd873f6d9ca2dd83/upgrade-path.py ; sudo chmod 755 upgrade-path.py ) && (curl -sH 'Accept:application/json' 'https://amd64.origin.releases.ci.openshift.org/graph?channel=stable-4' | upgrade-path.py 4.13.0-0.okd-2023-07-23-051208 4.14.0-0.okd-2024-01-26-175629 )
==To view status of update process run. Command is harmless and gives information about ongoing process and blockers.==
oc adm upgrade
watch -cn1 "oc whoami --show-console ; echo ; oc get clusteroperators | grep --color=always -E \"$(oc get clusterversions.config.openshift.io version -o json|jq -r '.spec.desiredUpdate.version')|\""
==To get slightly other view. VERSION column gives information about version. When update is done all cluster operators will have same version number.==
oc get clusteroperators
==Make a report of cluster status before installing. To rule out issues that you have not caused.==
"status of kubernetes" below.

==Look for api:s that are used that are flagged for being removed.==
oc get apirequestcounts
==Upgrade okd until there are no more updates or you have reached wanted version.==
oc adm upgrade --to-latest=true --allow-explicit-upgrade
==If complaining about cert. ReleaseAccepted=False==
oc patch --type='merge' --patch='{"spec":{"desiredUpdate":{"force":true}}}' clusterversion version
==If client want specific version pinpoint that.==
oc adm upgrade --to=<version from oc adm upgrade> --allow-explicit-upgrade
oc adm upgrade gives: Upgradeable=False Reason: AdminAckRequiredn Follow instructions from link. Command will be something like below.
oc -n openshift-config patch cm admin-acks --patch '{"data":{"ack-<version>-kube-<version>-api-removals-in-<version>":"true"}}' --type=merge
==Get pods that are less than perfekt.==
oc get pods -A --no-headers | grep -v Completed | while read LINE ; do PODS=$(awk '{print $3}' <<< "${LINE}") ; if [ "${PODS%%/*}" != "${PODS##*/}" ] ; then echo "${LINE}" ; fi ; done
==Get critical alerts.==
oc -n openshift-monitoring exec -c prometheus prometheus-k8s-0 -- curl -s "http://localhost:9090/api/v1/alerts" | jq '.data.alerts[]|select(.state=="firing")|select(.labels.severity=="critical")'
==Get warning alerts.==
oc -n openshift-monitoring exec -c prometheus prometheus-k8s-0 -- curl -s "http://localhost:9090/api/v1/alerts" | jq '.data.alerts[]|select(.state=="firing")|select(.labels.severity=="warning")'

=upgrade odf=
# View existing config.
oc get subscriptions -n openshift-storage odf-operator -o yaml
# Patch subscription
oc patch subscriptions -n openshift-storage odf-operator --type merge -p '{"spec": {"channel": "<channel>"}}'
# Get install plans
oc get installplan -n openshift-storage -o wide
# Approve install plan.
oc get installplans.operators.coreos.com -A --no-headers | awk '$5 ~ /false/' | awk '$4 ~ /Manual/' | while read NAMESPACE INSTALLPLAN END ; do echo '*' $NAMESPACE $INSTALLPLAN ; oc patch installplan $INSTALLPLAN -n $NAMESPACE --type merge --patch '{"spec":{"approved":true}}' ; done

=odf troubleshooting=
# ceph problem. Run commands from rook-ceph-operator
oc rsh -n openshift-storage $(oc get pods -n openshift-storage -o name -l app=rook-ceph-operator)
export CEPH_ARGS='-c /var/lib/rook/openshift-storage/openshift-storage.config'
ceph -s
ceph osd pool ls
ceph osd pool autoscale-status
ceph config dump
# disable autoscaling
ceph osd pool ls | while read i ; do echo '*' $i ; ceph osd pool set $i pg_autoscale_mode off ; done
# Look to see how much data is being used for pg:s.
# Number of PGLog Entries, size of PGLog data in megabytes, and Average size of each PGLog item
for i in 0 1 2 ; do echo '*' $i ; osdid=$i ; ceph tell osd.$osdid dump_mempools | jq -r '.mempool.by_pool.osd_pglog | [ .items, .bytes /1024/1024, .bytes / .items ] | @csv' ;done
ceph df

=cronjobs=
oc get cj
oc get cronjobs -o wide -A
Run cronjob manually
export CRONJOB=ldap-sync ; oc create job --from=cronjob/${CRONJOB} ${CRONJOB}-manual-$(date '+%Y-%m-%d-%H-%M-%S')
Disable cronjob
.spec.suspend: true
Enable cronjob
oc patch cronjobs.batch write-to-nfs --type merge -p '{"spec": {"suspend": false}}'

=delete po (stop, kill)=
stop pod
oc delete po --all --force
oc delete pod openshift-gitops-server --namespace openshift-gitops
oc delete pods -n openshift-oauth-apiserver --all
oc get po -A | grep -v ^NAME | awk '$4 !~ /Running/' | sort -k4 | while read NAMESPACE POD READY STATUS END ; do echo '****' $POD $STATUS ; echo oc delete po $POD -n $NAMESPACE --force --grace-period=0 ; done
oc get pods -A --field-selector=status.phase!=Running --no-headers | while read NAME_SPACE POD REST_OF_LINE ; do echo oc delete pod $POD -n "${NAME_SPACE}" --force --grace-period=0 ; done
(oc get pods --field-selector="status.phase=Pending" --no-headers -A ; oc get pods --field-selector="status.phase=Failed" --no-headers -A) | while read NAME_SPACE POD REST_OF_LINE ; do echo oc delete pod $POD -n "${NAME_SPACE}" --force --grace-period=0 ; done
# Delete pods and generate report on what has been removed.
LOG=/tmp/oc_delete_pod_$(oc config current-context | awk -F '/|:' '{print $2}').$(date '+%Y-%m-%d_%H-%M-%S').log ; (oc get pods --field-selector="status.phase=Pending" --no-headers -A ; oc get pods --field-selector="status.phase=Failed" --no-headers -A) | while read NAME_SPACE POD REST_OF_LINE ; do oc delete pod $POD -n "${NAME_SPACE}" --force --grace-period=0 ; done | tee $LOG ; awk -F\" '{print $2}' $LOG | sed 's/-[a-z0-9]*$//g'| sed 's/-[a-z0-9]*$//g' | sort | uniq -c | sort -n | tail -20

=use other namespace=
oc rsh --namespace namespace-name pod-name
oc rsh --namespace namespace-name-operator pod-name bash -c 'echo $PATH $HOSTNAME'

=list namespaces=
oc get namespace
=use namespace=
oc rsh --namespace openshift-gitops openshift-gitops-application-controller-0
=kubectl get netnamespace=
Command line utility used to configure network. Egress address can be used to define outgoing address. Which can also cause other issues.
oc get netnamespace openshift-gitops -oyaml

=oc get routes=
oc get routes --namespace openshift-gitops
=oc get oauth=
Describe authentication methods.
oc get oauth cluster -o yaml
=decode token. base64=
https://jwt.io/
=view secrets=
oc get secret ca-key-pair -o go-template='{{range $k,$v := .data}}{{"### "}}{{$k}}{{"\n"}}{{$v|base64decode}}{{"\n\n"}}{{end}}'
=delete cluster=
openshift-install destroy cluster
=storageclasses(sc)=
oc get storageclasses
=get storageclasses defined as default=
oc get sc -o json | jq -r '.items[]|select(."metadata".annotations."storageclass.kubernetes.io/is-default-class"=="true")|.metadata.name'
=set default storageclass=
# Set all sc to default false.
oc get sc -o json | jq -r '.items[]|select(."metadata".annotations."storageclass.kubernetes.io/is-default-class"=="true")|.metadata.name' | while read i ; do echo '*' $i ; oc patch storageclass $i -p '{"metadata": {"annotations":{"storageclass.kubernetes.io/is-default-class":"false"}}}'; done
# Set default storageclass.
oc patch storageclass ocs-storagecluster-cephfs -p '{"metadata": {"annotations":{"storageclass.kubernetes.io/is-default-class":"true"}}}'

=get service accounts=
oc get serviceaccounts -A
oc get sa -A

=which permissions do I have=
oc auth can-i --as=fjuza --list
oc get groups -o wide
oc auth can-i --as-group=<group> --list

=alerts=
==How is alertmanager configured==
oc get secret -n openshift-monitoring alertmanager-main -o json | jq -r '.data."alertmanager.yaml"|@base64d'

==Save alertmanger config==
<pre>
oc get secret alertmanager-main -n openshift-monitoring --template='{{index .data "alertmanager.yaml" | base64decode}}' > /tmp/oc_get_secret_alertmanager-main.alertmanager.yaml.$(oc whoami --show-console=true | awk -F / '{print $3}').$(date '+%Y-%m-%d_%H-%M-%S')
oc extract secret/alertmanager-main --confirm -n openshift-monitoring
</pre>

==Restore alertmanager config==
oc set data secret alertmanager-main -n openshift-monitoring --from-file=alertmanager.yaml=<file_alertmanager.yaml>

==alertmanager==
View Alertmanager configured alerts.
oc get prometheusrules -A -o yaml | grep alert: | sort
View configuration of alert
oc get prometheusrules -A -o json | jq '.items[].spec.groups[].rules[]| select(.alert=="AlertmanagerReceiversNotConfigured")'
view alerts.
oc -n openshift-monitoring exec -c prometheus prometheus-k8s-0 -- curl -s "http://localhost:9090/api/v1/alerts" | jq . | less -ISRM
View specific alert.
oc rsh -n openshift-monitoring -c prometheus prometheus-k8s-0 -- curl 'http://localhost:9090/api/v1/query?query=absent%28up%7Bjob%3D"fluentd"%7D+%3D%3D+1%29' | jq .
View alerts in state firing
oc -n openshift-monitoring exec -c prometheus prometheus-k8s-0 -- curl -s "http://localhost:9090/api/v1/alerts" | jq '.data.alerts[]|select(.state=="firing")' | less -ISRM
View alerts in state firing with severity warning
oc -n openshift-monitoring exec -c prometheus prometheus-k8s-0 -- curl -s "http://localhost:9090/api/v1/alerts" | jq '.data.alerts[]|select(.state=="firing")|select(.labels.severity=="warning")' | less -ISRM
View historical alerts.
oc -n openshift-monitoring exec -c prometheus prometheus-k8s-0 -- curl -s "http://localhost:9090/api/v1/query_range?query=ALERTS&start=2022-08-08T00:00:00.781Z&end=2022-08-09T00:00:00.781Z&step=1m"
oc -n openshift-monitoring exec -c prometheus prometheus-k8s-0 -- curl -s "http://localhost:9090/api/v1/query_range?query=ALERTS&start=$(date '+%Y-%m-%d' --date '-2 days')T00:00:00.781Z&end=$(date '+%Y-%m-%dT%H:%M:%S').781Z&step=1m" | jq . | less -ISRM
Get warning alerts since the last week.
echo '***' $(oc whoami --show-console) ; oc -n openshift-monitoring exec -c prometheus prometheus-k8s-0 -- curl -s "http://localhost:9090/api/v1/query_range?query=ALERTS&start=$(TZ=UTC date '+%Y-%m-%dT%H:%M:%S.000Z' --date '-6 days')&end=$(TZ=UTC date '+%Y-%m-%dT%H:%M:%S').000Z&step=1m" | jq -r '.data.result[].metric | {alertname, severity, alertstate}| select(.severity=="warning")|select(.alertstate=="firing") | .alertname'
Get more info about fired alerts.
echo '***' $(oc whoami --show-console) ; oc -n openshift-monitoring exec -c prometheus prometheus-k8s-0 -- curl -s "http://localhost:9090/api/v1/query_range?query=ALERTS&start=$(TZ=UTC date '+%Y-%m-%dT%H:%M:%S.000Z' --date '-6 days')&end=$(TZ=UTC date '+%Y-%m-%dT%H:%M:%S').000Z&step=1m" | jq -r '.data.result[].metric | {alertname, severity, alertstate, pod, namespace}| select(.severity=="warning")|select(.alertstate=="firing")'
Get alert during the last 6 days. Give times when alert has fired.
oc -n openshift-monitoring exec -c prometheus prometheus-k8s-0 -- curl -s "http://localhost:9090/api/v1/query_range?query=ALERTS&start=$(TZ=UTC date '+%Y-%m-%dT%H:%M:%S.000Z' --date '-6 days')&end=$(TZ=UTC date '+%Y-%m-%dT%H:%M:%S').000Z&step=1m" | jq -r . | python3 -c "import sys, re, datetime; print(re.sub(r'\b\d{10}\b', lambda x: datetime.datetime.utcfromtimestamp(int(x.group())).isoformat() + 'Z', sys.stdin.read()))" | less -ISRM

=disable alermanager alert=
oc -n openshift-monitoring exec -ti alertmanager-main-0 -c alertmanager -- amtool silence add --alertmanager.url http://localhost:9093 alertname=AlertmanagerReceiversNotConfigured --end="2053-11-07T00:00:00-00:00" --comment "silence alertmanager"
=list silenced alerts=
oc -n openshift-monitoring exec -ti alertmanager-main-0 -c alertmanager -- amtool silence query --alertmanager.url http://localhost:9093
=Parsed config to alertmanager=
oc -n openshift-monitoring exec -ti alertmanager-main-0 -c alertmanager -- curl http://localhost:9093/api/v2/status | jq -r .config.original
=Version of alertmanager=
oc -n openshift-monitoring exec -ti alertmanager-main-0 -c alertmanager -- curl http://localhost:9093/api/v2/status | jq -r .versionInfo.version | strings

=Silence alertmanager not configured alert=
oc set data secret alertmanager-main -n openshift-monitoring --from-file=alertmanager.yaml=<(cat <<'EOF'
"global":
"resolve_timeout": "5m"
"inhibit_rules":
- "equal":
- "namespace"
- "alertname"
"source_match":
"severity": "critical"
"target_match_re":
"severity": "warning|info"
- "equal":
- "namespace"
- "alertname"
"source_match":
"severity": "warning"
"target_match_re":
"severity": "info"
"receivers":
- "name": "Default"
- "name": "Watchdog"
- "name": "Critical"
- "name": "testrec" # Dummy receiver with webhook config
"webhook_configs":
- "url": "http://xxxxdumyxxx.com"
"route":
"group_by":
- "namespace"
"group_interval": "5m"
"group_wait": "30s"
"receiver": "Default"
"repeat_interval": "12h"
"routes":
- "match":
"alertname": "dummyalert" # Dummy alert being routed to dummy receiver
"receiver": "testrec"
EOF
)

=prometheus=
Url to web interface.
https://prometheus-k8s-openshift-monitoring.apps.<url>
echo https://prometheus-k8s-openshift-monitoring.$(oc whoami --show-console | awk -F 'console-openshift-console.' '{print $2}')
echo https://$(oc get route -n openshift-monitoring prometheus-k8s -o jsonpath="{.spec.host}")
Get disk usage from odf
oc -n openshift-monitoring exec -c prometheus prometheus-k8s-0 -- curl -s "http://localhost:9090/api/v1/query?query=odf_system_raw_capacity_used_bytes" | jq -r .
Get disk usage from odf over time.(metrics)
oc -n openshift-monitoring exec -c prometheus prometheus-k8s-0 -- curl -s "http://localhost:9090/api/v1/query_range?query=odf_system_raw_capacity_used_bytes&start=$(date '+%Y-%m-%d' --date '-20 days')T00:00:00.781Z&end=$(date '+%Y-%m-%dT%H:%M:%S').781Z&step=1h" | jq . | less -ISRM
Search tips
https://prometheus.io/docs/prometheus/latest/querying/basics/
Disk usage per project. Taken from RH ticket.
oc -n openshift-monitoring exec prometheus-k8s-0 -c prometheus -- curl -s -g 'http://localhost:9090/api/v1/query?' --data-urlencode 'query=(sort_desc(topk(25,(sum(kubelet_volume_stats_used_bytes * on (namespace,persistentvolumeclaim) group_left(storageclass, provisioner) (kube_persistentvolumeclaim_info * on (storageclass) group_left(provisioner) kube_storageclass_info {provisioner=~"(.*cephfs.csi.ceph.com)"})) by (namespace)))))'

=openshift-user-workload-monitoring=
"annotations": {
"description": "Prometheus operator in openshift-user-workload-monitoring namespace rejected 2 prometheus/ServiceMonitor resources.",
"summary": "Resources rejected by Prometheus operator"
},...
# Look at what is causing.
oc logs -l app.kubernetes.io/name=prometheus-operator -n openshift-user-workload-monitoring
# After tweaking with monitoring settings kill pod and view log.
oc delete pod -l app.kubernetes.io/name=prometheus-operator -n openshift-user-workload-monitoring
oc logs -l app.kubernetes.io/name=prometheus-operator -n openshift-user-workload-monitoring | less
# Stop monitoring.
oc label namespace openshift-local-storage openshift.io/cluster-monitoring-
oc label namespace openshift-local-storage openshift.io/user-monitoring=false
# Allow monitoring.
oc label namespace openshift-operators openshift.io/cluster-monitoring=true

=Talk to api with Bearer.=
HOST=$(oc -n openshift-monitoring get route alertmanager-main -ojsonpath={.spec.host})
TOKEN=$(oc whoami -t)
curl -skH "Authorization: Bearer $TOKEN" "https://$HOST/api/v2/alerts" | jq .
=token=
token=`oc sa get-token prometheus-k8s -n openshift-monitoring` ## --- In OCP client 4.10 or lower ---
OR
token=`oc create token prometheus-k8s -n openshift-monitoring` ## --- In OCP client 4.11 or higher ---
curl using token
curl -k -H "Authorization: Bearer $token" 'https://alertmanager-main-openshift-monitoring.apps.domain/api/v1/alerts' | jq '.data[].labels'
=ServiceMonitor=
Prometheus Operator:
When using Prometheus Operator, custom resources like ServiceMonitor and PodMonitor might include metricsConfig settings to customize how Prometheus should scrape metrics from various services or pods.

=bash completion=
. <(oc completion bash)

=machineconfig=
view settings
oc describe machineconfigpool
==set ntp servers==
echo 'variant: openshift
version: 4.9.0
metadata:
name: 99-master-chrony
labels:
machineconfiguration.openshift.io/role: master
storage:
files:
- path: /etc/chrony.conf
mode: 0644
overwrite: true
contents:
inline: |
server ntp.lio.se iburst
driftfile /var/lib/chrony/drift
makestep 1.0 3
rtcsync
logdir /var/log/chrony' | butane | oc apply -f -
==get machineconfig value==
oc get mc 00-master -o json | jq -r '.spec.config.storage.files[]|select(.path=="/var/lib/kubelet/config.json")|.contents.source' | perl -pe 's/%([0-9a-f]{2})/sprintf("%s", pack("H2",$1))/eig' | sed 's/^data:,//g' | jq .

==List machineconfigs by creation time==
oc get mc --sort-by=.metadata.creationTimestamp

=get users=
oc get users
=give me kubeadmin ecrypted password=
oc get secret kubeadmin -n kube-system -o json -o=jsonpath='{.data.kubeadmin}' | base64 -d
=Give kubeadmin a new password=
==generate password hash==
htpasswd -bnBC 10 "" '<password>' | tr -d ':\n' | base64 -w0

==patch password hash==
oc patch secret/kubeadmin -n kube-system -p '{"data": {"kubeadmin": "UGFzc3dvcmQK=="}}'

=work with oc without login=
export KUBECONFIG=/var/lib/kubelet/kubeconfig
if on bootstrap node.
export KUBECONFIG=/etc/kubernetes/kubeconfig

=Add the following if cert is not trusted.ssl/tls/ignore/expired=
- cluster:
insecure-skip-tls-verify: true
server: https://127.0.0.1:443
name: my-cluster

=run oc when on node=
oc get pod -n openshift-monitoring --kubeconfig=/var/lib/kubelet/kubeconfig

=etcdctl=
oc rsh -c etcdctl -n openshift-etcd $(oc get pod -l app=etcd -oname -n openshift-etcd | awk -F"/" 'NR==1{ print $2 }')
[root@ocp-03-lm8km-master-1 /]# etcdctl --write-out=table endpoint status
+---------------------------+------------------+---------+---------+-----------+------------+-----------+------------+--------------------+--------+
| ENDPOINT | ID | VERSION | DB SIZE | IS LEADER | IS LEARNER | RAFT TERM | RAFT INDEX | RAFT APPLIED INDEX | ERRORS |
+---------------------------+------------------+---------+---------+-----------+------------+-----------+------------+--------------------+--------+
| htt://172.19.14.36:2379 | c4f7b42b92713818 | 3.5.0 | 105 MB | false | false | 6 | 2632074 | 2632074 | |
| htt://172.19.14.37:2379 | 5dea668b432969fc | 3.5.0 | 105 MB | false | false | 6 | 2632074 | 2632074 | |
| htt://172.19.14.41:2379 | 51cecd971b657ee5 | 3.5.0 | 105 MB | true | false | 6 | 2632074 | 2632074 | |
+---------------------------+------------------+---------+---------+-----------+------------+-----------+------------+--------------------+--------+
Verifying etcd while openshift is less than perfekt
# List etcd containers
crictl ps --label io.kubernetes.pod.namespace=openshift-etcd
# Execute command to verify health of etcd using crictl
crictl exec -it <container-id> etcdctl endpoint status --write-out=table

=create troubleshooting/debug/test pod=
oc run abjorklund-redhat-ubi8 --image=redhat/ubi8 -i --tty -- sh
oc run abjorklund-curlimage-curl --image=curlimages/curl -i --tty -- sh
oc run -it busybox --image=busybox --restart=Never -- ash
oc run abjorklund-rocky-rocky --image=rockylinux/rockylinux -i --tty -- bash
oc run ${USER}-rocky-rocky --image=rockylinux/rockylinux -i --tty -- bash # dnf -y install procps-ng iproute
oc run ${USER}-rocky-rocky --image=rockylinux/rockylinux --restart=Never --command sleep infinity
==install packages to get running==
yum install -y lsof procps-ng bind-utils

=proxy settings=
oc get proxy cluster -o yaml
Change ca
oc patch proxy/cluster --type=merge --patch='{"spec":{"trustedCA":{"name":"custom-ca"}}}'
=oc proxy=
Run a proxy to the Kubernetes API server
=port forward to pod=
oc port-forward <my-pod-name> <local-port>:<remote-port>
=alertmanager=
oc port-forward -n monitoring svc/kube-prometheus-stack-alertmanager 9093:9093 # http://localhost:9093/
=grafana access=
oc port-forward -n monitoring svc/kube-prometheus-stack-grafana 3000:80 # http://localhost:3000 admin prom-operator
=prometheus access=
oc port-forward -n monitoring svc/kube-prometheus-stack-prometheus 9090:9090 # http://localhost:9090
=akhq=
<pre>
kubectl port-forward service/akhq 8080:80
http://localhost:8080
</pre>

=thanos-queries=
oc port-forward -n openshift-monitoring svc/thanos-querier 9091:9091 # access via: curl -sk -H "Authorization: Bearer $(oc whoami -t)" https://localhost:9091/api/v1/status/buildinfo | jq . (via browser use requestly)

==proxy via pod==
# Create tunnel pod. Please remove when done.
oc apply -f - << 'EOF'
apiVersion: v1
kind: Pod
metadata:
name: proxy-pod
namespace: default
spec:
containers:
- name: socat-proxy
image: alpine/socat:latest
command: ["/bin/sh", "-c"]
args:
- |
apk add --no-cache socat && # Install socat if not in image
socat TCP-LISTEN:443,fork,reuseaddr TCP:scm.devops.cambio.se:443
ports:
- containerPort: 443
restartPolicy: Never
EOF
# Tunnel on localhost reaching destination.
sudo oc --kubeconfig=$KUBECONFIG port-forward pod/proxy-pod -n default 443:443
# Add hosts entry to use browser as "usual".
grep scm.devops.cambio.se /etc/hosts
127.0.0.1 localhost scm.devops.cambio.se

=Install additional ca certificate=
apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
metadata:
labels:
machineconfiguration.openshift.io/role: worker
name: 50-company-ca-cert
spec:
config:
ignition:
version: 3.1.0
storage:
files:
- contents:
source: data:text/plain;charset=utf-8;base64,LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURrVENDQW5tZ0F3SUJBZ0lFSC93Skh6QU5CZ2txaGtpRzl3MEJBUXNGQURBM01SVXdFd1lEVlFRS0RBeFMKUlVSQ1VrbEVSMFV1VTBVeEhqQWNCZ05WQkFNTUZVTmxjblJwWm1sallYUmxJRUYxZEdodmNtbDBlVEFlRncweQpNVEF5TWpNd056RTVOVFphRncwME1UQXlNak13TnpFNU5UWmFNRGN4RlRBVEJnTlZCQW9NREZKRlJFSlNTVVJIClJTNVRSVEVlTUJ3R0ExVUVBd3dWUTJWeWRHbG1hV05oZEdVZ1FYVjBhRzl5YVhSNU1JSUJJakFOQmdrcWhraUcKOXcwQkFRRUZBQU9DQVE4QU1JSUJDZ0tDQVFFQW5mY1F3YURwcEdzNWJxaUc5ajE5aFJVaG1sMzhjb2JGT2tzRQpsZFo3Y3RkV1d6VHJqSTFCRGxZSEd5SXBYMEo4ZU1PaDhvbUZqbVR6VTEzTkpWSnJrWm5RaDRhTzA1UGtKRlJRCkg1ZVA2N3R0S2pEb0txOFZVWXRZUldxRlFaalNxY2lQMzJobXZSNG42QVZDWDdCaUVBZjd2Y05ZVys0a1k5OUsKbTluV1BNbEpGU056M1puRnlWc1BtR1ZWeVN2RmFVL0dBTmt1Z25uSGdUM1VUUTNsc2NidU5keUpBcVEya3dHSwpKbkdZKzBSajVrUWpvdXptUjBDZ3pJN0hWSmhwK2Z6R1lyenRYQXA1Zkt0Z3ZTZFRtTndVVXZJR3pLTmU4WklGCmY0WVVUUDFPdU9jUmNIRDJQclVodDgzWlRLYzNwOUhLYk5CazIzWFFtYU85QVBqeEl3SURBUUFCbzRHa01JR2gKTUI4R0ExVWRJd1FZTUJhQUZMbWFrNHdDamtuakZvWkd6M1daRGErY2N4RGxNQjBHQTFVZERnUVdCQlM1bXBPTQpBbzVKNHhhR1JzOTFtUTJ2bkhNUTVUQVBCZ05WSFJNQkFmOEVCVEFEQVFIL01BNEdBMVVkRHdFQi93UUVBd0lCCnhqQStCZ2dyQmdFRkJRY0JBUVF5TURBd0xnWUlLd1lCQlFVSE1BR0dJbWgwZEhBNkx5OXBjR0V0WTJFdWNtVmsKWW5KcFpHZGxMbk5sTDJOaEwyOWpjM0F3RFFZSktvWklodmNOQVFFTEJRQURnZ0VCQURabURvUytJY1ZMcERBRwpiSXM0SWRJKzcxY0xINk90NjNkYWhBT25QRDJnMUhvVUFIZFdUcGdobER3TkFQWjg3UXQybFc4Q1B4eDhCQVZOCnlrZWlEN2paeVA5dmVCcDRxNjBiSTVYSENndWV5U2lGdjBBKzloKzMzekMrYy9WbStJVHJNTkZ0dlZMNE1kRWQKaVE4UVBhaFJEWW1qVkJVb1VIZWErMDdkWEY3TzQxY2t2YzZRb0lad2F5Y1Zhc0gvd05lVGNrdzl1TlNiajNTQwoyNHdpOUthQnpxdDZsWlF3TG5uUjVnNjNWUDZNZUprR2FXMTBxdExiQVM4NGZwQ1NWTUx3U051MGZqeFU2d2lPCkRjaWlKKzNZOG5ldjM5NGJHRkwxcG5ZVmM4YmpoL0xaaHM1dTRQUnhlNFBLRER2Y09NZUhpUkN1M1YySWRRTTgKbDl3enBQZz0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQoK
mode: 0644
overwrite: true
path: /etc/pki/ca-trust/source/anchors/company-ca.crt

=get raw api data=
oc get --raw "/api/v1/nodes/[node]/proxy/stats/summary"
Via proxy.
oc proxy &
Starting to serve on 127.0.0.1:8001
curl -s http://localhost:8001/api/v1/nodes/crc-lgph7-master-0/proxy/stats/summary
curl -s http://localhost:8001/api/v1/nodes/crc-lgph7-master-0/proxy/metrics/resource
=explain=
Get documentation for a resource. Get available attributes for an resource.
oc explain deployment

=events=
Get events.
oc get events -A --sort-by=.metadata.creationTimestamp
=jsonpath=
Get names of MachineConfigs one value per line.
oc get mc -o jsonpath='{range .items[*]}{.metadata.name}{"\n"}{end}' --no-headers
=ImageStreamTag=
ImageStreamTag represents an Image that is retrieved by tag name from an ImageStream.
=imagestream=
apiVersion: image.openshift.io/v1
kind: ImageStream
metadata:
name: myapp
==Tagging Images: When you tag an image, it is added to the ImageStream with a specified tag.==
oc tag myregistry/myapp:latest myapp:latest
==Using ImageStreams in Deployment Configurations: Deployment configurations can reference ImageStreams instead of direct image URLs.==
apiVersion: apps.openshift.io/v1
kind: DeploymentConfig
metadata:
name: myapp
spec:
template:
spec:
containers:
- name: myapp
image: image-registry.openshift-image-registry.svc:5000/myproject/myapp:latest

=BuildConfig=
Build configurations define a build process for new container images.
=download okd openshift-install=
# Show latest.
curl -skL https://github.com/okd-project/okd/releases | elinks --dump | sed 's/^ *//g' | grep " Latest"
# Download and install in /usr/local/bin. Keep old versions.
export OKD_VERSION=4.15.0-0.okd-2024-03-10-010116 ; (cd /temp/ ; oc adm release extract --tools quay.io/openshift/okd:${OKD_VERSION} ; cd /usr/local/bin/ ; sudo tar xf /temp/openshift-install-linux-${OKD_VERSION}.tar.gz openshift-install ; sudo mv openshift-install openshift-install.${OKD_VERSION})

=setup openshift cluster=
Download binary
<pre>
cd /tmp/ ; curl -L -O https://mirror.openshift.com/pub/openshift-v4/x86_64/clients/ocp/4.10.47/openshift-install-linux.tar.gz && sudo tar xf openshift-install-linux.tar.gz -C /usr/local/bin/
</pre>
Add vmware certs if using that backend.
(cd /tmp/ ; curl -sk https://${vspherer_server}/certs/download.zip -O) ; cd /etc/pki/ca-trust/source/anchors ; sudo unzip -oj /tmp/download.zip certs/lin/\* ; sudo update-ca-trust
Create config file
install-config.yaml
Then fire off install
openshift-install create cluster
Another example
ln -s install-config.yaml.2023-03-23 install-config.yaml
./openshift-install-4.12.0-0.okd-2023-04-16-041331 create cluster

=Edit install config after setup=
Save config
<pre>
oc get cm cluster-config-v1 -n kube-system --template='{{index .data "install-config" }}' > /tmp/cm_cluster-config-v1_-n_kube-system.$(oc whoami --show-console=true | awk -F / '{print $3}').$(date '+%Y-%m-%d_%H-%M-%S')
</pre>
Edit downloaded file and apply edited file.
oc set data cm cluster-config-v1 -n kube-system --from-file=install-config=/tmp/cm_cluster-config-v1_-n_kube-system.<suitable_name>

=look at install settings=
oc get -n kube-system cm/cluster-config-v1 -o yaml

=argocd login=
argocd login openshift-gitops-server-openshift-gitops.apps.costest.ltkronoberg.se --username kubeadmin --password asdfasfasdfas --sso --insecure
argocd login $(oc get routes -n openshift-gitops openshift-gitops-server -o json | jq -r .spec.host) --username $USER --password $COMPANY_PASSWORD --sso --insecure

=git sync heal=
argocd app list | grep -v NAME | awk '{print $1}' | while read i ; do echo '*' $i ; argocd app set $i --self-heal ; done

=metrics=
==Get available values==
Thanos monitoring points
curl -sk -H "Authorization: Bearer $(oc whoami -t)" https://$(oc get routes -n openshift-monitoring thanos-querier -o jsonpath='{.status.ingress[0].host}')/api/v1/metadata | jq .
node-exporter
oc --request-timeout=3 -n openshift-monitoring exec -c node-exporter $(oc get pod -n openshift-monitoring -l app.kubernetes.io/name=node-exporter -o=custom-columns='NAME:.metadata.name' --no-headers | head -1) -- curl -s 'http://localhost:9100/metrics' | grep -vE "^#|^$"
==Cpu usage per node.==
100 - (avg by (instance) (irate(node_cpu_seconds_total{mode="idle"}[30m])) * 100)
instance:node_cpu_utilisation:rate1m{job="node-exporter", cluster=""} != 0
instance:node_cpu_utilisation:rate1m{job="node-exporter"} != 0
==cpu usage per pod on node==
sum(node_namespace_pod_container:container_cpu_usage_seconds_total:sum_irate{cluster="", node=~"<node>"}) by (pod)
==iowait==
avg by (instance) (irate(node_cpu_seconds_total{mode="iowait"}[30m]))
==namespace==
cpu usage per namespace.
sum(node_namespace_pod_container:container_cpu_usage_seconds_total:sum_irate{cluster=""}) by (namespace)
==load==
Load 1 graph
instance:node_load1_per_cpu:ratio{job="node-exporter", cluster=""} != 0
==usage for pvc==
kubelet_volume_stats_used_bytes
kubelet_volume_stats_available_bytes
kubelet_volume_stats_used_bytes{persistentvolumeclaim="prometheus-prometheus-k8s-1"}
With % usage of all pvc
( kubelet_volume_stats_used_bytes / kubelet_volume_stats_capacity_bytes ) * 100

==Memory usage==
Memory usage of node.
instance:node_memory_utilisation:ratio
node_memory_MemAvailable_bytes
100 * (1 - (node_memory_MemAvailable_bytes / node_memory_MemTotal_bytes))
==Memory usage per pod on a node==
sum(container_memory_usage_bytes{node="<node_name>"}) by (pod, namespace)
==OOMKilled==
sum by (namespace, pod) (kube_pod_container_status_restarts_total) * on(namespace, pod) group_left(reason) kube_pod_container_status_last_terminated_reason{reason="OOMKilled"}
oc -n openshift-monitoring exec -c prometheus prometheus-k8s-0 -- curl -s "http://localhost:9090/api/v1/query_range?query=sum%20by%20(namespace,%20pod)%20(kube_pod_container_status_restarts_total)%20*%20on(namespace,%20pod)%20group_left(reason)%20kube_pod_container_status_last_terminated_reason%7Breason%3D%22OOMKilled%22%7D&start=$(date '+%Y-%m-%d' --date '-20 days')T00:00:00.781Z&end=$(date '+%Y-%m-%dT%H:%M:%S').781Z&step=1h" | jq .
==uptime==
oc exec -n openshift-monitoring -c prometheus prometheus-k8s-0 -- curl -s 'http://localhost:9090/api/v1/query?query=time%28%29%20-%20node_boot_time_seconds%7Bjob%3D%22node-exporter%22%7D%0A' | jq -r '.data.result[]|.metric.instance +"\t"+ (.value[1] | tonumber | floor | tostring)' | column_tab
==disk usage==
(1 - (node_filesystem_avail_bytes{mountpoint="/"} / node_filesystem_size_bytes{mountpoint="/"})) * 100
==disk inode usage==
(1 - (node_filesystem_files_free{mountpoint="/"} / node_filesystem_files{mountpoint="/"})) * 100
==disk utalization==
100 * (rate(node_disk_io_time_seconds_total[5m]) / 300)

==steal==
sum by (instance) (rate(node_cpu_seconds_total{mode="steal"}[1m])) * 100
==request memory==
sum by (node) ( kube_pod_container_resource_requests{resource="memory"} * on (namespace, pod) group_left kube_pod_status_phase{phase="Running"} ) / 1024 / 1024

=install oc and kubectl=
curl -fsSL https://mirror.openshift.com/pub/openshift-v4/x86_64/clients/ocp/latest/openshift-client-linux.tar.gz | (cd /usr/local/bin/ ; sudo tar zxf - oc kubectl )

=time and timezone in first pod(date)=
oc get pods --no-headers -o 'custom-columns=:.metadata.namespace,:.metadata.name' -A | grep -v cert-manager | head -1 | while read NAMESPACE POD ; do oc rsh -n $NAMESPACE $POD bash -c 'date "+%Y-%m-%d %H:%M:%S %Z"' 2>/dev/null ; done

=oc get installplan=
InstallPlan defines the installation of a set of operators.
oc get installplan install-bk8hw -n openshift-operators -o yaml
Approve all manual updates.
oc get installplans.operators.coreos.com -A --no-headers | awk '$5 ~ /false/' | awk '$4 ~ /Manual/' | while read NAMESPACE INSTALLPLAN END ; do echo '*' $NAMESPACE $INSTALLPLAN ; oc patch installplan $INSTALLPLAN -n $NAMESPACE --type merge --patch '{"spec":{"approved":true}}' ; done
Get selected info from all installplans
oc get installplans.operators.coreos.com -A --no-headers -o=custom-columns='DATE:.metadata.creationTimestamp,NAME:.metadata.name,PHASE:.status.phase,CSV:.spec.clusterServiceVersionNames,NAMESPACE:.metadata.namespace' --sort-by=.metadata.creationTimestamp

=oc extract=
Extract secrets or config maps to disk
# Extract only the key "nginx.conf" from config map "nginx" to the /tmp directory
oc extract configmap/nginx --to=/tmp --keys=nginx.conf
=dependencies,owner=
Search in output from
oc describe ...
Search for this.
Controlled By: ReplicaSet/rook-ceph-osd-0-6dcdc7fb48
=metadata.ownerReferences=
Define object that owns object

=nodeAffinity=
Pin pod to node with label (kubectl label nodes <your-node-name> disktype=ssd)
spec:
affinity:
nodeAffinity:
requiredDuringSchedulingIgnoredDuringExecution:
nodeSelectorTerms:
- matchExpressions:
- key: disktype
operator: In
values:
- ssd

=Add user to group=
oc adm groups add-users openshift-admins rb_janitor
=api-int=
api-int.<fqdn>
for i in api-int:6443 api:6443 test.apps:443 ; do ping -c1 -W1 ${i%%:*} 2>&1 | xargs ; curl -skI https://${i%%:*}:${i##*:} 2>&1 | xargs ; done | cut -c -150
for i in api-int:6443 api:6443 test.apps:443 ; do ping -c1 -W1 ${i%%:*} 2>&1 | xargs ; set -x ; curl -skv https://${i%%:*}:${i##*:} -o /dev/null 2>&1 | grep "Server certificate:" -A5 ; set +x ; done | cut -c -150
=test talk to api-int=
CACERT=/tmp/%var%lib%kubelet%kubeconfig%certificate-authority-data ; grep certificate-authority-data: /var/lib/kubelet/kubeconfig | awk '{print $2}' | base64 -d > /$CACERT ; curl -s --key /var/lib/kubelet/pki/kubelet-client-current.pem --cert /var/lib/kubelet/pki/kubelet-client-current.pem --cacert $CACERT -XGET "$(grep server /etc/kubernetes/kubeconfig | awk '{print $2}')/api/v1/namespaces/default/pods?limit=500"
=api urls=
kubernetes generic: reference to the Kubernetes API server.
kubernetes.default: reference to the Kubernetes API server within the "default" namespace.
kubernetes.default.svc: refers to the Kubernetes service within the "default" namespace.
kubernetes.default.svc.cluster.local: This is the fully-qualified domain name (FQDN) for the Kubernetes service within the "default" namespace.
openshift: Similar to "kubernetes," this is a generic reference to the OpenShift API server.
openshift.default: reference to the OpenShift API server within the "default" namespace.
openshift.default.svc: refers to the OpenShift service within the "default" namespace.
openshift.default.svc.cluster.local: fully-qualified domain name (FQDN) for the OpenShift service within the "default" namespace.

=okd setup fix=
# On bootstrap node. Could work on all clusters. First a test to se if it work already.
DOMAIN=$(grep " baseDomain: " /etc/mcc/bootstrap/cluster-dns-02-config.yml | awk '{print $2}')
for i in api-int api ; do ping -c1 -W1 $i.${DOMAIN} 2>&1 | xargs; done | cut -c -150
echo "10.1.0.5 api-int.${DOMAIN} api.${DOMAIN}" >> /etc/hosts

=oc annotate=
Update the annotations on one or more resources.
oc annotate pods foo description='my frontend'
=setuid setgid=
securityContext:
runAsUser: 10004000
runAsGroup: 10004000
=patch examples=
==Look at oc get ... -o json and copy line after line.==
oc patch redis redis-standalone --type merge --patch '{"spec": {"securityContext": {"runAsGroup": 1000400000}}}'
==Enable disable clusterlogging # Unmanaged/Managed==
oc patch clusterlogging -n openshift-logging instance --type merge -p '{"spec": {"managementState": "Unmanaged"}}'
==Enable disable elasticsearch(Unmanaged/Managed)==
oc patch elasticsearch -n openshift-logging elasticsearch --type merge -p '{"spec": {"managementState": "Unmanaged"}}' #
==Remove finalizers from pod.==
oc patch pod <pod> -n <namespace> -p '{"metadata":{"finalizers":null}}'
==remove value==
Remove .spec.kafka.version
oc patch kafka kafka-cluster --type='json' -p='[{"op": "remove", "path": "/spec/kafka/version"}]'

==Add finalizer==
oc patch pod <pod> -n <namespace> -p '{"metadata":{"finalizers":["kubernetes.io/pvc-protection"]}}'
==Replace finalizers value with this.==
oc patch pod <pod> -n <namespace> --type merge -p '{"metadata":{"finalizers":["kubernetes.io/pvc-protection","kubernetes"]}}'
==patch replicas deployment==
oc patch deployment <deployment-name> --patch '{"spec": {"replicas": 0}}'
==patch list entries do not wipe existing list entries==
oc patch deployment -n openshift-kube-apiserver-operator kube-apiserver-operator --type json -p '[{"op": "replace", "path": "/spec/template/spec/containers/0/image", "value": "quay.io/okd/scos-content@sha256:37d6b6c13d864deb7ea925acf2b2cb34305333f92ce64e7906d3f973a8071642"}]'
oc get deployment kube-apiserver-operator -n openshift-kube-apiserver-operator -o json | jq '.spec.template.spec.containers[0].env |= map(if .name == "IMAGE" then .value = "quay.io/okd/scos-content@sha256:5c9128668752a9b891a24a9ec36e0724d975d6d49e6e4e2d516b5ba80ae2fb23" else . end)' | oc apply -f -
oc get deployment kube-apiserver-operator -n openshift-kube-apiserver-operator -o json | jq '.spec.template.spec.containers[0].env |= map(if .name == "OPERATOR_IMAGE" then .value = "quay.io/okd/scos-content@sha256:37d6b6c13d864deb7ea925acf2b2cb34305333f92ce64e7906d3f973a8071642" else . end)' | oc apply -f -
oc get deployment kube-apiserver-operator -n openshift-kube-apiserver-operator -o json | jq '.spec.template.spec.containers[0].env |= map(if .name == "OPERAND_IMAGE_VERSION" then .value = "1.29.6" else . end)' | oc apply -f -
==patch service monitor==
kubectl patch servicemonitor cert-utils-operator-controller-manager-metrics-monitor -n openshift-operators -p='[{"op": "replace", "path": "/spec/endpoints/0/tlsConfig/serverName", "value": "cert-utils-operator-controller-manager-metrics-service.openshift-operators.svc"}]' --type='json'
==edit text/cert entry==
#!/bin/bash
SSL_URL=halfface.se
SSL_PORT=443
DATE_FILE=$(date +%F_%H-%M-%S)
openssl s_client -connect ${SSL_URL}:${SSL_PORT} -servername ${SSL_URL} -verify 5 -showcerts -certform pem </dev/null 2>/dev/null | sed -n '/^----/,/^----/p' > chain.${SSL_URL}.${SSL_PORT}.${DATE_FILE}.pem
ln chain.${SSL_URL}.${SSL_PORT}.${DATE_FILE}.pem ${SSL_URL}
oc create cm argocd-tls-certs-cm -n argocd --from-file ${SSL_URL} --dry-run=client -o yaml >> /tmp/chain.${SSL_URL}.${SSL_PORT}.${DATE_FILE}.pem.patch
oc patch configmap argocd-tls-certs-cm -n argocd --patch-file /tmp/chain.${SSL_URL}.${SSL_PORT}.${DATE_FILE}.pem.patch

=limits=
When your need to increase your cpu and memory resources.
cpu limit is either written as a number. 0.5 for half a cpu. Or rather a definition in milli. 500m for half a cpu.
spec:
containers:
...
resources:
limits:
cpu: "2"
memory: 5Gi
requests:
cpu: "2"
memory: 5Gi

=quotas on cpu memory pvc... per project=
oc get ResourceQuota
=tolerations|node selectors|...=
oc describe pod
Node-Selectors: node-role.kubernetes.io/app=
Tolerations: node.kubernetes.io/memory-pressure:NoSchedule op=Exists
node.kubernetes.io/not-ready:NoExecute op=Exists for 300s
node.kubernetes.io/unreachable:NoExecute op=Exists for 5s
node.ocs.openshift.io/storage=true:NoSchedule
=tolerate any taint=
tolerations:
- operator: Exists

=enable monitoring=
cat <<EOF | oc apply -f -
apiVersion: v1
kind: ConfigMap
metadata:
name: cluster-monitoring-config
namespace: openshift-monitoring
data:
config.yaml: |
prometheusK8s:
retention: 2d
EOF

=retention elasticsearch=
Edit the ClusterLogging CR to add or modify the retentionPolicy parameter:
apiVersion: "logging.openshift.io/v1"
kind: "ClusterLogging"
...
spec:
managementState: "Managed"
logStore:
type: "elasticsearch"
retentionPolicy:
application:
maxAge: 1d
infra:
maxAge: 7d
audit:
maxAge: 7d
elasticsearch:
nodeCount: 3
...

=retention prometheus=
Prometheus retention. https://docs.openshift.com/container-platform/4.10/monitoring/configuring-the-monitoring-stack.html#modifying-retention-time-for-prometheus-metrics-data_configuring-the-monitoring-stack
oc edit configmap cluster-monitoring-config -n openshift-monitoring
# Enable prometheus.
cat <<EOF | oc apply -f -
apiVersion: v1
kind: ConfigMap
metadata:
name: cluster-monitoring-config
namespace: openshift-monitoring
data:
config.yaml: |
prometheusK8s:
retention: 2d
EOF
=retention prometheus default=
oc get Prometheus k8s -n openshift-monitoring -o json | jq -r .spec.retention
oc -n openshift-monitoring exec -c prometheus prometheus-k8s-0 -- curl -s "http://localhost:9090/api/v1/status/runtimeinfo" | jq -r '.data.storageRetention'

=EFK(elk)=
ElasticSearch
# Fluentd
processing pipeline
# Kibana.
https://kibana-openshift-logging.apps.<url>

=grafana=
# grafana
https://grafana-openshift-monitoring.apps.<url>
=pull secret=
Get pull secret
<pre>
oc get secret/pull-secret -n openshift-config -o jsonpath='{.data.\.dockerconfigjson}' | base64 -d | jq .
oc get secret/pull-secret -n openshift-config --template='Template:Index .data ".dockerconfigjson"' -o json | jq .
oc get secret/pull-secret -n openshift-config --template='{{index .data ".dockerconfigjson" | base64decode}}' -o json | jq .
</pre>
Just the keys.
oc get secret/pull-secret -n openshift-config --template='Template:Index .data ".dockerconfigjson"' -o json | jq -r '.data.".dockerconfigjson"' | base64 -d | jq .
Name of each key and email.
oc get secret/pull-secret -n openshift-config --template='Template:Index .data ".dockerconfigjson"' -o json | jq -r '.data.".dockerconfigjson"' | base64 -d | jq -r '.auths | with_entries(.value = .value.email)' | sed 's/{//g;s/}//g;s/"//g' | grep -v '^$' | sed 's/ *//g' | sort
Download pull secret.
<pre>
oc get secret/pull-secret -n openshift-config --template='{{index .data ".dockerconfigjson" | base64decode}}' > /tmp/pull_secret.$(oc whoami --show-console=true | awk -F / '{print $3}').$(date '+%Y-%m-%d_%H-%M-%S')
</pre>
Set pull secret.
oc set data secret/pull-secret -n openshift-config --from-file=.dockerconfigjson=/tmp/pull_secret_<file_name>
==has pull secret been update==
<pre>
echo '#' pull-secret ; oc get secret/pull-secret -n openshift-config --template='{{index .data ".dockerconfigjson" | base64decode}}' | jq -r '.auths[].email'
echo '#' apiserver ; oc exec deployment/apiserver -n openshift-apiserver -c openshift-apiserver -- cat /var/lib/kubelet/config.json | jq
echo '#' nodes ; oc get nodes -o name | xargs -I {} oc debug {} -- chroot /host sh -c 'cat /var/lib/kubelet/config.json | jq'
</pre>

==Does pull secret work==
jq . /tmp/pull_secret.2024-01-10_12-00-01.registry.redhat.io
{
"auths": {
"registry.redhat.io": {
"auth": "YmxhYmxh"
}
}
}
podman pull --authfile /tmp/pull_secret.2024-01-10_12-00-01.registry.redhat.io registry.redhat.io/ubi8/ubi:latest
==Which pull secret does machineconfig contain==
oc get mc 00-master -o json | jq -r '.spec.config.storage.files[]|select(.path=="/var/lib/kubelet/config.json")|.contents.source' | perl -pe 's/%([0-9a-f]{2})/sprintf("%s", pack("H2",$1))/eig' | sed 's/^data:,//g' | jq .
==Is pull secret correct in machineconfigpool. Rendered config==
oc get mc rendered-master-3626460c7752fc1605e94c19b7a9aba7 -o json | jq -r '.spec.config.storage.files[]|select(.path=="/var/lib/kubelet/config.json")|.contents.source' | sed 's/^data:,//g' | perl -pe 's/%([0-9a-f]{2})/sprintf("%s", pack("H2",$1))/eig'| jq .

=change number of nodes=
oc get machineset -n openshift-machine-api
oc edit machineset -n openshift-machine-api <MachineSet>
=Elasticsearch status=
oc exec -n openshift-logging -c elasticsearch $(oc get pods -n openshift-logging -l component=elasticsearch -o custom-columns=:.metadata.name --no-headers | head -1) -- es_util --query=_cat/health?v
oc exec -n openshift-logging -c elasticsearch $(oc get pods -n openshift-logging -l component=elasticsearch -o custom-columns=:.metadata.name --no-headers | head -1) -- es_util --query=_cluster/health?pretty

=talk to elasticsearch=
oc rsh elasticsearch-cdm-q8apadpa-1-65f99d99b4-8b9wg
curl -s --key /etc/elasticsearch/secret/admin-key --cert /etc/elasticsearch/secret/admin-cert --cacert /etc/elasticsearch/secret/admin-ca https://localhost:9200
Oneliner
oc exec -n openshift-logging -c elasticsearch $(oc get pods -l component=elasticsearch -o custom-columns=:.metadata.name --no-headers -n openshift-logging | head -1) -- curl -s --key /etc/elasticsearch/secret/admin-key --cert /etc/elasticsearch/secret/admin-cert --cacert /etc/elasticsearch/secret/admin-ca https://localhost:9200
=Free disk space/reclaim=
oc exec -n openshift-logging -c elasticsearch $(oc get pods -l component=elasticsearch -o custom-columns=:.metadata.name --no-headers -n openshift-logging | head -1) -- curl -s --key /etc/elasticsearch/secret/admin-key --cert /etc/elasticsearch/secret/admin-cert --cacert /etc/elasticsearch/secret/admin-ca "https://localhost:9200/_forcemerge?only_expunge_deletes=true" -X POST

=which version of elasticsearch operator is installed=
oc get csv -n openshift-operators-redhat -l operators.coreos.com/elasticsearch-operator.openshift-operators-redhat="" -o=custom-columns='VERSION:.spec.version' --no-headers
==list nodes==
oc exec -c elasticsearch $(oc get pods -l component=elasticsearch -o custom-columns=:.metadata.name --no-headers | tail -1) -- es_util --query="_cat/nodes?v"
==Who is master node==
oc exec -c elasticsearch $(oc get pods -l component=elasticsearch -o custom-columns=:.metadata.name --no-headers | tail -1) -- es_util --query="_cat/master?v"
==Is cluster recovering==
oc exec -c elasticsearch $(oc get pods -l component=elasticsearch -o custom-columns=:.metadata.name --no-headers | tail -1) -- es_util --query="_cat/recovery?active_only=true"
==Look at all indices==
oc exec -n openshift-logging -c elasticsearch $(oc get pods -n openshift-logging -l component=elasticsearch -o custom-columns=:.metadata.name --no-headers | tail -1) -- es_util --query=_cat/indices?v

export INDICE=<indice> ; oc exec -n openshift-logging -c elasticsearch $(oc get pods -n openshift-logging -l component=elasticsearch -o custom-columns=:.metadata.name --no-headers | tail -1) -- es_util --query=$INDICE -XDELETE

=look at chards=
oc exec -c elasticsearch $(oc get pods -l component=elasticsearch -o custom-columns=:.metadata.name --no-headers | tail -1) -- es_util --query=_cat/indices?v
=Create audit index=
oc exec -n openshift-logging -c elasticsearch $(oc get pods -n openshift-logging -l component=elasticsearch -o custom-columns=:.metadata.name --no-headers | head -1) -- es_util --query=audit-000001 -XPUT
==Remove all red indices.==
oc exec -c elasticsearch $(oc get pods -l component=elasticsearch -o custom-columns=:.metadata.name --no-headers | tail -1) -- es_util --query=_cat/indices?v | grep ^red | awk '{print $3}' | while read i ; do echo '*' $i ; oc exec -c elasticsearch $(oc get pods -l component=elasticsearch -o custom-columns=:.metadata.name --no-headers | tail -1) -- es_util --query=${i} -X DELETE ; done
==recreate elasticsearch pvc:s==
# scale down elasticsearch to 0 pods to be able to remove pvc:s
oc get deployment -l component=elasticsearch -o custom-columns=NAME:.metadata.name --no-headers -n openshift-logging | while read DEPLOYMENT ; do echo '*' $DEPLOYMENT ; oc scale deployment $DEPLOYMENT --replicas 0 ; done
# Remove pvc:s.
oc delete pvc -l logging-cluster=elasticsearch -n openshift-logging
# scale up elasticsearch to 0 pods to be able to remove pvc:s
oc get deployment -l component=elasticsearch -o custom-columns=NAME:.metadata.name --no-headers -n openshift-logging | while read DEPLOYMENT ; do echo '*' $DEPLOYMENT ; oc scale deployment $DEPLOYMENT --replicas 1 ; done

=vsphere creds=
oc get -n kube-system cm/cluster-config-v1 -o yaml
=does vsphere account have expected permissions=
oc logs -n openshift-cluster-storage-operator -l name=vsphere-problem-detector-operator --timestamps --tail=100 | less

=Enable openshift/okd logging=
==Enable redhat-operators==
oc patch OperatorHub cluster --type json -p '[{"op": "add", "path": "/spec/disableAllDefaultSources", "value": false}]'
Or edit individual operator.
oc edit operatorhubs
Spec:
Disable All Default Sources: true
Sources:
Disabled: false
Name: community-operators
Disabled: false
Name: redhat-operators
Or patch OperatorHub for individual operators
oc patch operatorhub cluster --type='json' -p='[{"op": "add", "path": "/spec/sources/-", "value":{"name":"redhat-operators","disabled":false}}]'

==Create namespace==
cat <<EOF | oc apply -f -
apiVersion: v1
kind: Namespace
metadata:
name: openshift-operators-redhat
annotations:
openshift.io/node-selector: ""
labels:
openshift.io/cluster-monitoring: "true"
EOF
==Create namespace==
cat <<EOF | oc apply -f -
apiVersion: v1
kind: Namespace
metadata:
name: openshift-logging
annotations:
openshift.io/node-selector: ""
labels:
openshift.io/cluster-monitoring: "true"
EOF
==Create operatorgroup==
cat <<EOF | oc apply -f -
apiVersion: operators.coreos.com/v1
kind: OperatorGroup
metadata:
name: openshift-operators-redhat
namespace: openshift-operators-redhat
spec: {}
EOF
==Subscribe to OpenShift Elasticsearch Operator==
cat <<EOF | oc apply -f -
apiVersion: operators.coreos.com/v1alpha1
kind: Subscription
metadata:
name: "elasticsearch-operator"
namespace: "openshift-operators-redhat"
spec:
channel: "stable"
installPlanApproval: "Automatic"
source: "redhat-operators"
sourceNamespace: "openshift-marketplace"
name: "elasticsearch-operator"
EOF
==Install the openshift logging operator.==
cat <<EOF | oc apply -f -
apiVersion: operators.coreos.com/v1
kind: OperatorGroup
metadata:
name: cluster-logging
namespace: openshift-logging
spec:
targetNamespaces:
- openshift-logging
EOF
==Create a subscription object yaml file.==
cat <<EOF | oc apply -f -
apiVersion: operators.coreos.com/v1alpha1
kind: Subscription
metadata:
name: cluster-logging
namespace: openshift-logging
spec:
channel: "stable"
name: cluster-logging
source: redhat-operators
sourceNamespace: openshift-marketplace
EOF
==Create OpenShift Logging instance.==
cat <<EOF | oc apply -f -
apiVersion: "logging.openshift.io/v1"
kind: "ClusterLogging"
metadata:
name: "instance"
namespace: "openshift-logging"
spec:
managementState: "Managed"
logStore:
type: "elasticsearch"
retentionPolicy:
application:
maxAge: 1d
infra:
maxAge: 7d
audit:
maxAge: 7d
elasticsearch:
nodeCount: 3
storage:
storageClassName: "standard-csi"
size: 200G
resources:
limits:
memory: "16Gi"
requests:
memory: "16Gi"
proxy:
resources:
limits:
memory: 256Mi
requests:
memory: 256Mi
redundancyPolicy: "SingleRedundancy"
visualization:
type: "kibana"
kibana:
replicas: 1
collection:
logs:
type: "fluentd"
fluentd: {}
EOF

=telemetry=
Restart telemetry.
oc delete pod -n openshift-monitoring -l app.kubernetes.io/component=telemetry-metrics-collector
=Update vsphere/openstack creds=
oc edit cm cloud-provider-config -n openshift-config
default-datastore = "cl07-2-fc-loc-001"

=Get datastore=
oc get cm cloud-provider-config -n openshift-config -o json | jq -r .data.config | sed -nr "/^\[Workspace\]/ { :l /^default-datastore[ ]*=/ { s/[^=]*=[ ]*//; p; q;}; n; b l;}"

=Manage labels.=
Add a label to a node or pod:
oc label node node001.krenger.ch mylabel=myvalue
oc label pod mypod-34-g0f7k mylabel=myvalue
Remove a label (in the example “mylabel”) from a node or pod:
oc label node node001.krenger.ch mylabel-
oc label pod mypod-34-g0f7k mylabel-
Permanently label a node
oc edit machineset ocp-qz7hf-worker-us-west-1b -n openshift-machine-api
=rollout=
Restart pod in an deployment
oc rollout restart deployment -n openshift-storage csi-rbdplugin-provisioner
=api.<URL>=
openssl_x509_multi_line <(oc get secrets external-loadbalancer-serving-certkey -n openshift-kube-apiserver -o json | jq -r '.data."tls.crt"|@base64d')
=ssl certificates replace=
How to replace api.<url> and star.apps.<url> certs.
# api. Create full chain cert. Public - intermediate - root ca.
api.<url>.crt
api.<url>.key
# create secret
oc delete secret api-cert -n openshift-config
oc create secret tls api-cert --cert=api.<url>.crt --key=api.<url>.key -n openshift-config
# patch apiserver
oc patch apiserver cluster --type=merge -p '{"spec":{"servingCerts": {"namedCertificates": [{"names": ["api.<url>"], "servingCertificate": {"name": "api-cert"}}]}}}'
...
# star.apps. Create full chain cert. Public - intermediate - root ca.
star.apps.<url>.crt
star.apps.<url>.key
# create secret
oc delete secret custom-certs-default -n openshift-ingress
oc create secret tls custom-certs-default --cert=star.apps.<url>.crt --key=star.apps.<url>.key -n openshift-ingress
# patch ingress controller
oc patch --type=merge --namespace openshift-ingress-operator ingresscontrollers/default --patch '{"spec":{"defaultCertificate":{"name":"custom-certs-default"}}}'
==edit serving certs==
look at api cert
oc get secret -n openshift-config $(oc get apiservers cluster -o json | jq -r '.spec.servingCerts.namedCertificates[].servingCertificate.name') -o json | jq -r '.data."tls.crt"' | base64 -d
Patch secret api cert
oc patch secret -n openshift-config $(oc get apiservers cluster -o json | jq -r '.spec.servingCerts.namedCertificates[].servingCertificate.name') -p '{"data":{"tls.crt": "<new-base64-encoded-certificate>"}}'
Look at ingress cert. wildcard.apps.<url>
oc get secret -n openshift-ingress $(oc get -n openshift-ingress-operator ingresscontrollers default -o json | jq -r .spec.defaultCertificate.name) -o json | jq -r '.data."tls.crt"' | base64 -d
Patch secret ingress wildcard.apps.<url>
oc patch secret -n openshift-ingress $(oc get -n openshift-ingress-operator ingresscontrollers default -o json | jq -r .spec.defaultCertificate.name) -p '{"data":{"tls.crt": "<new-base64-encoded-certificate>"}}'

=After you update above certificates then the following config map is updated to reflect that=
openssl_x509_multi_line <(oc get cm kube-root-ca.crt -o json | jq -r '.data."ca.crt"')
=get cluster-id=
oc get clusterversion/version -o jsonpath="{.spec.clusterID}"

=api=
Process running api server. They scale horizontally. They all serve requests.
openshift-kube-apiserver
kube-apiserver
=kube-proxy=
kube-proxy is a network proxy that runs on each node in your cluster, implementing part of the Kubernetes Service concept.
kube-proxy maintains network rules on nodes. These network rules allow network communication to your Pods from network sessions inside or outside of your cluster.
kube-proxy uses the operating system packet filtering layer if there is one and it's available. Otherwise, kube-proxy forwards the traffic itself.
=Resource Allocation=
OS and Kubernetes overhead. You can see the reserved OS & Kubernetes overhead by comparing the Allocatable (what the Kubernetes Scheduler can allocate to Pods) and the Capacity.
Capacity:
->cpu: 4
ephemeral-storage: 125293548Ki
hugepages-1Gi: 0
hugepages-2Mi: 0
->memory: 16409360Ki
pods: 250
Allocatable:
->cpu: 3500m
ephemeral-storage: 114396791822
hugepages-1Gi: 0
hugepages-2Mi: 0
->memory: 15258384Ki
pods: 250
==requests/limits==
User pod allocation is calculated by looking at the “Requests” resource columns from the kubectl get nodes output.
The relevant columns here are the “Requests, not Limits.
Requests impact how the pod is scheduled, and what resources are allocated to it,
whereas limits are used to enable pods to burst beyond their allocation.
==look at current Allocated resources==
oc get nodes --no-headers --selector="node-role.kubernetes.io/worker" -o=custom-columns='NAME:.metadata.name' | while read NODE ; do oc describe node $NODE | grep "Allocated resources:" -A10 | grep -E ' cpu | memory ' | while read RESOURCE ; do echo $NODE $RESOURCE ; done ; done

==empty space==
Allocatable - Allocated resources = empty
Allocatable:
cpu: 3500m
ephemeral-storage: 114396791822
hugepages-1Gi: 0
hugepages-2Mi: 0
memory: 15258384Ki
pods: 250
...
Allocated resources:
(Total limits may be over 100 percent, i.e., overcommitted.)
Resource Requests Limits
-------- -------- ------
cpu 834m (23%) 0 (0%)
memory 2474Mi (16%) 736Mi (4%)
ephemeral-storage 0 (0%) 0 (0%)
hugepages-1Gi 0 (0%) 0 (0%)
hugepages-2Mi 0 (0%) 0 (0%)
=status of namespace=
Show an overview of the current project
oc status
=age of cluster=
Looking at age of machines.
oc get nodes -o json | jq -r '.items[].metadata.creationTimestamp' | sort -n | sed 's/T/ /g;s/Z//g'
=oc adm inspect=
oc adm inspect namespace/isilon
tar cf /tmp/inspect.isilon.$(date_file ) inspect.local.*
=Operations Lifecycle manager(olm)=
oc logs -l app=olm-operator -n openshift-operator-lifecycle-manager --tail=-1
=Reinstall operator that is no longer available with current openshift version=
# Force install odf which is not possible to install because openshift has moved more than 1 version.
# Save subscription
for i in operators.coreos.com/mcg-operator.openshift-storage= operators.coreos.com/ocs-operator.openshift-storage= operators.coreos.com/odf-csi-addons-operator.openshift-storage= operators.coreos.com/odf-operator.openshift-storage= ; do
oc get subscription -o yaml -l $i > oc_get_subscription_${i//\//_}.yaml ; done
...
# Save operators
for i in operators.coreos.com/odf-operator.openshift-storage= operators.coreos.com/ocs-operator.openshift-storage= operators.coreos.com/mcg-operator.openshift-storage= operators.coreos.com/odf-csi-addons-operator.openshift-storage= ; do
oc get csv -l $i -o yaml > oc_get_csv_-l_${i//\//_}.yaml ; done
...
# Confirm backup files contain usable yaml. Have we forgotten any operators or csv:s. Remove resources clearly not related to odf.
...
# delete the existing ODF related subscriptions and the ClusterServiceVersions related:
for i in operators.coreos.com/mcg-operator.openshift-storage= operators.coreos.com/ocs-operator.openshift-storage= operators.coreos.com/odf-csi-addons-operator.openshift-storage= operators.coreos.com/odf-operator.openshift-storage= ; do
oc delete subscription -l $i; done
for i in operators.coreos.com/odf-operator.openshift-storage= operators.coreos.com/ocs-operator.openshift-storage= operators.coreos.com/mcg-operator.openshift-storage= operators.coreos.com/odf-csi-addons-operator.openshift-storage= ; do
oc delete csv -l $i ; done
...
# Make sure you wait for the CSVs to be deleted before creating a subscription again.
...
# create only the the Subscription again:
# (optional: edit the subscription before recreate, changing the channel version to the goal version)
...
# Recreate subscription
oc create -f 'oc_get_subscription_operators.coreos.com_odf-operator.openshift-storage=.yaml'
# wait watching the events:
oc get events -w

=increase disk on node=
Update worker machineset.
oc patch machinesets -n openshift-machine-api $(oc get machinesets -n openshift-machine-api -o json | jq -r '.items[] | select(.spec.template.metadata.labels."machine.openshift.io/cluster-api-machine-role" == "worker")| .metadata.name') --type merge -p '{"spec": {"template": {"spec": {"providerSpec": {"value": {"rootVolume": {"diskSize" : 50}}}}}}}'
==View results from above==
oc get machinesets -n openshift-machine-api $(oc get machinesets -n openshift-machine-api -o json | jq -r '.items[] | select(.spec.template.metadata.labels."machine.openshift.io/cluster-api-machine-role" == "worker")| .metadata.name') -o yaml | tee /tmp/$(oc get DNS cluster -o=jsonpath='{.spec.baseDomain}').$(date +%F_%H-%M-%S).yaml

==Update on node only==
VOLUME=abjorklund-01-h4sxm-worker-0-rkk87-root
os volume set --size 40 $VOLUME --os-volume-api-version 3.42
dnf install cloud-utils-growpart xfsprogs
ssh core@worker
growpart /dev/sda 4
xfs_growfs /

=increase ram on worker nodes=
oc patch machinesets -n openshift-machine-api $(oc get machinesets -n openshift-machine-api -o json | jq -r '.items[] | select(.spec.template.metadata.labels."machine.openshift.io/cluster-api-machine-role" == "worker")| .metadata.name') --type merge -p '{"spec": {"template": {"spec": {"providerSpec": {"value": {"memoryMiB" : 24576}}}}}}'
=Change flavor of worker node=
oc patch machinesets -n openshift-machine-api $(oc get machinesets -n openshift-machine-api -o json | jq -r '.items[] | select(.spec.template.metadata.labels."machine.openshift.io/cluster-api-machine-role" == "worker")| .metadata.name') --type merge -p '{"spec": {"template": {"spec": {"providerSpec": {"value": {"flavor" : "hm.4x16"}}}}}}'

=set number of worker nodes=
oc patch machinesets -n openshift-machine-api $(oc get machinesets -n openshift-machine-api -o json | jq -r '.items[] | select(.spec.template.metadata.labels."machine.openshift.io/cluster-api-machine-role" == "worker")| .metadata.name') --type merge -p '{"spec": {"replicas" : 2}}'

=clusteroperator=
ClusterOperator is the Custom Resource object which holds the current state of an operator. Clusteroperator is resposible for core, systemwide functions like dns and so on.
oc get clusteroperators
oc get co
oc get clusteroperators -o custom-columns=NAME:.metadata.name,ANNOTATIONS:.metadata.annotations

=ignition=
Retrieve rendered ignition data.
curl https://api-int.$(grep ^search /etc/resolv.conf | awk '{print $NF}'):22623/config/master
curl -v https://api-int.$(grep ^search /etc/resolv.conf | awk '{print $2}'):22623/config/worker

=rockylinux container names=
ubi ("Standard"): OpenSSL, microdnf, and utilities like gzip and vi
ubi-minimal ("Minimal"): Minimized binaries and minimal yum stack.
ubi-init ("Multi-service"): Less than standard but more than minimal, plus systemd.
ubi-micro ("Micro"): Most minimal image without even a package manager.
=create a job/pod/script=

==Create config map of script==
Notice that I have to escape $. Since I give date in a here document. Where $ is being expanded.
cat <<EOF | oc apply -f -
apiVersion: v1
kind: ConfigMap
metadata:
name: dns-lookup.sh
data:
dns-lookup.sh: |
#!/bin/bash
# Verify if dns resolution works and how fast.
while true ; do
for DNS in \$(awk '/^nameserver / {print \$2}' /etc/resolv.conf) 10.2.0.10 ; do
echo \$(date '+%F %H:%M:%S %Z') \$DNS \$(host -v -t A ibm.se 2>&1 | tail -3 )
done
sleep 5
done
EOF

==create job==
cat <<EOF | oc apply -f -
apiVersion: batch/v1
kind: Job
metadata:
name: dns-lookup
spec:
template:
spec:
containers:
- name: dns-lookup
# image: rockylinux/rockylinux:9
image: halfface/rockylinux-toolbox:v2
command: ["/script/dns-lookup.sh"]
volumeMounts:
- name: script
mountPath: "/script"
# securityContext:
# runAsUser: 0
# privileged: true
volumes:
- name: script
configMap:
name: dns-lookup.sh
defaultMode: 0755
restartPolicy: Never
activeDeadlineSeconds: 1209600
EOF

=terminal fix=
No line wraps
tput rmam
=list operatorhub/catalogsources=
oc get catalogsources -n openshift-marketplace
oc get catalogsources -n openshift-marketplace -o custom-columns=NAME:.metadata.name,DISPLAY:.spec.displayName,STATE:.status.connectionState.lastObservedState,TYPE:.spec.sourceType,PUBLISHER:.spec.publisher,IMAGE:.spec.image
oc get catalogsources -n openshift-marketplace -o custom-columns=NAME:.metadata.name,DISPLAY:.spec.displayName,STATE:.status.connectionState.lastObservedState,TYPE:.spec.sourceType,PUBLISHER:.spec.publisher,IMAGE:.spec.image,ADDRESS:.status.connectionState.address

=remove catalogsources=
oc get catalogsources.operators.coreos.com -n openshift-marketplace -l company=cambio --no-headers -o custom-columns=:.metadata.name | while read i ; do echo oc get catalogsources $i -n openshift-marketplace -o yaml \>oc_get_catalogsources.$(oc_api_url).$i.$(date_file).yaml ; echo oc delete catalogsource -n openshift-marketplace $i ; done

=which changes will occure=
. /etc/node-sizing-enabled.env ; NODE_SIZES_ENV=/tmp/node-sizing.env /usr/local/sbin/dynamic-system-reserved-calc.sh true ${SYSTEM_RESERVED_MEMORY} ${SYSTEM_RESERVED_CPU} ${SYSTEM_RESERVED_ES} ; sdiff /etc/node-sizing.env /tmp/node-sizing.env
=SYSTEM_RESERVED=
cat <<EOF | oc apply -f -
apiVersion: machineconfiguration.openshift.io/v1
kind: KubeletConfig
metadata:
name: dynamic-node
spec:
autoSizingReserved: true
machineConfigPoolSelector:
matchLabels:
pools.operator.machineconfiguration.openshift.io/worker: ""
EOF

Which changes will occur.
oc get nodes -o name | xargs -I {} oc debug {} -- chroot /host sh -c 'hostname ; . /etc/node-sizing-enabled.env ; NODE_SIZES_ENV=/tmp/node-sizing.env /usr/local/sbin/dynamic-system-reserved-calc.sh true ${SYSTEM_RESERVED_MEMORY} ${SYSTEM_RESERVED_CPU} ${SYSTEM_RESERVED_ES} ; sdiff /etc/node-sizing.env /tmp/node-sizing.env' 2>/dev/null
==which processes is it complaining about==
systemd-cgls /system.slice | grep -o '[^─]*\.service' | cat -v | sed 's/^\^\[\[0m//g' | while read i ; do echo -e "$(systemctl show -p MemoryCurrent $i | awk -F = '{print $2}')\t$i" ; done | column -t -s $'\t' | sort -n

=CNI=
oc get networks cluster -o 'custom-columns=NETWORKTYPE:.spec.networkType'
Cni from install
echo -e "$(oc --request-timeout=5 get -n kube-system cm/cluster-config-v1 -o json | jq -r '."data"."install-config"')" | python -c 'import sys, yaml, json; json.dump(yaml.safe_load(sys.stdin), sys.stdout, indent=4)' | jq -r .networking.networkType
=autoscale.=
https://docs.openshift.com/container-platform/4.12/machine_management/applying-autoscaling.html
==ClusterAutoscaler==
# The two below has to be configured.
apiVersion: autoscaling.openshift.io/v1
kind: ClusterAutoscaler
metadata:
name: default
spec:
logVerbosity: 4
podPriorityThreshold: -10
resourceLimits:
cores:
max: 128
min: 0
maxNodesTotal: 24
memory:
max: 256
min: 0
scaleDown:
delayAfterAdd: 10m
delayAfterDelete: 5m
delayAfterFailure: 30s
enabled: true
unneededTime: 5m
utilizationThreshold: "0.4"
==MachineAutoscaler==
apiVersion: autoscaling.openshift.io/v1beta1
kind: MachineAutoscaler
metadata:
name: abjorklund-01-4rp8x-worker-1
namespace: openshift-machine-api
spec:
maxReplicas: 12
minReplicas: 0
scaleTargetRef:
apiVersion: machine.openshift.io/v1beta1
kind: MachineSet
name: abjorklund-01-4rp8x-worker-1
==Machineset example where machine is labeled and tainted.==
apiVersion: machine.openshift.io/v1beta1
kind: MachineSet
metadata:
annotations:
autoscaling.openshift.io/machineautoscaler: openshift-machine-api/abjorklund-01-4rp8x-worker-1
capacity.cluster-autoscaler.kubernetes.io/cpu: "4"
capacity.cluster-autoscaler.kubernetes.io/memory: "17179869184"
machine.openshift.io/cluster-api-autoscaler-node-group-max-size: "12"
machine.openshift.io/cluster-api-autoscaler-node-group-min-size: "0"
machine.openshift.io/memoryMb: "16384"
machine.openshift.io/vCPU: "4"
labels:
machine.openshift.io/cluster-api-cluster: abjorklund-01-4rp8x
machine.openshift.io/cluster-api-machine-role: worker
machine.openshift.io/cluster-api-machine-type: worker
name: abjorklund-01-4rp8x-worker-1
namespace: openshift-machine-api
spec:
replicas: 0
selector:
matchLabels:
machine.openshift.io/cluster-api-cluster: abjorklund-01-4rp8x
machine.openshift.io/cluster-api-machineset: abjorklund-01-4rp8x-worker-1
template:
metadata:
labels:
machine.openshift.io/cluster-api-cluster: abjorklund-01-4rp8x
machine.openshift.io/cluster-api-machine-role: worker
machine.openshift.io/cluster-api-machine-type: worker
machine.openshift.io/cluster-api-machineset: abjorklund-01-4rp8x-worker-1
spec:
metadata:
labels:
stress: stress
providerSpec:
value:
apiVersion: machine.openshift.io/v1alpha1
cloudName: openstack
cloudsSecret:
name: openstack-cloud-credentials
namespace: openshift-machine-api
flavor: hm.4x16
image: ""
kind: OpenstackProviderSpec
metadata:
creationTimestamp: null
networks:
- subnets:
- filter:
name: abjorklund-01-4rp8x-nodes
tags: openshiftClusterID=abjorklund-01-4rp8x
rootVolume:
diskSize: 64
sourceUUID: abjorklund-01-4rp8x-rhcos
volumeType: ssd
securityGroups:
- name: abjorklund-01-4rp8x-worker
- uuid: 1de812c6-ed8b-4212-a486-ca283dbe1444
serverGroupName: abjorklund-01-4rp8x-worker-1
serverMetadata:
Name: abjorklund-01-4rp8x-worker
openshiftClusterID: abjorklund-01-4rp8x
tags:
- openshiftClusterID=abjorklund-01-4rp8x
userDataSecret:
name: worker-user-data
taints:
- effect: NoExecute
key: stress
value: stress

==autoscaler does not scale down==
oc logs -l cluster-autoscaler=default -n openshift-machine-api --tail=-1 --timestamps=true
==Add dynamic load to cluster. deployment==
apiVersion: apps/v1
kind: Deployment
metadata:
annotations:
deployment.kubernetes.io/revision: "7"
labels:
app: stress
name: stress
namespace: stress
spec:
progressDeadlineSeconds: 600
replicas: 0
revisionHistoryLimit: 10
selector:
matchLabels:
app: stress
strategy:
rollingUpdate:
maxSurge: 25%
maxUnavailable: 25%
type: RollingUpdate
template:
metadata:
annotations:
kubectl.kubernetes.io/restartedAt: "2025-01-24T09:52:22+01:00"
creationTimestamp: null
labels:
app: stress
spec:
containers:
- command:
- /mnt/bin/stress.sh
image: halfface/rockylinux-toolbox:v3
imagePullPolicy: IfNotPresent
livenessProbe:
exec:
command:
- bash
- -c
- ps uxawww | grep -q [s]tress && echo 0 || echo 1
failureThreshold: 3
periodSeconds: 10
successThreshold: 1
timeoutSeconds: 1
name: stress
resources:
requests:
cpu: 700m
memory: 300Mi
terminationMessagePath: /dev/termination-log
terminationMessagePolicy: File
volumeMounts:
- mountPath: /mnt/bin/
name: stress
dnsPolicy: ClusterFirst
nodeSelector:
stress: stress
restartPolicy: Always
schedulerName: default-scheduler
terminationGracePeriodSeconds: 30
tolerations:
- effect: NoExecute
key: stress
value: stress
volumes:
- configMap:
defaultMode: 493
name: stress.sh
name: stress
==configmap==
apiVersion: v1
data:
stress.sh: |
#!/bin/bash
# stress pod.
while true ; do
echo $(date '+%F %H:%M:%S %Z') $( stress -m 1 --vm-bytes 1000M --vm-keep -t 300s )
sleep 5
done
kind: ConfigMap
metadata:
name: stress.sh
namespace: stress

=change dns server for domain=
oc edit dns.operator/default
apiVersion: operator.openshift.io/v1
kind: DNS
metadata:
name: default
spec:
servers:
- name: halffce-server
zones:
- halfface.se
forwardPlugin:
policy: Random
upstreams: 10.111.222.2
# View config.
oc get configmap/dns-default -n openshift-dns -o yaml

=coredns=
# tail logs.
oc get events -A --sort-by=.metadata.creationTimestamp
# Change debug level.
oc patch dnses.operator.openshift.io/default -p '{"spec":{"logLevel":"Debug"}}' --type=merge
Sets
log . {
class denial error
}
oc patch dnses.operator.openshift.io/default -p '{"spec":{"logLevel":"Trace"}}' --type=merge
Sets
log . {
class all
}
oc patch dnses.operator.openshift.io/default -p '{"spec":{"logLevel":"Normal"}}' --type=merge
Sets
log . {
class error
}
==Get log files for analyze==
oc get pods -l dns.operator.openshift.io/daemonset-dns=default -o custom-columns=POD:.metadata.name,NODE:.spec.nodeName --no-headers -n openshift-dns | while read i j ; do oc logs $i --tail=-1 -c dns --timestamps=true -n openshift-dns > /tmp/oc_logs_$j.$i.$(oc get DNS cluster -o=jsonpath='{.spec.baseDomain}').$(date +%F_%H-%M-%S) ; done

=get instance dns name=
oc get DNS cluster -o=jsonpath='{.spec.baseDomain}'
=Read values provided by coredns /metrics=
oc exec -it -n openshift-dns $(oc get pods -l dns.operator.openshift.io/daemonset-dns=default --no-headers -n openshift-dns| head -1) -- curl -s http://localhost:9153/metrics
=coredns default logformat=
# Default format
{remote}:{port} - {>id} "{type} {class} {name} {proto} {size} {>do} {>bufsize}" {rcode} {>rflags} {rsize} {duration}
# Values explained
{port}: client’s port
{remote}: client’s IP address, for IPv6 addresses these are enclosed in brackets: [::1]
{>id}: query ID
{type}: qtype of the request
{class}: qclass of the request
{name}: qname of the request
{proto}: protocol used (tcp or udp)
{size}: request size in bytes
{>do}: is the EDNS0 DO (DNSSEC OK) bit set in the query
{>bufsize}: the EDNS0 buffer size advertised in the query
{rcode}: response RCODE
{>rflags}: response flags, each set flag will be displayed, e.g. “aa, tc”. This includes the qr bit as well
{rsize}: raw (uncompressed), response size (a client may receive a smaller response)
{duration}: response duration
=Confirm that coredns hosts are possible to resolve=
<pre>
grep match /etc/coredns/Corefile | uniq | sed 's/\[//g;s/\]//g;s/^ *match //g;s/\.\*/test/g;s/^\^//g' | while read i ; do echo $(dig +short ${i}.) ${i}. ; done
</pre>

=Create lets encrypt certificates on dns domain in route53 which is managed by certmanager.=
#Create a domain in route 53.
#Create a user with a token for "Application running outside AWS"
==Fill in below values to be able to update config below.==
Hosted_Zone_id: <Hosted_Zone_id>
Access_key: <Access_key>
Secret_access_key: <Secret_access_key>
DNS_Domain: <DNS_Domain>
DNS_shortname: <DNS_shortname>
==Attach the following policy to your newly created user.==
(Populate all <Values> below.)
{
"Version": "2023-11-22",
"Statement": [
{
"Effect": "Allow",
"Action": "route53:GetChange",
"Resource": "arn:aws:route53:::change/*"
},
{
"Effect": "Allow",
"Action": "route53:ChangeResourceRecordSets",
"Resource": "arn:aws:route53:::hostedzone/<Hosted_Zone_id>"
},
{
"Effect": "Allow",
"Action": "route53:ListHostedZonesByName",
"Resource": "*"
}
]
}
==Create namespace==
oc create namespace cert-manager
==Install cert-manager community version via graphical fluff.==
==Create secret that includes <Secret_access_key>.==
oc create secret generic route53-secret --from-literal=secret-access-key="<Secret_access_key>" -n cert-manager
==Create ClusterIssuer for letsencrypt which uses route53 to show that you own dns.==
cat <<EOF | oc apply -f -
apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
name: letsencrypt-prod-dns
namespace: cert-manager
spec:
acme:
server: https://acme-v02.api.letsencrypt.org/directory
email: support@company.se
# Name of a secret used to store the ACME account private key
privateKeySecretRef:
name: <DNS_shortname>-issuer-account-key
solvers:
- selector:
dnsZones:
- "<DNS_Domain>"
dns01:
route53:
accessKeyID: <Access_key>
secretAccessKeySecretRef:
name: route53-secret
key: secret-access-key
hostedZoneID: <Hosted_Zone_id>
region: 'us-east-1'
EOF

==Create api certificate.==
cat <<EOF | oc apply -f -
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
name: cert-api
namespace: openshift-config
spec:
issuerRef:
name: letsencrypt-prod-dns
kind: ClusterIssuer
dnsNames:
- "api.<DNS_Domain>"
secretName: le-api-cert
commonName: "api.<DNS_Domain>"
EOF
==Start to use api certificate.==
oc patch apiserver cluster --type=merge -p '{"spec":{"servingCerts": {"namedCertificates": [{"names": ["api.<DNS_Domain>"], "servingCertificate": {"name": "le-api-cert"}}]}}}'

==Create ingress certificate==
cat <<EOF | oc apply -f -
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
name: le-wildcard-apps-certificate
namespace: openshift-ingress
spec:
issuerRef:
name: letsencrypt-prod-dns
kind: ClusterIssuer
dnsNames:
- "*.apps.<DNS_Domain>"
secretName: le-wildcard-apps-certificate
commonName: "*.apps.<DNS_Domain>"
EOF
==Start to use ingress certificate.==
oc patch --type=merge --namespace openshift-ingress-operator ingresscontrollers/default --patch '{"spec":{"defaultCertificate":{"name":"le-wildcard-apps-certificate"}}}'
=resolv.conf=
ndots 5. This means that the DNS client will automatically consider a domain name to be fully qualified (which will allow it to skip the search path iteration) if it has five or more dots.
=bind to external login sources ldap ad=
oc get authentications.operator.openshift.io cluster -o yaml
=get machine name and creation time=
oc get machines -o=custom-columns='NAME:.metadata.name,CREATIONTIMESTAMP:.metadata.creationTimestamp,TYPE:.spec.providerSpec.value.flavor,STATUS:.status.phase' -n openshift-machine-api

=setup nfs server=
nfs export shared between pods.
==Create server==
openstack server create --flavor gp.1x2 --availability-zone europe-se-1a --image rocky-8-x86_64 --boot-from-volume 30 --network abjorklund-01-bmc7w-openshift --security-group ssh_allow --key-name abjorklund_ed25519 abjorklund_$(date_file)
openstack volume create --size 50 --type ssd --description "nfs storage block device 0" nfs_storage_abjorklund-01
openstack server add volume e93d2db1-6d95-4364-a236-0bd1b9255e90 28adbdb9-c88d-4397-9a79-b13c505016a8 --device /dev/vdb
==install nfs dependencis==
dnf -y install cloud-utils-growpart nfs-utils iptables-utils epel-release vim-enhanced
==How to grow filesystem.==
partx growpart
os volume set --size 60 nfs_storage_abjorklund-01 --os-volume-api-version 3.42
==Create partion and disk.==
gdisk /dev/sdb
mkfs.ext4 /dev/sdb1
find /dev/ -ls | grep sdb | grep by-uuid
==Mount drive. /etc/fstab==
UUID=66998126-9f18-44ce-a462-827c870a57bd /netstorage ext4 defaults 0 0
mkdir /netstorage
mount /netstorage/
mkdir /netstorage/abjorklund-01
chmod 777 /netstorage/abjorklund-01
==export drive==
systemctl enable nfs-server.service --now
/etc/exports
/netstorage/abjorklund-01 10.1.0.0/16(rw,root_squash)
exportfs -rav

==setup deployment==
# deployment.yaml
cat <<EOF | oc apply -f -
apiVersion: apps/v1
kind: Deployment
metadata:
name: nfs-client-provisioner
labels:
app: nfs-client-provisioner
# replace with namespace where provisioner is deployed
namespace: default
spec:
replicas: 1
strategy:
type: Recreate
selector:
matchLabels:
app: nfs-client-provisioner
template:
metadata:
labels:
app: nfs-client-provisioner
spec:
affinity:
nodeAffinity:
requiredDuringSchedulingIgnoredDuringExecution:
nodeSelectorTerms:
- matchExpressions:
- key: node-role.kubernetes.io/worker
operator: Exists
serviceAccountName: nfs-client-provisioner
securityContext:
supplementalGroups:
- 65534
- 1261150637
containers:
- name: nfs-client-provisioner
image: gcr.io/k8s-staging-sig-storage/nfs-subdir-external-provisioner:v4.0.0
volumeMounts:
- name: nfs-client-root
mountPath: /persistentvolumes
env:
- name: PROVISIONER_NAME
value: auto-nfs-storage
- name: NFS_SERVER
value: 10.1.0.48
- name: NFS_PATH
value: "/netstorage/abjorklund-01"
volumes:
- name: nfs-client-root
nfs:
server: 10.1.0.48
path: /netstorage/abjorklund-01
EOF
# nfs-clusterrolebinding.yaml
cat <<EOF | oc apply -f -
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: run-nfs-client-provisioner
subjects:
- kind: ServiceAccount
name: nfs-client-provisioner
# replace with namespace where provisioner is deployed
namespace: default
roleRef:
kind: ClusterRole
name: nfs-client-provisioner-runner
apiGroup: rbac.authorization.k8s.io
EOF
# nfs-clusterrole.yaml
cat <<EOF | oc apply -f -
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: nfs-client-provisioner-runner
rules:
- apiGroups: [""]
resources: ["persistentvolumes"]
verbs: ["get", "list", "watch", "create", "delete"]
- apiGroups: [""]
resources: ["persistentvolumeclaims"]
verbs: ["get", "list", "watch", "update"]
- apiGroups: ["storage.k8s.io"]
resources: ["storageclasses"]
verbs: ["get", "list", "watch"]
- apiGroups: [""]
resources: ["events"]
verbs: ["create", "update", "patch"]
EOF
# nfs-rolebinding.yaml
cat <<EOF | oc apply -f -
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: leader-locking-nfs-client-provisioner
# replace with namespace where provisioner is deployed
namespace: default
subjects:
- kind: ServiceAccount
name: nfs-client-provisioner
# replace with namespace where provisioner is deployed
namespace: default
roleRef:
kind: Role
name: leader-locking-nfs-client-provisioner
apiGroup: rbac.authorization.k8s.io
EOF
# nfs-role.yaml
cat <<EOF | oc apply -f -
kind: Role
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: leader-locking-nfs-client-provisioner
# replace with namespace where provisioner is deployed
namespace: default
rules:
- apiGroups: [""]
resources: ["endpoints"]
verbs: ["get", "list", "watch", "create", "update", "patch"]
EOF
# nfs-sa.yaml
cat <<EOF | oc apply -f -
apiVersion: v1
kind: ServiceAccount
metadata:
name: nfs-client-provisioner
# replace with namespace where provisioner is deployed
namespace: default
EOF
# storageclass.yaml
cat <<EOF | oc apply -f -
apiVersion: storage.k8s.io/v1
kind: StorageClass
metadata:
name: managed-nfs-storage
provisioner: auto-nfs-storage # or choose another name, must match deployment's env PROVISIONER_NAME'
parameters:
onDelete: delete
EOF
# test-claim.yaml
cat <<EOF | oc apply -f -
kind: PersistentVolumeClaim
apiVersion: v1
metadata:
name: test-claim
namespace: default
spec:
storageClassName: managed-nfs-storage
accessModes:
- ReadWriteMany
resources:
requests:
storage: 1Mi
EOF
=set nfs csi driver=
https://github.com/kubernetes-csi/csi-driver-nfs

=dns=
https://access.redhat.com/solutions/3804501
==confirm upstream dns works==
for UPSTREAM_DNS_IP in 10.46.201.1 10.46.201.2 10.46.201.3 ; do UPSTREAM_DNS_PORT=53 ; echo -e "\nTCP\n"; for dnspod in `oc get pods -n openshift-dns -o name --no-headers -l dns.operator.openshift.io/daemonset-dns=default`; do echo "Pod $dnspod"; oc exec -n openshift-dns -c dns $dnspod -- dig @${UPSTREAM_DNS_IP} redhat.com -p ${UPSTREAM_DNS_PORT} +tcp +short; echo; done ; done
for UPSTREAM_DNS_IP in 10.46.201.1 10.46.201.2 10.46.201.3 ; do UPSTREAM_DNS_PORT=53 ; echo -e "\nUDP\n"; for dnspod in `oc get pods -n openshift-dns -o name --no-headers -l dns.operator.openshift.io/daemonset-dns=default`; do echo "Pod $dnspod"; oc exec -n openshift-dns -c dns $dnspod -- dig @${UPSTREAM_DNS_IP} redhat.com -p ${UPSTREAM_DNS_PORT} +notcp +short; echo; done ; done

=image=
Which images are ok.
oc get image.config.openshift.io cluster -o yaml
=enable sso with keycloak=
apiVersion: config.openshift.io/v1
kind: OAuth
metadata:
annotations: {}
labels:
app.kubernetes.io/instance: sso
name: cluster
spec:
identityProviders:
- mappingMethod: add
name: SSO
openID:
claims:
email:
- email
groups:
- groups
name:
- name
preferredUsername:
- preferred_username
clientID: <Client name in keycloak>
clientSecret:
name: keycloak-client-secret
extraScopes: []
issuer: <URL to issuer>
type: OpenID
---
apiVersion: v1
data:
clientSecret: <base64 secret>
kind: Secret
metadata:
labels:
app.kubernetes.io/instance: sso
name: keycloak-client-secret
namespace: openshift-config

=keepalive/api/ingress=
On nodes where nodes server the same ip for api or ingress.
oc get nodes -o name | xargs -I {} oc debug {} -- chroot /host sh -c 'echo "# unicast_peer" > /etc/keepalived/keepalived.conf'
Get info about where ingress is running.
oc get nodes -o name | xargs -I {} oc debug {} -- chroot /host sh -c 'ip a' 2>&1 | tee /tmp/tmp ; grep $(host $(oc whoami --show-server | awk -F ':|/' '{print $4}') | awk '{print $NF}') /tmp/tmp

=diff rendered mc=
export OLD_RENDERED=rendered-infra-6c7e5fc796264dd32341950aea971807 ; export NEW_RENDERED=rendered-infra-bac1dd431374a5c4c21742e547739c7c ; diff -NrU 5 <(oc get mc ${OLD_RENDERED} -o json) <(oc get mc ${NEW_RENDERED} -o json)
=secret management=
List secrets of they type tls.
get secrets --field-selector type=kubernetes.io/tls
=ocm=
==ocm install==
(cd /usr/local/bin/ ; sudo curl -vLsk https://github.com/openshift-online/ocm-cli/releases/download/v0.1.72/ocm-linux-amd64 -o ocm ; sudo chmod 755 ocm)
==ocm search examples==
ocm list clusters --parameter search="name like 'da0d9ade-d649-4948-8bc6-744a1fcb0960'"
ocm get /api/clusters_mgmt/v1/clusters --parameter search="name like '0047ccf6-134b-4bff-99e0-5f2d6532a3ea'"
ocm get /api/accounts_mgmt/v1/subscriptions/ --parameter size=1000 | jq -r '.items[]| .display_name +"\t"+ .status +"\t"+ .cluster_id +"\t"+ .created_at' | grep -v Archived | column_tab
Search for two states.
ocm get /api/accounts_mgmt/v1/subscriptions/ --parameter search="status like 'Active' or status like 'Stale'" --parameter size=1000

=PodDisruptionBudget=
API object that specifies the minimum number of replicas that must be up at a time.
=pod placement=
Does it look sane which pods run on worker nodes. Search for pods on worker nodes and look for the same pods on all nodes.
oc get nodes --no-headers --selector='node-role.kubernetes.io/worker,!node-role.kubernetes.io/infra' -o=custom-columns='NAME:.metadata.name' | while read NODE ; do oc get pods -A -o wide --no-headers --field-selector "spec.nodeName=$NODE" | while read NAMESPACE POD REST ; do echo '#' $NAMESPACE ${POD%-*} ; oc get pods -n $NAMESPACE -o wide | grep ${POD%-*} ; done ; done | less -ISRM
Are any user pods running outside worker nodes?
oc get project --no-headers -o=custom-columns='NAME:.metadata.name' | grep -v ^openshift- | while read NAMESPACE ; do echo '*' $NAMESPACE ; oc get pods -o wide -n $NAMESPACE ; done
=wait=
Wait for kafka getting ready.
kubectl wait kafka/my-cluster --for=condition=Ready --timeout=300s -n kafka
=list configured ssh public keys=
oc get machineconfig --no-headers -o custom-columns=":metadata.name" | grep -E '^99-.*-ssh$' | while read MACHINECONFIG ; do echo '*' "${MACHINECONFIG}" ; oc get machineconfig "${MACHINECONFIG}" -o json | jq -r '.spec.config.passwd.users[].sshAuthorizedKeys[]'; done
=Add key for ssh login=
oc get machineconfig --no-headers -o custom-columns=":metadata.name" | grep -E '^99-.*-ssh$' | while read MACHINE_CONFIG_SSH ; do echo '*' $MACHINE_CONFIG_SSH ; oc patch machineconfig $MACHINE_CONFIG_SSH --type=json --patch="[{\"op\":\"add\", \"path\":\"/spec/config/passwd/users/0/sshAuthorizedKeys/-\", \"value\":\"$(cat $HOME/.ssh/id_ed25519.pub)\"}]" ; done
With a save.
oc get machineconfig --no-headers -o custom-columns=":metadata.name" | grep -E '^99-.*-ssh$' | while read MACHINE_CONFIG_SSH ; do echo '*' $MACHINE_CONFIG_SSH ; oc_script_log oc get machineconfig $MACHINE_CONFIG_SSH -o yaml </dev/null ; oc patch machineconfig $MACHINE_CONFIG_SSH --type=json --patch="[{\"op\":\"add\", \"path\":\"/spec/config/passwd/users/0/sshAuthorizedKeys/-\", \"value\":\"$(cat $HOME/.ssh/id_ed25519.pub)\"}]" ; done

=readable output from df.=
df -lh | grep -Ev '^overlay|^tmpfs|^shm|^nsfs|^cgroup|^devtmpfs'
=give me openstack credentials=
oc get secret -n kube-system openstack-credentials -o json | jq -r '.data."clouds.yaml" | @base64d'
=extract content of container=
CONT_ID=$(docker create nginx:latest)
docker export ${CONT_ID} -o nginx.tar.gz

=shut down openshift=
Stolen with pride: https://docs.openshift.com/container-platform/4.12/backup_and_restore/graceful-cluster-shutdown.html
# Etcd bacup.
# Do we use proxy.
oc get proxy cluster -o yaml
# Make an etcd backup.
oc debug --as-root node/$(oc get nodes --no-headers --selector='node-role.kubernetes.io/master' -o=custom-columns='NAME:.metadata.name' | head -1) -- chroot /host sh -c '/usr/local/bin/cluster-backup.sh /home/core/assets/backup'
# Copy files locally.
MASTER=node/$(oc get nodes --no-headers --selector='node-role.kubernetes.io/master' -o=custom-columns='NAME:.metadata.name' | head -1) ; oc debug $MASTER -- chroot /host sh -c 'ls /home/core/assets/backup/*' 2>/dev/null | while read ETCD_BACKUP ; do echo '*' Copying ${ETCD_BACKUP##*/} ; oc debug $MASTER -- chroot /host sh -c "cat $ETCD_BACKUP | gzip -9" | zcat > ${ETCD_BACKUP##*/} ; done
# Confirm files are ok.
MASTER=node/$(oc get nodes --no-headers --selector='node-role.kubernetes.io/master' -o=custom-columns='NAME:.metadata.name' | head -1) ; oc debug $MASTER -- chroot /host sh -c 'ls /home/core/assets/backup/*' 2>/dev/null | while read ETCD_BACKUP ; do echo '*' md5sum ${ETCD_BACKUP##*/} ; oc debug $MASTER -- chroot /host sh -c "md5sum $ETCD_BACKUP" 2>/dev/null ; md5sum ${ETCD_BACKUP##*/} ; done
# When does certificate run out.
oc -n openshift-kube-apiserver-operator get secret kube-apiserver-to-kubelet-signer -o jsonpath='{.metadata.annotations.auth\.openshift\.io/certificate-not-after}{"\n"}'
# kubelet client/server certificate expiration.
oc get nodes -o name | xargs -I {} oc debug {} -- chroot /host sh -c 'openssl x509 -in /var/lib/kubelet/pki/kubelet-client-current.pem -noout -enddate; openssl x509 -in /var/lib/kubelet/pki/kubelet-server-current.pem -noout -enddate'
# If certs expire while being shut down. Then we manually have to approve csr:s when cluster comes up.
# oc get csr -o name | xargs oc adm certificate approve
# Shutdown all nodes.
oc get nodes -o name | xargs -I {} oc debug {} -- chroot /host sh -c 'shutdown -h 1'
# Now nodes can stay dead until reviving.
# To start up use command similar to this which is from openstack.
openstack server list -f value | grep SHUTOFF | awk '{print $2}' | xargs openstack server start

=statefulset=
StatefulSet is a Kubernetes controller designed to manage stateful applications that require stable network identities and persistent storage. It handles the deployment, scaling, and management of pods in an ordered and predictable manner, making it ideal for databases, distributed systems, and other applications where state preservation is critical.
=oc diff=
Se which changes would be made
kubectl diff -f <manifest>.yaml
=taint=
Remove taint from node.
kubectl taint node control-plane0.novalocal control-plane1.novalocal control-plane2.novalocal node.cloudprovider.kubernetes.io/uninitialized-
=list nodes with taints=
oc get nodes -o custom-columns=NAME:.metadata.name,TAINTS:.spec.taints

=Sealed secrets=
==create sealed secret==
kubeseal --controller-namespace=kube-system --format yaml --namespace openshift-config <ldap-secret.yaml > ldap-secret-sealed.yaml
==get secret that you want to unencrypt==
oc get sealedsecrets -n openshift-config ldap-secret -o yaml > sealedsecrets_-n_openshift-config_ldap-secret
==Unencrypt sealed secrets==
kubeseal --recovery-private-key <private_key_file> --recovery-unseal < sealedsecrets_-n_openshift-config_ldap-secret > sealedsecrets_-n_openshift-config_ldap-secret.unsealed
==Get private keys from from Sealed secrets==
oc get secret -n kube-system -l sealedsecrets.bitnami.com/sealed-secrets-key -o json | jq -r '.items[].data."tls.key"' | while read LINE ; do echo $LINE | base64 -d > $(echo "${LINE}" | cut -c -100) ; done

=imagetag=
ImageTag represents a single tag within an image stream and includes the spec, the status history, and the currently referenced image (if any) of the provided tag
"alertname": "SamplesImagestreamImportFailing",
"namespace": "openshift-cluster-samples-operator",
# Remove import fail
oc -n openshift get imagetag | grep "ImportFailed" | awk -e '{ print $1 }' | xargs -r oc -n openshift tag -d
oc delete pod -l name=cluster-samples-operator -n openshift-cluster-samples-operator

=custom-column examples=
oc get machine -n openshift-machine-api -o custom-columns=MACHINE:.metadata.name,SERVERGROUPNAME:.spec.providerSpec.value.serverGroupName,CREATIONTIME:.metadata.creationTimestamp --no-headers
=/etc/hosts=
BASE_URL=$(oc get DNS cluster -o=jsonpath='{.spec.baseDomain}')
cat << EOF
$( host api.${BASE_URL} | awk '{print $NF}') api.${BASE_URL}
$( host oauth-openshift.apps.${BASE_URL} | awk '{print $NF}') oauth-openshift.apps.${BASE_URL}
EOF
=--field-selector: examples=
List pods on node.
kubectl get pods --all-namespaces -o wide --field-selector spec.nodeName=<node-name>
List running pods
oc get pods --field-selector status.phase==Running
List not running pods
oc get pods --field-selector status.phase!=Running
=node is not ready. What could cause it=
oc logs -n openshift-machine-config-operator -l k8s-app=machine-config-controller
=Copy file from pod to your machine=
kubectl cp -n kafka $(oc get kafka -n kafka --no-headers -o custom-columns=:.metadata.name)-kafka-0:/opt/kafka/libs/kafka-tools-3.9.0.jar /temp/kafka-tools-3.9.0.jar
=category=
oc get crd -o jsonpath='{range .items[?(@.spec.names.categories)]}{.metadata.name}{"\t"}{.spec.names.categories}{"\n"}{end}' | awk -F '"' '{print $2}' | sort | uniq | while read i ; do echo '*' $i oc get $i -A ; done
* cluster-api oc get cluster-api -A
* coreoperators oc get coreoperators -A
* olm oc get olm -A
* prometheus-operator oc get prometheus-operator -A
=noobaa=
==recreate noobaa==
# Recreate noobaa. https://access.redhat.com/solutions/5948631
oc patch -n openshift-storage noobaa noobaa --type='merge' -p '{"spec":{"cleanupPolicy":{"allowNoobaaDeletion":true}}}'
oc delete -n openshift-storage noobaas.noobaa.io --all
# possibly run this command if hanging.
oc patch -n openshift-storage noobaas/noobaa --type=merge -p '{"metadata": {"finalizers":null}}'
# confirm working.
oc get pv,deployment,pods,sts -n openshift-storage|grep noobaa

=hdd to ssd convertion=
ceph osd crush rm-device-class osd.<id>
ceph osd crush set-device-class ssd osd.<id>
ROTA 1 means spinning platter
oc get nodes -l cluster.ocs.openshift.io/openshift-storage="" --no-headers -o custom-columns=:.metadata.name | xargs -I % oc debug node/% -- chroot /host sh -c "lsblk -d -o NAME,ROTA,MODEL" 2>/dev/null | grep -Ev '^loop|^sr0|^nbd|^rbd' ; oc exec -n openshift-storage $(oc get pods -n openshift-storage -o name -l app=rook-ceph-operator) -it -- bash -c "export CEPH_ARGS='-c /var/lib/rook/openshift-storage/openshift-storage.config'; exec ceph osd tree"

=lease=
I way of distributing resouces. In the case of nodes report back within time defined.
oc get leases -o custom-columns=NAMESPACE:.metadata.name,NAME:.metadata.name,HOLDER:.spec.holderIdentity,LEASEDURATION:.spec.leaseDurationSeconds,RENEWTIME:.spec.renewTime -A
=download oc for windows=
https://mirror.openshift.com/pub/openshift-v4/clients/oc/latest/
==missing commands==
ps_ls(){
echo "PID STATE COMMAND"
for pid in /proc/[0-9]*; do
[ -d "$pid" ] || continue
pid_num=$(basename "$pid")
cmd=$(cat "$pid/cmdline" 2>/dev/null | tr '\0' ' ')
state=$(cat "$pid/stat" 2>/dev/null | cut -d' ' -f3)
[ -n "$cmd" ] && printf "%-8s %-5s %s\n" "$pid_num" "$state" "$cmd"
done
}
=Create pod for testing read and write to pvc=
<pre>
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: odf-simple-test-pvc
namespace: default
spec:
accessModes:
- ReadWriteMany
resources:
requests:
storage: 1Gi
storageClassName: ocs-storagecluster-cephfs
---
apiVersion: v1
kind: Pod
metadata:
name: odf-simple-test-pod
namespace: default
spec:
containers:
- name: test-container
image: registry.redhat.io/ubi8/ubi:latest
command: ["/bin/bash"]
args:
- -c
- |
echo "Starting simple ODF PVC test..."
TEST_FILE="/mnt/test/simple-test.txt"

while true ; do
DATE=$(TZ=Europe/Stockholm date '+%F %H:%M:%S %Z')
# Write test
echo "${DATE}" > $TEST_FILE
# Read test
READ_RESULT=$(timeout 1 cat $TEST_FILE 2>/dev/null)
if [ "$READ_RESULT" = "${DATE}" ]; then
echo "${DATE} PVC Read/Write test PASSED"
else
echo "${DATE} PVC Read/Write test FAILED"
exit 1
fi
sleep 1
done
volumeMounts:
- name: test-volume
mountPath: /mnt/test
readinessProbe:
exec:
command: ["true"]
initialDelaySeconds: 5
periodSeconds: 5
livenessProbe:
exec:
command: ["true"]
initialDelaySeconds: 10
periodSeconds: 10
volumes:
- name: test-volume
persistentVolumeClaim:
claimName: odf-simple-test-pvc
restartPolicy: Never
</pre>
=PrometheusDuplicateTimestamps=
https://access.redhat.com/solutions/7101689
# Save yaml that you want to edit.
oc get configmap cluster-monitoring-config -n openshift-monitoring -o json | jq -r '.data."config.yaml"' | yq -e '.prometheusK8s.logLevel = "debug"' > config.yaml
# Upload the same
oc create configmap cluster-monitoring-config -n openshift-monitoring --from-file=config.yaml --dry-run=client -o yaml | kubectl apply -f -
# If above fails it may be caused by argocd managing the manifest. Disable sync
oc label application <argo-app> -n openshift-gitops owner-
# Command above should do the same as below command.
argocd app set openshift-gitops/<argo-app> --sync-policy=none
# Find trouble
oc logs -n openshift-monitoring prometheus-k8s-1 --tail=-1 | grep "Duplicate sample for timestam" | awk -F ' msg="Duplicate sample for timestamp"' '{print $2}' | sort | uniq -c
49 series="kube_persistentvolumeclaim_access_mode{namespace=\"rjh-mh-test\",persistentvolumeclaim=\"postgres-1\",access_mode=\"ReadWriteOnce\"}"
# Enable sync
oc label application <argo-app> -n openshift-gitops owner=rjh
# If above does not start sync.
argocd app set <argo-app> --sync-policy=automated --auto-prune --self-heal
=serverGroupName/server_groups=
<pre>
# Look at machinegroup on machineset and machine
oc get machinesets -n openshift-machine-api -o custom-columns=NAME:.metadata.name,SERVERGROUP:.spec.template.spec.providerSpec.value.serverGroupName
oc get machine -n openshift-machine-api -o custom-columns=NAME:.metadata.name,SERVERGROUPNAME:.spec.providerSpec.value.serverGroupName,CREATIONTIME:.metadata.creationTimestamp
# Patch machineset to suitable machinegroup
oc patch --namespace openshift-machine-api machineset <machineset> --type=merge --patch '{"spec":{"template":{"spec":{"providerSpec":{"value":{"serverGroupName":"<server-group>"}}}}}}'
# List servergroups.
openstack server group list
# Create servergroup with soft-affinity
openstack server group create --policy soft-anti-affinity <server_group_name>
# look at openstack what server group is.
openstack server list -f value -c ID | while read ID ; do openstack server show $ID -f json | jq -r '.|[.name,.server_groups[]]|@tsv' ; done
</pre>
=When creating new machines. Os template comes from the following values=
oc get machinesets -o name -n openshift-machine-api | while read i ; do echo $i $( oc get -n openshift-machine-api $i -o json | jq -r '.spec.template.spec.providerSpec.value|.rootVolume.sourceUUID,.template' ) ; done

Commands

2026-03-27T12:23:36Z

Ekaanbj: /* proxy */

=7za=
decompress file
7za e myfiles.7z
=ab=
apache benchmarking
ab -n 50 https://www.halfface.se/photos/
ab -n 1000 -c 10 https://www.halfface.se/wiki/index.php/Halfface

=abcde=
Rip cd.
abcde
=adb android=
# install adb
dnf install android-tools
# enable debug. On phone. Settings. about phone. build version. Click until prompted. Enable debug via selector.
# Connect phone via usb.
# List phones.
adb devices
# Get shell on phone.
adb shell
# list installed packages.
pm list packages -f
adb shell pm list packages -f | grep game
# Uninstall
adb shell pm uninstall -k --user 0 com.samsung.android.game.gos
adb shell pm uninstall -k --user 0 com.samsung.android.game.gametools
adb shell pm disable-user --user 0 com.sec.android.app.samsungapps

=agrep=
Aproximate grep. 3 differences from andreas
agrep -3 andreas /var/log/messages
=alacritty(Terminal emulator hw accellerated)=
Terminal copy mode.
CTRL + SHIFT + SPACE
=alsactl=
Reload alsa drivers
systemctl restart alsa-state
sudo alsactl restore

=alternatives=
alternatives --set mta /usr/sbin/sendmail.postfix
sudo alternatives --config java

=antiword=
antiword bad.doc > pure.txt

=arecord=
List soundcards.
arecord -l
Chose source.
alsamixer
Create mp3 from source.
arecord -f cd -d 5 -t raw | lame -x -r - out.mp3
=arp-scan=
Scan ip addresses on local subnet
arp-scan --localnet | sort -n -k4 -t. | grep ^[0-9]

=at=
Run command at specific time. Look at queue.
echo '/usr/bin/espeak -s120 "I will say this only once."' | at -t $(date +%Y%m%d%H%M --date="+2 min")
atq
List at jobs.
atq ; atq | awk '{print $1}' | while read i ; do echo '***' $i ; at -c $i 2>&1 | tail -3 | head -1 ; done
2 Sun May 17 04:00:00 2020 a root
*** 2
/usr/bin/systemctl restart springboot_uc_supportrouter.service

=authselect=
Redhat command to manage connection to underlying services and features.
# To change content of nsswitch.conf do to your used profile.
vim /usr/share/authselect/default/local/nsswitch.conf
authselect select local --force

=base64=
base64 -d /tmp/html | elinks --dump | less -ISRM
No wrapping
base64 --wrap=0
base64 -w 0
=bash=
curl
exec 3<>/dev/tcp/localhost/8080 ; echo -e "GET /health HTTP/1.1\r\nHost: localhost\r\nConnection: close\r\n\r\n" >&3 ; cat <&3

=bbk_cli_...=
Bredbandskollen via cli.
bbk_cli_linux_amd64-1.0

=bc=
Simplify using bercerly calculator
calc(){ echo -e "scale=8\n${@}\nquit\n" | bc ; }
To the power of(upphöjt i)
2^10 = 1024
scientific (aka exponential) notation
echo 1.6945991213315015e+09 | sed -E 's/([+-]?[0-9.]+)[eE]\+?(-?)([0-9]+)/(\1*10^\2\3)/g' | bc
=bitwarden=
# Install bw.
curl -L -o /tmp/bw.zip 'https://vault.bitwarden.com/download/?app=cli&platform=linux' ; (cd /usr/local/bin ; sudo unzip -o /tmp/bw.zip)
# Remove bitwarden config.
unset BW_CLIENTID BW_CLIENTSECRET BW_SESSION
\rm -r /home/abjorklund/.config/Bitwarden*
# Set bitwarden server.
bw config server https://halfface.se/vaultwarden/
# api login
bw login --apikey
# sso login. When web server opens write "Binero SSO"
bw login
# Unlock
bw unlock
# Sync from server.
bw sync
# List items.
bw list items | jq -r '.[].name'
# get totp
bw_halfface get totp ginatricot_user
# get login info.
bw get item bareos-webui | jq .login
# which version
curl https://halfface.se/vaultwarden/api/version
podman image inspect docker.io/vaultwarden/server | jq -r '.[].Config.Labels."org.opencontainers.image.version"'

=bluetoothctl=
Enable bluetooth
sudo systemctl enable bluetooth --now
Scan
bluetoothctl scan on
Pair
bluetoothctl pair <MAC address>
Connect
bluetoothctl connect <MAC address>
Trust
bluetoothctl trust <MAC address>
Remove
bluetoothctl remove <MAC address>
List paired devices
bluetoothctl devices
Get info about paired device
bluetoothctl info 00:00:00:00:3E:E2

=blkid=
Get uuid of disk.
blkid /dev/sdb1
/dev/sdb1: UUID="64cd54f7-5330-425d-81e5-a0e473a5f5e7" TYPE="ext4" PARTLABEL="primary" PARTUUID="21f38e48-af2d-4fdd-854a-5910f392a6e0"

=bonnie++=
Report performance on disk. benchmark
bonnie++ -u 0:0
On machine running out of disk
sudo bonnie++ -d ./ -s 400 -r 200 -u root
Example command.
bonnie++ -d /storage/temp/ -s 32G -n 0 -m TEST -f -b -u abjorklund

=boot=
Booting singe user mode.
kernel ... single

=bootchart=
Analyze startup times.

=bootgraph=
How to use.
Kernel later than 2.6.28
kernel option initcall_debug
dmesg | /usr/src/linux-headers-2.6.28-11-generic/scripts/bootgraph.pl > /tmp/bootgraph.svg
=bpftrace=
run code at each system call
#!/usr/bin/bpftrace

interval:s:5
{
exit();
}

kprobe:do_sys_open
{
printf("%s %s\n", comm, str(arg1));
}
=busctl=
busctl may be used to introspect and monitor the D-Bus bus.

=bzip2=
Extract keep original
bzip2 -dk /compressed_file.bz2 and extract standard out via tar.
Extract bunzip2 file and extract via tar from standard out.
bzip2 -c /compressed_file.bz2 | tar -xivf -

=cdrecord=
Blank cd/dvd rw
cdrecord -v gracetime=2 dev=/dev/cdrom -eject blank=all -force
=certutil=
Test password. Password should be part of file called by -f
certutil -K -d /etc/dirsrv/slapd-halfface -f /tmp/pin.txt
Remove cert if it already exist.
certutil -D -n "Self-Signed-CA" -d /etc/dirsrv/slapd-halfface/ -f /tmp/pin.txt
Create new certificate.
certutil -S -n Self-Signed-CA -s CN=ssca.389ds.halfface,O=halfface,L=389ds,ST=Stockholm,C=SE -x -t "CT,," -v 480 -d /etc/dirsrv/slapd-halfface/ -k rsa -g 2048 -f /tmp/pin.txt
List certificates
certutil -L -d /etc/dirsrv/slapd-halfface/
Look at a specific certificate
certutil -L -d /etc/dirsrv/slapd-halfface/ -n "Self-Signed-CA"
Remove orphan key
certutil -F -d /etc/dirsrv/slapd-halfface/ -f /tmp/pin.txt -k 27e0fcb7a201cf0f0c3674eae03c8d94b47b4de0
Generate a new csr
certutil -R -s "CN=www.halfface.se,O=halfface,L=389ds,ST=Stockholm,C=SE" -o server.csr -d /etc/dirsrv/slapd-halfface/ -k rsa -g 2048 -f /tmp/pin.txt --extSAN "dns:www.halfface.se,dns:ldap.halfface.se" -v 240
sign certificate
certutil -C -i server.csr -o server-cert.crt -c "Self-Signed-CA" -d /etc/dirsrv/slapd-halfface/ -f /tmp/pin.txt
Import signed cert
certutil -A -n "Server-Cert" -t "u,u,u" -i server-cert.crt -d /etc/dirsrv/slapd-halfface/ -f /tmp/pin.txt
==Add certs to chrome==
for i in $(ls) ; do echo '*' $i ; certutil -d sql:${HOME}/.pki/nssdb -A -t "C,," -n "vSphere Root CA $i" -i $i ; done

=cfdisk=
Disk partitioning via ncurses interface. like fdisk.
=chage=
List password properties of user
chage -l abjorklund
Unlimited login
chage -I -1 -m 0 -M 99999 -E -1 sftponly

=chattr/lsattr=
Set extendet attributes of files.
# Lock file for most activities.
chattr +i file
# Unlock file
chattr -i file
# recursive lsattr looking for imutable.
lsattr -aR -- .//. 2>/dev/null | sed -rn '/i.+\.\/\/\./s/\.\/\///p'

=chmod=
Sticky bit on directory. Only owners of files are able to delete.
chmod 1755 /file.
-rwxr-xr-t
GUID on file. binaries started will have the group set to the defined group.
chmod 2755 /file
-rwxr-sr-x
SUID on file.
chmod 4755 /file
-rwsr-xr-x
Remover permissions for others
chmod o-rwx

=chntpw=
# Change windows passwords offline
mkdir /mnt/disk ; mount /dev/sd1 /mnt/disk; cd /mnt/disk/Windows/System32/config
# List local users.
chntpw -l SAM
# clear password on user.
chntpw -u Administrator SAM
=chrony=
# setup time sync via ntp.
/etc/chrony.conf
# look at status
chronyc tracking
# List ntp sources.
chronyc sources
.-- Source mode '^' = server, '=' = peer, '#' = local clock.
/ .- Source state '*' = current synced, '+' = combined , '-' = not combined,
| / '?' = unreachable, 'x' = time may be in error, '~' = time too variable.
|| .- xxxx [ yyyy ] +/- zzzz
|| Reachability register (octal) -. | xxxx = adjusted offset,
|| Log2(Polling interval) --. | | yyyy = measured offset,
|| \ | | zzzz = estimated error.
|| | | \
MS Name/IP address Stratum Poll Reach LastRx Last sample
===============================================================================
#? PHC0 0 3 0 19d +41ns[ +349ns] +/- 104ns
Force syncronize
sudo chronyc -a 'burst 4/4'
Make a big step. Did not work for me.
chronyc -a makestep
Verify clock
chronyd -q 'server pool.ntp.org iburst'

=chvt=
From a script change to a virtual interface and connect script to that terminal.
chvt 3 exec < /dev/tty3 > /dev/tty3

=cacafire=
View some fire in ascii.

=clean=
Clean file from comments and blank lines.
sed '/ *#/d; /^ *$/d'

=codepage=
Change codepage of file.
convmv -f cp850 -t iso-8859-1 --notest *
convmv -f utf8 -t iso8859-1 -r --notest *
convmv -f iso8859-1 -t en_US.UTF-8 -r --notest .
Change codepage of file.
iconv --from-code=ISO-8859-15 --to-code=UTF-8 document.csv > document_iconv.csv
View nfo files
iconv -f CP437 -t UTF-8 KaOs.nfo

=column=
Create nice column. Use tab as delimiter.
column -t -s $'\t' /file.tsv
=compgen=
List all commands
compgen -A function -abck

=convert=
Convert Image to 8 bit grey with threshold for white.
for tif in *.tif; do convert -depth 8 -white-threshold 70% ${tif} ${tif%%.*}.png;done
Resize image
convert -resize 25% -gamma 1.5 2011-08-03_11-09-43.jpg 2011-08-03_11-09-43_new.jpg
Multipage pdf.
convert -adjoin -page A4 -compress jpeg Infineon1.tif Infineon2.tif Infineon.pdf
pdfunite RegionUppsala01.pdf RegionUppsala02.pdf RegionUppsala03.pdf RegionUppsala04.pdf RegionUppsala.pdf
Prepare photos for printing.
convert -rotate 90 -gamma 1.5 -resize 25% -compress jpeg -quality 80 -adjoin -page A4 * print.pdf
Resize change aspect.
convert Slide1.PNG -resize 1920x1080\! slide01.png
animated gif
convert -delay 100 -loop 0 *.jpg animation.gif
Create multipage pdf of photos.
convert -resize 25% -adjoin -page A4 -rotate 90 -compress jpeg *.jpg test.pdf ; pdfjam test.pdf --no-landscape --frame true --nup 2x2 --suffix 4up --outfile /temp/photos/Alva/test_2x2.pdf
For vertical stacking (top to bottom):
convert -append 1.jpg 2.jpg out.jpg
For horizontal stacking (left to right):
convert +append 1.jpg 2.jpg out.jpg
Remove transparancy
convert image.png -background white -flatten image.jpg

=cpio=
Copy wanted partitions.
#!/bin/bash
ssh root@192.168.2.148 "(cd /boot/ ; find ./ -xdev -depth -print0 | cpio -o -0Hnewc )" | (cd /mnt/sysimage/boot ; cpio -idvuma )
ssh root@192.168.2.148 "(cd / ; find ./ -xdev -depth -print0 | cpio -o -0Hnewc)" | (cd /mnt/sysimage ; cpio -idvuma )
# -o copy out mode.
# -0 terminated by null character.
# -Hnewc som storing format.
# -i extract copy in mode.
# -d make directories.
# -v verbose.
# -V print dot.
# -u replace all files.
# -m preserve modification time.
# -a preserve access time.
=cpulimit=
Limit application cpu usage to 25% cpu utilization. Inherit limit to spawned processes.
cpulimit -i -l 25 /apps

=crash=
Troubleshoot hung Redhat vm.
Dump vm.
virsh dump <vm> --memory-only --verbose /tmp/<vm>.core
Login to machine you dump:ed and rebooted. Verify kernel version. uname -r
Setup vm similar to the one you dumped.
Install rpm:s to be able to debug.
export UNAME_R=5.14.0-554.el9.x86_64
dnf install --enablerepo=* crash kernel-modules-${UNAME_R} kernel-core-${UNAME_R} kernel-${UNAME_R} kernel-modules-core-${UNAME_R} kernel-debuginfo-common-x86_64-${UNAME_R} kernel-debuginfo-${UNAME_R}
Tips to find rpm:s.
<pre>
https://kojihub.stream.centos.org/koji/builds -> Dropdown: builds -> Search: kernel-5.14.0-554.el9
https://kojihub.stream.centos.org/kojifiles/packages/kernel/ -> find your way down the tree.
</pre>
Start crash. Write help to give advice. LLMS are quite useful for troubleshooting advice.
crash /usr/lib/debug/lib/modules/${UNAME_R}/vmlinux /tmp/<vm>.core
Scripting with crash
cd /temp/ ;cat commands.txt ; for i in $(ls instance-0002da2b_osc-compute27-sto1-prod.cloud.binero.net_okd01-ppj65-master-0_2025-04-15_15-03-04*) ; do crash -i commands.txt /usr/lib/debug/lib/modules/5.14.0-554.el9.x86_64/vmlinux /temp/instance-0002da2b_osc-compute27-sto1-prod.cloud.binero.net_okd01-ppj65-master-0_2025-04-15_15-03-04.core > $i.log </dev/null ; done
ps
runq

=cronie=
Start cronie in foreground. Write what it is doing.
/usr/sbin/crond -n -x sch

=crontab/cron=
crontab.
* * * * * command to be executed
- - - - -
| | | | |
| | | | +----- day of week (0 - 6) (Sunday=0)
| | | +------- month (1 - 12)
| | +--------- day of month (1 - 31)
| +----------- hour (0 - 23)
+------------- min (0 - 59)
0 Sunday
1 Monday
2 Tuesday
3 Wednesday
4 Thursday
5 Friday
6 Saturday
@reboot "run command at reboot"
If you need % in crontab escape it. \%

Run command every 10 minutes.
*/10 * * * * command

Run command at 12:00 and 24:00 hours.
00 0,12 * * * command

Run command between 8-17 every 2 hours.
0 8-17/2 * * * /path/command
0 8,10,12,14,16 * * * /path/command

Start program under crontab.
#!/bin/bash
COMMAND="screen -L -d -m ping www.dn.se"
if [ "$(ps -ef | grep -i ping | grep -v grep)" ]
then
echo "\"${COMMAND}\" already running."
else
echo "Starting \"${COMMAND}\"."
cd /tmp
${COMMAND}
fi

=crudini=
Edit ini files och cli.
crudini --set /lib/systemd/system/icinga2.service Service Nice -10 ; systemctl daemon-reload ; systemctl restart icinga2.service

=cryptsetup=
luks. Process to unlock disk. Mount it and unmount and encrypt.
cryptsetup luksOpen /dev/nvme0n1p3 secure
mount /dev/mapper/secure /mnt
umount /mnt
cryptsetup luksClose secure
==create luks encrypted disk==
# Add block device and add gpt label. Create partition.
cfdisk /dev/sde
# Encypt partition
sudo cryptsetup luksFormat /dev/vdb1
# open encrypted disk
sudo cryptsetup open /dev/vdb1 encrypted-disk
# Format disk
sudo mkfs.ext4 /dev/mapper/encrypted-disk
# Info about partition
sudo blkid /dev/vdb1
/dev/vdb1: UUID="cb2e7238-8245-41cb-9811-6804f602e5e8" TYPE="crypto_LUKS" PARTUUID="56b829b6-8295-4963-9562-29e8937819a8"
# Setup crypttab if you want to decrypt at boot splash
echo 'encrypted-disk UUID=cb2e7238-8245-41cb-9811-6804f602e5e8 none luks' | sudo tee -a /etc/crypttab
# Manually unlock luks partition
sudo cryptsetup luksOpen UUID=cb2e7238-8245-41cb-9811-6804f602e5e8 encrypted-disk
# Manuall lock luks partition
sudo cryptsetup luksClose encrypted-disk
# Add disk to fstab
echo '/dev/mapper/encrypted-disk /mnt/encrypted-disk ext4 noauto 0 2' | sudo tee -a /etc/fstab
# Create mount point
sudo mkdir /mnt/encrypted-disk ; sudo chmod 777 /mnt/encrypted-disk
# mount disk
sudo umount /mnt/encrypted-disk
# Change password of luks partition
sudo cryptsetup luksAddKey UUID=cb2e7238-8245-41cb-9811-6804f602e5e8
sudo cryptsetup --test-passphrase -v open UUID=cb2e7238-8245-41cb-9811-6804f602e5e8
sudo cryptsetup luksRemoveKey UUID=cb2e7238-8245-4

=cups=
Install cups
dnf install cups
enable cups
systemctl enable cups.service --now
Configure printer in cups.
http://localhost:631/

=cut=
Cuf everything from field 5.
cut -f5- -d ' '

=curl=
==Get http return code.==
curl --connect-timeout 3 --max-time 9 -ksL -w '%{http_code}\n' 'http://www.dn.se' -o /dev/null
==get external ip. what is my ip==
curl ifconfig.me
==get external ip and all related browser information.==
curl ifconfig.me/all
==Alternative address for domain.==
<pre>
curl -sk --resolve www.halfface.se:80:127.0.0.1 http://www.halfface.se
curl http://127.0.0.1/ -H "Host: halfface.se" -H "X-Forwarded-Proto: https" -I
</pre>

==Get header / mime type==
curl -I http://url.se
==post file==
curl -X POST -d @myfilename http://user:pass@myhost/hudson/job/_jobName_/postBuildResult
==post file via ftp using proxy==
curl -p --proxy http://proxy.example.se:3128 -v -T backup.tar ftp://user:password@ftp.example.se/directory/

==cookie format. tab delimited.==
domain - The domain that created AND that can read the variable. .halfface.se
flag - A TRUE/FALSE value indicating if all machines within a given domain can access the variable. This value is set automatically by the browser, depending on the value you set for domain.
path - The path within the domain that the variable is valid for.
secure - A TRUE/FALSE value indicating if a secure connection with the domain is needed to access the variable.
expiration - The UNIX time that the variable will expire on. UNIX time is defined as the number of seconds since Jan 1, 1970 0:00:00 GMT.
name - The name of the variable.
value - The value of the variable.

==add certificate authority to openssl==
Redhat based os:es this file gets updated. /etc/pki/ca-trust/extracted/openssl/ca-bundle.trust.crt
cp /tmp/ca.crt /etc/pki/ca-trust/source/anchors/
update-ca-trust
Debian based
cp /tmp/ca.crt /usr/share/ca-certificates/extra
update-ca-certificates
Debian 2
cp foo.crt /usr/local/share/ca-certificates/foo.crt
update-ca-certificates

==curl ipv6==
<pre>
curl -6 -g "http://[::1]:80/"
curl -g "http://[2001:9b1:402d:0:ffff:f038:ec3e:b5d4]/"
</pre>

==proxy==
curl --proxy http://proxy.se:3128 -sk "http://mirrorlist.centos.org"
===no_proxy===
export https_proxy=http://proxy.se:3128 ; export http_proxy=$https_proxy ; export HTTPS_PROXY=$https_proxy ; export HTTP_PROXY=$https_proxy ; export no_proxy=localhost,127.0.0.1,.inter.net,$(echo 10.217.{4..5}.{1..254}, 10.217.5.255) ; export NO_PROXY=$no_proxy
===time spent===
-w "time_namelookup: %{time_namelookup}, time_connect: %{time_connect}, time_appconnect: %{time_appconnect}, time_pretransfer: %{time_pretransfer}, time_redirect: %{time_redirect}, time_starttransfer: %{time_starttransfer}, time_total: %{time_total}\n"
==which isp==
curl -s http://ip-api.com/json/${IP} | grep -o '"isp":"[^"]*"' | cut -d '"' -f4

=Is it a free day?=
<pre>
curl -sk https://sholiday.faboul.se/dagar/v2.1/2023 | jq -r '.dagar[] |select(."arbetsfri dag"=="Ja")|.datum'
</pre>

=qr code=
encode
qrencode "Andreas" -o /tmp/qr_Andreas.png
decode
zbarimg /tmp/qr_Andreas.png

=date=
Get date in requested format.
date '+%Y-%m-%d %H:%M'
date +%Y-%m-%d-%H%M
date "+%F_%T" # 2017-01-16_19:41:41

date 033121422003.55
Mon Mar 31 21:42:55 PST 2003
date MMDDhhmmCCYY.ss

Whats the date in 1000 years. Or any other increment.
date --date="+1000 years" +%C%y-%m-%d
date --date="-2 hour" +%C%y-%m-%d\ %H:%M
TZ=CEST date --date="-2 hour" +%C%y-%m-%d\ %H:%M

What is the time in other timezone given in unixtime/epoch.
TZ=GMT date -d '@1345064585'
Wed Aug 15 21:03:05 GMT 2012

Unix time.
date +%s
Unix to normal
date -d @1234567890

scew clock by a second.
DATE_OFF=$(date --date="-5 second" +%C%y-%m-%d\ %H:%M:%S\ %Z) ; date --set="${DATE_OFF}"
Set clock
date '+%Y-%m-%d %T %Z' -s "2008-11-28 08:08:08 UTC"
=datefudge=
Fake date for command.
datefudge "2020-04-01 10:23" date

=dateseq=
Create date sequense.
dateseq 2017-04-01 2017-04-05

=db2=
Empty catalog remove node
for DB2 in $(db2 list node directory | grep "Node name" | awk '{print $4}') ; do db2 uncatalog node $DB2;done
Empty catalog remove db
for DB2 in $(db2 list db directory | grep "Database name" | awk '{print $4}') ; do db2 uncatalog db $DB2;done
# Load db2 environment.
. /home/db2/sqllib/db2profile

# Connect to database.
db2 connect to ${database_name} user ${user} using ${password}

# Test query.
SELECT service_level, fixpack_num, bld_level FROM TABLE (sysproc.env_get_inst_info()) as A;

# System Database Directory
db2 list db directory

# Node Directory
db2 list node directory

# setup directory
db2 "catalog tcpip node db2datan remote 1.2.3.4 server 5000"
db2 "catalog db db2datadb as db2datadb at node db2datan"

# Drop connection.
db2 terminate

=dbus-monitor=
dbus-monitor # Monitor activity on the dbus to see what system and sessions are doing.

=dd=
output your microphone to a remote computer's speaker
dd if=/dev/dsp | ssh -c arcfour -C username@host dd of=/dev/dsp
Add 2GB to disk image.
dd if=/dev/zero of=/system_image.img bs=1M oflag=append conv=notrunc count=2000
dd with progress bar.
dd if=kali.iso of=/dev/sdc status=progress
pv -ptre /install/backup/machine/raspberry/ipcenter_view.img | sudo dd of=/dev/mmcblk0 bs=1M
dd to position on disk
dd of=/dev/disk1 if=/dev/urandom obs=500000 seek=1 bs=1MB count=1 conv=notrunc
==consume 100GB ram==
mount -o remount,size=300G /dev/shm
dd if=/dev/zero of=/dev/shm/$(date '+%Y-%m-%d_%H-%M-%S') bs=1073741824 count=100 status=progress

=debugfs=
ctime: Shows file change time.
atime: Shows file access time.
mtime: Shows file modification time.
crtime: Shows file creation time. Birth.
Example
debugfs -R 'stat /etc/exports.bkp-2021-11-17_10-07-46' /dev/mapper/vg_rbnetstorage0-lv_root
debugfs 1.41.12 (17-May-2010)
Inode: 924905 Type: regular Mode: 0644 Flags: 0x80000
Generation: 2068409071 Version: 0x00000000:00000001
User: 0 Group: 0 Size: 4775
File ACL: 0 Directory ACL: 0
Links: 1 Blockcount: 16
Fragment: Address: 0 Number: 0 Size: 0
ctime: 0x6194c662:deae4368 -- Wed Nov 17 10:07:46 2021
atime: 0x6193bd7f:c4faf658 -- Tue Nov 16 15:17:35 2021
mtime: 0x61925419:34c06f18 -- Mon Nov 15 13:35:37 2021
crtime: 0x6194c662:deae4368 -- Wed Nov 17 10:07:46 2021
Size of extra inode fields: 28
Extended attributes stored in inode body:
selinux = "unconfined_u:object_r:etc_t:s0\000" (31)
EXTENTS:
(0-1): 3718194-3718195
=ddclient=
Debug
ddclient -daemon=0 -debug -verbose -noquiet

=df=
df output one per line. Without header.
df -Plk / /apps | tail -n+2

=dhclient=
[root@wall sysconfig]# cat /etc/dhclient.conf
interface "eth0" {
prepend domain-name-servers 127.0.0.1;
supersede domain-name "bltprojektering.se";
}

=dialog=
Create dialog in terminal. Example a progressbar.
for i in {0..100} ; do echo $i | dialog --gauge "Please wait" 7 70 1 ; sleep .1 ; done
=diff=
sdiff <(echo -e 'hej\nda\nvi\nses\ni\nmorgon') <(echo -e 'hej\ndå\nvi\nSES\ni\nmorgon')
Only show files that differ.
-q --brief
Only show change between files.
diff -u file1.txt file2.txt | grep -vE '^(---|\+\+\+|@@|\+|-)'

=dig=
==Get all dns information about host.==
dig any www.halfface.se
==Trace dns lookups from root dns. Use 8.8.8.8 for lookups.==
dig +trace @8.8.8.8 www.halfface.se
==Recursive lookup.==
dig -tAXFR halfface.se
==backward resolve==
dig -x 89.253.75.84
==get ttl==
dig +nocmd +multiline +noall +answer any halfface.se
==Get external ip.==
dig +short myip.opendns.com @resolver1.opendns.com
==Get txt record.==
dig google.com txt
==You can find the authoritative servers by asking for the NS records for a domain==
dig example.com NS
==dig using alternative port==
dig +short -p 5353 halfface.se @10.130.0.35

=digitemp=
digitemp_DS9097 -c /etc/.digitemprc -t0

=disk=
disk usage
baobab
foremost
recover deleted files.
=disown=
Disconnect process(pid) so that is survives a logout.
disown %2

=display=
Change resolution
xrandr --output LVDS --mode 1280x800
xrandr --output default --mode 1280x1024
Query graphics card capabilities.
xrandr -q
Change dpi
xrandr --dpi 138/eDP1
=du=
du -amx / | sort -n | tail -5
=duplicity=
Encrypted backups over rsync

=dmesg=
dmesg with iso time format
dmesg --ctime --time-format iso
Write to dmesg
echo "$USER $(date '+%Y-%m-%d %H:%M:%S %Z')" | sudo tee /dev/kmsg

=dmidecode=
List memory banks
sudo dmidecode -t 17

=dnf=
install skip if not exist
sudo dnf install --setopt=strict=0 $(sort -u /temp/other_machine_rpm)
==update system==
dnf -y upgrade --refresh
reboot
dnf -y install dnf-plugin-system-upgrade
dnf -y system-upgrade download --refresh --allowerasing --releasever=43
# Before 42:
dnf -y system-upgrade reboot
# From 42 and onward
dnf5 offline reboot
# broken deps.
dnf repoquery --unsatisfied
# look for duplicates
dnf repoquery --duplicated
# which rpms do not exit in repo.
dnf list extras
# remove no longer used.
dnf autoremove
dnf remove $(rpm -qa| grep \.fc23)
# reinstall rpm
dnf reinstall sssd-common

==auto update==
# Install auto updates.
dnf install dnf-automatic
# Enable auto update.
sed -i "s/apply_updates = no/apply_updates = yes/g;s/email_from = root@example.com/email_from = root@${HOSTNAME}/g;s/email_to = root/email_to = anden@halfface.se/g" /etc/dnf/automatic.conf
# Enable timer.
systemctl enable dnf-automatic.timer && systemctl start dnf-automatic.timer
# Trigger timer.
systemctl start dnf-automatic.timer
# Check status of dnf-automatic:
systemctl list-timers *dnf-*
==build environment==
dnf group install "C Development Tools and Libraries"
==update to specific version==
View available version.
dnf --showduplicates list gitlab-ee
Update to specific version
dnf install gitlab-ee-13.12.15-ee.0.el8

=Setup dnsmasq on ubuntu=
<pre>
# Install dnsmasq
apt install dnsmasq
systemctl enable dnsmasq --now
# Disable systemd-resolved.
sudo systemctl disable --now systemd-resolved
# Make NetworkManager ignore dns.
sudo tee /etc/NetworkManager/conf.d/no-dns.conf <<'EOF'
[main]
dns=none
EOF
systemctl restart NetworkManager
# Fix /etc/resolv.conf
sudo \rm /etc/resolv.conf
sudo tee /etc/resolv.conf <<'EOF'
nameserver 127.0.0.1
search int.redbridge.se halfface.se cloud.binero.net
options timeout:1 attempts:1
EOF
# Create config
sudo tee /etc/dnsmasq.d/custom.conf <<'EOF'
listen-address=127.0.0.1
bind-interfaces
server=/redbridge.se/185.53.164.25
#server=/halfface.se/10.111.222.2
server=8.8.8.8
EOF
# Restart dnsmasq
systemctl restart dnsmasq
</pre>

=dovecot=
# List files with doveadm
MAIL=mbox:/var/vmail/fordonskontroll.app doveadm mailbox list
# Remove mails with doveadm
MAIL=mbox:/var/vmail/fordonskontroll.app doveadm expunge -u n

=dovecot=
# List files with doveadm
MAIL=mbox:/var/vmail/fordonskontroll.app doveadm mailbox list
# Remove mails with doveadm
MAIL=mbox:/var/vmail/fordonskontroll.app doveadm expunge -u n

=dracut=
Dracut is a tool used to create an initial RAM filesystem (initramfs) for Linux systems.

=dvgrab=
Capture dv material
dvgrab -f dv2 -i -showstatus -s 0 -timestamp California-2

=e2fsck=
Scan for bad blocks.
e2fsck -ycv /dev/VolGroup00/LogVol00

=edid/ddc=
startx -- -logverbose 5.
The EDID information turns up in /var/log/Xorg.0.log.
=enca=
detect and convert encoding of text files. (codepage utf)
enca -L none /temp/locale2
=esmtp=
# Install dependency
dnf install procmail
# Put the following config in either /etc/esmtprc or more specific ~/.esmtprc. chmod 644.
SMTP_SERVER=halfface.se
cat << EOF > ~/.esmtprc
hostname = $SMTP_SERVER:25
# Set the Mail Delivery Agent (MDA)
mda = "/usr/bin/procmail -d %T"
EOF
chmod 0710 ~/.esmtprc

=etckeeper=
Keep your /etc/ directory under git revision control.
What has happened.
git log -p /etc/resolv.conf
Wipe /etc/.git
etckeeper uninit
etckeeper init

=ethtool=
show-features
ethtool -k <device>
generic-segmentation-offload = gso
tcp-segmentation-offload = tso
...
Enable wake on lan magic package.
ethtool --change <interface> wol g
Permanently add wol
find /sys/class/net -type l -not -lname '*virtual*' -printf '%f\n' | while read i ; do INTERFACE_INFO=$(ip address show $i) ; MAC=$(grep link/ether <<< "${INTERFACE_INFO}" | awk '{print $2}') ; echo "# /etc/systemd/network/50-wired.link
[Match]
MACAddress=$MAC

[Link]
NamePolicy=kernel database onboard slot path
MACAddressPolicy=persistent
WakeOnLan=magic" ; done

=exiftool=
Change meta data for files, exif, jpg, mp3...
Get info from file.
exiftool $file.mp4
gps format
41°24'12.2"N 2°10'26.5"E
gps format known to maps.google.com
exiftool -c "%.6f" 2022-03-06_10-39-40.mp4 | grep -i gps

=exportfs=
Install server
dnf install nfs-utils
Start nfs server
systemctl enable nfs-server --now
Reexport everything.
exportfs -avr
Example export.
*(rw,no_root_squash,async,insecure)
rw rewritable
no_root_squash Allow root on remote machine same permissions as local root
async
insecure NFS version 2 and 3 servers only provide (insecure) host-based authentication: Hosts are allowed/denied based on hostnames and/or IP addresses. Authorization of users is controlled on the clients using the permissions of the files based on user/group IDs. allows clients with NFS implementations that don't use a reserved port for NFS

=fdupes=
Find duplicate files.
fdupes -r /home
=feh=
Image viewer

=ffmpeg=
ffmpeg
ffmpeg -y -deinterlace -aspect 16:9 -author "Andreas Bjorklund" -title "Tanzania" -year 2007 -i Tanzania.m2t -acodec mp3 -vcodec mpeg4 -b 3000k -s 720x540 test.avi
Create swf/flv from mpeg2 stream
ffmpeg -deinterlace -i VTS_01_1.VOB -ab 56 -ar 22050 -b 500000 -r 15 -s 360x288 sisyfos.swf
Create horse movie.
ffmpeg -deinterlace -i /temp/VTS_01_1.VOB -ab 100 -ar 22050 -b 1200000 -r 25 -s 360x288 3horses.swf
Cut video from command prompt.
ffmpeg -i video.avi -vcodec copy -acodec copy -ss 00:00:00 -t 00:00:04 trimmed_video.avi
Record desktop.
ffmpeg -f alsa -ac 2 -i pulse -f x11grab -r 5 -s 1920x1080 -i :0.0 -acodec pcm_s16le -vcodec libx264 -threads 0 -y output.mkv
ffmpeg -f x11grab -s $(xrandr | grep \*+|awk '{print $1}') -r 25 -i :0.0 -sameq /tmp/out.mpg
Change container.
ffmpeg -i film.mov -vcodec copy -acodec copy film.mp4
Transcode to h264 aac
ffmpeg -i original.avi -vcodec libx264 -acodec aac -strict experimental new_file.mp4
Transcode mp3 to ogg vorbis
for file in *.mp3; do ffmpeg -i "${file}" -acodec libvorbis "${file/%mp3/ogg}";done
Take one photo from video stream.
ffmpeg -ss 00:00:01 -i <video input> -frames:v 1 -q:v 2 <photo created>
Take photo
ffmpeg -f video4linux2 -s 1280x720 -i /dev/video0 -f image2 snapshot.jpg
ls /dev/video* | while read i ; do echo $i ; ffmpeg -f video4linux2 -i $i -vframes 1 -q:v 2 /tmp/${i//\//%}.$(date +%F_%H-%M-%S).jpg ; done ; ls -la /tmp/%*
Take a photo from a video steam every 10 seconds.
ffmpeg -i video.mp4 -r 0.1 -f image2 %03dandreas.jpg
Take a photo every 1 put it in a file.
ffmpeg -y -i http://balcony.halfface.se:8080 -r 1 -f image2 -update 1 stream_image.jpg -probesize 5e+07
Rotate 180 degrees.
ffmpeg -i input.mp4 -filter:v "transpose=1,transpose=1" output.mp4
Change rotation without transcoding.
ffmpeg -i IMG_0703.MOV -metadata:s:v rotate="" -codec copy rotate_IMG_0703.MOV
Concaternate videos.
ffmpeg -f concat -safe 0 -i mylist.txt -c copy output

=find=
==Find exluding directory==
find . -wholename '/var/' -prune -o -ls
==Find text file in directoy execpt directory. Grep for text in that file and show it with colours in less==
find /opt/ongame/ -wholename '/opt/ongame/napsjb/server/naps/tmp' -prune -o -type f -exec grep --color=always -r '/fraud' /dev/null {} \; | less -SR
==Find excluding several directories==
find / -type d $ -path /proc -o -path /dev -o -path /net $ -prune -o -gid 1002 -exec chgrp -h 1001 {} \;
==Find excluding svn==
find . -path '*/.svn' -prune -o -type f -print
==Searches for files modified up to 4 days ago==
find ./ -type f -mtime -4
==Searches for files modified between certain dates. Here for files older than 30 days but younger than 60 (penultimate month)==
find ./ -type f -mtime -60 ! -mtime -30
sudo find . -newermt "2014-10-19 09:30" ! -newermt "2014-10-19 09:35"
==Find which dir is consuming inodes==
find /var -xdev -printf '%h\n' | sort | uniq -c | sort -k 1 -n
for i in $(ls) ; do echo $(find $i | wc -l) $i ; done | sort -n
==How much data is consumed by pattern==
export NFS_DIR=/netstorage/cam/ocp-01 ; find ${NFS_DIR} -maxdepth 1 | grep ^${NFS_DIR}/archived- | while read NFS_DIR_REMOVE ; do du -sk "${NFS_DIR_REMOVE}" ; done | awk '{ SUM += $1} END { print SUM "KiB" }' | numfmt --from=auto --to=iec-i --suffix=B
==find search small files==
find . -type f -size -1M -exec grep -H 'your_search_pattern' {} +
=find physical network interfaces=
find /sys/class/net -type l -not -lname '*virtual*' -printf '%f\n'

=findmnt=
view the mount tree
findmnt

=flash=
When firefox is complaining about outdated flash plugin
rm pluginreg.dat
=flatpak=
=Install flatpak=
sudo apt install -y flatpak gnome-software-plugin-flatpak
sudo flatpak remote-add --if-not-exists flathub https://dl.flathub.org/repo/flathub.flatpakrepo
=Install flatpak application and replace system binary=
sudo flatpak install -y flathub com.freerdp.FreeRDP
cat <<'EOF' | sudo tee /usr/local/bin/xfreerdp
#!/bin/bash
flatpak run com.freerdp.FreeRDP "$@"
EOF
sudo chmod 755 /usr/local/bin/xfreerdp
hash -r
=Run other binary from flatpack=
flatpak run --command=xfreerdp com.freerdp.FreeRDP

=List installed applications.=
flatpak list --app

=flock=
used to use cript that only used 1 time concurrently.
flock

=fmt=
Join lines
ifconfig -a | fmt -w 300

=fold=
Fold long lines. Break at 80 and blank spaces.
fold -w 80 -s text.txt
=forward traffic=
service x11
{
disable = no
socket_type = stream
protocol = tcp
wait = no
user = root
server = /usr/bin/nc
server_args = 172.28.37.152 6000
}
=fping=
fping --timeout=10 --elapsed --netdata <fqdn>
Example of testing connectivity.
for i in $(grep -E 'ocp-[0-9]{2}-' /etc/hosts | awk '{print $2}') ; do echo -e "$(fping --timeout=10 --elapsed $i)\t$(nc -v -w1 $i 22 </dev/null 2>&1 | strings | xargs)" ; done | column -t -s $'\t'

=free=
You have 15956MB physical ram. 9033MB is used by applications. 6922MB is free.
free -m
total used free shared buffers cached
Mem: 15956 15755 200 0 300 6421
-/+ buffers/cache: 9033 6922
Swap: 19998 2405 17593

=free new=
Total memory 8076624k and 5169152 free.
total used free shared buff/cache available
Mem: 8076624 2536328 1069132 284152 4471164 5169152
Swap: 7815164 2809244 5005920

Free memory usage from /proc/zoneinfo and /proc/meminfo
awk -v low=$(grep low /proc/zoneinfo | awk '{k+=$2}END{print k}') '{a[$1]=$2} END{print a["MemFree:"]+a["Active(file):"]+a["Inactive(file):"]+a["SReclaimable:"]-(12*low);}' /proc/meminfo
5168456
==physical memory==
Show physical memory in machine. Consider points below.
grep MemTotal /proc/meminfo
meminfo:
Provides information about distribution and utilisation of memory. This varies by architecture and compile options...
MemTotal:
Total usable ram (i.e. physical ram minus a few reserved bits and the kernel binary code)
Gives more information not really sure how.
dmesg|grep Memory:
==List memory modules==
dmidecode -t memory
lshw -class memory

=fstab=
Use ram for some logfiles.
none /var/log/ tmpfs defauls,noatime,size=10% 0 0
none /tmp/ tmpfs defauls,noatime,size=10% 0 0
none /var/tmp/ tmpfs defauls,noatime,size=10% 0 0
none /var/spool/ tmpfs defauls,noatime,size=10% 0 0

=fswebcam=
Capture photo.
fswebcam -r 1920x1080 --jpeg 85 -D 1 --quiet --no-banner shot.jpg
fswebcam -d /dev/video0 -i 0 -r 2592x1944 -p YUYV /net/10.111.222.1/storage/temp/logitech.jpg
=fwupdmgr=
fwupdmgr get-devices --show-all-devices
fwupdmgr get-upgrades
fwupdmgr update $device_id

=genisoimage=
genisoimage -o nuc.iso nuc
=gnome-font-viewer=
view fonts
gnome-font-viewer /file.woff2
=gnome-monitor-config=
Set one monitor. Disable all others.
gnome-monitor-config set -LpM HDMI-2
Get monitor settings
WINDOWS + p

=gpg=
Password encryption decryption with gnupg.
gpg -c --force-mdc /temp/shadow
echo "$(gpg -qd /temp/shadow.gpg)"
==create keys==
gpg --full-generate-key
==list secret keys==
gpg --list-secret-keys --keyid-format LONG
==delete secret keys==
gpg --delete-secret-key liza

==list public keys==
gpg --list-public-keys --keyid-format LONG

==export public key==
gpg --armor --export 3AA5C34371567BD2
==export private key==
gpg --armor --export-secret-keys 3AA5C34371567BD2
==export secret subkey==
gpg --armor --export-secret-subkeys 3AA5C34371567BD2
==import keys==
gpg --import pub.key
gpg --import sec.key
gpg --import sub.key
==add trust to private key==
gpg --edit-key 6252FC9A029A2669 trust quit # 5 y

==edit gpg key==
gpg --edit-key 6252FC9A029A2669
==send gpg key==
gpg --send-key 6252FC9A029A2669
==delete public key==
gpg --delete-key "User Name"
==change trust level on all keys==
gpg --list-keys --fingerprint |grep pub -A 1|egrep -Ev "pub|--"|tr -d ' ' | awk 'BEGIN { FS = "\n" } ; { print $1":6:" } ' | gpg --import-ownertrust
==get info about gpg encrypted file==
gpg --list-packets crypto-text.pgp
==list keys in gpg file==
gpg --list-packets crypto-text.pgp # | grep keyid
==get public key from command above==
gpg --recv-keys 754817487F42735A
==encrypt file==
gpg --encrypt --recipient user1@inter.net --recipient user2@inter.net --recipient user3@inter.net file.txt

==decrypt gpg file==
gpg --decrypt vpn-0ea602e33ab9c49fd.txt.gpg

==who has encrypted file==
gpg --pinentry-mode cancel --list-packets file.gpg
==remove expired public keys==
for i in $(gpg --list-public-keys --keyid-format LONG 2>&1 | grep -A1 -B1 expired | grep -Ev '^$|^pub|^uid') ; do gpg --delete-key $i ; done

=pgpdump=
pgpdump <(curl -sS https://download.spotify.com/debian/pubkey_C85668DF69375001.gpg)
=gphoto2=
Capture photo from the command line linux.
gphoto2 --camera='Canon EOS 40D (PTP mode)' --port=usb: --capture-image-and-download

=graphviz=
Create graph.
dot -Tps /flow -o /tmp/flow.ps

=grep=
Colorize grep output.
grep --color=always -r '10\.7\.' /opt/ongame/
Show non comment lines ending with a blank.
find . -name '*.properties' -exec grep --color=always -E '^[^#].*\ $' {} \; | less -SR
grep ipaddress from message file.
sudo grep DHCP /var/log/messages | grep -oir --color=always '192\.168\.[0-9]*\.[0-9]*' | sort -u
grep -E '([0-9]|[1-9][0-9]|1([0-9][0-9])|2([0-4][0-9]|5[0-5]))\.([0-9]|[1-9][0-9]|1([0-9][0-9])|2([0-4][0-9]|5[0-5]))\.([0-9]|[1-9][0-9]|1([0-9][0-9])|2([0-4][0-9]|5[0-5]))\.([0-9]|[1-9][0-9]|1([0-9][0-9])|2([0-4][0-9]|5[0-5]))'
grep ipaddress from file
grep -E '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}'
grep for tab
grep 10.199.2.1$'\t' /etc/hosts
grep from word containing regex space separated.
grep -oE '\S*regex\S*' /file
When grep start to complain about file being binary run the following command to define where.
grep -Pa '\x00' /temp/file_name
Remove binary part of file.
sed -i 's/\x00//g' /temp/file_name
Grep email addresses.
grep -E -o "\b[a-zA-Z0-9.-]+@[a-zA-Z0-9.-]+\.[a-zA-Z0-9.-]+\b" filename.txt
Grep for exact string like \
grep -F \\ blabla.json
=grepcidr=
grepcidr -v 10.0.0.0/8,172.16.0.0/12,192.168.0.0/16

=growpart=
growpart /dev/vda 5
btrfs filesystem resize max /

=gsettings=
Emulate 3 button mouse
gsettings set org.gnome.settings-daemon.peripherals.mouse middle-button-enabled true
Blinking cursor disable
gsettings set org.gnome.Terminal.Legacy.Profile:/org/gnome/terminal/legacy/profiles:/:$(gsettings get org.gnome.Terminal.ProfilesList default|tr -d \')/ cursor-blink-mode off
List settings
gsettings list-recursively

=gsync=
Install gsync
git clone https://github.com/iwonbigbro/gsync.git
cd gsync/
sudo python setup.py install
Download data.
gsync -u -r -t -v --progress --delete -l -s drive://motion/ /temp/motion2/

=gzip=
Compress a stream.
find . | gzip -9 > /tmp/file_list.gz

=gscan2pdf=
Scan and ocr pdf dokuments

=Handbrake=
Compress dvd
#Rip dvd.
sudo vobcopy -o /storage/temp/ -v -x -l
#compress video.
HandBrakeCLI -e x264 -Z Normal -i source.vob -o destination.mkv -a 2 -r 25 -E faac -f mkv -d -S 600 --crop 0:0:0:0
#Create film for android.
HandBrakeCLI -i 01.Alla.Vi.Barn.I.Bullerbyn.1986.SWEDiSH.vob -o 01.Alla.Vi.Barn.I.Bullerbyn.1986.SWEDiSH.mp4 -x level=30:bframes=0:cabac=0:ref=1:vbv-maxrate=1500:vbv-bufsize=2000:analyse=all:me=umh:no-fast-pskip=1 -e x264 --vb 300 -E faac --ab 128 --maxWidth 320 -2 -T -d
# Compress.
SOURCE=/ssd/temp ; DESTINATION=/temp ; for FILM in $(cd ${SOURCE}; ls *.mov | sed 's/\.mov$//g'); do HandBrakeCLI -e x264 -q 20 -B 160 -i ${SOURCE}/${FILM}.mov -o ${DESTINATION}/${FILM}.mp4 ;done
# High profile
HandBrakeCLI -i DVD -o ~/Movies/movie.mp4 -e x264 -q 20.0 -a 1 -E faac -B 160 -6 dpl2 -R Auto -D 0.0 -f mp4 --strict-anamorphic -m -x ref=2:bframes=2:subme=6:mixed-refs=0:weightb=0:8x8dct=0:trellis=0
=hashid=
Identify hash strings.
hashid

=heif-convert=
heif-convert image.HEIC new-image.jpg
=hostnamectl=
hostnamectl set-hostname rocky_8_1

=htmldoc=
Convert html document to pdf
htmldoc --webpage -f php_html_doc.pdf /home/andreasbj/php_manual_en.html 2>/tmp/htmldoc
=htpasswd=
Add user to htpasswd file.
htpasswd -b /etc/httpd/conf/htpasswd <username> <password>

=hunspell=
hunspell -d sv_SE swedish.txt
=hydra=
Password checking.
hydra -l root -P /etc/passwdknown -t 5 192.168.29.62 ssh2

=ifconfig=
Configure network.
ifconfig eth0 192.168.0.1 netmask 255.255.255.0 up
ip address alias
ifconfig eth0:0 192.168.1.2 netmask 255.255.255.0
Network configuration Full config.
echo -e "options timeout:1 attempts:1
domain halfface.se
nameserver 84.246.88.10
nameserver 84.246.88.20" > /etc/resolv.conf
ifconfig eth0 89.253.75.84 netmask 255.255.255.224 up
route add default gw 89.253.75.65 eth0
Vip on loopback /etc/sysconfig/network-scripts/ifcfg-lo:ipdbm
DEVICE=lo:ipdbm
IPADDR=192.168.122.2
NETMASK=255.255.255.255
NETWORK=192.168.122.0
ONBOOT=yes
Setting up multiple addresses. ifcfg-eth0-range0
TYPE=Ethernet
IPADDR_START=192.168.122.3
IPADDR_END=192.168.122.15
ifcfg-eth0
DEVICE=eth0
BOOTPROTO=static
ONBOOT=yes
TYPE=Ethernet
IPADDR=10.111.222.2
NETMASK=255.255.255.0
GATEWAY=10.111.222.1
DNS1=10.111.222.253
DNS2=10.111.222.254
DOMAIN="halfface.se subdomain.halfface.se"

=imv=
Image viewer for wayland
imv . -f -s full

=ilo=
log in to ilo
env -u LANG ssh -v Ongame@10.1.1.94
restart ilo
reset map1
start system
start system1

=install=
Crete directory
install -d --mode=755 --owner=user --group=group /apps/IP/IPim/var/log
Create empty file
install -o 0664 -o user -g group /dev/null ${ALFRESCO_DIR}/logs/catalina.out
=inotifywathc=
Se what access /dev/random
inotifywatch -v -t 60 /dev/random

=inxi=
inventory report.
inxi -Frmxx
=iostat=
iostat -xtc 5
-x extended statistics.
-t print time for each report.
-c display the cpu utalization report.
-y Omit first report with statistics since the system boot
==iostat -xty 5 1 dm-3==
Linux 2.6.32-573.7.1.el6.x86_64 (machine.se) 12/30/2021 _x86_64_ (12 CPU)
12/30/2021 11:47:42 AM
avg-cpu: %user %nice %system %iowait %steal %idle
0.12 0.00 2.01 4.23 0.00 93.65
Device: rrqm/s wrqm/s r/s w/s rsec/s wsec/s avgrq-sz avgqu-sz await svctm %util
dm-3 0.00 0.00 5806.20 0.00 1485056.00 0.00 255.77 1.54 0.27 0.17 97.44

# Explained.
rrqm/s The number of read requests merged per second that were queued to the device.
wrqm/s The number of write requests merged per second that were queued to the device.
r/s The number of read requests that were issued to the device per second.
w/s The number of write requests that were issued to the device per second.
rsec/s The number of sectors read from the device per second.
wsec/s The number of sectors written to the device per second.
avgrq-sz The average size (in sectors) of the requests that were issued to the device.
avgqu-sz The average queue length of the requests that were issued to the device.
await The average time (in milliseconds) for I/O requests issued to the device to be served. This includes the time spent by the requests in queue and the time spent servicing them.
svctm The average service time (in milliseconds) for I/O requests that were issued to the device. Warning! Do not trust this field any more. This field will be removed in a future sysstat version.
%util Percentage of elapsed time during which I/O requests were issued to the device (bandwidth utilization for the device). Device saturation occurs when this value is close to 100%.

=iotop=
iotop with dates for output to logfile.
DATE=$(date '+%Y-%m-%d %H:%M:%S %Z') ; sudo iotop -kbon1 | head -2 | while read i ; do echo $DATE $i ; done

=ip=
==Add vlan 23==
ip link add link eno1 name eno1.23 type vlan id 23
==View vlan protocol==
ip -d link show eno1.23
==Configure vlan==
ip addr add 10.151.23.101/24 brd 10.151.23.255 dev eno1.23
ip link set dev eno1.23 up
==create default route==
ip route add default via 192.168.1.254
==show routing==
ip route show
more info
ip route show table all
==Add static route==
ip route add 10.10.20.0/24 via 192.168.50.100 dev eth0
==Remove static route.==
ip route del 10.10.20.0/24
==which outgoing interfaces are available.==
ip r l| awk '/src/{print $9}'
==Which route is used for ip.==
ip route get 192.168.122.252
==route subnet over interface.==
sudo ip route add 145.251.242.0/24 dev tun0
==Show ipaddress on interface tun0==
ip address show tun0
==vlan tag interface.==
ip link add link eth0 name eth0.8 type vlan id 8
==set ip on interface.==
ip addr add 192.168.50.5 dev eth1
ip addr add 192.168.50.5/24 dev eth1
==set secondary ip on interface==
ip addr add 192.168.1.2/24 dev eth0
==remove ip address.==
ip addr del 192.168.50.5/24 dev eth1
==enable interface==
ip link set eth1 up
==disable interface==
ip link set eth1 down
==list arp entries.==
ip neigh show
==local routing table==
ip route list table local
==rule base routing. List rules==
ip rule show
==show multicast networks==
ip maddr show
==Disable traffic to an ipaddress.==
ip route add blackhole 10.151.19.151
==dynamic/random mac wifi disable==
MAC=$(ip link show | grep link/ | grep -v 00:00:00:00:00:00 | awk '{print $2}') ; nmcli -f TYPE,NAME connection show | grep ^wifi | sed 's/^wifi *//g' | while read i ; do echo '*' $i ; nmcli connection modify "${i}" 802-11-wireless.cloned-mac-address $MAC ; done
==change mtu==
sudo ip link set dev ens3 mtu 1400
==network namespaces==
ip netns list

=ip2location=
ip2location -d /usr/share/IP2Location/IP2LOCATION-LITE-DB5.BIN -p $IP -e country_name,city_name,ip --format TAB
sed 's/ \+/\t/g' haproxy.log | cut -f 9 | sort -u | while read IP ; do ip2location -d /usr/share/IP2Location/IP2LOCATION-LITE-DB5.BIN -p $IP -e country_name,city_name,ip --format TAB | tail -n1 ; done | column_tab | sort
=ipcalc=
ipcalc -n 192.121.85.96/27 -m

=iperf=
start server on client A.
iperf -s
start measure from the other host. Limit bandwidth to 10k.
iperf -c 10.20.30.40 --bandwidth 10K
==Multicast test.==
On the listener side:
iperf -s -u -B 224.1.1.1 -i 1
On sender
iperf -c 224.1.1.1 -u -T 32 -t 3 -i 1

=ipmitool=
What is the power consumtion of dell server.
ipmitool -I lanplus -H 127.0.0.1 -U root -P calvin delloem powermonitor
ipmitool lan print
ipmitool sdr list

=iptables=
==Show iptables OUTPUT, PREROUTING and POSTROUTING==
iptables --table nat --list --exact --verbose --numeric --line-number
==Show config==
iptables -L -t nat -n
==Dnat to localhost.==
iptables -t nat -I PREROUTING --source 131.115.115.53 -p tcp --dport 22 -j REDIRECT --to-ports 222
iptables -t nat -I OUTPUT --source 131.115.115.53 --destination 127.0.0.1 -p tcp --dport 22 -j REDIRECT --to-ports 222
==Flush all rules.==

iptables -F
iptables -X
iptables -t nat -F
iptables -t nat -X
iptables -t mangle -F
iptables -t mangle -X
iptables -P INPUT ACCEPT
iptables -P FORWARD ACCEPT
iptables -P OUTPUT ACCEPT

==Block==
iptables -A OUTPUT -p tcp -d 131.115.248.82 --dport 8080 -j DROP
iptables -A OUTPUT -p tcp -d 131.115.248.82 --dport 8080 -j REJECT

==Block outgoing mail==
iptables -A OUTPUT -p tcp --dport 25 -o $INTERFACE -j REJECT

==Block all traffic except ssh in/out log to syslog.==
iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -P FORWARD DROP
iptables -A INPUT -m tcp -p tcp --dport 22 -j ACCEPT
iptables -A INPUT -m tcp -p tcp --sport 22 -j ACCEPT
iptables -A INPUT -m state --state NEW -m tcp -p tcp -j LOG --log-level info --log-prefix "dropped-in"
iptables -A OUTPUT -m tcp -p tcp --dport 22 -j ACCEPT
iptables -A OUTPUT -m tcp -p tcp --sport 22 -j ACCEPT
iptables -A OUTPUT -m state --state NEW -m tcp -p tcp -j LOG --log-level info --log-prefix "dropped-out"

==Block traffic on certain port.==
iptables -A INPUT -p tcp --dport 7009 -j REJECT
==Fake source==
iptables -t nat -A POSTROUTING -d "${DST}" -p udp --dport 162 -j SNAT --to "${SRC}" &>/dev/null
# Remove the current rules
iptables -t nat -D POSTROUTING -d "${DST}" -p udp --dport 162 -j SNAT --to "${SRC}"
==redirect ip==
Send traffic destined for one ip and port to another ip and port.
iptables -t nat -A OUTPUT -p tcp -d 146.213.6.7 --dport 1023 -j DNAT --to-destination 10.199.150.111:1023
iptables -t nat -A OUTPUT -p icmp -d 146.213.6.7 -j DNAT --to-destination 10.199.150.111
==allow trafic from subnet==
iptables -A INPUT -s 172.16.27.0/24 -j ACCEPT
==allow ssh from all==
iptables -A INPUT -p tcp -dport 22 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p tcp -dport 22 -m conntrack --ctstate ESTABLISHED -j ACCEPT
or
-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 22 -j ACCEPT
==find which rule is blocking by removing one at a time. Better way is to enable logging==
iptables -L -n --line-numbers
iptables -D <line-number>
==List rules from OUTPUT chain with line number==
iptables -t filter -L OUTPUT --line-numbers -n

==Add rule to specific row number==
iptables -I OUTPUT $ROW_NUMBER -d 54.72.175.186/32 -p tcp -m tcp --dport 443 -j ACCEPT

=irc=
Close private messages
/window close
Close public messages
/window close
Close a query
/q
=jmtpfs=
Mount disk
jmtpfs /mnt/mtp
Umount disk
fusermount -u /mnt/mtp

=john=
Test performance
john -test
Recover passwords with password list.
john -wordlist:password.lst passfile.txt
=journalctl=
==View log from last day.==
journalctl --since yesterday
==List all units.==
systemctl list-unit-files
==Current disk usage.==
journalctl --disk-usage
==Show only certain error level. (err crit)==
journalctl -p err
==List boots==
journalctl --list-boots
==Show events between two time stamps.==
journalctl --since "2017-01-23 05:56:42" --until "2017-01-23 07:56:42"
==show entries for one unit.==
journalctl -u openvpn-server@server
journalctl -u sshd -f
==iptables logs==
journalctl -k -f | grep -i iptables
==wipe logs==
journalctl --vacuum-time=1h
==compare two different boots==
journalctl --since "$(date '+%F %H:%M:%S' --date '-10 hour')" -u NetworkManager -b -1 -o cat | sed 's/\[[0-9.]*\]//g'

==persistent logging==
Enable persistent logging in systemd-journald. grep journal /usr/lib/tmpfiles.d/systemd.conf. Install syslog instead.
mkdir /var/log/journal
chmod 2755 /var/log/journal
chown root:systemd-journal /var/log/journal
killall -USR1 systemd-journald

=jpegtran=
# to lossless cut a file.
jpegtran -crop 700x400+2150+1500 2012-05-19_20-39-35.jpg > /photos/Sweden/2012/2012-05-19/2012-05-19_20-39-35.jpg
# Rotate counter clockwise.
jpegtran -copy all -rotate 270 2012-08-18_15-06-43.jpg > 2012-08-18_15-06-43_270.jpg
=kdump=
Change action to dump memory.
/etc/kdump.conf
core_collector true
Reload config.
systemctl restart kdump
=keepass=
Create database
printf '%s\n' 'P@55Word'{,} | keepassxc-cli db-create -p -q keepassxc_abjorklund.kdbx
Add entry to database.
keepassxc-cli add keepassxc_abjorklund.kdbx abjorklund
Copy password from password entry
keepassxc-cli clip keepassxc_abjorklund.kdbx abjorklund

=keyboard=
keymaps
dumpkeys
loadkeys sv-latin1
loadkeys us
setxkbmap en
setxkbmap -layout se -variant nodeadkeys
reset corrupt keyboard after using vmware.
setxkbmap

=kill=
suspend/resume a jobb.
# kill -STOP PID
# kill -CONT PID
=kpartx=
# Create device files from disk image.
sudo kpartx -av disk_image.raw
# Remove device files.
sudo kpartx -d disk_image.raw

=lastb=
Show failed ssh logins.
lastb
=less=
Toggle line wrap
- -> S
tail with less. CTRL + c = scroll around. SHIFT + f = to tail again.
less +F -B /tmp/tmp
=lftp=
lftp -u <user>,<password> <ftp_server>
With proxy.
lftp -e "set ftp:proxy http://<url>:3128 ; set ssl:verify-certificate no; open -u user,password ftp://ftp.example.se/"
Workaround.
lftp -e 'set ftp:use-feat false; set ftp:ssl-allow false' -u user,passwor ftp.example.se
Run commands from cli.
lftp -u '<user>,<password>' -e 'set ssl:verify-certificate no ; ls -la ; quit' <ftp_server>

=ln=
Create link even if it exists.
ln -sfT /destination link

=locale=
To show 24 hour format.
LC_ALL=C
=localectl=
Change keyboard.
localectl list-keymaps
localectl set-keymap se-nodeadkeys
localectl set-x11-keymap se-nodeadkeys

=lock=
locking keyboard under linux.
lock-keyboard-for-baby
=logging=
bash create log.
#!/bin/bash
exec > /logfile
alternative
exec 2>/tmp/log
Read logs on system.
tail -f $(lsof | grep log$ |awk '{ print $NF }' | sort -u |xargs)
=logrotate=
Test dry run logrotate file. -d=debug -f=force
logrotate -d -f /etc/logrotate.conf
Force logrotate in verbose mode.
logrotate -v -f /etc/logrotate.conf
Create logrotate config entry.
# Configure log rotation.
cat << EOF > /etc/logrotate.d/ipmonperfj_cleanupdaemon
/directory/logs/cleanupdaemon.log {
copytruncate
size 100M
rotate 60
compress
missingok
olddir old
}
EOF
Disable logrotate. Look for file extension to ignore.
man logrotate.conf, you can read find tabooext
Ex. mv /etc/logrotate.d/mysql{,.rpmsave}

=losetup=
Create loopback devices for partitions in image. Force the kernel to scan the partition table on a newly created loop device
losetup -P /dev/loop2 harddrive.img
Set up next available device read only.
losetup -f -r /temp/rb-slog05/sda6
Show all
losetup -a
detatach
losetup -d /dev/loop2

=ls=
ls -la --time-style="+%Y-%m-%d %H:%M:%S" *.3gp
List processes in epoch date
( cd /proc; ls -rtd --full-time --time-style=+%s [0123456789]*; )
=lsblk=
lsblk -d -o NAME,ROTA,MODEL
=lshw=
==List memory modules==
lshw -C memory

==Is cpu 32 or 64bit.==
lshw -class processor

=lsof=
List recurivly all process that have a path open.
lsof +D /apps/
which ports has a process opened?
lsof -Pan -p 13354 -i
=lspci=
List devices without drivers.
lspci -nnk

=which process listen to port=
lsof -i :443

=mail=
command line mail with changed from
echo message$(date +%F_%H-%M-%S) | mail -s Subject$(date +%F_%H-%M-%S) -r from@inter.net reciever@inter.net
command line mail with changed from with attachment
echo message | mail -s Subject -r from@inter.net -a /attach.ment reciever@inter.net
Change default sender.
# ~/.mailrc
# From address for mailx.
set from="root degn.redbridge.se <abjorklund@redbridge.se>"
set replyto="root degn.redbridge.se <abjorklund@redbridge.se>"

=man=
man correct caracters.
LANG=C man passwd

man clean for output to file.
man [manual] | col -b > file.txt
Read from section 5
man man.5

=mbr=
backup mbr.
# dd if=/dev/sdX of=/temp/sdx-mbr bs=512 count=1

restore mbr
# dd if=/temp/sdx-mbr of=/dev/sdX bs=446 count=1
=mdadm=
Add disk that was lost
mdadm /dev/md125 -a /dev/vda1

=minimodem=
Transmit file via audio.
minimodem -t 200
Recieve file via audio
minimodem -r 200

=mkfs=
Create fat32 file system.
dd if=/dev/zero of=/tmp/sdb bs=32M status=progress conv=fdatasync count=10
fdisk /tmp/sdb
n
<accept all defaults>
t
b
p
w
mkfs.vfat -F 32 -n MYDRIVE /tmp/sdb1
==mkfs.ext4==
Create ext4 filesystem. Overwrite. Label and root reserved to 0.
mkfs.ext4 -F -L looted_storage -m 0 /dev/sda1

=mkpasswd=
Create a password hash
echo password | mkpasswd -m sha-512 -s

=mogrify=
Resize, crop... a file. Removes original.
mogrify -resize 800 *.jpg
=mokutil(secure boot/secureboot=
mokutil --sb-state

=mount=
Mount a temporary ram partition
mount -t tmpfs tmpfs /mnt -o size=1024
Mount a cifs filesystem and change owner on mountpoint.
mount.cifs -o credentials=/home/user/cifs.credentials,gid=1004,uid=1004 //server/c$ /mnt/cifs
Disallow normal user to ps. If not belonging to gid 1001.
*/etc/fstab
proc /proc proc defaults,hidepid=2,gid=1001 0 0

=movgrab=
List available formats
movgrab -T http://youtu.be/ucivXRBrP_0
Get version listed.
movgrab -f mp4:1920x1080 http://www.youtube.com/v/ucivXRBrP_0

=mplayer=
mplayer in ascii mode.
mplayer -monitoraspect 4:3 -vo aa LinaFreestyler.avi
mplayer -vo aa -monitorpixelaspect 0.5 *.mp4
mplayer on second soundcard.
mplayer -ao oss:/dev/dsp *.mp3
mplayer -ao alsa:device=hw=0.0 *.mp3
Or, to specify a non-default (secondary) device either of the following commands can be used.
mplayer -ao oss:/dev/dsp1 *.mp3
mplayer -ao alsa:device=hw=1.0 *.mp3
play from v4l
mplayer -tv device=/dev/video:driver=v4l:input=1:width=640:height=480:norm=ntsc:adevice=/dev/dsp tv://1 -zoom -aspect 4:3
mplayer -fps 15 tv:// -tv driver=v4l2:width=640:height=480:device=/dev/video0play hdv material.
mplayer -monitoraspect 16:9 -vf pp=lb
play dvd image.
mplayer dvd://1 -dvd-device DVD.iso
play h264 webcam
mplayer -fps 24 tv:// -tv driver=v4l2:width=1920:height=1080:device=/dev/video0:outfmt=0x34363248 -aspect 16:10 -fs
play mjpeg webcam
mplayer -fps 24 tv:// -tv driver=v4l2:outfmt=mjpeg:width=1920:height=1080:device=/dev/video0 -aspect 16:10 -fs
play mp3 in different speed keep pitch.
mplayer -speed 1.5 -af scaletempo /mp3/music.mp3
# list chapters.
mplayer dvd://1 -dvd-device /dev/sr0 -identify -novideo -nosound
# dump chapters.
mplayer -dvd-device /dev/sr0 dvd://3 -dumpstream -dumpfile 3.vob

=MP4Box=
Combine mp4 files
MP4Box -add file1.mp4 -add file2.mp4 output.mp4
=mpv=
Video player. Enable hardware accelleration.
# Install packages.
dnf install intel-media-driver libva libva-utils gstreamer1-vaapi ffmpeg intel-gpu-tools mesa-dri-drivers mpv
# Top for intel gpu
sudo intel_gpu_top
# Enable hardware accelleration for mpv.
CONFIG_FILE=~/.config/mpv/mpv.conf ; if ! grep -q ^hwdec=auto ${CONFIG_FILE} ; then echo hwdec=auto ${CONFIG_FILE} ; fi
# Create new initramfs
sudo dracut --force
# Look at browser.
chrome://gpu/

=mpstat=
top like output of system usage
mpstat 5 5

=mtr=
ping and traceroute combined.
mtr -rc 10 8.8.8.8

=mutt=
Put the followin in .muttrc to change From.
set realname="Joe User"
set from="user@host"
set use_from=yes
command line mail with attachment
mutt -s subject -a syslogs.tar.gz admin@domain.org < /dev/null
Change sender from command line.
export EMAIL=address@inter.net && mutt -s "Subject Test" anden@halfface.se < /dev/null
echo "Test message" | mutt -s "Subject test" -e "set realname=\"Real Name\"" -e "set from=\"anden@halfface.se\"" -e "set use_from=yes" anden@halfface.se
Change envolope from
export REPLYTO=email@inter.net
export EMAIL=email@inter.net
echo "email@inter.net testing" | mutt -e "set envelope_from=yes" email@inter.net -a /tmp/attachment
oneliner
export EMAIL=email@inter.net;export REPLYTO="${EMAIL}";echo "email@inter.net testing" | mutt -e "set envelope_from=yes" email@inter.net -a /tmp/attachment
export EMAIL=email@inter.net;export REPLYTO="${EMAIL}";echo "${EMAIL} testing on ${HOSTNAME}" | mutt -e "set envelope_from=yes" -s "${EMAIL} testing on ${HOSTNAME}" "${EMAIL}"
Dont trigger out of Out Of Office reply.
echo "email@inter.net testing" | mutt -e "unignore list-id" email@inter.net
=multilog=
split standard output to logfiles. In this case keep specific size. t means to prepend a TAI timestamp on each line. 10000B. 5 logfiles. tai64nlocal program simply reads stdin and replaces TAI timestamps with human-readable ones. http://blog.teksol.info/pages/daemontools/best-practices. Compress rotated logfiles.
mkdir /tmp/myapp ; ./myapp | multilog t s10000 n5 '!tai64nlocal' '!gzip' /tmp/myapp 2>&1

=nc (netcat)=
==Check communication.==
listen on port 3333.
nc -kl 3333
talk to port 3333.
nc 192.168.0.1 3333

==Transfer data==
Cat file, calculate size listen on port 3333.
cat backup.iso | pv -b | nc -l 3333
Receive file.
nc 192.168.0.1 3333 | pv -b > backup.iso

==Setup telnet server==
nc -L -l -p1234 -d -e cmd.exe

==Test connection.==
nc -w2 -znv 10.1.22.31 7222

==tunnel==
On the server, we open a listener on the TCP port 6667 which will forward data to UDP port 53 of a specified IP. If you want to do DNS forwarding like me, you can take the first nameserver's IP you will find in /etc/resolv.conf - in this example, this is 192.168.1.1. But first, we need to create a fifo. The fifo is necessary to have two-way communication between the two channels. A simple shell pipe would only communicate left process' standard output to right process' standard input.

mkfifo /tmp/fifo
nc -l -p 6667 < /tmp/fifo | nc -u 192.168.1.1 53 > /tmp/fifo

==Dont eat up standard output.==
nc -v --send-only --recv-only localhost 22

==Talk to pop3 server over ssl.==
nc --ssl mail.tele2.se 995
==Talk to pop server==
nc -C mail.tele2.se 25

==Talk to web server==
URL_SSL=halfface.se ; echo -e "HEAD / HTTP/1.1\nHost: ${URL_SSL}\n\n" | nc --ssl ${URL_SSL} 443
echo -e 'GET /users/password/new HTTP/1.1\r\nHost: localhost\r\nConnection: Close\r\n\r\n' | nc localhost 80 | head
To overcome problems with nc closing connection too fast.
(echo -en 'GET / HTTP/1.1\r\nHost: 172.30.156.15\r\nConnection: close\r\n\r\n'; sleep .1) | nc 172.30.156.15 80 | head -30
nc --no-shutdown -v 172.30.156.15 80 <<<$(echo -en 'GET / HTTP/1.1\r\nHost: 172.30.156.15\r\nConnection: close\r\n\r\n')

=ncdu=
disk usage. Stay in one filesystem.
ncdu -x /
=net=
Start service via samba.
net rpc service start ipremote -I 172.17.255.99 -U 'domain/user%password'

=netstat=
Look at network connections. tcp/ip4.
netstat -4anpt
Look at multicast groups
netstat -g
What does it mean?=
ESTABLISHED
The socket has an established connection.
SYN_SENT
The socket is actively attempting to establish a connection.
SYN_RECV
A connection request has been received from the network.
FIN_WAIT1
The socket is closed, and the connection is shutting down.
FIN_WAIT2
Connection is closed, and the socket is waiting for a shutdown
from the remote end.
TIME_WAIT
The socket is waiting after close to handle packets still in the
network.
CLOSE The socket is not being used.
CLOSE_WAIT
The remote end has shut down, waiting for the socket to close.
LAST_ACK
The remote end has shut down, and the socket is closed. Waiting
for acknowledgement.
LISTEN The socket is listening for incoming connections. Such sockets
are not included in the output unless you specify the
--listening (-l) or --all (-a) option.
CLOSING
Both sockets are shut down but we still don't have all our data
sent.
UNKNOWN
The state of the socket is unknown.
==statistics==
netstat -s
netstat -s | retransmit

=nft=
nftables list config
nft -j list ruleset | jq .
=nmap=
Scan for open ssh ports.
nmap -p 22 --open -sV 10.0.0.*
nmap -p 22 -sV --open -oG - $(ip -4 a s $(ip route show default | awk '{print $5}') | grep inet | awk '{print $2}') | awk '/\/open\// {print $2,$3}'
Syn scan.
nmap -P0 -sS -p1023 www.halfface.se
Ping scan. Do not resolve.
nmap -sn -n 10.127.254.1-254
Which ciphers are allowed.
nmap --script ssl-enum-ciphers -p 465 www.halfface.se
arp scan.
nmap -PR 192.168.0.0/24
which kex_algorithms server_host_key_algorithms encryption_algorithms compression_algorithms
nmap --script ssh2-enum-algos -sV -p 22 ssh.server.inter.net
Which manufacturer.
nmap -sn 10.111.222.0/24

=nmcli=
==List connections==
nmcli con
==rename connection==
nmcli connection modify <old_name> con-name <new_name>

==manage network from cli==
http://fedoraproject.org/wiki/Networking/CLI
==Connect to a configured connection by name==
nmcli connection up WireLess
==Disconnection by name==
nmcli connection down Wireless
==Connect to remembered network.==
nmcli con up '[-_-] halfface 5'
==List available wireless networks.==
nmcli device wifi list
==Generate list of available wireless networks.==
nmcli device wifi rescan
sudo nmcli device wifi list --rescan yes

==Create connection for wireless network.==
nmcli device wifi connect Bredband password P4ssM0rd
==Connect to specific bssid==
nmcli connection modify MyWifiConnection 802-11-wireless.bssid 00:11:22:33:44:55

==List networks on specific interface.==
nmcli device wifi list ifname wlp0s18f2u4
==Disconnect network interface.==
nmcli device disconnect wlp0s18f2u4
==Manually setup interface.==
nmcli con add con-name "static-ens32" ifname ens32 type ethernet ip4 xxx.xxx.120.44/24 gw4 xxx.xxx.120.1
nmcli con mod "static-ens32" ipv4.dns "xxx.xxx.120.1,8.8.8.8"
nmcli con up "static-ens32" iface ens32
==list devices.==
nmcli device status
==list connections.==
nmcli connection show
==delete connection==
nmcli con delete "Wired connection 1"
==add connection with static ip.==
nmcli con add con-name ens224 ifname ens224 type ethernet ip4 172.30.109.16/24
==show properties for connection==
nmcli dev show ens224
==set dns server==
nmcli connection modify enp1s0 ipv4.dns "10.111.222.2,8.8.8.8"
==edit==
nmcli con edit $connection
print all
==autostart==
nmcli connection modify IFNAME connection.autoconnect yes|no
==dhcp option==
ip -4 addr show | grep -Ev "127.0.0.1|LOOPBACK" | awk '/^[0-9]+:/ {sub(/:/,"",$2); print $2}' | sort -u | while read NIC ; do echo '*' $NIC ; nmcli -f DHCP4 device show $NIC ; done

==Make network a bridge interface==
sudo nmcli con add ifname br0 type bridge con-name br0
sudo nmcli con add type bridge-slave ifname <network_card> master br0
sudo nmcli con modify br0 bridge.stp no
sudo nmcli con down "Wired connection 1"
sudo nmcli con up br0
==modify(change) vlan id==
nmcli connection modify <connection_name> vlan.id <new_id>

=nohup=
Start binary under nohup and tail log.
nohup ./run.sh & sleep 1 ; tail -1000f nohup.out
Start process and log to specified file.
nohup daemon > /path/daemon.log &

=nping=
nping -c 1 --tcp -p 80 www.halfface.se

=nth=
Name That Hash
nth --text '$y$j9T$jogs61gwDHB6L1oEwHeR00$L4cfYqkxKzS8dtkC5hPXFRMOIcEl6q5VKIkngrRGFM0'
=ntfs-3g=
mount ntfs filesystem. read and write.
yum install fuse fuse-libs ntfs-3g
mount /dev/sda1 /media/c_drive -t ntfs-3g -r -o umask=0222,locale=en_US
mount /dev/sda1 /media/c_drive -t ntfs-3g -rw -o umask=0000,locale=en_US
fstab read and write.
/dev/sda3 /media/e_drive ntfs-3g ro,defaults,umask=0222 0 0
/dev/sda1 /media/c_drive ntfs-3g rw,defaults,umask=0000 0 0
Create ntfs partition.
fdisk 7/gdisk 0700
mkfs.ntfs /dev/sdx1 -Q

=numbers=
series of numbers
bash:
echo {1..10}
=numfmt=
iec=accept optional single letter suffix. No output suffix. Remove B from input. change format of output, mb ,gb and so on.
numfmt --from=iec --to=none --suffix=B 8.7KB

=nwipe (dban)=
Wipe your disk
nwipe --nogui --nowait --autonuke /dev/sdb

=omping=
multicast ping
omping -c10 10.111.222.118 10.111.222.121
=openvpn3=
==Install openvpn fedora 38+ /etc/yum.repos.d/_copr\:copr.fedorainfracloud.org\:dsommers\:openvpn3-devsnapshots.repo==
[copr:copr.fedorainfracloud.org:dsommers:openvpn3-devsnapshots]
name=Copr repo for openvpn3-devsnapshots owned by dsommers
baseurl=https://download.copr.fedorainfracloud.org/results/dsommers/openvpn3-devsnapshots/fedora-$releasever-$basearch/
type=rpm-md
skip_if_unavailable=True
gpgcheck=1
gpgkey=https://download.copr.fedorainfracloud.org/results/dsommers/openvpn3-devsnapshots/pubkey.gpg
repo_gpgcheck=0
enabled=1
enabled_metadata=1
==Install package from above.==
dnf install openvpn3-client
==Add configuration==
OPENVPN_CONFIG=<name> ; openvpn3 config-import --name "$OPENVPN_CONFIG" --persistent --config "$OPENVPN_CONFIG".ovpn
==List configs==
openvpn3 configs-list
openvpn3 configs-list --verbose

==Remove config==
openvpn3 config-remove --config <config-name>
==show full config==
openvpn3 config-dump --config <config-name>

==Connect==
openvpn3 session-start --config <config-name>
==Disconnect==
openvpn3 session-manage --config <config-name> --disconnect
==Connect to the log with debug enabled. This can be run in a different terminal window after the connection has been started.==
openvpn3 log --config <config-name> --log-level 6
==Show active sessions==
openvpn3 sessions-list
==Show statistics for an active session==
openvpn3 session-stats --config <config-name>
==Show configuration settings==
openvpn3 config-manage --config <config-name> --show
==sessions disconnect==
openvpn3 sessions-list | grep Path | awk '{print $2}' | while read OPENVPN_PATH ; do echo $OPENVPN_PATH ; openvpn3 session-manage --session-path $OPENVPN_PATH --disconnect ; done
==View config files==
sudo find /var/lib/openvpn3/configs/ -type f

=openssl=
==Grab the public key.==
openssl s_client -connect www.halfface.se:443 </dev/null 2>/dev/null | sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p'
==What does the ssl cert look like.==
HOST=www.halfface.se ; PORT=443 ; echo | openssl s_client -connect ${HOST}:${PORT} -servername ${HOST}| openssl x509 -ext subjectAltName -noout -startdate -enddate -subject -issuer -nameopt RFC2253,sep_comma_plus_space

==What does crl look like. (Certificate Revocation List)==
openssl crl -inform PEM -text -noout -in crl.pem

==Connect to ssl server==
echo hello | openssl s_client -connect www.halfface.se:8140
==Connect to ssl server -cipher NULL,LOW==
echo hello | openssl s_client -connect www.halfface.se:8140
==Connect with openssl v3==
openssl s_client -ssl3 -connect ipmon01.dupont:443
==Connect with low security cipher==
echo X | openssl s_client -cipher NULL,LOW -connect www.halfface.se:8140
==PEM convert to DER==
openssl x509 -inform PEM -in /file.pem -outform DER file.der
==p12 to cer==
openssl pkcs12 -in infile.p12 -out outfile.cer -nodes
Export public
openssl pkcs12 -in path.p12 -out newfile.crt.pem -clcerts -nokeys -passin pass:<password>
export CERT=<cert>.p12 ; export PASS=<pass> ; openssl pkcs12 -in $CERT -out ${CERT}.pem -clcerts -nokeys -passin pass:${PASS}
Export private
openssl pkcs12 -in path.p12 -out newfile.key.pem -nocerts -nodes -passin pass:<password>
export CERT=<cert>.p12 ; export PASS=<pass> ; openssl pkcs12 -in $CERT -out ${CERT}.key -clcerts -nodes -passin pass:${PASS}
==p7b to pem==
openssl pkcs7 -print_certs -in <certificate>.p7b -out certificate.pem
==pem to p12==
Using file containing private, public and chain.
openssl pkcs12 -export -in sulzer.pem -out sulzer.p12 -passout pass:

==pfx to pem==
env FILE="<file>" PASSWORD="<password>" bash -c 'openssl pkcs12 -in "$FILE" -out "${FILE//\//_}.pem" -nodes -password pass:"$PASSWORD"'
Complete file.
openssl pkcs12 -in filename.pfx -out cert.pem -nodes
Get private cert. Then remove password. Decrypt
openssl pkcs12 -in filename.pfx -nocerts -out key.pem
openssl rsa -in key.pem -out server.key
Get public cert.
openssl pkcs12 -in filename.pfx -clcerts -nokeys -out cert.pem

==Extract p12 password protected keys in==
openssl pkcs12 -in /file.p12 -passin file:/password -nokey -nodes -out /file.nokeys
openssl pkcs12 -info -in </path/to/file.pfx> -passin pass:<pfx's password>

==Encrypt file==
openssl aes-256-cbc -a -salt -in file -out file,encoded -passin file:passfile
==Decrypte file==
openssl aes-256-cbc -d -a -salt -in file -out file,encoded -passin file:passfile
==Install new root ca==
# Change to the directory:
cd /etc/pki/tls/certs
# Next download the College root certificate:
wget https://icca2.ic.ac.uk/certenroll/ic-root.crt
# Convert the certificate to PEM format:
openssl x509 -inform der -in ic-root.crt -out ic-root.pem
# Create a link with the certificate hash:
ln -s ic-root.pem `openssl x509 -hash -noout -in ic-root.pem`.0
# Create sha256 base64 encoded hash
openssl dgst -binary -sha256 | openssl base64
# Verify root ca.
openssl verify -CApath /etc/pki/tls/certs ic-inter-root.pem
icrootca.cer: OK
The server certificate is the first certificate returned, and will be PEM formatted. The CA certificate is the final certificate returned, and is also PEM formatted.
openssl': echo | openssl s_client -connect www.sslsite.com:443 -showcerts
Check ca store files.
find . -name '*.pem' | while read PEM ; do echo '###' ${PEM} '###';ls -la "${PEM}" ; set -x ; curl --cacert "${PEM}" https://site.test.net/index.htm.
==Verify pop3 connectivity.==
openssl s_client -crlf -connect mail.tele2.se:110 -starttls pop3
USER yiming
PASS foobar
LIST – lists the messages available in the user’s account, returning a status message and list with each row containing a message number and the size of that message in bytes
STAT – returns a status message, the number of messages in the mailbox, and the size of the mailbox in bytes
RETR [message_num] – returns the message identified by the message number, which is the same as the message number shown in the LIST command output
TOP [message_num] [n] – returns the top n lines of the message denoted by message number.
QUIT command will end the session.
==Create wildcard self signed certificate.==
openssl req -x509 -nodes -days 3650 -newkey rsa:2048 -keyout wildcard.test.internal.zone.key -out wildcard.test.internal.zone.crt
Common Name (eg, your name or your server's hostname) []:*.test.internal.zone
==Verify certificate chain==
openssl verify -CAfile Thawte_Primary_Root_CA.pem -untrusted thawte_SSL_CA_G2.cer www.halfface.se.pem
Look at certificate chain.
openssl s_client -connect www.halfface.se:443
CONNECTED(00000003)
depth=2 O = Digital Signature Trust Co., CN = DST Root CA X3
verify return:1
depth=1 C = US, O = Let's Encrypt, CN = Let's Encrypt Authority X3
verify return:1
depth=0 CN = www.halfface.se
verify return:1
---
Certificate chain
0 s:CN = www.halfface.se
i:C = US, O = Let's Encrypt, CN = Let's Encrypt Authority X3
1 s:C = US, O = Let's Encrypt, CN = Let's Encrypt Authority X3
i:O = Digital Signature Trust Co., CN = DST Root CA X3
---
Verify chain.
openssl s_client -showcerts -verify 5 -connect www.halfface.se:443 < /dev/null 2>&1

==Connect to smtp server via ssl.==
openssl s_client -crlf -ign_eof -connect www.halfface.se:25 -starttls smtp -quiet
EHLO halfface.se
AUTH LOGIN
$(echo -n "username" | base64)
$(echo -n "password" | base64)
MAIL FROM:anden@halfface.se
RCPT TO:<anden@halfface.se>
DATA
Subject: Test from cli.

This is a test email.
.
QUIT

==Connect to imap==
openssl s_client -crlf -connect www.halfface.se:993
openssl s_client -showcerts -connect www.halfface.se:143 -starttls imap
Login
tag login abjorklund ${PASSWORD}
List mailboxes
tag LIST "" "*"
Log out
tag LOGOUT

==compare two certifactes==
Compare the use case for the certificate.
sdiff <(openssl x509 -in server.crt -noout -issuer -subject -enddate -purpose) <(openssl x509 -in uc_activemq.crt -noout -issuer -subject -enddate -purpose)| less
==create a csr==
openssl req -new -sha256 -nodes -out www.halfface.se.csr -newkey rsa:2048 -keyout www.halfface.se.key -config <(
cat <<-EOF
[req]
default_bits = 2048
prompt = no
default_md = sha256
req_extensions = req_ext
distinguished_name = dn
[ dn ]
O=Organisation: halfface
C=SE
ST=Stockholm
L=Stockholm
CN = www.halfface.se
[ req_ext ]
subjectAltName = @alt_names
[ alt_names ]
DNS.1 = halfface.se
DNS.2 = ldap.halfface.se
DNS.3 = mqtt.halfface.se
EOF
)

==csr information==
openssl req -noout -text -in file.csr | grep -vE ' [0-9A-Fa-f]{2}:[0-9A-Fa-f]{2}:'

==look at content of private key==
openssl rsa -text -noout -in key.pem

==confirm that public private and csr match==
# For your SSL certificate:
CERT_PUBLIC=$(ls *.crt)
echo $(openssl x509 -noout -modulus -in "${CERT_PUBLIC}" | openssl md5 | awk '{print $2}'),"${CERT_PUBLIC}",public cert.
# For your RSA private key:
CERT_PRIVATE=$(ls *.key)
echo $(openssl rsa -noout -modulus -in "${CERT_PRIVATE}" | openssl md5 | awk '{print $2}'),"${CERT_PRIVATE}",private key
# For your CSR:
CERT_CSR=$(ls *.csr)
echo $(openssl req -noout -modulus -in "${CERT_CSR}" | openssl md5 | awk '{print $2}'),"${CERT_CSR}",certificate signing request

==connect with ca private and public key==
openssl s_client -CAfile ca.pem -cert public.crt -key private.key -connect 10.12.118.184:1023 -tls1_2
==create a ca==
===Create ca and certificates.===
# Create folder structure.
mkdir /root/ca/
mkdir /root/ca/certs/
mkdir /root/ca/crl/
mkdir /root/ca/newcerts/
mkdir /root/ca/private/
mkdir /root/ca/requests/
touch /root/ca/index.txt
echo 1000 > /root/ca/serial
chmod 600 /root/ca
# Create private key for the CA certificate. pass phrase: $(pwgen 15)
cd /root/ca/
openssl genrsa -aes256 -out private/cakey.pem 4096
# Create a public certificate for the CA.
openssl req -new -x509 -key /root/ca/private/cakey.pem -out cacert.pem -days 36525

Country Name (2 letter code) [AU]:SE
State or Province Name (full name) [Some-State]:Stockholm
Locality Name (eg, city) []:Stockholm
Organization Name (eg, company) [Internet Widgits Pty Ltd]:Company
Organizational Unit Name (eg, section) []:Company
Common Name (e.g. server FQDN or YOUR name) []:Certificate Authority
Email Address []:anden@halfface.se

# Copy system openssl.cnf to /root/ca dir. Then change dir in config.
vim openssl.cnf
[ CA_default ]
dir = /root/ca # Where everything is kept

===Create signed certificate keypair===
cd requests/
# Create csr
openssl req -new -newkey rsa:2048 -nodes -keyout <client>.key -out <client>.csr -config ../openssl.cnf
# Issue certificate for csr.
openssl ca -in <client>.csr -out <client>.crt -config ../openssl.cnf -days 36525

==talk http via openssl==
openssl s_client -crlf -quiet -connect www.halfface.se:443 <<EOF
GET / HTTP/2.0
Host: www.halfface.se

EOF

==look at cert==
openssl asn1parse -in rb-ca.crt.2021-02-28
==performance testing==
openssl speed -evp aes-256-ecb
==confirm that ca is correct==
echo | openssl s_client -CAfile Sectigo_RSA_Domain_Validation_Secure_Server_CA.pem -no-CAfile -no-CApath -tls1_2 -connect 172.30.32.141:5044 2>&1 | grep Verification
Verification: OK
==openssl s_server==
Setup server listening as http server.
openssl s_server -status_verbose -HTTP -cert host.inter.net.crt -key host.inter.net.key
Setup https server listening on https on port 4433 providing complete chain
openssl s_server -status_verbose -HTTP -cert halfface.se.pem -cert_chain halfface.se.intermediate.pem -key halfface.se.key -accept 4433

==othername:<unsupported>==
You will have to locate the "OCTET STRING" line just below the "OBJECT :X509v3 Subject Alternative Name" line then strpars
# print section offset via
openssl asn1parse -in yourcert.pem
# parse otherName from "OCTET STRING" <offset> is the value in the beginning of the line.
openssl asn1parse -in yourcert.pem -strparse <offset>
Another way of seeing same data is through
openssl asn1parse -in /tmp/tmp -dump -strictpem

=create password string=
openssl passwd -6 -salt $RANDOM $PASSWORD

=pactl=
Pulse Audio cli tool.
List output devices.
pactl list short sinks
Set default output device
pactl set-default-sink $i
List where applications send output.
pactl list short sink-inputs
Move application to other output device.
pactl move-sink-input $applicaiton $sink

=pam=
Troubleshooting pam.
/etc/syslog.conf
# Get debugging data.
*.debug /var/log/debug.log
Create logfile and restart *syslog.
touch /var/log/debug.log
service syslog restart
Put pam in debug mode.
touch /etc/pam_debug
OR you can enable debugging only for the modules you're interested in by adding "debug" to the end of the relevant lines in /etc/pam.d/system-auth or the other /etc/pam.d/* files:
login auth required pam_unix.so debug
Debugging is found in /var/log/debug.log.

=pam_tally2=
Configured here.
/etc/pam.d/password-auth:auth required pam_tally2.so file=/var/log/tallylog onerr=fail per_user deny=6 no_magic_root
What is status from account?
pam_tally2 --user=user1
Login Failures Latest failure From
user1 8 04/20/15 11:39:54 192.168.1.1

=parallel=
Run command 10 times in parallel.
seq 10 | parallel -n0 echo "Hello, World"
Run command 10 times in parallel dryrun.
seq 10 | parallel --dry-run -n0 echo "Hello, World"
Compress logfiles in parallel.
parallel gzip ::: *.log
=partprobe=
Rescan block device to setup device files
partprobe /dev/sde
=partx=
partx /dev/sda -l ; partx /dev/sda -u ; partx /dev/sda -l

=paste=
Combine to files to one in multiple column. Replace tab with spaces.
paste /tmp/check_name_nagios /tmp/filename | column -t -s $'\t'
Combine every second line with a space in between.
paste -d' ' - -

=pcregrep=
Multiline grep
pcregrep -M 'pattern: line1\nPattern lin2' /temp/files_*
=pdftotext=
grab text from pdf document.
pdftotext document.pdf
=pdftk=
Rotate clockwise
PDF=<file.pdf> ; pdftk "${PDF}" cat 1-endwest output "${PDF}".rotate
Rotate counter clockwise
PDF=<file.pdf> ; pdftk "${PDF}" cat 1-endeast output "${PDF}".rotate
Create one pdf from others.
pdftk <file.pdf>* cat output <file_combo.pdf>
Extract one page from pdf.
pdftk input.pdf cat 11 output page11.pdf
Extract series of pages from pdf
pdftk input.pdf cat 3-7 output pages_3-7.pdf

=pidof=
which pids has a program stared. Find pid.

=ping=
Ping ipv6 loopback
ping6 ::1 -c1
Ping ipv6 broadcast
ping6 ff02::1%2 | cut -d\ -f4
Ping short output
export ADDRESS=2001:4860:4860::8888 ; PING=$(ping6 -w1 -q -c1 -i10 ${ADDRESS} 2>&1) ; RTT=$( grep rtt <<<"${PING}" | awk -F/ '{print $6}') ; RECEIVED=$(grep received <<<"${PING}") ; echo $ADDRESS $RECEIVED, rtt=${RTT}
Ping to discover mtu. 1460, 1450. When reply increase with 2. when found highest value increase with 28 to get mtu.
ping -M do -s 1472 123.45.56.78

=pip=
==which versions of django exist==
pip install pylibmc
==which versions are installed==
pip list

==which files does pip package provide.==
pip show -f $package
==Uppgrade package.==
pip install $package --upgrade
==where your own packages might end up==
/usr/local/lib/python3.9
/usr/lib/python2.7/site-packages/
==upgrade pip==
ls -la /usr/lib64/libldap_r.so /usr/lib64/libldap.so
==do not use cache==
pip3 install -r requirements.txt --no-cache-dir

=pgrep=
Grep any processlines including 1066
pgrep -lf 1066
=pmap=
Look at memory usage of process.
sudo pmap 2258

=postfix=
remove mails in queue.
mailq | grep ^[A-F0-9] | awk '{print $1}' | postsuper -d -
list mails in queue
mailq | grep "^[A-F0-9]"
Get mails in better output to better decide what to do with mails.
mailq | grep -v -- "-Queue ID-" | sed 's/^$/\x0/g' | tr -d '\n' | sed 's/\x0/\n/g'
Remove stuck emails.
postsuper -d ALL deferred
List email
postcat -q E55692442F
Read mail
postcat -vq [message-id]

=pr=
Print two files between each other.
pr -w200 -m -t /tmp/1 /tmp/2
=printf=
Convert octal to utf-8
printf '\360\237\222\200'
decimal to integral
printf "%.0f" <decimal>

=printscreen=
import -window root test.png
Gnome copy graphics to paste buffer. Copy selected portion of screen.
gnome-screenshot -a

=/proc=
*/proc/meminfo
MemTotal — Total amount of physical RAM, in kilobytes.

MemFree — The amount of physical RAM, in kilobytes, left unused by the system.

Buffers — The amount of physical RAM, in kilobytes, used for file buffers.

Cached — The amount of physical RAM, in kilobytes, used as cache memory.

SwapCached — The amount of swap, in kilobytes, used as cache memory.

Active — The total amount of buffer or page cache memory, in kilobytes, that is in active use. This is memory that has been recently used and is usually not reclaimed for other purposes.

Inactive — The total amount of buffer or page cache memory, in kilobytes, that are free and available. This is memory that has not been recently used and can be reclaimed for other purposes.

HighTotal and HighFree — The total and free amount of memory, in kilobytes, that is not directly mapped into kernel space. The HighTotal value can vary based on the type of kernel used.

LowTotal and LowFree — The total and free amount of memory, in kilobytes, that is directly mapped into kernel space. The LowTotal value can vary based on the type of kernel used.

SwapTotal — The total amount of swap available, in kilobytes.

SwapFree — The total amount of swap free, in kilobytes.

Dirty — The total amount of memory, in kilobytes, waiting to be written back to the disk.

Writeback — The total amount of memory, in kilobytes, actively being written back to the disk.

Mapped — The total amount of memory, in kilobytes, which have been used to map devices, files, or libraries using the mmap command.

Slab — The total amount of memory, in kilobytes, used by the kernel to cache data structures for its own use.

Committed_AS — The total amount of memory, in kilobytes, estimated to complete the workload. This value represents the worst case scenario value, and also includes swap memory.

PageTables — The total amount of memory, in kilobytes, dedicated to the lowest page table level.

VMallocTotal — The total amount of memory, in kilobytes, of total allocated virtual address space.

VMallocUsed — The total amount of memory, in kilobytes, of used virtual address space.

VMallocChunk — The largest contiguous block of memory, in kilobytes, of available virtual address space.

HugePages_Total — The total number of hugepages for the system. The number is derived by dividing Hugepagesize by the megabytes set aside for hugepages specified in /proc/sys/vm/hugetlb_pool. This statistic only appears on the x86, Itanium, and AMD64 architectures.

HugePages_Free — The total number of hugepages available for the system. This statistic only appears on the x86, Itanium, and AMD64 architectures.

Hugepagesize — The size for each hugepages unit in kilobytes. By default, the value is 4096 KB on uniprocessor kernels for 32 bit architectures. For SMP, hugemem kernels, and AMD64, the default is 2048 KB. For Itanium architectures, the default is 262144 KB. This statistic only appears on the x86, Itanium, and AMD64 architectures.

=ps=
==Process list in tree view.==
ps axfww
==Process sort by cpu usage.==
ps auxwww --sort -%cpu | head
==How long has process been running.==
ps -p 1 -o etime=
==Process list sorted after memory usage.==
ps aux --sort=size
==Process show memory usage... sort...==
ps axo rss,%cpu,pid,euser,cmd | sort -nr | head -n 10 | less -ISRM
==Process sort by mem usage.==
ps auxwww --sort -rss | head
==Processes sorted by time running.==
ps aux --sort -time
==Processes sorted by time started==
ps -auxwww --sort=start_time
==ps showing threads.==
ps -efL
==How long has process been running.==
echo -n $(( ($(date +%s) - $( stat -c%X /proc/$(pgrep -f [a]ctivemq.jar))) / 3600 ))
==ps long usernames==
ps axo user:20,pid,pcpu,pmem,vsz,rss,tty,stat,start,time,comm
==ps including nice==
ps -eo pid,user,ni,comm

=pstack=
print a stack trace of a running process

=pulseaudio=
# Is pulseaudio running?
ps uxawww| grep -E pulseaudi[o]
# stop pulseaudio
pulseaudio -k
# start pulseaudio as found by ps | grep pulseaudio
/usr/bin/pulseaudio --start --log-target=syslog

=putty=
Run putty from cli with login
"C:\Program Files\PuTTY\putty.exe" -l <username> -pw <password> <host_url>
Always setup stay alive.
connection -> keepalive -> 60
set up tunnel
putty -load blt.homeip.net -l bjorklun -pw password -L 19242:192.168.0.42:3389 blt.homeip.net
putty without taking tty.
plink -load www.halfface.se -l user_name -pw password -R *:3389:localhost:3389 -2 -4 -N
reverse tunnel. Connect remote host 3400 to machine running putty localhost:3389.
connection -> ssh -> tunnels -> "Source Port" = 3400 -> destination = localhost:3389 -> remote.
socks server.
connection -> ssh -> tunnels -> Source port: 3128 , Destination: localhost:3128, Dynamic:true -> add -> apply.
Change font size
echo Windows Registry Editor Version 5.00 > putty.reg && echo [HKEY_CURRENT_USER\Software\SimonTatham\PuTTY\Sessions\Default%20Settings] >> putty.reg && echo "Font"="Courier New" >> putty.reg && echo "FontHeight"="12" >> putty.reg && reg import putty.reg

=pv=
throughput in pipe. speed.
pv
pv -cN
make a dd and limit througput to 20MB/s.
dd if=${HOST}.qcow2 bs=4k conv=noerror,sync | pv -L 20M | dd of=${HOST}.dd_noerror.qcow2
=pwgen=
Create less complicated password.
pwgen -sy 15 -r \'\"\^\`\~\;\[\]\{\}\,

=qalculate=
qalc
> 40 euro to SEK
40 * euro = approx. SEK 417.36
=readpst=
output pst file in separate files in out directory
readpst -S -o out/ outlook.pst
=reboot=
Hard reboot mean that shutdown scripts will not run and machine reboot immediately without syncing hard disk drives.
This commands enable sysrq and after this call fast reboot.
echo 1 > /proc/sys/kernel/sysrq
echo b > /proc/sysrq-trigger
Force shutdown
echo 1 > /proc/sys/kernel/sysrq
echo o > /proc/sysrq-trigger
Kernel panic
echo c > /proc/sysrq-trigger
==List last reboots==
last --time-format iso reboot

=rename=
Recursive lowercase to uppercase
for i in $(find * -depth); do (mv $i $(echo $i | sed 's%[^/][^/]*$%%')$(echo $i | sed 's!.*/!!' | tr [:upper:] [:lower:])); done
Upper to lower case
for f in `find .`; do mv -v "$f" "`echo $f | tr '[A-Z]' '[a-z]'`"; done

=reposync=
reposync -n -c /etc/yum/yum.conf -p /repos/centos6 -d -r base -r updates -r extras -r centosplus -r contrib
createrepo -g /repos/centos6/base/repodata/comps.xml /repos/centos6/base
createrepo /repos/centos6/updates
createrepo /repos/centos6/extras
createrepo /repos/centos6/centosplus
halfface -> sync repo. -d delete what is not on remote, -n only newest version, -p store here, -r which repos to sync
reposync -d -n -p /install/system/linux/fedora/24/repo/ -r updates -r fedora -r rpmfusion-free -r rpmfusion-free-updates -r rpmfusion-nonfree -r rpmfusion-nonfree-updates
halfface -> create repository
REPODIR=/install/system/linux/fedora/24/repo ; for REPO in $(cd $REPODIR; ls) ; do echo $REPO ; createrepo_c ${REPODIR}/${REPO} ;done
=reptyr=
Reparent a running program to a new terminal. (move tty)

=rfcomm=
list usb devices
hcitool scan
What properties does the device have.
sdptool browse 00:0D:B5:30:07:79
connect bluetooth device virtual servial.
rfcomm bind /dev/rfcomm0 00:0D:B5:30:07:79 1
=rkhunter=
Run rkhunter full scan no keypresses needed
sudo rkhunter --checkall --skip-keypress -x
Update database
sudo rkhunter --propupd
Search for what triggered alarm.
sudo grep -E 'Warning|Suspicious' /var/log/rkhunter/rkhunter.log

=dnf update rkhunter. Update dnf after rkhunter scan=
tail -1 /etc/sysconfig/rkhunter
sleep 300 && ( dnf -e 0 -y update ; rkhunter --propupd ) >> /tmp/dnf_update_rkhunter--propupd.$(date +%F_%H-%M-%S).log 2>&1 &

=rotatelogs=
Write standard output to logfile. Rotate at 100M. Keep 3 files.
your_script.sh | rotatelogs -n3 /var/log/your.log 100M
=route=
The route to a network is behind 10.111.222.7
route add -net 10.111.223.0 netmask 255.255.255.0 gw 10.111.222.7
Add default route
route add default gw 192.168.122.1
Permanent route under redhat
/etc/sysconfig/static-routes
any net 198.18.129.0/24 gw 10.240.175.12
/etc/sysconfig/network-scripts/route-eth1
1.2.3.4/23 via 1.2.3.1
Drop packages to ip.
route add -host 192.168.1.51 reject
Remove reject rule.
route del -host 192.168.1.51 reject
Remove route
route -n
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
192.168.122.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0
169.254.0.0 0.0.0.0 255.255.0.0 U 1002 0 0 eth0
10.0.0.0 0.0.0.0 255.0.0.0 U 0 0 0 eth0
0.0.0.0 192.168.122.1 0.0.0.0 UG 0 0 0 eth0
route del -net 10.0.0.0 gw 0.0.0.0 netmask 255.0.0.0 dev eth0

=rpm=
==install src.rpm==
rpmbuild --rebuild alien-6.51-1.src.rpm
rpm -i /usr/src/redhat/RPMS/x86_64/alien-6.51-1.rpm
==List contents of rpm.==
rpm -qlp myfile.rpm
==Extract single file from rpm.==
rpm2cpio package.rpm | cpio -idv ./search_path_to_file_from_listing_above.txt
==List information about non installed rpm.==
rpm -qip foo.rpm
==Extract contents of rpm.==
rpm2cpio *.rpm | cpio -i --make-directories
==Which version of rpm is installed.==
/etc/rpm/macros ~/.rpmmacros
%_query_all_fmt %%{name}-%%{version}-%%{release}.%%{arch}
==list architecture==
rpm -qa --qf "%{n}-%{v}-%{r}.%{arch}\n"
==List only name of installed rpms.==
rpm -qa --qf "%{NAME}\n"
==Extract rpms in subdirectories.==
for RPM in $(ls *|sed 's_\.rpm$__g');do echo $RPM; mkdir $RPM; rpm2cpio $RPM.rpm | (cd $RPM && cpio -i --make-directories);done
==Verify content of rpm==
rpm -V package
# What does those cryptic letters mean from rpm -V:
S file Size differs
M Mode differs (includes permissions and file type)
5 MD5 sum differs
D Device major/minor number mismatch
L readlink(2) path mismatch
U User ownership differs
G Group ownership differs
T mTime differs
==Reinstall rpm==
rpm -iv --replacepkgs package.rpm
==Dependencies of rpm==
rpm -qpR ${rpm}
rpm -qR ${packagename}
rpm -qp mypackage.rpm --provides
rpm -qp mypackage.rpm --requires
==Rebuild rpm database.==
\rm /var/lib/rpm/__db*
rpm --rebuilddb

==Update minor release.==
yum --releasever=6.11 update sl-release
yum clean all
yum update
==Downgrade rpm.==
rpm -Uvh --oldpackage /tmp/app.x86_64.rpm
==Which rpm:s are required by rpm. Can be used to install rpm on machine without access to yum repo.==
PKG=openssh-server ; yum install --downloadonly --installroot=/tmp/$PKG-installroot --releasever=7 --downloaddir=/tmp/$PKG $PKG
==CVE:s fixed by rpm==
rpm -qi --changelog openssh-server | grep -i CVE

=rsync=
Syncronize folders. Delete non existing files on remote host. Compress.
rsync --delete -az -e ssh bjorklun@semco.homeip.net:/install/program/windows/
Syncronize files over ssh on port 2222. Show progress. Syncronize even empty directories.
rsync -Pae 'ssh -p 2222' localhost:/opt/techops/bin/ /opt/techops/bin/
rsync with total progress bar.
rsync -a --info=progress2 /dir1/ /dir2/
Run rsync in both ends but transfer data with normal user.
sudo rsync -aP /tmp/andreas/ andreasbj@localhost:/tmp/andreas2/ --rsync-path='sudo rsync'
rsync with limit of 8 MB/s.
rsync -aP --bwlimit=8000 /source/ /destination/
rsync excluding directory
rsync -r --exclude=.svn /source/ /destination/
rsync including selinux information. Preserve hard links.
rsync -aPXH /source /destination
rsync don't keep links. Copy files referenced.
rsync -rLP /source/ /destination
Record which files to sync.
rsync -r -ptgo --delete -P --size-only -n www.halfface.se:/mp3/ /mp3/ -n | tee /temp/mp3_$(date +%Y-%m-%d)_diff.txt
Rsync new files.
rsync -RDa0P --files-from=<(find /sourcedir -mtime -7 -print0) . /targetdir/
rsync ignore existing files.
rsync -P --ignore-existing /source/* /destination/ -n
rsync excluding directories matching pattern.
SOURCE=/apps/IP400 ; DESTINATION=/apps/IP400.$(date '+%Y-%m-%d_%H-%M-%S') ; rsync -aP "${SOURCE}"/ "${DESTINATION}"/ --exclude-from=<(cd "${SOURCE}" ; find -type d -name log | sed -e 's|./||')
Sync files partially.
rsync -avz --partial --inplace
which files differ between hosts.
rsync -nrlptDqv --delete --exclude napsjb/server/naps/tmp/ /opt/ongame/ 10.6.21.11:/opt/ongame | less
-n dry run.
-r recursive
-l copy symlinks av symlinks.
-p preserve permission
-t preserve tims.
-D --device --special. Keep special files.
-q quiet
-v verbose

=sar=
Old sar information.
sar -f /var/log/sa/sa25 -s 00:00:00 -e 23:59:00
load average.
sar -q -f /var/log/sa/sa25 -s 00:00:00 -e 23:59:00
All information.
sar -A -f /var/log/sa/sa25 -s 00:00:00 -e 23:59:00
View network statistics.
LANG=c sar -n DEV | grep eth0
realtime summary.
sar 4 5
=script=
Run command under shell even if it does not exist.
script -q -f -c "commands or scripts to run"
Run session under screen in script.
screen -dm bash -c 'script --timing=script1.tm script1.out'
Replay script recorded file
scriptreplay --timing script1.tm --typescript script1.out
=scp=
Limit to 1.2MB/s.
scp -l 10240 Rocky-8.5-x86_64-minimal.iso halfface.se:/temp/

=search&replace=
perl
grep -rsl '10.6.4.102' * | xargs perl -pi -e 's/10.6.4.102/10.6.4.103/'
sed
find . -type f -exec sed -i 's/string1/string2/g' {} \;
Grep for regexp starting with CN= and stop at first occurrence of ,. not greedy
grep -oE 'CN=[^,]*,'
=set=
Look at current settings. Expanded or simple view.
set -o
echo $-

=setfacl=
Add rwx permission for user_name recursivly from /directory
setfacl -Rm u:user_name:rwx /directory
Remove acl:s
setfacl -bn foobar
=setpriv=
Dump your privileges.
setpriv -d

=shred=
Recurse remove dir
find /tmp/secret -type f -exec shred {} \;

=shuf=
Pick random line in file.
shuf -n1 /file
Get random number
shuf -i 10-120 -n1

=sms=
Mail to sms gateway.
tele2
07XXXXXXXX@sms.tele2.se

Comviq
467xxxxxxxx@sms.comviq.se

Europolitan
4670xxxxxxx@europolitan.se

=snmptrap=
# send more than one string.
snmptrap -v 2c -Ci -u user -c community localhost "" .1.3.6.1.4.1.5089.1.0.1 1 s "This is the first string" 2 s "This is the second string"
snmptrap -v 2c -Ci -u user -c community localhost '' .1.3.6.1.4.1.5089.1.0.1 1 s "This is the first string" 2 s "This is the second string"
snmptrap -v 2c -c xxxxxxx localhost '' .1.3.6.1.4.1.5089.1.0.1 .1.3.6.1.4.1.5089.2.0.999 s "Hej Hej"
Simple trap
snmptrap -v 1 -c public localhost '' 0 0 ''

=snmptrapd=
# Enable logfile. /etc/sysconfig/snmptrapd
OPTIONS="-Lf /var/log/snmptrapd.log"
# Disable authorization and put in logfile. /etc/snmp/snmptrapd.conf
disableAuthorization yes
authCommunity log public

=snmpwalk=
Get information from an oid.
snmpwalk -v 1 -c public snmp.device.net .1.3.6.1.4.1.2021.84
Do tcpdump while running.
tcpdump -i eth0 -n -s0 -v host snmp.device.net and port snmp
=socat=
Create a tunnel between localhost 2222 to remote host 2222
socat TCP-LISTEN:2222,fork TCP:10.111.222.2:2222
socat TCP-LISTEN:22,fork,bind=127.0.0.1 TCP:192.168.0.15:5900
socat TCP-LISTEN:2222,fork TCP:10.8.110.20:22,bind=172.19.14.251
Listen on 10.120.50.12:9090 and forward to 127.0.0.1:9090
socat TCP-LISTEN:9090,bind=10.120.50.12,fork TCP:127.0.0.1:9090
Create tunnel via systemctl
Create file similar to this. /etc/systemd/system/socat_win.service
[Service]
ExecStart=/usr/bin/socat TCP-LISTEN:3389,fork TCP:192.168.122.204:3389
[Install]
WantedBy=multi-user.target
Enable new file.
systemctl daemon-reload
Start new daemon
systemctl start socat_win

=sort=
Sort ip address.
sort -t. +0n -1 +1n -2 +2n -3 +3n -4
sort -t . -k 1,1n -k 2,2n -k 3,3n -k 4,4n
sort on fift column
sort -t, -k5n,5 /tmp/gfp
Get a list of configured ip for a set of hosts. Sort on domain then hostname
pdsh ^/host_list 'ip route get 8.8.8.8 | awk "NR==1 {print \$NF}"' | sort -t . -k 2 -k 1
Sort on first column only.
sort -n -k 1,1

=spawn=
Encode wav to ogg in parallel.
# ls -1 *.wav | while read ; do echo "oggenc -q6 \"$REPLY\"" ; done | spawn -j4
=split=
Devide file into parts containing 100 lines.
split -l 100 create_updated_2013-10-29_sort_created_ci_id_name.txt --numeric-suffixes --suffix-length=3 Cleanup.
Devide file in 10 parts. Suffix length 4.
split -n 10 -a 3 bigfile.tar.gz

=sqlite=
Is db broken?
sqlite3 mydata.db "PRAGMA integrity_check"
recover db
sqlite3 mydata.db ".dump" | sqlite3 new.db
sqlite3 stellar.db .recover | sqlite3 stellar_2.db
Show databases
sqlite> .databases
main: /var/lib/tuptime/tuptime.db
List tables
sqlite> .tables
tuptime
Run sql command
sqlite> select * from tuptime;
1544984636|2387765.42|-1|0|0.0|Linux-4.19.8-200.fc28.x86_64-x86_64-with-fedora-28-Twenty_Eight
exit|quit
.quit
==vacuum==
/usr/local/openvpn_as/bin/sqlite3 /usr/local/openvpn_as/etc/db/log.db "VACUUM"
==count tables==
DB=files.db ; for TABLE in $( sqlite3 $DB ".tables") ; do echo -e $TABLE\\t$(sqlite3 $DB "SELECT COUNT(1) FROM $TABLE;") ; done | column_tab

=ss=
List all connections.
ss -an
List processes and which port they listen too. Grep process.
ss -tulpn | grep 5405

=ssh=
==ssh-keygen==
Create key pair without input.
<pre>
KEYNAME=cluster-info-reporting ; KEYNAME_PATH=/tmp/${KEYNAME}-$(date '+%Y-%m-%d_%H-%M-%S') ; ssh-keygen -q -t ed25519 -N '' -C $KEYNAME <<< $'\ny' >/dev/null 2>&1 -f "${KEYNAME_PATH}" ; echo Keys: $(ls "${KEYNAME_PATH}"*)
</pre>

==which private ssh keys are password protected==
ls ${HOME}/.ssh/* | grep -Ev 'pub$|authorized_keys|config|known_hosts|ssh-agent.sock' | while read i ; do SSH_PASSWORD=$(ssh-keygen -y -P "" -f "$i" 2>&1 | grep "incorrect passphrase supplied to decrypt private key") ; if [ -z "${SSH_PASSWORD}" ] ; then echo No password encrypted ssh private key: $i ; fi ; done

==Remove pass phrase==
ssh-keygen -p [-P old_passphrase] [-N new_passphrase] [-f keyfile]

==view fingerprint==
ssh-keygen -l -E md5 -f /tmp/ssh-keygen.pub

==change the name of private key==
ssh-keygen -c -C "first.lastname@example.com" -f ~/.ssh/id_ed25519

==Copy public key to authorized_keys==
ssh-copy-id user@host
List supported ciphers
ssh -Q cipher
List supported MACs
ssh -Q mac
List supported public key type
ssh -Q key
List supported key exchange algorithms
ssh -Q kex
List supported ciphers, macs and kexalgorithms.
sshd -T | grep "$ciphers\|macs\|kexalgorithms$"
Run command each time you login via ssh.
$HOME/.ssh/rc

==Tunnel==
sudo ssh -nNTx -R 2222:localhost:22 andreasbj@www.halfface.se
Reverse tunnel.
ssh -D \*:666 www.halfface.se
ssh -N ipmon10.ny1.ip-soft.net -L43389:ippc01.ongame.ip-soft.net:3389
-n Dont take console. Good for background.
-N Do not execute a remote command
-T Disable pseudo-tty allocation.
-x Disables X11 forwarding.
-R port:host:hostport
sudo ssh -N -L 2222:www.halfface.se:22 www.halfface.se
sudo ssh -nNTx -R 2222:www.halfface.se:22 www.halfface.se
sudo ssh -nNTx -R 443:satellite.ongame.com:443 root@10.0.254.30 # Tunnel 443 over ssh from remote host via local host.
Open tunnel on remote host. Start remote proxy server forwarding to internal network.
ssh remotehost -R remoteport:localhost:localport "ssh -D 9050 localhost:remoteport"
Multiple reverse tunnel controled by autossh. (-M)Control port,(-f)background, (-N) no remote command, reverse tunnel (-R)
autossh -M 41000 -f -N -R 0.0.0.0:8001:192.168.1.10:80 -R 0.0.0.0:8002:192.168.1.20:80 user@remotehost

==reverse tunnel bound to all interfaces==
The config has to allow to bind to * interface. /etc/ssh/sshd_config GatewayPorts yes
sudo ssh -i ${HOME}/.ssh/id_dsa -N -R \*:2222:localhost:22 ${USER}@www.halfface.se

==Create an ssh tunnel link==
https://help.ubuntu.com/community/SSH_VPN
echo 1 > /proc/sys/net/ipv4/ip_forward
vim /etc/ssh/sshd_config PermitTunnel=yes
sudo ssh -NTCf -w 0:0 1.2.3.4
sudo ssh -v -w any:any www.halfface.se
###
local:
ip link set tun0 up
ip addr add 169.254.0.1/32 peer 169.254.0.2 dev tun0
ip route add 192.168.0/24 via 169.254.0.2
remote:
ip link set tun1 up
ip addr add 169.254.0.2/32 peer 169.254.0.1 dev tun1
arp -sD 169.254.0.2 eth1 pub
### Change default gateway. In this case, 192.168.0.1 is Machine B's current default gateway; it is the gateway on Network B that provides internet connectivity
ip route add 1.2.3.4/32 via 192.168.0.1
ip route replace default via 10.0.0.1

==Limit ssh access with pam_access==
/etc/security/access.conf

==Proxycommand without nc==
Host server1
Hostname 10.0.1.1
ProxyCommand ssh -q -x jumphost -W %h:22

==ssh over ipv6 via 2 network interface.==
ssh -6 fe80::1ec1:deff:fecb:6ce%2

==ssh options==
None interactive. Dont ask for password.
-o BatchMode=yes
Accept all keys.
-o StrictHostKeyChecking=no

==ssh via proxy/squid==
ssh -o 'ProxyCommand nc --proxy proxy.inter.net:3128 --proxy-type http %h %p' host.inter.net hostname
ssh -o 'ProxyCommand nc -X connect -x proxy.inter.net:3128 %h %p' host.inter.net hostname

==brow.sh==
browser in terminal window.
ssh brow.sh

==jail==
/etc/sshd/sshd_config
Match group mychroot
ChrootDirectory /jail/
X11Forwarding no
AllowTcpForwarding no

==sshd debug==
Start deamon once in debug mode and put output to your console.
/etc/sysconfig/sshd
OPTIONS="-ddd"
Kill of sshd which is listening for new connections. Start sshd with the following command. Debug level can bee changed.
/usr/sbin/sshd -De -o LogLevel=DEBUG3

==ssh multiple jumps one cli==
Jump through host1.net to get to host2.net
ssh -t host1.net ssh -t host2
Jump through host1.net to host2.net and bring port 8080 with you.
ssh -t host1.net -L 8080:localhost:8080 ssh -t host2.net -L 8080:localhost:8080

==ssh force password login==
ssh -o StrictHostKeyChecking=no -o ControlPath=none -o ControlMaster=no -o PubkeyAuthentication=no user@host

==ssh via jumphost==
ssh -J core@1.1.1.1 core@2.2.2.2

==socks==
# Setup socks server exiting on remote host
ssh -D '*:3128' halfface.se
# Use socks setup above.
curl --socks5 localhost:3128 https://ifconfig.me

==Create public key from private==
ssh-keygen -y -f <private_key_with_return_at_end>

=sshfs mount filesystem over ssh=
sshfs name@server:/path/to/folder /path/to/mount/point
=sshpass=
ssh with password provided on the command line.
sshpass -p P@ssW0rd ssh -t -o ControlPath=none -o PreferredAuthentications=password -o PubkeyAuthentication=no -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o LogLevel=Error user@localhost hostname
=specify key=
ssh -o "IdentitiesOnly=yes" -i <private key>

=sshuttle=
create a network route over ssh.
sshuttle -D -r user@remotehost:2222 192.168.1.0/24

=stat=
View file permissions only.
stat -c "%a %n" /usr/bin/bash
Access - the last time the file was read
Modify - the last time the file was modified (content has been modified)
Change - the last time meta data of the file was changed (e.g. permissions)
Copy permissions from one location to another.
rpm -qlp package.rpm | while read FILE ; do echo chmod $(stat -c "%a" $FILE) \"$FILE\";done > /tmp/copy_permissions.sh

=strace=
==File open activity.==
strace -e open -f ls -la /temp/
==File open activity under directory.==
strace -e open -P /temp/ -f ls -la /temp/
==More file activity.==
strace -e trace=file -p 1234
strace -e trace=desc -p 1234
==Trace network activity.==
sudo strace -f -e trace=network -p 1476
# 1024 long strings.
sudo strace -s 1024 -f -e trace=network -p 1476
# strace follow process with matching regex.
strace -f -e poll,select,connect,recvfrom,sendto -p $(pgrep -f login-sync.xml)
# trace nework activity
strace -f -e trace=network -s 1000000 nc localhost 3333

==Memory usage==
sudo strace -f -e trace=memory -p $(pgrep -f firefox)
==What is taking time==
[root@util01 abjorklund]# strace -f -c -p 9657
% time seconds usecs/call calls errors syscall
------ ----------- ----------- --------- --------- ----------------
88.11 11.614155 1644 7065 1565 futex
9.94 1.310794 16183 81 73 restart_syscall
1.86 0.245018 86 2850 recvfrom
0.05 0.006784 30 228 poll
0.03 0.004006 2 1838 sendto
0.00 0.000271 1 253 sched_yield
0.00 0.000134 12 11 mmap
0.00 0.000107 0 5176 ioctl
0.00 0.000026 0 148 148 stat
0.00 0.000000 0 1 read
0.00 0.000000 0 254 write
0.00 0.000000 0 44 mprotect
0.00 0.000000 0 1 rt_sigreturn
------ ----------- ----------- --------- --------- ----------------
100.00 13.181295 17950 1786 total

==strace multiple processes==
strace -s 1024 -f -o /tmp/strace $(pidof Process_name | sed 's/$[0-9]*$/-p \1/g')
==strace to hex output. Convert to utf8.==
strace -xx -f -o/tmp/strace -s0 echo bajskorv
cat /tmp/strace | while read -r line; do printf "%b\n" "$line" ; done

=stty=
List settings
stty -a
speed 38400 baud; rows 50; columns 200; line = 0;
intr = ^C; quit = ^\; erase = ^?; kill = ^U; eof = ^D; eol = <undef>; eol2 = <undef>; swtch = <undef>; start = ^Q; stop = ^S; susp = ^Z; rprnt = ^R; werase = ^W; lnext = ^V; discard = ^O; min = 1; time = 0;
-parenb -parodd -cmspar cs8 -hupcl -cstopb cread -clocal -crtscts
-ignbrk -brkint -ignpar -parmrk -inpck -istrip -inlcr -igncr icrnl ixon -ixoff -iuclc -ixany -imaxbel -iutf8
opost -olcuc -ocrnl onlcr -onocr -onlret -ofill -ofdel nl0 cr0 tab0 bs0 vt0 ff0
isig icanon iexten echo echoe echok -echonl -noflsh -xcase -tostop -echoprt echoctl echoke -flusho -extproc
Set terminal properties.
stty rows 50 cols 200

=sudo=
Enable sudo logging
sed -i "$(( $(grep -n ^Defaults /etc/sudoers | tail -1 | awk -F: '{print $1}') + 1 ))iDefaults log_output\nDefaults log_input" /etc/sudoers
Command above adds the following to /etc/sudoers
Defaults log_output
Defaults log_input
List sudo-io logs.
sudoreplay -l
Search for string in logs.
zgrep search_string $(find /var/log/sudo-io/ -type f)
Replay session. Max wait 1s. 5 times the speed.
sudoreplay -m1 -s5 000002
Replay session including stdin
sudo sudoreplay -m1 -s5 -f stdin,stdout,stderr,ttyin,ttyout 000001
Which rules apply to user
sudo -l -U username
==Add user to sudoers.d so you do not need to add password for that user.==
SUDO_USER=<user> ; echo -e "# Adding $SUDO_USER user to sudo users.\n$SUDO_USER ALL=(ALL) NOPASSWD:ALL" > /etc/sudoers.d/90-${SUDO_USER//./_} ; chmod 440 /etc/sudoers.d/90-${SUDO_USER//./_}

=swapon/swapof=
Free swap
(swapoff -a; swapon -a) & watch free -m

=sysbench=
cpu test.
sysbench cpu --cpu-max-prime=20000 --threads=32 run | grep "events per second"
ram test
sysbench memory --threads=32 run | grep sec
disk test
RAM_TWO=$(( $(grep MemTotal /proc/meminfo | awk '{print $2}') * 2 ))kb
sysbench fileio --file-total-size=${RAM_TWO} prepare > /dev/null
sysbench fileio --file-total-size=${RAM_TWO} --file-test-mode=rndrw --time=300 --max-requests=0 run|grep -E ' read, | written, '
sysbench fileio --file-total-size=${RAM_TWO} cleanup > /dev/null

=sysctl=
Rename machine.
sysctl kernel.hostname=ipmonxx.${CLIENT}.ip-soft.net
Set tcp keepalive
$ sysctl -a | grep tcp_keepalive
net.ipv4.tcp_keepalive_time = 1800
net.ipv4.tcp_keepalive_probes = 9
net.ipv4.tcp_keepalive_intvl = 75
sudo sysctl -w net.ipv4.tcp_keepalive_time=60 net.ipv4.tcp_keepalive_probes=3 net.ipv4.tcp_keepalive_intvl=10
net.ipv4.tcp_keepalive_time = 60
net.ipv4.tcp_keepalive_probes = 3
net.ipv4.tcp_keepalive_intvl = 10
Reload config files
sysctl --system

=systemctl=
==init 3==
systemctl isolate runlevel3.target
systemctl isolate multi-user.target
systemctl set-default multi-user.target

==init 5==
systemctl isolate runlevel5.target
systemctl isolate graphical.target
systemctl set-default graphical.target

==When you have made changes to /etc/systemd/system/*.service==
systemctl daemon-reload

==List all units==
systemctl list-unit-files
==List units with problems==
systemctl list-units --failed
==create service==
cd /etc/systemd/system ; vim $service.service ; systemctl daemon-reload
[Unit]
Description=Set laptop brightness
After=multi-user.target

[Service]
Type=forking
ExecStart=/bin/sh -c 'echo 1000 > /sys/class/backlight/intel_backlight/brightness'
LimitNOFILE=65535
LimitNPROC=65535

[Install]
WantedBy=default.target

==Add groups to processes started by services script==
[Service]
SupplementaryGroups=33 518
==takes a long time to login==
systemctl daemon-reexec
systemctl restart systemd-logind

=strace process started by systemctl=
strace -f -o /tmp/strace.log -s 2048 -p 1 & systemctl restart httpd.service
=systemctl show puma=
Show variables of service
systemctl show puma

=systemd-analyze=
What takes time at startup.
systemd-analyze plot > /tmp/systemd-analyze-plot.svg ; chrome /tmp/systemd-analyze-plot.svg
=systemd-resolved=
resolvectl status
clear cache.
sudo systemd-resolve --flush-caches
Look at stats.
systemd-resolve --statistics
==restart daemon to apply settings==
systemctl daemon-reload
systemctl restart systemd-networkd
systemctl restart systemd-resolved
=systemctl show=
will show all available properties
systemctl show $service

=tail=
Tail from line number 21.
tail -n +21 /file
=talk=
Talks swedish.
espeak -v swedish -f /tmp/file

=tar=
Make a backup of a directory or disk.
server: tar -cpsf - $dir | pv -b | nc -l 3333
client: nc server 3333 | pv -b | tar -xpst -
Inline tar archive.
awk '/^__ARCHIVE_FOLLOWS__/ { print NR + 1; exit 0; }' $0
tail -n $0 > archive.tar # tail -n +347 Filename
Backup dir but exclude files within
tar zcf /tmp/backup_$(date '+%Y-%m-%d_%H-%M-%S').tar.gz /apps/app --exclude=/apps/app/var/* --exclude=/apps/app/logs/*
extract files remove 5 path element components.
tar xf archive.tar --strip-components 5
extract to other directory.
tar -xzf bar.tar.gz -C foo
extract files excluding path.
tar xf $file.tar.gz --transform='s/.*\///'

=tcpdump=
dump trafic information, -e Print the link-level header on each dump line, -vvv verbose.
tcpdump -e -vvv port 21
dump all trafic to and from machine. -w write to file, -s0 size of package, host to listen from.
time tcpdump -w ssl_dump -s0 host test.x30.webservices.itsfogo.com
dump all trafic into files of max 100MB. 270MB in reality.
tcpdump -w snoop -s0 -C 100000000
dump all trafic. compress logfiles. Create 10 files which are 10 MB big. Dont convert numbers to names. Dont truncate frames create logfile with this name.
tcpdump -z gzip -i wlan0 -C 10 -W 10 -n -s0 -w /tmp/tcpdump.log
Which machines send a syn packet.
sudo tcpdump -nn -i eth0 'tcp[13] = 2'
Show information about all traffic on interface.
tcpdump -s0 -i eth1 -vv
Show information about communication over port 514
tcpdump -Xni any port 514
listen on port 1023 for incoming trafic. disable local subnets.
sudo tcpdump -n -i eth0 tcp and dst host 172.17.17.6 and not src net 172.17.17.0/24 and not src net 158.0.0.0/8 and 'port 1023'
listen after torrent traffic.
sudo tcpdump -Xni any portrange 6882-6999
View content of http trafic
sudo tcpdump -i any -A -s 1500 dst 89.253.75.84 and port 80
View post in utf-8 format.
<pre>
sudo tcpdump -lnp -i any -A -s 1500 dst 89.253.75.84 and port 80 -w - | tr -t '[^[:print:]]' ''
</pre>
Get cookie
tcpdump -i lo -A -l dst port 8000 | grep "^Cookie: "
To create cookie for curl: https://xiix.wordpress.com/2006/03/23/mozillafirefox-cookie-format/
Look at traffic from specific ip
tcpdump -n -i any -n host 198.18.130.9
Eavesdrop password
tcpdump -i any -A -s0 port 8030 | grep Authorization:
==flags==
tcpdump -enni eth0 host 172.30.142.11 port 5432
F - FIN
S - SYN
R - RST
P - PSH
U - URG
E - ECN Echo
W - ECN Cwnd Reduced
. - ACK only
==get ftp username/password==
sudo tcpdump -n -vvv -i any -A -f "port 21" | grep -i "user\|pass"

=tcptraceroute=
tcptraceroute -n -q 1 192.168.0.1 -p 22
=teamdctl=
teamdctl team0 state view -v
=tee=
Feed tee with an unbuffered stream.
sar -n DEV 2 | stdbuf -oL grep wlp0s20f3 | tee /temp/sar_-n_wlp0s20f3.$(date)

=telnet=
Look at world map. a - z zoom.
telnet mapscii.me
=testssl=
test ssl certificate
testssl www.halfface.se

=tftp=
# Download test.file
tftp -v 172.17.17.6 -c get test.file
# Upload file.
tftp -v 172.17.17.6 -c put /tmp/test.put test.put
# Enable upload file in in.tftpd
/etc/xinetd.d/tftp
server_args = -c -s /var/lib/tftpboot
=tibco=
show permissions.
help permissions
Create user
create user surveillance "Surveillance user" password=surveillance
Grant user permission to view all
grant admin user=surveillance view-all
=tif=
cli image viewer.
tif $IMAGE.jpg

=time=
Time in a loop.
{ time sleep 2 >> ${LOG} ; } 2>> ${LOG}
How long did a command take
TIME=$( { /usr/bin/time -f "%e" sleep 1.5 ;} 2>&1 ) ; echo $TIME
Built in time command. 3 decimals in seconds.
TIMEFORMAT='%3R'; time ( sleep 61.22222 )
=timedatectl=
Show info how clock is synced.
timedatectl timesync-status
Which time zones exist
timedatectl list-timezones | cat -v | grep -i stockholm
Set timezone.
timedatectl set-timezone "Europe/Stockholm"
Show ntp servers
timedatectl show-timesync --all
Sync clock
timedatectl set-ntp true
Enable clock sync.
systemctl enable systemd-timesyncd --now

=timeout=
limit waiting for a period.
timeout 2s sleep 100
Run function under timeout
export -f my_function ; timeout 1 bash -c 'my_function options'
Run loop for some time then exit.
timeout 172800 bash -c -- 'while true ; do echo $(TZ=UTC date "+%Y-%m-%d %H:%M:%S %Z") $(ping -w1 -q -c1 -i10 192.168.10.120 | grep received) ; sleep 1 ; done| tee /tmp/ping_192.168.10.120.log'

=tnef=
List content of winmail.dat. Remove options to extract to current dir.
tnef -t -f winmail.dat
=toilet=
Generate graphics text similar to banner.
toilet -F gay -f mono12 "Some Funky Text"
=tor=
Select outgoing country. https://en.wikipedia.org/wiki/ISO_3166-1_alpha-2
Set country in:
torrc
One or several exit countries.
ExitNodes {us}
ExitNodes {kr},{ru},{sy},{cn}
test exit node
ifconfig.me
=toolbox=
toolbox create --distro rhel --release 9.5
==running rocky==
podman pull docker.io/rockylinux/rocky-toolbox:9
toolbox create --image docker.io/rockylinux/rocky-toolbox:9

=top(the command)=
Top batch mode run one iteration
top -bn1
Sort by memory usage
for i in {1..10};do date; top -c -b -o +%MEM | head -n 17|tail -11;sleep 5;done
Top used in openshift.
top -bcn1 -w512 | less -ISRM

=top derivates=
apachetop
dnstop
iftop
latencytop
glances

=touch=
touch -am 0910120003 Give a new access time on a file 0910120003MMDDhhmmyy
linux
touch -t 197102162324 *

=tput=
No line wraps
tput rmam
Line wraps
tput smam
invisible cursor
tput civis
visible cursor
tput cnorm
reset is a good command to reset shell
reset

=tr=
translate capital to lower letter.
tr '[:upper:]' '[:lower:]'
null character to new line
tr '\000' '\n' < /proc/3575/environ
Remove unprintable characters.
<pre>
tr -dc '[[:print:]]'
</pre>

=trickle=
Speed limit for download
rsync -ae "trickle -d 80 ssh" user@host:/src/ /dst/
Speed limit for upload.
rsync -ae "trickle -u 80 ssh" user@host:/src/ /dst/
Limit wget to 64kbit upload and download.
trickle -d 64 -u 64 wget "https://www.halfface.se/file.txt"
=ts=
timestamp
ls -la | ts '%F %H:%M:%S'

=tune2fs(tunefs)=
tune2fs -m 0 /dev/sdb1

=type=
What kind of command do we use. builtin or some file?
type ls

=udevadm=
Monitor udev events.
udevadm monitor
udevadm info --query=all --name=sda
look at values for disk. Can be used to locate san source.

=udr=
rsync over udp.
udr -a 57621 -b 57631 rsync -rP host.inter.net:/source/ /destination/
=ulimt=
Look at current limits for logged in user.
ulimit -a
Look at limits for process with pid 12345.
cat /proc/12345/limits
=unalias=
Unalias all aliases
unalias -a
=unhide=
Find hidden ports.
unhide -v proc

=unetbootin=
Boot iso image from usb memory.
=update-crypto-policies=
Change crypt policies so that I am able to start openvpn connection.
sudo update-crypto-policies --set DEFAULT:SHA1

=upower=
# Powerstatus of the system. battery charge.
upower --dump
=uptime=
Uptime in seconds.
awk -F . '{print $1}' /proc/uptime

=urldecode/urlencode=
Encode
perl -pe's/([^-_.~A-Za-z0-9])/sprintf("%%%02X", ord($1))/seg'
jq -sRr @uri
Decode
perl -pe 's/%([0-9a-f]{2})/sprintf("%s", pack("H2",$1))/eig'
jq -r @uri

=useradd=
useradd --uid 666 --gid 666 --comment 'devil' devil && echo 'devil:VerySecretPassword' | chpasswd

=v4l2=
Video player
qv4l2
List available formatats and resolutions.
v4l2-ctl --list-formats-ext
List available formats
v4l2-ctl --list-formats
Set camera to h264
v4l2-ctl --set-fmt-video=width=800,height=448,pixelformat=1
Set framerate.
v4l2-ctl --set-parm=30
List video parameters
v4l2-ctl --get-fmt-video
List video output
v4l2-ctl --all
Disable autofocus
v4l2-ctl --verbose --set-ctrl=focus_auto=0
v4l2-ctl --verbose --set-ctrl=focus_absolute=0
=version of linux=
cat /etc/os-release

=vi=
:set ignorecase
:set list show all keys.
:set nolist show their representative.
=wipefs=
Wipe removes information about file system without removing actual data.
wipefs -a /dev/sdc

=vmstat=
top over time.
vmstat -n 5
Description:
r=procs waiting for cpu time.
b=procs in sleep mode.
swpd=virtual memory in use in swap.
free=memory free.
buff=memory used by buffers
cache=memory used as cache.
si=swap in.
so=swap out.
bi=io block in.
bo=io block out.
in=interups
cs=contex switching.
us=cpu user space
sy=cpu system usage to serve.
id=cpu idle
wa=cpu waiting for input output. iowait.
st=cpu time stolen from a virtual machine

procs -----------memory---------- ---swap-- -----io---- --system-- -----cpu-----
r b swpd free buff cache si so bi bo in cs us sy id wa st
2 1 814984 167992 26820 999460 0 0 1 0 2467 5088 2 2 95 1 0
0 0 814984 168100 26820 999540 0 0 2 150 2467 5026 1 2 97 0 0
=w3m(elinks)=
curl -s https://google.com | w3m -T text/html -dump

=wget=
wget -r -nH -np --cut-dirs=1 --no-check-certificate -U Mozilla --user={uname} --password={pwd} https://my-host/my-webdav-dir/my-dir-in-webdav
wget to standard output.
wget --no-check-certificate -S -O- http://inter.net
Special heather
wget 'http://halfface.se' --header='Cookie: has_js=1'
Mirror
wget 'https://halfface.se/test' -r -l 3 --convert-links -o log --html-extension

=whois=
# When does a domain expire.
whois -h whois.iana.org sivberg.se
# which ipranges does an ipaddress belong too. In this case looking at google.
whois -h whois.radb.net -- "-i origin $(whois -s -h whois.radb.net 172.217.26.68 | grep ^origin | awk '{print $2}' | tail -1)" | grep ^route | awk '{print $2}'
# Who to find address range for site.
host www.facebook.com
whois 157.240.194.35 | grep CIDR

=wireshark=
find packet
packet details
string
==ssl decryption==
export SSLKEYLOGFILE=/tmp/sslkeylog ; curl -sv -d "blablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablabla" https://www.halfface.se
wireshark. Edit - Preferences - Protocols - TLS - (Pre) -master-Secret log file.
==tshark==
cli version
tshark -V -r $dump.pcap
=wlr-randr=
Change dpi in wayland.
wlr-randr --output eDP-1 --scale 2
Change resolution
wlr-randr --output DP-1 --mode 1920x1080

=wodim=
Burning disks.
wodim -scanbus # Scan scsi bus for burners.
wodim --devices # Discover basic information.
wodim -checkdrive # Information about burner.
wodim -tao speed=0 dev=/dev/sr0 -v -data /temp/files/ # Burn disk containing structure from /temp/files/
wodim -eject -tao speed=0 dev=/dev/scd0 -v -data /my/directory/image.iso # Burn image to disc.
=write=
Send message to someone via tty.
who | grep user
write message end with CTRL + d
write abjorklund pts/2

=xargs=
locate case insensetive, regular expression. xargs string to replace imput. Print output to standard error.
locate -ir ".*\.crt$" | xargs -I '{}' -t cp {} /temp/ssl/
Do something on everything from standard input.
ls -la | xargs -i% echo '# beginning #' % '# end of line #'
split several lines into groups.
for i in {00..99} ; do echo $i, ; done | xargs -L 20

=xdotool=
When you have to move your mouse but you dont want to push it.
xdotool mousemove_relative -- -1 -1
xdotool mousemove_relative 1 1
Send ab to window.
xdotool search --onlyvisible --name freerdp key a key b
=xfs=
xfs_repair -L /dev/mapper/vg00-root

=xinput=
# List xinputs.
xinput list
# List properties.
xinput list-props "Logitech Unifying Device. Wireless PID:400e"
# Middle button emulation.
xinput set-prop "Logitech Unifying Device. Wireless PID:400e" "Evdev Middle Button Emulation" 1
xinput set-prop 12 "libinput Middle Emulation Enabled" 1
=xkill=
Kill xorg process with id 0xb6ffa0
xkill -id 0xb6ffa0
List x applictions
xwininfo
Get recursive list of x applications.
xwininfo -root -tree

=xmllint=
prettify xml
xmllint --format -

=xset=
Disable screen saver
xset -dpms ; xset s noblank ;xset s off
Disable repeat
xset r off
Enable repeat
xset r on

=xxd=
Hex to binary
xxd -r -p hex.txt output.bin
Hex to binary in pipe
echo "$HEX" | xxd -r -p -
=yum=
download src rpm
yumdownloader --source net-snmp
Reinstall default repos.
yum reinstall yum-conf-sl6x-1-2
This will give you a directory with all rpm:s that are required to install rpm.
PKG=openssh-server ; yum install --downloadonly --installroot=/tmp/$PKG-installroot --releasever=6 --downloaddir=/tmp/$PKG $PKG
==broken repos==
yum install bareos-client --disablerepo=* --enablerepo=bareos
==search for different versions==
yum --showduplicates search percona-xtrabackup
==Add repos to centos 6==
curl https://www.getpagespeed.com/files/centos6-eol.repo --output /etc/yum.repos.d/CentOS-Base.repo
curl https://www.getpagespeed.com/files/centos6-epel-eol.repo --output /etc/yum.repos.d/epel.repo
==fix yum in Centos 7, 8==
<pre>
sed -i 's%^enabled=.%enabled=0%' /etc/yum/pluginconf.d/subscription-manager.conf
sed -i 's/^mirrorlist/#mirrorlist/g' /etc/yum.repos.d/*
sed -i 's%^#baseurl=http://mirror.centos.org%baseurl=http://vault.centos.org%g' /etc/yum.repos.d/*
</pre>

==Get variables to test /etc/yum-repos.d/<file>.conf files==
export releasever=$(lsb_release -r | awk '{print $NF}' | awk -F . '{print $1}')
export basearch=$(uname -m)

=zip=
Zip directory exclude files .svn directory.
zip -r /temp/ssl.zip . -x ".svn/*"
List contents of zip archive.
unzip -l archive.zip
Unzip single file
unzip file.zip file/you/want/to/extract/the_file.txt
unzip excluding path.
unzip -j file.zip

=zdump=
View information from timezone tz.
zdump -v /etc/localtime
Change timezone on host
ln -sfT ../usr/share/zoneinfo/Europe/Stockholm localtime

=zfs=
==Get sync==
zfs get sync datapool/netstorage/dog/prod
NAME PROPERTY VALUE SOURCE
datapool/netstorage/dog/prod sync standard default
==set sync==
zfs set sync=disabled datapool/netstorage/dog/prod
==List snapshots(can take time)==
zfs list -t snapshot
==List snapshots for one mount point.==
zfs list -r -t snapshot -o name,creation datapool/netstorage/bro/prod
==Displays the detailed health status==
zpool status
==List datasets==
zfs list
==Create dataset==
zfs create datapool/netstorage/media
==zdb==
display zpool debugging and consistency information
zdb -d dataset
==zpool list==
Lists the given pools along with a health status and space usage.
==iostat==
Get iostat with values since last second.
zpool iostat are -y 1 -l

[[Category:Applications]]
[[Category:Unix]]
[[Category:Commands]]

Openstack

2026-03-26T12:20:10Z

Ekaanbj: /* list volumes */

=What does it mean=
aodh Alarming service
barbican REST API designed for the secure storage, provisioning and management of secrets such as passwords, encryption keys and X.509
cinder OpenStack Block Storage
gnocchi Time Series Database as a Service
glance OpenStack Image Service
heat iac. Deploy instances, volumes and other OpenStack services using YAML based templates.
horizon Openstack’s Dashboard, which provides a web based user interface to OpenStack services
ironic bootstrap
keystone identity service
magnum container orchestration engines
mistral workflow service
neutron networking as a service
nfv Network functions virtualization
nova cloud computing instance controller, provision compute instances (aka virtual servers).
octavia Load balancer. Octavia HAProxy Amphora API
rhosp Red Hat OpenStack Platform
swift OpenStack Object Storage
tacker NFV Orchestration
trove Database as a Service
Zaqar multi-tenant cloud messaging service

=bash completion=
. <(openstack complete 2>/dev/null )
=flavor=
Which machine types exist.
gp "General purpose" Well rounded combination of amount of CPUs and the amount of RAM.
hm "High memory" Optimimzed for applications that need a lot of memory.
hp "High performance" High frequenzy cpu.
List suitable flavors
openstack flavor list -f json -c VCPUs -c RAM -c Disk -c Name | jq -r '.[] | [ .Name, .VCPUs, .RAM, .Disk ] | @tsv' | sort -k 2,2n -k 3,3n | grep -vE 'gpu|pinned|nvme' | column_tab
Change flavor of vm
openstack server resize <vm-name-or-id> --flavor <new-flavor-name-or-id> --wait
openstack server resize confirm <vm-name-or-id>

=Manage multiple projects=
export OS_CLIENT_CONFIG_FILE=~/.config/openstack/project1_clouds.yaml
export OS_CLOUD=project1

=list volumes=
openstack volume list
==list volume belonging to <server>==
openstack server volume list <server>
==remove volume from server==
openstack server remove volume <vm_name_or_id> <volume_id>

=install openstack=
dnf install python3-openstackclient
dnf -y install $(dnf -q search python3- client |grep -i OpenStack | grep -v -- -tests| awk '{print $1}')

=get ip addresses of all host=
openstack server list -c Networks -f json | jq -r '.[].Networks[][]'
=long output=
openstack server list --long
=select server depending status=
openstack server list --status ACTIVE

=output=
-f csv,json,table,value,yaml
Get output without headers.
openstack server list -f value

=list all=
openstack command list -f yaml | grep - | grep list | sed 's/^ - /openstack /g' |grep -v "openstack command list" | while read i ; do echo '*' $i ; $i 2>&1 ; done | tee /tmp/openstack_list_resources.${OS_CLOUD}.$(date +%F_%H-%M-%S)
openstack command list -f json | jq -r '.[].Commands[]|select (match("list$"))' | while read i ; do echo '*' openstack $i ; openstack $i 2>&1 ; done | tee /tmp/openstack_list_resources.${OS_CLOUD}.$(date +%F_%H-%M-%S)

=How to reach nodes=
OPENSTACK=$(openstack server list -c Networks -f json | jq -r '.[].Networks[][]') ; OPENSTACK_JUMP=$(grep 185 <<< "${OPENSTACK}") ; NODES=$(grep -v 185 <<< "${OPENSTACK}") ; for NODE in ${NODES} ; do echo ssh -J core@${OPENSTACK_JUMP} core@${NODE} ; done
=create server=
openstack server create --flavor gp.1x2 --availability-zone europe-se-1a --image fedora-37-x86_64 --boot-from-volume 100 --network abjorklund-01-5tsbc-openshift --security-group ssh_allow --key-name abjorklund_ed25519 abjorklund_$(date_file)
With setting password.
cat << EOF > user-data
#cloud-config
password: Password123!
chpasswd: {expire: False}
ssh_pwauth: True
EOF
openstack server create --flavor gp.1x2 --availability-zone europe-se-1a --image rocky-8-x86_64 --boot-from-volume 30 --network abjorklund-01-bmc7w-openshift --security-group ssh_allow --key-name abjorklund_ed25519 abjorklund_$(date_file) --user-data user-data
With existing network port
openstack server create --flavor gp.1x2 --block-device source=volume,id=<volume-id>,dest=volume,bootindex=0,delete_on_termination=false --nic port-id=<existing-port-id> --key-name <your-keypair> <new-server-name

=router=
==List routers==
openstack router list
==Get external ip.==
openstack router show abjorklund-01-5tsbc-external-router -c external_gateway_info -f json | jq '.external_gateway_info.external_fixed_ips[0].ip_address'
==Remove subnet from router==
openstack router remove subnet <router> <subnet>
==add route to router==
openstack router add route --route destination=10.8.1.0/24,gateway=10.111.222.254 <router>

=list available images=
openstack image list
=Download image=
Get info about image.
openstack image list | grep -i nord-ic-
| 98c03b69-4ba8-4276-8695-b6c3f006cf20 | nord-ic-bc84t-rhcos | active |
glance image-download --file nord-ic-bc84t-rhcos --progress 98c03b69-4ba8-4276-8695-b6c3f006cf20

=Upload image=
https://cloud-images.ubuntu.com/focal/current/
openstack image create --disk-format qcow2 --container-format bare --file focal-server-cloudimg-amd64.img Focal_Fossa.$(date_file)

=security=
==Create security group.==
openstack security group create <group>
openstack security group create ssh_allow

==Get security groups.==
openstack security group list -c Name -f json | jq -r '.[].Name'
==Get all security groups with rules.==
openstack security group list -c Name -f value | while read SECURITY ; do openstack security group show "$SECURITY" ; done > /temp/${OS_CLOUD##*/}}_openstack_security_group_list_openstack_security_group_show.$(date_file).log
==Get rules from one security group.==
openstack security group rule list <group>
==Add rule to allow traffic from ip.==
openstack security group rule create --proto tcp --dst-port 6443 --remote-ip 185.53.164.10/32 --ingress <group>
openstack security group rule create --proto tcp --dst-port 22 --remote-ip 0.0.0.0/0 --ingress <security group>
openstack security group rule create ssh_allow --remote-ip 0.0.0.0/0 --protocol tcp --dst-port 22 --ingress
openstack security group rule create <rule> --remote-ip 100.120.0.0/21 --protocol tcp --dst-port 22 --ingress <security group>

==Allow nfs4 traffic==
# List group to add too.
openstack security group list | grep rw-core
openstack security group rule create --proto tcp --dst-port 2049 --remote-ip 10.2.0.0/16 rw-core-p9dq6-master
==Add security group to server==
openstack server add security group <server_name_or_id> <security_group_name_or_id>
Example of adding a group with a rule.
openstack security group create ssh-vpn
openstack security group rule create ssh-vpn --remote-ip 100.120.0.0/21 --protocol tcp --dst-port 22 --ingress
openstack server add security group RW01 ssh-vpn

=create block device=
openstack volume create --size 50 --type ssd --description "nfs storage block device 0" nfs_storage_abjorklund-01
Resize block device.
os volume set --size 60 nfs_storage_abjorklund-01 --os-volume-api-version 3.42

=set physical ip on host=
openstack port list
List in different view.
openstack port list -f json | jq -r '.[]|[.ID, .Name, .Status, ."Fixed IP Addresses"[].ip_address]| join("\t")' | column -t -s $'\t'

=Change security group on port=
Remove if existing port does not exist.
openstack port set --no-security-group a7434863-fc4d-46ad-b93e-b0f2f717023f
openstack port set --security-group 3723f737-280f-453e-af0b-50aca4ce1b0d a7434863-fc4d-46ad-b93e-b0f2f717023f
=create port=
openstack port create --network abjorklund-01-h4sxm-openshift --fixed-ip subnet=4bb2ab0c-f8f9-4346-b238-5f992f0bcf56,ip-address=10.1.0.5 abjorklund-01-h4sxm-api-port

=manage loadbalancer aurora/haproxy=
openstack loadbalancer
openstack loadbalancer list
openstack loadbalancer show test-lb -c listeners -f value
=view limits=
If you have problems to create something in openstack it could be worth verifying you are within limits.
openstack limits show --absolute -f value | grep -E 'RAM|Cores'
openstack quota show --usage -c Resource -c Limit -c "In Use"

=count resources=
openstack quota show --usage -c Resource -c "In Use" -f json | jq -r '.[] | select(.Resource == "cores" or .Resource == "ram" or .Resource == "gigabytes" )| [.Resource, ."In Use"] | @tsv' | column -t -s $'\t'

=get project id=
openstack project list -f value -c ID
=manage s3/swift=
==create s3 credentials==
openstack ec2 credentials create
openstack ec2 credentials list
==Create s3 bucket==
aws s3api create-bucket --bucket <bucket>
swift post <bucket>
openstack container create <bucket>

==list s3 storage==
swift list
swift list <bucket>
swift list --long <container>
swift stat <bucket>
aws s3api list-buckets
openstack container list
==download file==
swift download elastic_snapshots elasticsearch-snapshots/snap-symvtlMpRIetTyfCDsHIVg.dat

==mount s3 bucket==
export AWS_ACCESS_KEY_ID=$AWS_ACCESS_KEY_ID ; export AWS_SECRET_ACCESS_KEY=$AWS_SECRET_ACCESS_KEY ; export AWS_DEFAULT_REGION=us-west-2 ; s3fs -f -d openshift-region /mnt/openshift-region/ -o endpoint=europe-se-1 -o "host=https://object-eu-se-1a.binero.cloud" -o use_path_request_style
==copy file to s3==
openstack server show $(openstack server list -f value | head -1 | awk '{print $2}') -c project_id -f value

=whoami=
openstack configuration show -f json | jq -r '."auth.username"'
=sort=
Sort on column name.
openstack network list --sort-column Name
=selected columns=
Select column name only
openstack server list -c Name -c Status -f table

=create ssh public key(keypair)=
openstack keypair create --public-key /home/abjorklund/.ssh/id_ed25519.pub abjorklund_id_ed25519
List keys
openstack keypair list
Delete kaypair
openstack keypair delete <keypair>

=create floating ip=
openstack floating ip create europe-se-1-1a-net0
=remove floating ip=
openstack floating ip delete 193.93.251.72

=assign floating ip to port=
openstack floating ip set --port abjorklund-01-h4sxm-ingress-port 193.93.251.233
=unassign floating ip to server=
openstack server remove floating ip ocp-13-nkvgn-master-0 193.93.251.72

=assign ip to server=
openstack server add floating ip abjorklund_dns-lookup 193.93.248.34

=restart server=
openstack server reboot <server>
openstack server reboot --hard <server>
=view events/log from server=
openstack server event list <server>
openstack server event show <server> <requestid>

=recovery of server using iso=
Upload iso recovery.
export ISO=ubuntu-22.04.4-live-server-amd64.iso ; openstack image create $ISO --property hw_rescue_device=cdrom --property hw_rescue_bus=scsi --disk-format iso --file $ISO --private --progress
If special properties are not set then set them.
openstack image set --property hw_rescue_device=cdrom --property hw_rescue_bus=scsi <image>
Boot server with recovery iso.
export SERVER=<server> ISO=<iso>; openstack --os-compute-api-version 2.87 server rescue --image $ISO $SERVER
When done disable rescue mode.
openstack server unrescue SERVER

=subnet=
List subnets
openstack subnet list
=hypervisor=
Which underlying hypervisor is used.
Not of your business. Ask worthy person.
=volume backups=
openstack volume backup list
=create snapshot=
SERVER=<server> openstack server image create --name "backup-${SERVER}-$(date_file)" ${SERVER}
=volume snapshot=
openstack volume snapshot list
openstack volume snapshot list -c ID -f value | while read SNAPSHOT ; do echo '*' $SNAPSHOT ; openstack volume snapshot delete $SNAPSHOT ; done

=dns=
# openstack dns https://docs.binero.com/dns.html
# List zones
openstack zone list
# Create zone
openstack zone create --email anden@halfface.se binero.halfface.se.
# Add entries.
openstack recordset create --record <ip> --type A <zone> <name>
# list enries.
openstack recordset list <zone>
# Delete entries.
openstack recordset delete <zone> <name>
# show values for one entry
openstack recordset show <zone> <name>

=Networking explained=

1. openstack_networking_network_v2
- Purpose: Represents a network in OpenStack.
- Interaction: This is the top-level network entity. You create a network to provide a layer 2 domain for your instances.

2. openstack_networking_subnet_v2
- Purpose: Represents a subnet within a network.
- Interaction: A subnet is associated with a network. It defines a range of IP addresses, and optionally, DHCP settings.

3. openstack_networking_router_v2
- Purpose: Represents a virtual router.
- Interaction: Routers are used to route traffic between different subnets or networks. They can also be used to provide external network access to instances.

4. openstack_networking_router_interface_v2
- Purpose: Connects a router to a subnet.
- Interaction: This resource is used to add an interface to a router, effectively connecting the router to a subnet, enabling routing between that subnet and others.

5. openstack_networking_port_v2
- Purpose: Represents a port on a network.
- Interaction: Ports are attachment points for devices (like instances) on a network. They have associated IP addresses and MAC addresses.

6. openstack_networking_port_secgroup_associate_v2
- Purpose: Associates security groups with a port.
- Interaction: Security groups define the firewall rules applied to ports. Associating a security group with a port applies the security group's rules to that port.

7. openstack_networking_secgroup_v2
- Purpose: Represents a security group.
- Interaction: Security groups contain a set of rules that define the allowed ingress and egress traffic to and from ports.

8. openstack_networking_secgroup_rule_v2
- Purpose: Represents a rule within a security group.
- Interaction: Security group rules define specific ingress or egress traffic allowed to the instances associated with ports to which the security group is applied.

9. openstack_networking_floatingip_v2
- Purpose: Represents a floating IP.
- Interaction: Floating IPs are IP addresses that can be dynamically associated with instances. They provide external access to instances.

10. openstack_networking_floatingip_associate_v2
- Purpose: Associates a floating IP with a port.
- Interaction: This resource links a floating IP to a port, providing the instance with an external IP address that is accessible from outside the OpenStack cloud.

Interaction Summary
1. Network and Subnet Creation:
- Create a network using `openstack_networking_network_v2`.
- Create a subnet within this network using `openstack_networking_subnet_v2`.

2. Router Configuration:
- Create a router using `openstack_networking_router_v2`.
- Add an interface to this router to connect it to a subnet using `openstack_networking_router_interface_v2`.

3. Instance Connectivity:
- Create a port on the network using `openstack_networking_port_v2`.
- Attach this port to an instance.

4. Security:
- Create security groups using `openstack_networking_secgroup_v2`.
- Define rules for the security group using `openstack_networking_secgroup_rule_v2`.
- Associate security groups with the port using `openstack_networking_port_secgroup_associate_v2`.

5. External Access:
- Create a floating IP using `openstack_networking_floatingip_v2`.
- Associate the floating IP with the port attached to the instance using `openstack_networking_floatingip_associate_v2`.
=Extend disk=
Look at usage from beginning.
df -lh
Extend partition partprobe
openstack volume set --size <new_size> <volume> --os-volume-api-version 3.42
Grow partition that you intend to grow. This part can be ignored if using disk as raw partion(/dev/sd?)
growpart /dev/sdb 1
Resize filesystem.
resize2fs /dev/sdb1
Look at usage after extend.
df -lh
=affinity=
affinity Put servers on same hypervisor.
anti-affinity Dont put servers on same hypervisor.
soft-affinity Put servers on same hypervisor if possible.
soft-anti-affinity Put server on hypervisor if possible

=Are hosts located on same hypervisor=
openstack server list -f value -c ID | while read i ; do openstack server show $i -f value -c hostId -c name | xargs ; done | sort -n
=Define how server should be handled regarding affinity=
openstack server group list
==create server group name with soft affinity==
openstack server group create --policy soft-anti-affinity <name>

=install openstack cli on rhel7/8=
yum install centos-release-openstack-train.noarch
yum install python-openstackclient
sed -i 's/^mirrorlist/#mirrorlist/g' /etc/yum.repos.d/*
sed -i 's%^#baseurl=http://mirror.centos.org%baseurl=http://vault.centos.org%g' /etc/yum.repos.d/*
=remove network with dependencies=
export ROUTER=93b6d9c1-67db-4e04-9aaf-dad208def3c4
export NETWORK=9b86febc-f46f-4990-96c8-ef2e4bc8e139
openstack router remove subnet ${ROUTER} $(openstack route show ${ROUTER} -f json | jq -r '.interfaces_info[].subnet_id')
openstack router unset --external-gateway ${ROUTER}
for port in $(openstack port list --network ${NETWORK} -f value -c ID); do
openstack port delete "$port"
done
for subnet in $(openstack subnet list --network ${NETWORK} -f value -c ID); do
openstack subnet delete "$subnet"
done
openstack network delete ${NETWORK}
openstack router delete ${ROUTER}
=delete nic/network from server=
openstack port list --server <vm-name-or-id>
openstack server remove port <vm-name-or-id> <port-id>

=openstack version=
openstack major miro version.
openstack version show
openstack version show -f json | jq -r '.[] | select(.Status == "CURRENT") | [."Service Type", .Version, .Endpoint]|@tsv' | column_tab
=download volume to you where you want=
Create an image.
openstack image create --volume <volume name> --private --progress <image name>
Download it using.
openstack image save --file <local filename> <image name>
=application credentials=
<pre>
# Login via working cli session. Create application credentials with read permissions. Create config file with output from the command.
openstack application credential create reader_3 --role reader -c id -c secret -f value | xargs | while read ID SECRET ; do cat > clouds.yaml <<EOF
clouds:
${OS_CLOUD}:
auth_type: "v3applicationcredential"
auth:
auth_url: https://auth.binero.cloud:5000
application_credential_id: "${ID}"
application_credential_secret: "${SECRET}"
region_name: europe-se-1
interface: public
identity_api_version: 3
volume_api_version: 3
EOF
done
# To be able to use above config file you have to set OS_CLOUD variable and have the clouds.yaml file in either your working directory or ~/.config/openstack/clouds.yaml.
</pre>
=manage certs=
==List secrets==
openstack secret list
==Add new cert. Content type p12==
openssl pkcs12 -export -in sulzer.pem -out sulzer.p12 -passout pass:
openstack secret store --name star-sulzer-com-lb-cert-2026-10-23 --secret-type opaque --payload-content-type 'application/octet-stream' --payload-content-encoding base64 --payload "$(base64 /temp/sulzer.p12)"

==Download cert==
openstack secret get https://api-eu-se-1.binero.cloud:9311/v1/secrets/8c0e090c-6cf4-4767-94ce-a55417e56429 --payload_content_type 'application/octet-stream' --file /tmp/tmp
==Look at cert==
openstack secret get https://api-eu-se-1.binero.cloud:9311/v1/secrets/8c0e090c-6cf4-4767-94ce-a55417e56429 --payload_content_type 'application/octet-stream' --payload -f value | python3 -c "import sys; sys.stdout.buffer.write(eval(sys.stdin.read()))" | openssl pkcs12 -nodes -info -passin pass:
==Add cert to listener==
openstack loadbalancer listener set <listener_id> --default-tls-container-ref <certificate_secret_id>
=dhcp options provided by cloud-init=
/var/log/cloud-init.log
=List hypervisor=
openstack hypervisor list -f json | jq -r '.[]|select(.State == "up")|."Hypervisor Hostname"' | sort -n | while read i ; do echo "$i(){ ssh root@$i "'"${@}" ; }' ; done
openstack hypervisor list -f json | jq -r '[.[] | select(.State == "up")] | sort_by(."Hypervisor Hostname" | match("([0-9]+)").captures[0].string | tonumber) | .[]."Hypervisor Hostname"'| while read i ; do echo "$i(){ ssh root@$i "'"${@}" ; }' ; done

Drac

2026-03-26T09:03:06Z

Ekaanbj: /* List virtual disk */

=get system information=
racadm getsysinfo
=reset drac=
racadm racreset soft
=racadm(Manage dell sever via ssh idrac)=
==List system events.==
racadm getsel
==How many event in log==
racadm getsel -i
==Read 7 event from line 10.==
racadm getsel -s 10 -c 7
==Read lifecycle log==
racadm lclog view
==Read lifecycle logs of warning critical version.==
racadm lclog view -s Warning,Critical -n 5
==Reset idrac==
racadm racreset -f
==Version of idrac==
racadm getversion
==Is sol enabled==
racadm get iDRAC.IPMISOL
==Login via sol/serial==
racadm console com2
==Short info about system==
racadm getsysinfo
==Long output inventory==
hwinventory
==View settings==
racadm get BIOS.ProcSettings.ProcVirtualization
==Set value==
racadm set BIOS.ProcSettings.ProcVirtualization Disabled
[Key=BIOS.Setup.1-1#ProcSettings]
RAC1017: Successfully modified the object value and the change is in
pending state.
To apply modified value, create a configuration job and reboot
the system. To create the commit and reboot jobs, use "jobqueue"
command. For more information about the "jobqueue" command, see RACADM
help.
==Cold restart (hard reset)==
racadm serveraction hardreset
==Full power cycle (off → on)==
racadm serveraction powercycle
==Force shutdown and power-up manually==
racadm serveraction powerdown
racadm serveraction powerup
==look at state of disks==
racadm storage get pdisks -o -p State,Name,Size,MediaType
==List virtual disk==
racadm storage get vdisks -o
==change password==
Find user that you want to change password on.
racadm get iDRAC.Users.2.UserName
Set password on user
racadm set iDRAC.Users.2.Password <password>

Ascii

2026-03-24T13:55:46Z

Ekaanbj: /* Batman */

Stolen with pride from https://www.ascii-art.de/ascii/
=Ferdinad=
<pre>
|\ _____
|\ J \ _.--' `-.__
\`. \ \--.-'" `-.-.__
\ `-. .' \ `.__.`. \ `-.
`. J | `. ) ` `.
`-. /\ | )-.__.<_ __ \
\\/ \|>- ' `.'.') \
`\ / \ -._.-' / \
|| | /\ `-.__.' \
|| | | | \
'' |-'-'/ \
. .-.' _.\'' `.
|| ( /.-.|`-._ / . L
\\ \ (_.' /|| /_.'-' L
\ .'//__.-' >_`. J
`.__.'-' | `-`-. J
/_/\ \ \ _ L
||| /- |`- \ . .' `- J
| || F/ ) \ | / | J \ L
\ L.'// / \ J L| F J \-. |
_ \/ // .-'| \ \ \| / J | J
_ .-()-| / ____.-<_(/` .'`-. \ | J.-' F F \ F__.--"""-.
`. / `._ _ _) V/// . (_.( /.--.\`- \ / F F `. _.---. J
`.\ / ' \|\||\\///.' ( \ /' `--._ | | \ J L \" _.'.'
`.\\_F .''./\ -./)/.'/ _ `.__`-.--' `.-| / \ Y | .-' `)
`.(/`.(\||/)\\-'/ .')/) "" `) / `-..-""`. `. || / \
.-'| /\\$)'_|/-'/'()-'-> F J-._J_ `.. \_.' \ | )
.'``\\\//\\/).'/\\/)\\" _.' | .' \_.-. J____.) `. (
/ ___-(`.|//-(\|_/-`-' .' ' | (__./ )-' `--.\
__\|/`-()-<(/()-< .-' `. ___| (__.-'
`-()(.'|_)-<\_)-' <___.-| F
|/$ \_ \ | .-'
`\ "
</pre>
=Haircut=
<pre>
|
|/ |
,,,,, ,+ /|
/ \ () | ||
\ C '\ /|_() ||
) _| .'___/,,,// ||
.'=. (____E.' / / \ ||
| \)`-\ _F_.' \ c `\ ||
\ \ !'__/ ) _| ||
\ \,' / /`._( ||
|`. .' / \ \ ||
\ `-' | .-. | | \ E ||
>====[] | \ |__| | O OE ||
/ |_/ | |___)| `.__j____ \|E ||
\_ | || __`.________ `. |""|\|
\ |\ ||| \///_ _|__|_|
\ __ | \ ||`""\\""""//"' \`. \ |
|[__]| \ ||.---\\__//---. | | \____|
||__|/ / \|____________|\ |/ |
| | / || || /| | |
-----| |/------------||-||-/`| |----------|
/| | || ||/`-|___| |
/\| | || \\._ [____] h|
/`.|____| || \\ `-/ '`._ j|
`=.\____/ || \\__`-.____) w|
) '`--. _.-||-._ `""""""" |
`='====' ,-' ' ` `-. |
`-.________.-' |
</pre>
=Batman=
<pre>
. .
|\_|\
| a_a\
| | "]
____| '-\___
/.----.___.-'\
// _ \
// .-. (~v~) /|
|'| /\: .-- / \
// |-/ \_/____/\/~|
|/ \ | []_|_|_] \ |
| \ | \ |___ _\ ]_}
| | '-' / '.' |
| | / /|: |
| | | / |: /\
| | / / | / \
| | | / / | \
\ | |/\/ |/|/\ \
\|\ |\| | | / /\/\__\
\ \| | / | |__
/ | |____)
|_/
</pre>
=Superman=
<pre>
.=.,
;c =\
__| _/
.'-'-._/-'-._
/.. ____ \
/' _ [<_->] ) \
( / \--\_>/-/'._ )
\-;_/\__;__/ _/ _/
'._}|==o==\{_\/
/ /-._.--\ \_
// / /| \ \ \
/ | | | \; | \ \
/ / | :/ \: \ \_\
/ | /.'| /: | \ \
| | |--| . |--| \_\
/ _/ \ | : | /___--._) \
|_(---'-| >-'-| | '-'
/_/ \_\
</pre>

=Skull=
<pre>
_,.---,---.,_
,;~' '~;,
,; ;,
; ;
,' '
,; ;,
; ; . . ; :
| ; ______ ______ ; |
| '/~" ~" . "~ "~\' |
| ~ ,-~~~^~, | ,~^~~~-, ~ |
| | }:{ | |
| l / | \ ! |
.~ (__,.--" .^. "--.,__) ~.
| ----;' / | \ `;---- |
\__. \/^\/ .__/
V| \ / |V
| |T~\___!___!___/~T| |
| |`IIII_I_I_I_IIII'| |
| \,III I I I III,/ |
\ `~~~~~~~~~~' /
\ . . /
\. ^ ./
^~~~^~~~^
</pre>
=Castle=
<pre>
._-_.
|_-_(
I
/_\ ___
._-_. |,|/ \
|_-_( | /_____\ ._-_.
I \| u -| _ |_-_(
/ \ -_-_-_-_--|/ \ I
/___\ \._._._./-|___\ / \
|_u | |_ _| -| u_| /___\
|_-_-_-_-_- U_| -| _| | u_|
|_\._._._./ _|-_-_-_-_-_-_|
\_|- -| _| .. -|_|
\|- U| _| U ++ U-|/
|U -| U _| ____ -|
|- _ -| _| /|-|-\ -|
|-/#\-| _| |-|-|| -|
,___|_MEB_|-----'__I|-|-I__|__,
._/ / \____/ \,
/ \ \ \```\ \,
(__ _\ |'''| L_,
/ ./ / \```\ / _\
| / / |'''| \, |
/ ( \```\ / _/ \
/_ |'''| _,|
| \
</pre>
=kentaur=
<pre>
(_______
-.__\ __\
_) / \
\_ _ ( "("
_>_ \_-/
)/ ,-' (-.
)/ _ - - )
/,'| _)_)|
(_____ // | /||
.___\ \----._//___/ '( \\
_> / __// ',,,\ )\
_) /| /,-/ )'\|
\ ( | , |
/_,$ \ \-.__\ (_, /
( ' \ | | ) |\ /
_) _/ _/ /, )/ )
_) <\ ( ) |) |
) $_\_ / / \(
/_,\ \_\ )| /_\
)_\ /_,) )_\
|_\
</pre>
=bull=
<pre>
/| /|
| \ __ _ _ / ;
___ \ \ _.-"-" `~"\ `"--' /
_.-' ""-._\ "" ._," ; "\"--._./
_.-' \./ "-""", ) ~" |
/ ,- .' , ' `o. ; )
\ ;/ ' ; /
|/ ' | \ ' |
/ | J."\ , |
" : \ .' : | ,. _)
| | / f | |`--"--'
\_ \ \ / _/ |
\ "-._ _.| ( j/; -'/
\ | "/ ( | /, |
| \ | /\ |\_/// /
\ / \ | \ \ / /
|| \ \| | | |
|| \ \ | | /
|\ |_|/ ||
L \ || ||
`"' |\ |\
( \. \ `.
|_ _\|_ _\
" "
</pre>
=Deer=
<pre>
/| |\
`__\\ //__'
|| ||
\__`\ |'__/
`_\\ //_'
_.,:---;,._
\_: :_/
|@. .@|
| |
,\.-./ \
;;`-' `---__________-----.-.
;;; \_\
';;; |
; | ;
\ \ \ | /
\_, \ / \ |\
|';| |,,,,,,,,/ \ \ \_
| | | \ / |
\ \ | | / \ |
| || | | | | |
| || | | | | |
| || | | | | |
|_||_| |_| |_|
/_//_/ /_/ /_/
</pre>
=dinosaur=
<pre>
. .
/ `. .' \
.---. < > < > .---.
| \ \ - ~ ~ - / / |
~-..-~ ~-..-~
\~~~\.' `./~~~/
\__/ \__/
/ .- . \
_._ _.- .-~ ~-. / } \/~~~/
_.-'q }~ / } { ; \__/
{'__, / ( / { / `. ,~~| . .
`''''='~~-.__( /_ | /- _ `..-' \\ //
/ \ =/ ~~--~~{ ./| ~-. `-..__\\_//_.-'
{ \ +\ \ =\ ( ~ - . _ _ _..---~
| | { } \ \_\
'---.o___,' .o___,'
</pre>
=Dinosaur=
<pre>
__.--'~~~~~`--.
.. __. .-~ ~-.
((\ / `}.~ `.
\\\ .{ } / \ \
(\ \\~~ } | } \
\`.-~ -@~ } ,-,. | ) \
(___ ) _} ( : | / / `._
`----._-~. _\ \ |_ \ / /-.__ `._
~~----~~ \ \| ~~--~~~( + / ~-._ ~-._
/ / \ \ ~--.,___~_-_.
__/ / _\ )
.<___.' .<___/
</pre>
=Dog=
<pre>
_
,:'/ _..._
// ( `""-.._.'
\| / 6\___
| 6 4
| /
\_ .--'
(_'---'`)
/ `'---`()
,' |
, .'` |
)\ _.-' ;
/ | .'` _ /
/` / .' '. , |
/ / / \ ; | |
| \ | | .| | |
\ `"| /.-' | | |
'-..-\ _.;.._ | |.;-.
\ <`.._ )) | .;-. ))
(__. ` ))-' \_ ))'
`'--"` `"""`
</pre>
=Boss=
<pre>
.-.
/ 7, `\,')/,
( \\ =/= )))
) \\ < . D/
( \\ `e_ /
\ \\_ __\ \___
) / 7// ~ `\
/ |( / ) ) , \
( ' `\(_ (_' \ \
\ \__/ \ (\ )
) )) \\ |
/( ( )\|
( \_ / '( \
| ( |'\/\
| | |
| | /
( ` /( ,(
| ( ) \
| ) \ |
| / \ |
| / \ |
/( )\
/ / \ \
/_/ \_\
</pre>
=Dragonfly=
<pre>
.-.
()I()
"==.__:-:__.=="
"==.__/~|~\__.=="
"==._( Y )_.=="
.-'~~""~=--...,__\/|\/__,...--=~""~~'-.
( ..=\=/=.. )
`'-. ,.-"`;/=\ ;"-.,_ .-'`
`~"-=-~` .-~` |=| `~-. `~-=-"~`
.-~` /|=|\ `~-.
.~` / |=| \ `~.
.-~` .' |=| `. `~-.
(` _,.-="` |=| `"=-.,_ `)
`~"~"` |=| `"~"~`
|=|
|=|
|=|
/=\
\=/
^
</pre>
=Tuttancanon=
<pre>
___..--------..___
_.-':: '::::::' ::'-._
_.-':: :: '::' :: ::'-._
_.-':: :: :: :: :: :: ::'-._
.-':: :: :: :: :: :: :: :: ::'-.
/:::\:: :: :: :: :: :: :: :: ::/:::\
/ \:: :: :: :: :: :: :: :: ::/ \
/:::::::\:: :: :: :: :: :: :: :: ::/:::::::\
| \:: :: :: :: :: :: :: :: ::/ |
/::::::::::\:: :: :: ::/::::::::::\
/ \:: ::/ \
|:::::::::::.-\ .''''''''''''''''''''. /-.:::::::::::|
/ // \\.' .-==-. .-==-. '.// \\ \
|:::::::::::||.-| .' '. .' '. |-.||:::::::::::|
/ |||'| _.'''. \ / .'''._ |'||| \
|::::::::::::|||_|.-' :(*):'.| |.':(*): '-.|_|||::::::::::::|
/ |\_.|`''''''''' | | '''''''''`|._/| \
|:::::::::::::\(O)| | | |(O)/:::::::::::::|
| `-'| .' '. |`-' |
/:::::::::::::::::\ ( __ ) /:::::::::::::::::\
/ \ .' '. / \
|::::::::::::::::::::\ _.--..--._ /::::::::::::::::::::|
| ' '.---..---.' ' |
|::::::::::::::::::::::'. '-....-' .'::::::::::::::::::::::|
| '. .' |
'-:::::::::::::::::::::::' '.________.' ':::::::::::::::::::::::-'
/'-. | '--------' | .-'\
/ '::::::::::::::::::| |-._\\_.-| |::::::::::::::::::' \
| \ | |-._//_.-| | / |
|_..--|:::::::::::::::::| |-._\\_.-| |:::::::::::::::::|--.._|
|>.<>.<\ |._|-._//_.-|_.| />.<>.<|
|>.<>.<|::::::::::::::::|-.|-._\\_.-|.-|::::::::::::::::|>.<>.<|
|>.<>.<| |<>|-._//_.-|<>| |>.<>.<|
|>.<>.<|::::::::::::::::|<>|-._\\_.-|<>|::::::::::::::::|>.<>.<|
|>.<>.<| |<>|-._//_.-|<>| |>.<>.<|
|>.<>.<|::::::::::::::::|<>|-._\\_.-|<>|::::::::::::::::|>.<>.<|
|>.<>.<| |<>'-._//_.-'<>| |>.<>.<|
|>.<>.<|::::::::::::::::|<>.<>.<>.<>.<>|::::::::::::::::|>.<>.<|
|>.<>.<\ |<>.<>.<>.<>.<>| />.<>.<|
|>.<>.<>':::::::::::::::|<>.<>.<>.<>.<>|:::::::::::::::'<>.<>.<|
|>.<>.<>.<'. |<>.<>.<>.<>.<>| .'>.<>.<>.<|
|>.<>.<>.<>.<'::::::::::'<>.<>.<>.<>.<>'::::::::::'>.<>.<>.<>.<|
\>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<></
\>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.</
\>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>/
\>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>./
'.>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.'
'.>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<.'
'.>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<.'
'.>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<.'
''==============================''
</pre>
=Elephant=
<pre>
_,--._ _,.--'''''''---..._
,' _`''-'' `-._
/ / `. `.
/ ,_. | \ \
/ `-' | _,-'' \
| \,-' / \ `. \
| ,') ; / / |/\ \
_,.-'_,'\,-:_;;.| \\ | / | \ :
`'-'' \ \ | | \ / |/ |;
\ \ | / | / | ;;
`. \ \ |__ \ |/ ::
\ : | / `''----''`. / | \\
| ; ,\ | \ | | ;;
/ / \| | | | |
/,' || | | | |
;| | | | |
',_;-,__\ ,';-,__\.\
</pre>
=Escavator=
<pre>
.-.
/ \
_____.....-----|(o) |
_..--' _..--| .''
.' o _..--'' | | |
/ _/_..--'' | | |
________/ / / | | |
| _ ____\ / / | | |
_.-----._________|| || \\ / | | |
|=================||=||_____\\ |__|-'
| ||_||_____// (o\ |
|_________________|_________/ |-\|
`-------------._______.----' / `.
.,.,.,.,.,.,.,.,.,.,.,.,., / \
((O) o o o o ======= o o(O)) ._.' /
`-.,.,.,.,.,.,.,.,.,.,.,-' `.......'
</pre>
=Bobcat=
<pre>
______________
/.----------..-'
-. || \\
.----'-||-. \\
|o _ || | \\
| [_] || |_...-----.._\\
| [_] ||.' `-._ _
| [_] '.O)_...-----....._ `.\
/ [_]o .' _ _'''''''''_ _ `. `. __
|______/.' _ `.---.' _ `.\ `._./ \
|'''''/, .' _ '. . , .' _ '. .`. .o'| \
`---..|; : (_) : ;-; : (_) : ;-'`--.| \
' '. _ .' ' ' '. _ .' ' / \
`._ _ _,' `._ _ _,' `._____\
</pre>
=Angel=
<pre>
,_ .--.
, , _)\/ ;--.
. ' . \_\-' | .' \
-= * =- (.-, / / |
' .\' ). ))/ .' _/\ /
\_ \_ /( / \ /(
/_\ .--' `-. // \
||\/ , '._// |
||/ /`(_ (_,;`-._/ /
\_.' ) /`\ .'
.' . | ;. /`
/ |\( `.(
| |/ | ` `
| | /
| |.'
__/' /
_ .' _.-`
_.` `.-;`/
/_.-'` / /
| /
( /
/_/
</pre>
=Flamino=
<pre>
___
,' `.
/_. _,. \
( /(' \ :
\\| / ;
`' / /
/ /
: :
| : _______
: \ ,' `-._
' / . . . \
: `' ; ; ; ; , :
\`./ / / / ; ;;
`. `'../__/ / ,.\
`'-.____;-'`\\\
\ // / '|
::\
||\\
|| \\
|| ))
|| //
||//
||/
||
/||
`||-
__,';
</pre>
=Mr Gadget=
<pre>
_..__
.' I '.
|.-"""-.|
_;.-"""-.;_
_.-' _..-.-.._ '-._
';--.-(_o_I_o_)-.--;'
`. | | | | | | .`
`-\| | | |/-'
| | | |
| \_/ |
_.'; ._._. ;'._
_.-'`; | \ - / | ;'-.
.' : / | | | | \ '.
/ : /__ \ \___/ / __\ : `.
/ | / '._/_\_.' \ : `\
/ . `---;"""""'-----` . \
/ | |() () | \
/ /| | |\ \
/ / | |() () | \ \
| <jgs\_,,___|_.....____,,__/ `> |
\ \ | ][ | | ][ | / /
\ \ ;=""====='"""'====""==; / /
|/`\ \/ |() () \/ /`\|
|_/.-'; | |`-.\_|
/ | ; : \
|__.| | |.__|
; | |
| : ;
| : |
; | |
; | ;
| : |
| | ;
| | ;
'-._ ; _.-'
`;"--.....--";`
| | | |
| | | |
| | | |
T----T T----T
_..._L____J L____J _..._
.` "-. `% | | %` .-" `.
/ \ .: :. / \
'-..___|_..=:` `-:=.._|___..-'
</pre>
=Lizard=
<pre>

)/_
_.--..---"-,--c_
\L..' ._O__)_
,-. _.+ _ \..--( /
`\.-''__.-' \ ( \_
`''' `\__ /\
')
</pre>
=World=
<pre>
_.-,=_"""--,_
.-" =/7" _ .T "=.
,/7 " " ,//)`d `.
,/ " 4 ,i-/ `.
/ _)"_sm =,=T"D \
/ (_/"_`;\/gjo D-O \
/ ,d"""O-_.._.) P.___ \
, ," \\ bi- `\| Y.
| .d b\ P' V |
|\ 'O O!", |
|L. \__.=_ 7 |
' D. ) / '
\ T \ | /
\D / 7 / /
\ \ ," /" /
`. \ 7' ,'
"-_ `"' ,-'
"-._ _.-"
""""---""""
</pre>
=Gnu=
<pre>
_,-----.
_,------.__,-' `. . .
.-' `//__ \\
| ((___`-_____ ))
| \_____) \`=:'
| `=| |=,'
/ | O (|
/ /\ | |
/ / \ . \ |
| / /| / `--. ___ __,,-. |
| / // / `-' \ ,_ /'' | o o|
/ | | | | \ \ `. | ``--'
mmm | | | \ \ | |
| |\ | | || |
| | || / / `. )
\ \ \\ / / | |
|_| || / / | |
|_\ \_| | \
\__\
</pre>
=Duck=
<pre>
___
,-"" `.
,' _ e )`-._
/ ,' `-._<.===-'
/ /
/ ;
_ / ;
(`._ _.-"" ""--..__,' |
<_ `-"" \
<`- :
(__ <__. ;
`-. '-.__. _.' /
\ `-.__,-' _,'
`._ , /__,-'
""._\__,'< <____
| | `----.`.
| | \ `.
; |___ \-``
\ --<
`.`.<
`-'
</pre>
=Dog=
<pre>
()._
_.--. (##)_`-.
/ . ``u (##), ` `.
\__) _/ (##),--. \
| --' ()' \ \
/ | | |
,' \ _,' /
,' | ,;--//
/ ___\ |/ ___V__{(_
| ' \| || ,'-===- `,'|
__| ,' /| || |""""""""|-L|
,`__. < _)))_))) |________|,'
(,'
</pre>
=Giljotine=
<pre>
.___________________.
|`._______________,'|
| | | |
| |_______________| |
| || || |
| ||_ _ || |
| || ""--._._ || |
| || `-. || |
| || `. || |
| || \|| |
| || || |
| || || |
| || || |
| || || |
| || || |
| || || |
| || || |
| || || |
| || || |
| || || |
| || || |
| || || |
| || || |
| || || |
| || || |
| || || |
| || || |
| || || |
| || || |
| || || |
| ||_____________|| |
| |/ ,--. \| |
| |-(_)-( )-(_)| |
| | `--' | |
|===================|
| |
</pre>
=Gun=
<pre>
+-'~`---------------------------------/\--
||"""""""""""""""""""""""""""""""" \\\\\\ \/~)
|| \\\\\\ \/_
|~~~~~~~~-________________-_________________\ ~--_
!---------|_________ ------~~~~~(-- )--~~
\ /~~~~\~~\ )--- \_ /(
|| | | \ () \\
\\____/_ / ()\ \\
`~~~~~~~~~-. \ \\
\ \ <($)> \\
\ \ \\
\ \ \\
\ \ \\
\ \ () \|
_\_\__====~~~
</pre>
=Deer=
<pre>
( )
)) ((
// \\
| \\____// |
\~/ ~ ~\/~~/
(| _/o ~~
/ / ,|
(~~~)__.-\ |
``~~ | |
| | |
| |
/ \
`\ /'
`\_ _/'
~~~~
</pre>
=Hedgehog=
<pre>
\ / \/ \/ / ,
\ / \/ \/ \/ / ,
\ \ \/ \/ \/ \ \/ \/ /
.\ \/ \/ \/ \/ \/ / / /
' / / \/ \/ \/ \/ \/ \ \/ \
.' ) \/ \/ \/ \/ \/ \/ \ / \
/ o ) \/ \/ \/ \/ \/ \/ \// /
o'_ ',__ .' ,.,.,.,.,.,.,.,'- '%
// \\ // \\
'' '' '' ''
</pre>
=Helikopter=
<pre>
.- . _
.: ` " - . _
\ :: ` ""--..__ . . . : : :
`\ :: :' ` _ _ ""--..__ ......_._._:.:.: " " " " " "
`\.:: :' " " " - ----.....___ ""-##.____...:::""""""""""""
: : :' "::":"-----......______
." ""--..__ . .:'.: """"""-----. . . _ _ _
/.""--.._ ""--..__ : .:'. : " " "
/' .: ":-.._ ""--..__ .:'. :
`-._:__.-" ""-.._ ""--...___..:'. :
.: /.""-..__...---""-.'"-:"--.:_
" : POLICE .' ::""-."";.
:_ : :: ":: `-.
:::::.._ '-._ :: :: `.
: """:::::.._ "''-._ :: :
: "":::::.._ "': :
`. """:::::-:_ :
:. """::::::... :
..__..--"" ". . """::::::
""--..__ :.--"" ":
""-+:=:_ ("-:
: ""--.._ []'
: :""--..___..--"
: :
""--..__ :
""--.:_
""--..__.-grp
</pre>
=Halv Liter=
<pre>
| | ------------\ ,---. /------------ | |
| | ---------. `-./ "\.-' .--------- | |
| ,--. | --------\ . /-------- | ,--. |
| ( >< ) | ------`-.| .-'------ | ( >< ) |
| `--' | ---/ `/"\ \--- | `--' |
| . | `//_-_\\' 8 | |
| : . ! | (.' ',) | . : . :|
| ! ! .| | | : | ! .|
| |_| ;|_| . |_| !_| !|
`-' `-^' \o `-' `-^'
\__________________T>_________________/
`-=--=--=--=--=--=---=--=--=--=--=--=-'
] _] _] _] _] _] _L] _] _] _] _] _] _
`-------------------------------------'
`u---u---u---u---u---u---u---u---u---u'
</pre>
=Hockey=
<pre>
.---.
/_____\
_HH.H.HH
_ _-"" WHHHHHW""--__
\\ _-" __\VW=WV/__ /"".
\\ _-" \__--" "-_-" """ "_
\\/ _ ""
\\----_/_| ___ /"\ T""\====-
\\ /"-._ |%|H| ( "\|) | / .:)
\/ / |-+-| \ |_ J .:::-'
/ / |H|%| _-' '-._ " )/;"
/ / \ __ ( \ \ \ "
/ /\/ '. / \ \ \ \ _- \
"'-._/ \/ \ "-_ \ -"" _- \
_,'\\ \ \/ ) "-, -"" \
_,'_- _ \\ \ \,' \ \_\_\ \
,' _- \_\ \ \ \_\_\ \
\_ _- _- _,' \ \ \ """" )
C\_ _- _,' \ "--------. L_""""_/
" \/-' "-_________| '"-Y
</pre>
=Hockey=
<pre>
.-.-.
/_____\
:._|_|_.:
|/a> a>\|
_.-: ( ;._
,'::::\ _ /:::`-._
/:::::::`._,'|:::::::`._
/:::::_.--`._,'-.::::::::`.
:`:::;' \ ) ( `':_:;-' \
|: `' : \ \ . ,-.\
|' --._;. `:\,' .._\
|:. -.\: `;:;'.' :
:,----..(:._ ._,---.';'. `.__.'
/\,---.|:':..-(\,-, `.`..-'
/ :.--.'|:' ;',:.__.-''
: | |' ,',' /:/ /
: |,'|.-| ,',' /:/ /
/:\ : ,'_,:',' /:/ /
/ `:._\,'.`.`, -.';','
:`-._`:/ >._>.' .;\'
|`-._`:,',/_ ,'
|::::;',' ; `-'':
/\:,',| :`-..-.;
_,`,',' ; ;:::::/
,'`,','.;':_;`-::'/
<`,',;::;:-' /
,',' ( ```` ,'.::::.
,'.' /`_.__.-'::::'
_,',' `:::::::'
_______..-`.,'
,' ,----. ,'
'---`----'-''
</pre>
=Jeep=
<pre>
_.------------------.
.'____________________|
// _|||| | | | | |
______//_\__j_|||"--" "--" | | _
/-----+-|p ==,|||__________|_|-|W|
_j,====. |b_____||| _____ | |W|
|_) ,---.`.`------'|.',---.`.___|_|W|
`/ .-. \\`======__// .-. \`-----'""
\ `-' / """"""" \ `-' /
`---' `---'
</pre>
=Fool=
<pre>
,;;;;;;,
,;;;'""`;;\
,;;;/ .'`',;\
,;;;;/ | \|_
/;;;;; \ / .\
,;;;;;;| '. \/_/
/;;;;;;;| \
_,.---._ /;;;;;;;;| ; _.---.,_
.;;/ `.;;;;;;;;;| ;' \;;,
.;;;/ `;;;;;;;;;.._ .' \;;;.
/;;;;| _;-"` `"-;_ |;;;;\
|;;;;;|.---. .' __.-"```"-.__ '. .---.|;;;;;|
|;;;;;| `\/ .'/__\ /__\'. \/` |;;;;;|
|;;;;;| |_/ // \\ // \\ \_| |;;;;;|
|;;;;;| |/ |/ || || \| \| |;;;;;|
\;;;;| __ || _ .-.\| |/.-. _ || __ |;;;;/
\jgs| / _\|/ = /_o_\ /_o_\ = \|/_ \ |;;;/
\;;/ |`.- ` ` ` ` -.`| \;;/
_|;' \ | _ _ _ _ | / ';|_
/ .\ \\_ ( '--'( )'--' ) _// /. \
\/_/ \_/| /_ | | _\ |\_/ \_\/
| /|\\ \ / //|\ |
| | \'._'-'_.'/ | |
| ; '-.```.-' ; |
| \ ``` / |
__ ; '.-"""""-.' ; __
/\ \_ __..--\ `-----' /--..__ _/ /\
\_'/\`''---''`..;;;;.'.__, ,__.',;;;;..`''---''`/\'_/
'-.__'';;;;;;;;;;;,,'._ _.',,;;;;;;;;;;;''__.-'
``''--; ;;;;;;;;..`"`..;;;;;;;; ;--''`` _
.-. /,;;;;;;;';;;;;;;;;';;;;;;;,\ _.-' `\
.' /_ /,;;;;;;'/| ;;;;;;; |\';;;;;;,\ `\ '-'|
/ ) /,;;;;;',' | ;;;;;;; | ',';;;;;,\ \ .'-./
`'-..-' /,;;;;',' | ;;;;;;; | ',';;;;,\ `"`
| ;;;',' | ;;;;;;; | , ', ;;;'|
_\__.-' .-. ; ;;;;;;; ; |'-. '-.__/_
/ .\ ( ) \';;;;;'/ | | /. \
\/_/ (` `) \';;;'/ '-._| \_\/
'-/ \-' '._.' `
""" /.`\
\|_/
</pre>
=Mogly=
<pre>
.-c.
_ .., _ ( ")\
['" 6'-'</ '-/ |
; ( -=; / |
| \-` _./ |
) `'--' (
/ .. .-"`
,-"' .' '. /
__ / _.- : Y
.',-7 ) .-' ) .' ;
[ )'} < / | : |
_".(. ( \, | : \
.'-. .\.,='-' / : |
=; | |-' / : |
_/--\ | : |
/_7-'<\ \ : .(
,L / |/ \ '. .' \
'/ / \ :-; /
\> __\ / \ /_
`----' '-._\
</pre>
=King=
<pre>
.
/ \
_\ /_
. . (,'v`.) . .
\) ( ) ,' `. ( ) (/
\`. / `-' `-' \ ,'/
: ' _______ ' :
| _,-' ,-. `-._ |
|,' ( )__`-'__( ) `.|
(|,-,'-._ _.-`.-.|)
/ /<( o)> <( o)>\ \
: : | | : :
| | ; : | |
| | (.-.) | |
| | ,' ___ `. | |
; |)/ ,'---'. \(| :
_,-/ |/\( )/\| \-._
_..--'.-( | `-'''-' | )-.`--.._
`. ;`._________,': ,'
,' `/ \'`.
`------.------'
'
</pre>
=Crest=
<pre>
o .,<>., o
|\/\/\/\/|
'========'
(_ SSSSSSs
)a'`SSSSSs
/_ SSSSSS
.=## SSSSS
.#### SSSSs
###::::SSSSS
.;:::""""SSS
.:;:' . . \\
.::/ ' .'|
.::( . |
:::) \
/\( /
/) ( |
.' \ . ./ /
_-' |\ . |
_..--.. . /"---\ | ` | . |
-=====================,' _ \=(*#(7.#####() | `/_.. , (
_.-''``';'-''-) ,. \ ' '+/// | .'/ \ ``-.) \
,' _.- (( `-' `._\ `` \_/_.' ) /`-._ ) |
,'\ ,' _.'.`:-. \.-' / <_L )" |
_/ `._,' ,')`; `-'`' | L / /
/ `. ,' ,|_/ / \ ( <_-' \
\ / `./ ' / /,' \ /|` `. |
)\ /`._ ,'`._.-\ |) \'
/ `.' )-'.-,' )__) |\ `|
: /`. `.._(--.`':`':/ \ ) \ \
|::::\ ,'/::;-)) / ( )`. |
||::::: . .::': :`-( |/ . |
||::::| . :| |==[]=: . - \
|||:::| : || : | | /\ ` |
___ ___ '|;:::| | |' \=[]=| / \ \
| /_ ||``|||::::: | ; | | | \_.'\_ `-.
: \_``[]--[]|::::'\_;' )-'..`._ .-'\``:: ` . \
\___.>`''-.||:.__,' |_______`> <_____:::. . . \ _/
`+a:f:......jrei'''
</pre>
=Kiwi=
<pre>
.```. _.''..
; ``` ``'.
: d `.
/ >,: \
/.' `'., :
/' ;. . ;
/ ; \ ; ; /
`..;\: :'
__|| `...,'
`-, ) ||
/.^/ ___||
'---,_\
(/ `\
</pre>
=Knight=
<pre>
.oo.
.\. ..
,'..''\ ...oooo''
| \_/' ...oooo'''
/''.'\ . ...oooo'''
| | '| ...o!oo'''
| | |. ...oooo''./ '\
| '\, ''''\ ./ ./\ '\.
/\ooo''|''''-/ -../ / \'' '\.
/ '\. '|.''\--/-+-+-+-+-+-+-+-+.'
....- \. \. '\-'/',, /'---/' '''
././ ''\.-.-.\ '\| '',,\--;
/-/| |-'\. '> '\\
!--!| /---/' ./' |
!--!! ./---/' ,/| |
./'-/'| |----\ \-| |
./'--/ |..........|''''''./'|...........|
-'-'-' '/---/\---|' '/-\--\''''
/--/' |--\ ./---\--\
|--| \--\. ./--/' \--\
|--| |--| ./--/' \--\.
'\-| '\-| /--/' \--|
|..\ |..\ |..\ |..\
</pre>
=knight=
<pre>
.I.
/ : \
|===|
>._.<
.=-< >-=.
/.'`(`-+-')'`.\
_/`.__/ : \__.'\_
( `._/\`. : .'/\_.' )
>-(_) \ `:' / (_)-<
| | / \___/ \ | |
)^( | .' : `. | )^(
| _\|`-._:_.-'| \ |
"-<\)| : | : | "-"
(\\| : / \ : |
\\-:-| |-:-')
\\:_/ \_:_/
|\\_| |_:_|
(;\\/ \__;)
|: \\ | :|
\: /\\ \ :/
|==| \\|==|
/v-'( \\`-v\
// .-' \\. \\
`-' \\`-'
\|
</pre>
=sheep=
<pre>
,-''''-.
(. ,. L ___...__
/7} ,-` `'-==''`` ''._
//{ '`.
\_,X , : )
7 ;`
: , /
\_, \ ;
Y L_ __..--':`. L
| /| ```` ; y J
[ j J / / L ;
| |Y \ /_J | |
L_J/_) /_) L_J
/_) /_)
</pre>
=laptop=
<pre>
.-----------------------===------------------------.
:o ______________________________________________ o:
; : : ;
`. `. .' .'
: : : :
`. `. .' .'
: : : :
`. `. .' .'
: : : :
`. `. .' .'
: : : :
`. `. .' .'
: :__________________________________: :
`. .'
'-------------| |-----| |--------------'
.""""""""""""""| |"""""| |"""""""""""""".
| () '-----------' o () |
| ___________________________________ |
| :__|__|__|__|__|__|__|__|__|__|__|__: |
| |___|__|__|__|__|__|__|__|__|__|__|_| |
| |__|_|__|__|__|__|__|__|__|__|__|___| |
| |___|__|__|__|__|__|__|__|__|__|____| |
| |____|__|__|__|__|__|__|___|__|__|__| |
| :___|__|___________________|__|__|__: |
| |
| .-------------. |
| | | |
| | | |
| |_____________| |
| | | |
| | | |
| '.___________.' |
| ___ |
'-----------------------------------------'
</pre>
=grass cutter=
<pre>
---. .---
'. .'
'.'
/
/
/
/
/
/
/
/
.'.
.' \
.' |
.' \
..--/_________|.--.
// '----------'// \\
||'=:='=:='=:='||()||
\\_'--''--''--'\\__//
`--' `--`
</pre>
=lamp=
<pre>
. | ,
\ _---_ /
-_ .' `. _-
__ : .---. : __
: \ / :
-" `. | | .' "-
/ |`-'| \
' ]"-_[ `
]"-_[
"*"
</pre>
=Lion=
<pre>
,.
,_> `. ,';
,-`' `' '`'._
,,-) ---._ | .---''`-),.
,' `. \ ; / _,' `,
,--' ____ \ ' ,' ___ `-,
_> /--. `-. .-'.--\ \__
'-, ( `. `.,`~ \~'-. ,' ,' ) _\
_> \ \ ,' ') ) `. / / <,.
,-' _, \ ,' ( / `. / `-,
`-.,-' `.,' ` `.,' `\ ,-'
,' _ / ,,, ,,, \ `-. `-._
/-, ,' ; ' _ \ / _ ` ; `. `(`-\
/-, ; (o) (o) ; `'`,
,~-' ,-' \ ' ` / \ <_
/-. ,' \ / \ ,-'
'`, ,' `-/ \-' `. `-. <
/_ / / (_ _) \ \ `,
`-._; ,' | .::.`-.-' :.. | `-. _\
_/ \ `:: ,^. :.:' / `. \,-'
'`. ,-' /`-..-'-.-`-..-'\ `-.
>_ / ; (\/( ' )\/) ; `-. _<
,-' `. \`-^^^-'/ ,' \ _<
`-, ,' `. `"""""' ,' `-. <`'
') `._.,,_.' \ ,-'
'._ '`'`' \ <
> ,' , `-. <`'
`,/ \ ,-`
`, ,' | / /
'; / ; (
_)| ` (
`') .-'
<_ \ /
\ /\(
`;/ `
</pre>
=I love you=
<pre>
__,,,__
,-""-,-" "-,-""-,
/,-' , .-'-.7.-'-. , '-,\
\( / _ _ \ )/
'-, { (0) (0) } ,-'
/ > .---. < \
|/ .-' \___/ '-. \|
{, / ,_ _, \ ,}
\ {, \ / ,} /
',\. '---' ./,'
_.-""""""-._ _.-""""""-._
.' `._.` '.
_/_ _ \
.'` `\ | | \
/ | | | ;
| / |_| |
\ ;'---' _ ___ _ _ ___ ;
'. ; | | / \| || || _| _ ;
`-\ | |_ | | || |/ /| _| .' `,
`\ |___|\___/ \__/ |___| | \
\ _ _ \ |
`\ | | | /` _/
,-""-. .'`\ | | | /`-,-'` .-""-,
/ `\.' `\ \___/ /` './` \
; .--. \ '\ /' / .--. ;
| ( \ |, '\ /' | / ) |
\ ; } ;\ /; ` { ; /
`;\ \ _.-' \ / `-._ / /;`
\ \__.' _.-' Y `-._ '.__//
'.___,.-' `-.,___.'
</pre>
=Lynx=
<pre>
, ,
(\ "\
,--;.)._
).,-._ . ""-,_
/.'".- " 8 o . ";_
`L_ ,-)) o . 8.o .""-.---...,,--------.._ _"";
""" ")) 8 . . 8 . 8 8 8 8 8. 8 8 ._""._;
";. .8 .8 .8 8 8 8 8 . 8. 8 .".""
;.. 8 ; . 8. 8 8 8 . } 8 . 8 :
;.. 8 ; 8. 8 8 8 8 ( . 8 . :
;. 8 \ . .......;;; 8 . 8 :
;o ;"\\\\```````( o( 8 .;
: o: ; :. : . 8 (
:o ; ; "; ";. o :
; o; ; "; ;";..\
;.; .: )./ ;. ;
_).< .; _;./ _;./
;"__/--" ((__7 ((_J
</pre>
=Wizard=
<pre>
o
O /`-.__
/ \ '^|
o T l *
_|-..-|_
O (^ '----' `)
`\-....-/^
O o ) "/ " (
_( (-) )_
O /\ ) ( /\
/ $ ) | \
o o $ ( / \
/ |( )| \
/ o \ \( / \
__.--' O \_ / .._ \
//|)\ , (_) /(((\^)'\
| | O ) ` |
| / o___ / /
/ _.-''^^__O_^^''-._ /
.' / -''^^ ^^''- \--'^
.' .`. `'''----'''^ .`. \
.' / `'--..____..--'^ \ \
/ _.-/ \ \
.::'_/^ | | `.
.-'| | `-.
_.--'` \ / `-.
/ \ / `-._
`'---..__ `. .´_.._ __ \
``'''`. .' `'^ `''---'^
`-..______..-'
</pre>
=Suricat=
<pre>
,'''''-._
; ,. <> `-._
; \' _,--'"
; (
; , ` \
;, , \
; | |
; |, | |\
; | | | \
|.-\ ,\ |\ :
|.- `. `-. | ||
:.- `-. \ ';;
.- , \;;|
; , | ,\
; , ; \
; , /`. , )
__,;, ,' \ ,|
_,--''__,| / \ :
,'_,-'' | ,/ | :
/ / | ; ; |
| | __,-| |--..__,--| |---.--....___
___,-| |----'' / | `._`-. `----
\ \ `""" """ --
`.`. --'
`.`-._ _, ,- __,-
`-.`.
--' `;
</pre>
=Dagger=
<pre>
,-.
("O_)
/ `-/
/-. /
/ )
/ /
_ /-. /
(_)"-._ / )
"-._ "-'""( )/
"-/"-._" `.
/ "-.'._
/\ /-._"-._
_,---...__ / ) _,-"/ "-(_)
___<__(|) _ ""-/ / / /
' `----' ""-. \/ / /
) ] / /
____..-' // / )
,-"" __.,'/ / ___ /,
/ ,--""/ / / /,-"" """-. ,'/
[ ( / / / / ,.---,_ `._ _,-','
\ `-./ / / / / `-._ """ ,-'
`-._ / / / /_,' ""--"
"/ / / /"
/ / / /
/ / / /
/ |,' /
: / /
[ / ,'
| / ,'
|/,-'
P'
</pre>

=Supergirl=
<pre>
,
;\
: "-.
: ""--._
; "-._
: "-.
\ `.
`. `.
""--._ \
""--._ ;
`. :
.----. `. ;
/.-J-. \ ;`. ;
:/ / \ `-; ; ;:
;_/ _."-+: , : / ;
: -= =;\ ;\ ;' /
;"\ ,: `--' ; .' :
: t -= '"-._ ( ___ .' ;
; :"-._/`-. `-"+ .-" `.__.-" ;
.-: \ :-.____..--:-" ;
__.^-:_j `;J:\_ _.' :
_.--"" : / "-,l "-;""" ;
_.--"" :' -' `. ___ ;
_.-".-" .' / : \ """--..__.-' :
/ .' _.-" / : ; . :\ ;
/ .' .-" j : / /\ \ /
/ / .' / t--' `....' / \ \ /
/ : / / : : / `. "-. :
: ; / / ;/ ; `. / : `. `. ;
\ : / : :/: ; ; : \ \ \ .'
;.\/ : j : : : ; "-._ `. `. .-"
: `. .-; /-.; ; ; :`. .' "-.__j+. `._.-"
;`. `. : : : : .--"" t "-( `. \
/ "-.`. \; ; ;`.-" .--"".^. `. `.-"\
:\ `. :__: :`. .-T__.-".-: \ : _ "-._
; `. `. \; `\ : Y-" _.-" \ ; ;: "-._/
: "-. `. \ : ; ; / .'/ ; : :; U
"-._ `. \ ;j:/ : / : : ;
/ ""--..__`-""+:-+.\ ; ; /
,--^-...__ _.-"; `| "--: : .'
; _. _.-" : ; | ;"
:.-".-"_.-" ; ; ; /
J.-".-" .--"-. .-" | : /
.-".-" : "" : | /
: / : ; ; /
;: _..-' | : /
: ; \ : | /
; ; \ ; ; :
: ; ; : : `.
; : ; ; \ , `.
: \ / : \;"-.__\
: `.: /; ; \ ;
\ "-. /: : \ ;
`. `. ; ; :/`. \ :
"-. `. :: ; `-:\ :
"-._ `. .-"; | : \ ;
"-._ `..-" : : : \ :__
"-. `. .' ; | ; ) ;
"-.J.' | | : :
: ; ; :
; ; : \
| :_ ; ;
: .' \ | /
; / :_.'
; :
: ;
; :
| ;
:_/
</pre>
=Eagle=
<pre>
/T /I
/ |/ | .-~/
T\ Y I |/ / _
/T | \I | I Y.-~/
I l /I T\ | | l | T /
T\ | \ Y l /T | \I l \ ` l Y
__ | \l \l \I l __l l \ ` _. |
\ ~-l `\ `\ \ \\ ~\ \ `. .-~ |
\ ~-. "-. ` \ ^._ ^. "-. / \ |
.--~-._ ~- ` _ ~-_.-"-." ._ /._ ." ./
>--. ~-. ._ ~>-" "\\ 7 7 ]
^.___~"--._ ~-{ .-~ . `\ Y . / |
<__ ~"-. ~ /_/ \ \I Y : |
^-.__ ~(_/ \ >._: | l______
^--.,___.-~" /_/ ! `-.~"--l_ / ~"-.
(_/ . ~( /' "~"--,Y -=b-. _)
(_/ . \ : / l c"~o \
\ / `. . .^ \_.-~"~--. )
(_/ . ` / / ! )/
/ / _. '. .': / '
~(_/ . / _ ` .-<_
/_/ . ' .-~" `. / \ \ ,z=.
~( / ' : | K "-.~-.______//
"-,. l I/ \_ __{--->._(==.
//( \ < ~"~" //
/' /\ \ \ ,v=. ((
.^. / /\ " }__ //===- `
/ / ' ' "-.,__ {---(==-
.^ ' : T ~" ll
/ . . . : | :! \\
(_/ / | | j-" ~^
~-<_(_.^-~"
</pre>
=Dog=
<pre>
,--._______,-.
,',' , . ,_`-.
/ / ,' , _` ``. | ) `-..
(,';'""`/ '"`-._ ` \/ ______ \\
: ,o.-`- ,o. )\` -' `---.))
: , d8b ^-. '| `. ` `.
|/ __:_ `. | , ` ` \
| ( ,-.`-. ;' ; ` : ;
| | , `. / ; : \
;-'`:::._,`.__),' : ;
/ , `- `-- ; |
/ \ ` , |
( ` : : ,\ |
\ `. : : : ,' \ :
\ `|-- ` \ ,' ,-' :-.-';
: |`--.______; | : :
: / | | | \
| ; ; ; / ;
_/--' | :`-- / \_:_:_|
,',',' | |___ \
`^._,--' / , , .)
`-._,-'
</pre>
=kitten=
<pre>
. ,.
T."-._..---.._,-"/|
l|"-. _.v._ (" |
[l /.'_ \; _~"-.`-t
Y " _(o} _{o)._ ^.|
j T ,-<v>-. T ]
\ l ( /-^-\ ) ! !
\. \. "~" ./ /c-..,__
^r- .._ .- .-" `- . ~"--.
> \. \
] ^. \
3 . "> . Y
,.__.--._ _j \ ~ . ; |
( ~"-._~"^._\ ^. ^._ I . l
"-._ ___ ~"-,_7 .Z-._ 7" Y ; \ _
/" "~-(r r _/_--._~-/ / /,.--^-._ / Y
"-._ '"~~~>-._~]>--^---./____,.^~ ^.^ !
~--._ ' Y---. \./
~~--._ l_ ) \
~-._~~~---._,____..--- \
~----"~ \
\
</pre>

Ascii

2026-03-24T13:55:25Z

Ekaanbj: /* Superman */

Stolen with pride from https://www.ascii-art.de/ascii/
=Ferdinad=
<pre>
|\ _____
|\ J \ _.--' `-.__
\`. \ \--.-'" `-.-.__
\ `-. .' \ `.__.`. \ `-.
`. J | `. ) ` `.
`-. /\ | )-.__.<_ __ \
\\/ \|>- ' `.'.') \
`\ / \ -._.-' / \
|| | /\ `-.__.' \
|| | | | \
'' |-'-'/ \
. .-.' _.\'' `.
|| ( /.-.|`-._ / . L
\\ \ (_.' /|| /_.'-' L
\ .'//__.-' >_`. J
`.__.'-' | `-`-. J
/_/\ \ \ _ L
||| /- |`- \ . .' `- J
| || F/ ) \ | / | J \ L
\ L.'// / \ J L| F J \-. |
_ \/ // .-'| \ \ \| / J | J
_ .-()-| / ____.-<_(/` .'`-. \ | J.-' F F \ F__.--"""-.
`. / `._ _ _) V/// . (_.( /.--.\`- \ / F F `. _.---. J
`.\ / ' \|\||\\///.' ( \ /' `--._ | | \ J L \" _.'.'
`.\\_F .''./\ -./)/.'/ _ `.__`-.--' `.-| / \ Y | .-' `)
`.(/`.(\||/)\\-'/ .')/) "" `) / `-..-""`. `. || / \
.-'| /\\$)'_|/-'/'()-'-> F J-._J_ `.. \_.' \ | )
.'``\\\//\\/).'/\\/)\\" _.' | .' \_.-. J____.) `. (
/ ___-(`.|//-(\|_/-`-' .' ' | (__./ )-' `--.\
__\|/`-()-<(/()-< .-' `. ___| (__.-'
`-()(.'|_)-<\_)-' <___.-| F
|/$ \_ \ | .-'
`\ "
</pre>
=Haircut=
<pre>
|
|/ |
,,,,, ,+ /|
/ \ () | ||
\ C '\ /|_() ||
) _| .'___/,,,// ||
.'=. (____E.' / / \ ||
| \)`-\ _F_.' \ c `\ ||
\ \ !'__/ ) _| ||
\ \,' / /`._( ||
|`. .' / \ \ ||
\ `-' | .-. | | \ E ||
>====[] | \ |__| | O OE ||
/ |_/ | |___)| `.__j____ \|E ||
\_ | || __`.________ `. |""|\|
\ |\ ||| \///_ _|__|_|
\ __ | \ ||`""\\""""//"' \`. \ |
|[__]| \ ||.---\\__//---. | | \____|
||__|/ / \|____________|\ |/ |
| | / || || /| | |
-----| |/------------||-||-/`| |----------|
/| | || ||/`-|___| |
/\| | || \\._ [____] h|
/`.|____| || \\ `-/ '`._ j|
`=.\____/ || \\__`-.____) w|
) '`--. _.-||-._ `""""""" |
`='====' ,-' ' ` `-. |
`-.________.-' |
</pre>
=Batman=
<pre>
. .
|\_|\
| a_a\
| | "]
____| '-\___
/.----.___.-'\
// _ \
// .-. (~v~) /|
|'| /\: .-- / \
// |-/ \_/____/\/~|
|/ \ | []_|_|_] \ |
| \ | \ |___ _\ ]_}
| | '-' / '.' |
| | / /|: |
| | | / |: /\
| | / / | / \
| | | / / | \
\ | |/\/ |/|/\ \
\|\ |\| | | / /\/\__\
\ \| | / | |__
/ | |____)
|_/
</pre>
=Skull=
<pre>
_,.---,---.,_
,;~' '~;,
,; ;,
; ;
,' '
,; ;,
; ; . . ; :
| ; ______ ______ ; |
| '/~" ~" . "~ "~\' |
| ~ ,-~~~^~, | ,~^~~~-, ~ |
| | }:{ | |
| l / | \ ! |
.~ (__,.--" .^. "--.,__) ~.
| ----;' / | \ `;---- |
\__. \/^\/ .__/
V| \ / |V
| |T~\___!___!___/~T| |
| |`IIII_I_I_I_IIII'| |
| \,III I I I III,/ |
\ `~~~~~~~~~~' /
\ . . /
\. ^ ./
^~~~^~~~^
</pre>
=Castle=
<pre>
._-_.
|_-_(
I
/_\ ___
._-_. |,|/ \
|_-_( | /_____\ ._-_.
I \| u -| _ |_-_(
/ \ -_-_-_-_--|/ \ I
/___\ \._._._./-|___\ / \
|_u | |_ _| -| u_| /___\
|_-_-_-_-_- U_| -| _| | u_|
|_\._._._./ _|-_-_-_-_-_-_|
\_|- -| _| .. -|_|
\|- U| _| U ++ U-|/
|U -| U _| ____ -|
|- _ -| _| /|-|-\ -|
|-/#\-| _| |-|-|| -|
,___|_MEB_|-----'__I|-|-I__|__,
._/ / \____/ \,
/ \ \ \```\ \,
(__ _\ |'''| L_,
/ ./ / \```\ / _\
| / / |'''| \, |
/ ( \```\ / _/ \
/_ |'''| _,|
| \
</pre>
=kentaur=
<pre>
(_______
-.__\ __\
_) / \
\_ _ ( "("
_>_ \_-/
)/ ,-' (-.
)/ _ - - )
/,'| _)_)|
(_____ // | /||
.___\ \----._//___/ '( \\
_> / __// ',,,\ )\
_) /| /,-/ )'\|
\ ( | , |
/_,$ \ \-.__\ (_, /
( ' \ | | ) |\ /
_) _/ _/ /, )/ )
_) <\ ( ) |) |
) $_\_ / / \(
/_,\ \_\ )| /_\
)_\ /_,) )_\
|_\
</pre>
=bull=
<pre>
/| /|
| \ __ _ _ / ;
___ \ \ _.-"-" `~"\ `"--' /
_.-' ""-._\ "" ._," ; "\"--._./
_.-' \./ "-""", ) ~" |
/ ,- .' , ' `o. ; )
\ ;/ ' ; /
|/ ' | \ ' |
/ | J."\ , |
" : \ .' : | ,. _)
| | / f | |`--"--'
\_ \ \ / _/ |
\ "-._ _.| ( j/; -'/
\ | "/ ( | /, |
| \ | /\ |\_/// /
\ / \ | \ \ / /
|| \ \| | | |
|| \ \ | | /
|\ |_|/ ||
L \ || ||
`"' |\ |\
( \. \ `.
|_ _\|_ _\
" "
</pre>
=Deer=
<pre>
/| |\
`__\\ //__'
|| ||
\__`\ |'__/
`_\\ //_'
_.,:---;,._
\_: :_/
|@. .@|
| |
,\.-./ \
;;`-' `---__________-----.-.
;;; \_\
';;; |
; | ;
\ \ \ | /
\_, \ / \ |\
|';| |,,,,,,,,/ \ \ \_
| | | \ / |
\ \ | | / \ |
| || | | | | |
| || | | | | |
| || | | | | |
|_||_| |_| |_|
/_//_/ /_/ /_/
</pre>
=dinosaur=
<pre>
. .
/ `. .' \
.---. < > < > .---.
| \ \ - ~ ~ - / / |
~-..-~ ~-..-~
\~~~\.' `./~~~/
\__/ \__/
/ .- . \
_._ _.- .-~ ~-. / } \/~~~/
_.-'q }~ / } { ; \__/
{'__, / ( / { / `. ,~~| . .
`''''='~~-.__( /_ | /- _ `..-' \\ //
/ \ =/ ~~--~~{ ./| ~-. `-..__\\_//_.-'
{ \ +\ \ =\ ( ~ - . _ _ _..---~
| | { } \ \_\
'---.o___,' .o___,'
</pre>
=Dinosaur=
<pre>
__.--'~~~~~`--.
.. __. .-~ ~-.
((\ / `}.~ `.
\\\ .{ } / \ \
(\ \\~~ } | } \
\`.-~ -@~ } ,-,. | ) \
(___ ) _} ( : | / / `._
`----._-~. _\ \ |_ \ / /-.__ `._
~~----~~ \ \| ~~--~~~( + / ~-._ ~-._
/ / \ \ ~--.,___~_-_.
__/ / _\ )
.<___.' .<___/
</pre>
=Dog=
<pre>
_
,:'/ _..._
// ( `""-.._.'
\| / 6\___
| 6 4
| /
\_ .--'
(_'---'`)
/ `'---`()
,' |
, .'` |
)\ _.-' ;
/ | .'` _ /
/` / .' '. , |
/ / / \ ; | |
| \ | | .| | |
\ `"| /.-' | | |
'-..-\ _.;.._ | |.;-.
\ <`.._ )) | .;-. ))
(__. ` ))-' \_ ))'
`'--"` `"""`
</pre>
=Boss=
<pre>
.-.
/ 7, `\,')/,
( \\ =/= )))
) \\ < . D/
( \\ `e_ /
\ \\_ __\ \___
) / 7// ~ `\
/ |( / ) ) , \
( ' `\(_ (_' \ \
\ \__/ \ (\ )
) )) \\ |
/( ( )\|
( \_ / '( \
| ( |'\/\
| | |
| | /
( ` /( ,(
| ( ) \
| ) \ |
| / \ |
| / \ |
/( )\
/ / \ \
/_/ \_\
</pre>
=Dragonfly=
<pre>
.-.
()I()
"==.__:-:__.=="
"==.__/~|~\__.=="
"==._( Y )_.=="
.-'~~""~=--...,__\/|\/__,...--=~""~~'-.
( ..=\=/=.. )
`'-. ,.-"`;/=\ ;"-.,_ .-'`
`~"-=-~` .-~` |=| `~-. `~-=-"~`
.-~` /|=|\ `~-.
.~` / |=| \ `~.
.-~` .' |=| `. `~-.
(` _,.-="` |=| `"=-.,_ `)
`~"~"` |=| `"~"~`
|=|
|=|
|=|
/=\
\=/
^
</pre>
=Tuttancanon=
<pre>
___..--------..___
_.-':: '::::::' ::'-._
_.-':: :: '::' :: ::'-._
_.-':: :: :: :: :: :: ::'-._
.-':: :: :: :: :: :: :: :: ::'-.
/:::\:: :: :: :: :: :: :: :: ::/:::\
/ \:: :: :: :: :: :: :: :: ::/ \
/:::::::\:: :: :: :: :: :: :: :: ::/:::::::\
| \:: :: :: :: :: :: :: :: ::/ |
/::::::::::\:: :: :: ::/::::::::::\
/ \:: ::/ \
|:::::::::::.-\ .''''''''''''''''''''. /-.:::::::::::|
/ // \\.' .-==-. .-==-. '.// \\ \
|:::::::::::||.-| .' '. .' '. |-.||:::::::::::|
/ |||'| _.'''. \ / .'''._ |'||| \
|::::::::::::|||_|.-' :(*):'.| |.':(*): '-.|_|||::::::::::::|
/ |\_.|`''''''''' | | '''''''''`|._/| \
|:::::::::::::\(O)| | | |(O)/:::::::::::::|
| `-'| .' '. |`-' |
/:::::::::::::::::\ ( __ ) /:::::::::::::::::\
/ \ .' '. / \
|::::::::::::::::::::\ _.--..--._ /::::::::::::::::::::|
| ' '.---..---.' ' |
|::::::::::::::::::::::'. '-....-' .'::::::::::::::::::::::|
| '. .' |
'-:::::::::::::::::::::::' '.________.' ':::::::::::::::::::::::-'
/'-. | '--------' | .-'\
/ '::::::::::::::::::| |-._\\_.-| |::::::::::::::::::' \
| \ | |-._//_.-| | / |
|_..--|:::::::::::::::::| |-._\\_.-| |:::::::::::::::::|--.._|
|>.<>.<\ |._|-._//_.-|_.| />.<>.<|
|>.<>.<|::::::::::::::::|-.|-._\\_.-|.-|::::::::::::::::|>.<>.<|
|>.<>.<| |<>|-._//_.-|<>| |>.<>.<|
|>.<>.<|::::::::::::::::|<>|-._\\_.-|<>|::::::::::::::::|>.<>.<|
|>.<>.<| |<>|-._//_.-|<>| |>.<>.<|
|>.<>.<|::::::::::::::::|<>|-._\\_.-|<>|::::::::::::::::|>.<>.<|
|>.<>.<| |<>'-._//_.-'<>| |>.<>.<|
|>.<>.<|::::::::::::::::|<>.<>.<>.<>.<>|::::::::::::::::|>.<>.<|
|>.<>.<\ |<>.<>.<>.<>.<>| />.<>.<|
|>.<>.<>':::::::::::::::|<>.<>.<>.<>.<>|:::::::::::::::'<>.<>.<|
|>.<>.<>.<'. |<>.<>.<>.<>.<>| .'>.<>.<>.<|
|>.<>.<>.<>.<'::::::::::'<>.<>.<>.<>.<>'::::::::::'>.<>.<>.<>.<|
\>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<></
\>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.</
\>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>/
\>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>./
'.>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.'
'.>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<.'
'.>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<.'
'.>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<.'
''==============================''
</pre>
=Elephant=
<pre>
_,--._ _,.--'''''''---..._
,' _`''-'' `-._
/ / `. `.
/ ,_. | \ \
/ `-' | _,-'' \
| \,-' / \ `. \
| ,') ; / / |/\ \
_,.-'_,'\,-:_;;.| \\ | / | \ :
`'-'' \ \ | | \ / |/ |;
\ \ | / | / | ;;
`. \ \ |__ \ |/ ::
\ : | / `''----''`. / | \\
| ; ,\ | \ | | ;;
/ / \| | | | |
/,' || | | | |
;| | | | |
',_;-,__\ ,';-,__\.\
</pre>
=Escavator=
<pre>
.-.
/ \
_____.....-----|(o) |
_..--' _..--| .''
.' o _..--'' | | |
/ _/_..--'' | | |
________/ / / | | |
| _ ____\ / / | | |
_.-----._________|| || \\ / | | |
|=================||=||_____\\ |__|-'
| ||_||_____// (o\ |
|_________________|_________/ |-\|
`-------------._______.----' / `.
.,.,.,.,.,.,.,.,.,.,.,.,., / \
((O) o o o o ======= o o(O)) ._.' /
`-.,.,.,.,.,.,.,.,.,.,.,-' `.......'
</pre>
=Bobcat=
<pre>
______________
/.----------..-'
-. || \\
.----'-||-. \\
|o _ || | \\
| [_] || |_...-----.._\\
| [_] ||.' `-._ _
| [_] '.O)_...-----....._ `.\
/ [_]o .' _ _'''''''''_ _ `. `. __
|______/.' _ `.---.' _ `.\ `._./ \
|'''''/, .' _ '. . , .' _ '. .`. .o'| \
`---..|; : (_) : ;-; : (_) : ;-'`--.| \
' '. _ .' ' ' '. _ .' ' / \
`._ _ _,' `._ _ _,' `._____\
</pre>
=Angel=
<pre>
,_ .--.
, , _)\/ ;--.
. ' . \_\-' | .' \
-= * =- (.-, / / |
' .\' ). ))/ .' _/\ /
\_ \_ /( / \ /(
/_\ .--' `-. // \
||\/ , '._// |
||/ /`(_ (_,;`-._/ /
\_.' ) /`\ .'
.' . | ;. /`
/ |\( `.(
| |/ | ` `
| | /
| |.'
__/' /
_ .' _.-`
_.` `.-;`/
/_.-'` / /
| /
( /
/_/
</pre>
=Flamino=
<pre>
___
,' `.
/_. _,. \
( /(' \ :
\\| / ;
`' / /
/ /
: :
| : _______
: \ ,' `-._
' / . . . \
: `' ; ; ; ; , :
\`./ / / / ; ;;
`. `'../__/ / ,.\
`'-.____;-'`\\\
\ // / '|
::\
||\\
|| \\
|| ))
|| //
||//
||/
||
/||
`||-
__,';
</pre>
=Mr Gadget=
<pre>
_..__
.' I '.
|.-"""-.|
_;.-"""-.;_
_.-' _..-.-.._ '-._
';--.-(_o_I_o_)-.--;'
`. | | | | | | .`
`-\| | | |/-'
| | | |
| \_/ |
_.'; ._._. ;'._
_.-'`; | \ - / | ;'-.
.' : / | | | | \ '.
/ : /__ \ \___/ / __\ : `.
/ | / '._/_\_.' \ : `\
/ . `---;"""""'-----` . \
/ | |() () | \
/ /| | |\ \
/ / | |() () | \ \
| <jgs\_,,___|_.....____,,__/ `> |
\ \ | ][ | | ][ | / /
\ \ ;=""====='"""'====""==; / /
|/`\ \/ |() () \/ /`\|
|_/.-'; | |`-.\_|
/ | ; : \
|__.| | |.__|
; | |
| : ;
| : |
; | |
; | ;
| : |
| | ;
| | ;
'-._ ; _.-'
`;"--.....--";`
| | | |
| | | |
| | | |
T----T T----T
_..._L____J L____J _..._
.` "-. `% | | %` .-" `.
/ \ .: :. / \
'-..___|_..=:` `-:=.._|___..-'
</pre>
=Lizard=
<pre>

)/_
_.--..---"-,--c_
\L..' ._O__)_
,-. _.+ _ \..--( /
`\.-''__.-' \ ( \_
`''' `\__ /\
')
</pre>
=World=
<pre>
_.-,=_"""--,_
.-" =/7" _ .T "=.
,/7 " " ,//)`d `.
,/ " 4 ,i-/ `.
/ _)"_sm =,=T"D \
/ (_/"_`;\/gjo D-O \
/ ,d"""O-_.._.) P.___ \
, ," \\ bi- `\| Y.
| .d b\ P' V |
|\ 'O O!", |
|L. \__.=_ 7 |
' D. ) / '
\ T \ | /
\D / 7 / /
\ \ ," /" /
`. \ 7' ,'
"-_ `"' ,-'
"-._ _.-"
""""---""""
</pre>
=Gnu=
<pre>
_,-----.
_,------.__,-' `. . .
.-' `//__ \\
| ((___`-_____ ))
| \_____) \`=:'
| `=| |=,'
/ | O (|
/ /\ | |
/ / \ . \ |
| / /| / `--. ___ __,,-. |
| / // / `-' \ ,_ /'' | o o|
/ | | | | \ \ `. | ``--'
mmm | | | \ \ | |
| |\ | | || |
| | || / / `. )
\ \ \\ / / | |
|_| || / / | |
|_\ \_| | \
\__\
</pre>
=Duck=
<pre>
___
,-"" `.
,' _ e )`-._
/ ,' `-._<.===-'
/ /
/ ;
_ / ;
(`._ _.-"" ""--..__,' |
<_ `-"" \
<`- :
(__ <__. ;
`-. '-.__. _.' /
\ `-.__,-' _,'
`._ , /__,-'
""._\__,'< <____
| | `----.`.
| | \ `.
; |___ \-``
\ --<
`.`.<
`-'
</pre>
=Dog=
<pre>
()._
_.--. (##)_`-.
/ . ``u (##), ` `.
\__) _/ (##),--. \
| --' ()' \ \
/ | | |
,' \ _,' /
,' | ,;--//
/ ___\ |/ ___V__{(_
| ' \| || ,'-===- `,'|
__| ,' /| || |""""""""|-L|
,`__. < _)))_))) |________|,'
(,'
</pre>
=Giljotine=
<pre>
.___________________.
|`._______________,'|
| | | |
| |_______________| |
| || || |
| ||_ _ || |
| || ""--._._ || |
| || `-. || |
| || `. || |
| || \|| |
| || || |
| || || |
| || || |
| || || |
| || || |
| || || |
| || || |
| || || |
| || || |
| || || |
| || || |
| || || |
| || || |
| || || |
| || || |
| || || |
| || || |
| || || |
| || || |
| || || |
| ||_____________|| |
| |/ ,--. \| |
| |-(_)-( )-(_)| |
| | `--' | |
|===================|
| |
</pre>
=Gun=
<pre>
+-'~`---------------------------------/\--
||"""""""""""""""""""""""""""""""" \\\\\\ \/~)
|| \\\\\\ \/_
|~~~~~~~~-________________-_________________\ ~--_
!---------|_________ ------~~~~~(-- )--~~
\ /~~~~\~~\ )--- \_ /(
|| | | \ () \\
\\____/_ / ()\ \\
`~~~~~~~~~-. \ \\
\ \ <($)> \\
\ \ \\
\ \ \\
\ \ \\
\ \ () \|
_\_\__====~~~
</pre>
=Deer=
<pre>
( )
)) ((
// \\
| \\____// |
\~/ ~ ~\/~~/
(| _/o ~~
/ / ,|
(~~~)__.-\ |
``~~ | |
| | |
| |
/ \
`\ /'
`\_ _/'
~~~~
</pre>
=Hedgehog=
<pre>
\ / \/ \/ / ,
\ / \/ \/ \/ / ,
\ \ \/ \/ \/ \ \/ \/ /
.\ \/ \/ \/ \/ \/ / / /
' / / \/ \/ \/ \/ \/ \ \/ \
.' ) \/ \/ \/ \/ \/ \/ \ / \
/ o ) \/ \/ \/ \/ \/ \/ \// /
o'_ ',__ .' ,.,.,.,.,.,.,.,'- '%
// \\ // \\
'' '' '' ''
</pre>
=Helikopter=
<pre>
.- . _
.: ` " - . _
\ :: ` ""--..__ . . . : : :
`\ :: :' ` _ _ ""--..__ ......_._._:.:.: " " " " " "
`\.:: :' " " " - ----.....___ ""-##.____...:::""""""""""""
: : :' "::":"-----......______
." ""--..__ . .:'.: """"""-----. . . _ _ _
/.""--.._ ""--..__ : .:'. : " " "
/' .: ":-.._ ""--..__ .:'. :
`-._:__.-" ""-.._ ""--...___..:'. :
.: /.""-..__...---""-.'"-:"--.:_
" : POLICE .' ::""-."";.
:_ : :: ":: `-.
:::::.._ '-._ :: :: `.
: """:::::.._ "''-._ :: :
: "":::::.._ "': :
`. """:::::-:_ :
:. """::::::... :
..__..--"" ". . """::::::
""--..__ :.--"" ":
""-+:=:_ ("-:
: ""--.._ []'
: :""--..___..--"
: :
""--..__ :
""--.:_
""--..__.-grp
</pre>
=Halv Liter=
<pre>
| | ------------\ ,---. /------------ | |
| | ---------. `-./ "\.-' .--------- | |
| ,--. | --------\ . /-------- | ,--. |
| ( >< ) | ------`-.| .-'------ | ( >< ) |
| `--' | ---/ `/"\ \--- | `--' |
| . | `//_-_\\' 8 | |
| : . ! | (.' ',) | . : . :|
| ! ! .| | | : | ! .|
| |_| ;|_| . |_| !_| !|
`-' `-^' \o `-' `-^'
\__________________T>_________________/
`-=--=--=--=--=--=---=--=--=--=--=--=-'
] _] _] _] _] _] _L] _] _] _] _] _] _
`-------------------------------------'
`u---u---u---u---u---u---u---u---u---u'
</pre>
=Hockey=
<pre>
.---.
/_____\
_HH.H.HH
_ _-"" WHHHHHW""--__
\\ _-" __\VW=WV/__ /"".
\\ _-" \__--" "-_-" """ "_
\\/ _ ""
\\----_/_| ___ /"\ T""\====-
\\ /"-._ |%|H| ( "\|) | / .:)
\/ / |-+-| \ |_ J .:::-'
/ / |H|%| _-' '-._ " )/;"
/ / \ __ ( \ \ \ "
/ /\/ '. / \ \ \ \ _- \
"'-._/ \/ \ "-_ \ -"" _- \
_,'\\ \ \/ ) "-, -"" \
_,'_- _ \\ \ \,' \ \_\_\ \
,' _- \_\ \ \ \_\_\ \
\_ _- _- _,' \ \ \ """" )
C\_ _- _,' \ "--------. L_""""_/
" \/-' "-_________| '"-Y
</pre>
=Hockey=
<pre>
.-.-.
/_____\
:._|_|_.:
|/a> a>\|
_.-: ( ;._
,'::::\ _ /:::`-._
/:::::::`._,'|:::::::`._
/:::::_.--`._,'-.::::::::`.
:`:::;' \ ) ( `':_:;-' \
|: `' : \ \ . ,-.\
|' --._;. `:\,' .._\
|:. -.\: `;:;'.' :
:,----..(:._ ._,---.';'. `.__.'
/\,---.|:':..-(\,-, `.`..-'
/ :.--.'|:' ;',:.__.-''
: | |' ,',' /:/ /
: |,'|.-| ,',' /:/ /
/:\ : ,'_,:',' /:/ /
/ `:._\,'.`.`, -.';','
:`-._`:/ >._>.' .;\'
|`-._`:,',/_ ,'
|::::;',' ; `-'':
/\:,',| :`-..-.;
_,`,',' ; ;:::::/
,'`,','.;':_;`-::'/
<`,',;::;:-' /
,',' ( ```` ,'.::::.
,'.' /`_.__.-'::::'
_,',' `:::::::'
_______..-`.,'
,' ,----. ,'
'---`----'-''
</pre>
=Jeep=
<pre>
_.------------------.
.'____________________|
// _|||| | | | | |
______//_\__j_|||"--" "--" | | _
/-----+-|p ==,|||__________|_|-|W|
_j,====. |b_____||| _____ | |W|
|_) ,---.`.`------'|.',---.`.___|_|W|
`/ .-. \\`======__// .-. \`-----'""
\ `-' / """"""" \ `-' /
`---' `---'
</pre>
=Fool=
<pre>
,;;;;;;,
,;;;'""`;;\
,;;;/ .'`',;\
,;;;;/ | \|_
/;;;;; \ / .\
,;;;;;;| '. \/_/
/;;;;;;;| \
_,.---._ /;;;;;;;;| ; _.---.,_
.;;/ `.;;;;;;;;;| ;' \;;,
.;;;/ `;;;;;;;;;.._ .' \;;;.
/;;;;| _;-"` `"-;_ |;;;;\
|;;;;;|.---. .' __.-"```"-.__ '. .---.|;;;;;|
|;;;;;| `\/ .'/__\ /__\'. \/` |;;;;;|
|;;;;;| |_/ // \\ // \\ \_| |;;;;;|
|;;;;;| |/ |/ || || \| \| |;;;;;|
\;;;;| __ || _ .-.\| |/.-. _ || __ |;;;;/
\jgs| / _\|/ = /_o_\ /_o_\ = \|/_ \ |;;;/
\;;/ |`.- ` ` ` ` -.`| \;;/
_|;' \ | _ _ _ _ | / ';|_
/ .\ \\_ ( '--'( )'--' ) _// /. \
\/_/ \_/| /_ | | _\ |\_/ \_\/
| /|\\ \ / //|\ |
| | \'._'-'_.'/ | |
| ; '-.```.-' ; |
| \ ``` / |
__ ; '.-"""""-.' ; __
/\ \_ __..--\ `-----' /--..__ _/ /\
\_'/\`''---''`..;;;;.'.__, ,__.',;;;;..`''---''`/\'_/
'-.__'';;;;;;;;;;;,,'._ _.',,;;;;;;;;;;;''__.-'
``''--; ;;;;;;;;..`"`..;;;;;;;; ;--''`` _
.-. /,;;;;;;;';;;;;;;;;';;;;;;;,\ _.-' `\
.' /_ /,;;;;;;'/| ;;;;;;; |\';;;;;;,\ `\ '-'|
/ ) /,;;;;;',' | ;;;;;;; | ',';;;;;,\ \ .'-./
`'-..-' /,;;;;',' | ;;;;;;; | ',';;;;,\ `"`
| ;;;',' | ;;;;;;; | , ', ;;;'|
_\__.-' .-. ; ;;;;;;; ; |'-. '-.__/_
/ .\ ( ) \';;;;;'/ | | /. \
\/_/ (` `) \';;;'/ '-._| \_\/
'-/ \-' '._.' `
""" /.`\
\|_/
</pre>
=Mogly=
<pre>
.-c.
_ .., _ ( ")\
['" 6'-'</ '-/ |
; ( -=; / |
| \-` _./ |
) `'--' (
/ .. .-"`
,-"' .' '. /
__ / _.- : Y
.',-7 ) .-' ) .' ;
[ )'} < / | : |
_".(. ( \, | : \
.'-. .\.,='-' / : |
=; | |-' / : |
_/--\ | : |
/_7-'<\ \ : .(
,L / |/ \ '. .' \
'/ / \ :-; /
\> __\ / \ /_
`----' '-._\
</pre>
=King=
<pre>
.
/ \
_\ /_
. . (,'v`.) . .
\) ( ) ,' `. ( ) (/
\`. / `-' `-' \ ,'/
: ' _______ ' :
| _,-' ,-. `-._ |
|,' ( )__`-'__( ) `.|
(|,-,'-._ _.-`.-.|)
/ /<( o)> <( o)>\ \
: : | | : :
| | ; : | |
| | (.-.) | |
| | ,' ___ `. | |
; |)/ ,'---'. \(| :
_,-/ |/\( )/\| \-._
_..--'.-( | `-'''-' | )-.`--.._
`. ;`._________,': ,'
,' `/ \'`.
`------.------'
'
</pre>
=Crest=
<pre>
o .,<>., o
|\/\/\/\/|
'========'
(_ SSSSSSs
)a'`SSSSSs
/_ SSSSSS
.=## SSSSS
.#### SSSSs
###::::SSSSS
.;:::""""SSS
.:;:' . . \\
.::/ ' .'|
.::( . |
:::) \
/\( /
/) ( |
.' \ . ./ /
_-' |\ . |
_..--.. . /"---\ | ` | . |
-=====================,' _ \=(*#(7.#####() | `/_.. , (
_.-''``';'-''-) ,. \ ' '+/// | .'/ \ ``-.) \
,' _.- (( `-' `._\ `` \_/_.' ) /`-._ ) |
,'\ ,' _.'.`:-. \.-' / <_L )" |
_/ `._,' ,')`; `-'`' | L / /
/ `. ,' ,|_/ / \ ( <_-' \
\ / `./ ' / /,' \ /|` `. |
)\ /`._ ,'`._.-\ |) \'
/ `.' )-'.-,' )__) |\ `|
: /`. `.._(--.`':`':/ \ ) \ \
|::::\ ,'/::;-)) / ( )`. |
||::::: . .::': :`-( |/ . |
||::::| . :| |==[]=: . - \
|||:::| : || : | | /\ ` |
___ ___ '|;:::| | |' \=[]=| / \ \
| /_ ||``|||::::: | ; | | | \_.'\_ `-.
: \_``[]--[]|::::'\_;' )-'..`._ .-'\``:: ` . \
\___.>`''-.||:.__,' |_______`> <_____:::. . . \ _/
`+a:f:......jrei'''
</pre>
=Kiwi=
<pre>
.```. _.''..
; ``` ``'.
: d `.
/ >,: \
/.' `'., :
/' ;. . ;
/ ; \ ; ; /
`..;\: :'
__|| `...,'
`-, ) ||
/.^/ ___||
'---,_\
(/ `\
</pre>
=Knight=
<pre>
.oo.
.\. ..
,'..''\ ...oooo''
| \_/' ...oooo'''
/''.'\ . ...oooo'''
| | '| ...o!oo'''
| | |. ...oooo''./ '\
| '\, ''''\ ./ ./\ '\.
/\ooo''|''''-/ -../ / \'' '\.
/ '\. '|.''\--/-+-+-+-+-+-+-+-+.'
....- \. \. '\-'/',, /'---/' '''
././ ''\.-.-.\ '\| '',,\--;
/-/| |-'\. '> '\\
!--!| /---/' ./' |
!--!! ./---/' ,/| |
./'-/'| |----\ \-| |
./'--/ |..........|''''''./'|...........|
-'-'-' '/---/\---|' '/-\--\''''
/--/' |--\ ./---\--\
|--| \--\. ./--/' \--\
|--| |--| ./--/' \--\.
'\-| '\-| /--/' \--|
|..\ |..\ |..\ |..\
</pre>
=knight=
<pre>
.I.
/ : \
|===|
>._.<
.=-< >-=.
/.'`(`-+-')'`.\
_/`.__/ : \__.'\_
( `._/\`. : .'/\_.' )
>-(_) \ `:' / (_)-<
| | / \___/ \ | |
)^( | .' : `. | )^(
| _\|`-._:_.-'| \ |
"-<\)| : | : | "-"
(\\| : / \ : |
\\-:-| |-:-')
\\:_/ \_:_/
|\\_| |_:_|
(;\\/ \__;)
|: \\ | :|
\: /\\ \ :/
|==| \\|==|
/v-'( \\`-v\
// .-' \\. \\
`-' \\`-'
\|
</pre>
=sheep=
<pre>
,-''''-.
(. ,. L ___...__
/7} ,-` `'-==''`` ''._
//{ '`.
\_,X , : )
7 ;`
: , /
\_, \ ;
Y L_ __..--':`. L
| /| ```` ; y J
[ j J / / L ;
| |Y \ /_J | |
L_J/_) /_) L_J
/_) /_)
</pre>
=laptop=
<pre>
.-----------------------===------------------------.
:o ______________________________________________ o:
; : : ;
`. `. .' .'
: : : :
`. `. .' .'
: : : :
`. `. .' .'
: : : :
`. `. .' .'
: : : :
`. `. .' .'
: :__________________________________: :
`. .'
'-------------| |-----| |--------------'
.""""""""""""""| |"""""| |"""""""""""""".
| () '-----------' o () |
| ___________________________________ |
| :__|__|__|__|__|__|__|__|__|__|__|__: |
| |___|__|__|__|__|__|__|__|__|__|__|_| |
| |__|_|__|__|__|__|__|__|__|__|__|___| |
| |___|__|__|__|__|__|__|__|__|__|____| |
| |____|__|__|__|__|__|__|___|__|__|__| |
| :___|__|___________________|__|__|__: |
| |
| .-------------. |
| | | |
| | | |
| |_____________| |
| | | |
| | | |
| '.___________.' |
| ___ |
'-----------------------------------------'
</pre>
=grass cutter=
<pre>
---. .---
'. .'
'.'
/
/
/
/
/
/
/
/
.'.
.' \
.' |
.' \
..--/_________|.--.
// '----------'// \\
||'=:='=:='=:='||()||
\\_'--''--''--'\\__//
`--' `--`
</pre>
=lamp=
<pre>
. | ,
\ _---_ /
-_ .' `. _-
__ : .---. : __
: \ / :
-" `. | | .' "-
/ |`-'| \
' ]"-_[ `
]"-_[
"*"
</pre>
=Lion=
<pre>
,.
,_> `. ,';
,-`' `' '`'._
,,-) ---._ | .---''`-),.
,' `. \ ; / _,' `,
,--' ____ \ ' ,' ___ `-,
_> /--. `-. .-'.--\ \__
'-, ( `. `.,`~ \~'-. ,' ,' ) _\
_> \ \ ,' ') ) `. / / <,.
,-' _, \ ,' ( / `. / `-,
`-.,-' `.,' ` `.,' `\ ,-'
,' _ / ,,, ,,, \ `-. `-._
/-, ,' ; ' _ \ / _ ` ; `. `(`-\
/-, ; (o) (o) ; `'`,
,~-' ,-' \ ' ` / \ <_
/-. ,' \ / \ ,-'
'`, ,' `-/ \-' `. `-. <
/_ / / (_ _) \ \ `,
`-._; ,' | .::.`-.-' :.. | `-. _\
_/ \ `:: ,^. :.:' / `. \,-'
'`. ,-' /`-..-'-.-`-..-'\ `-.
>_ / ; (\/( ' )\/) ; `-. _<
,-' `. \`-^^^-'/ ,' \ _<
`-, ,' `. `"""""' ,' `-. <`'
') `._.,,_.' \ ,-'
'._ '`'`' \ <
> ,' , `-. <`'
`,/ \ ,-`
`, ,' | / /
'; / ; (
_)| ` (
`') .-'
<_ \ /
\ /\(
`;/ `
</pre>
=I love you=
<pre>
__,,,__
,-""-,-" "-,-""-,
/,-' , .-'-.7.-'-. , '-,\
\( / _ _ \ )/
'-, { (0) (0) } ,-'
/ > .---. < \
|/ .-' \___/ '-. \|
{, / ,_ _, \ ,}
\ {, \ / ,} /
',\. '---' ./,'
_.-""""""-._ _.-""""""-._
.' `._.` '.
_/_ _ \
.'` `\ | | \
/ | | | ;
| / |_| |
\ ;'---' _ ___ _ _ ___ ;
'. ; | | / \| || || _| _ ;
`-\ | |_ | | || |/ /| _| .' `,
`\ |___|\___/ \__/ |___| | \
\ _ _ \ |
`\ | | | /` _/
,-""-. .'`\ | | | /`-,-'` .-""-,
/ `\.' `\ \___/ /` './` \
; .--. \ '\ /' / .--. ;
| ( \ |, '\ /' | / ) |
\ ; } ;\ /; ` { ; /
`;\ \ _.-' \ / `-._ / /;`
\ \__.' _.-' Y `-._ '.__//
'.___,.-' `-.,___.'
</pre>
=Lynx=
<pre>
, ,
(\ "\
,--;.)._
).,-._ . ""-,_
/.'".- " 8 o . ";_
`L_ ,-)) o . 8.o .""-.---...,,--------.._ _"";
""" ")) 8 . . 8 . 8 8 8 8 8. 8 8 ._""._;
";. .8 .8 .8 8 8 8 8 . 8. 8 .".""
;.. 8 ; . 8. 8 8 8 . } 8 . 8 :
;.. 8 ; 8. 8 8 8 8 ( . 8 . :
;. 8 \ . .......;;; 8 . 8 :
;o ;"\\\\```````( o( 8 .;
: o: ; :. : . 8 (
:o ; ; "; ";. o :
; o; ; "; ;";..\
;.; .: )./ ;. ;
_).< .; _;./ _;./
;"__/--" ((__7 ((_J
</pre>
=Wizard=
<pre>
o
O /`-.__
/ \ '^|
o T l *
_|-..-|_
O (^ '----' `)
`\-....-/^
O o ) "/ " (
_( (-) )_
O /\ ) ( /\
/ $ ) | \
o o $ ( / \
/ |( )| \
/ o \ \( / \
__.--' O \_ / .._ \
//|)\ , (_) /(((\^)'\
| | O ) ` |
| / o___ / /
/ _.-''^^__O_^^''-._ /
.' / -''^^ ^^''- \--'^
.' .`. `'''----'''^ .`. \
.' / `'--..____..--'^ \ \
/ _.-/ \ \
.::'_/^ | | `.
.-'| | `-.
_.--'` \ / `-.
/ \ / `-._
`'---..__ `. .´_.._ __ \
``'''`. .' `'^ `''---'^
`-..______..-'
</pre>
=Suricat=
<pre>
,'''''-._
; ,. <> `-._
; \' _,--'"
; (
; , ` \
;, , \
; | |
; |, | |\
; | | | \
|.-\ ,\ |\ :
|.- `. `-. | ||
:.- `-. \ ';;
.- , \;;|
; , | ,\
; , ; \
; , /`. , )
__,;, ,' \ ,|
_,--''__,| / \ :
,'_,-'' | ,/ | :
/ / | ; ; |
| | __,-| |--..__,--| |---.--....___
___,-| |----'' / | `._`-. `----
\ \ `""" """ --
`.`. --'
`.`-._ _, ,- __,-
`-.`.
--' `;
</pre>
=Dagger=
<pre>
,-.
("O_)
/ `-/
/-. /
/ )
/ /
_ /-. /
(_)"-._ / )
"-._ "-'""( )/
"-/"-._" `.
/ "-.'._
/\ /-._"-._
_,---...__ / ) _,-"/ "-(_)
___<__(|) _ ""-/ / / /
' `----' ""-. \/ / /
) ] / /
____..-' // / )
,-"" __.,'/ / ___ /,
/ ,--""/ / / /,-"" """-. ,'/
[ ( / / / / ,.---,_ `._ _,-','
\ `-./ / / / / `-._ """ ,-'
`-._ / / / /_,' ""--"
"/ / / /"
/ / / /
/ / / /
/ |,' /
: / /
[ / ,'
| / ,'
|/,-'
P'
</pre>

=Supergirl=
<pre>
,
;\
: "-.
: ""--._
; "-._
: "-.
\ `.
`. `.
""--._ \
""--._ ;
`. :
.----. `. ;
/.-J-. \ ;`. ;
:/ / \ `-; ; ;:
;_/ _."-+: , : / ;
: -= =;\ ;\ ;' /
;"\ ,: `--' ; .' :
: t -= '"-._ ( ___ .' ;
; :"-._/`-. `-"+ .-" `.__.-" ;
.-: \ :-.____..--:-" ;
__.^-:_j `;J:\_ _.' :
_.--"" : / "-,l "-;""" ;
_.--"" :' -' `. ___ ;
_.-".-" .' / : \ """--..__.-' :
/ .' _.-" / : ; . :\ ;
/ .' .-" j : / /\ \ /
/ / .' / t--' `....' / \ \ /
/ : / / : : / `. "-. :
: ; / / ;/ ; `. / : `. `. ;
\ : / : :/: ; ; : \ \ \ .'
;.\/ : j : : : ; "-._ `. `. .-"
: `. .-; /-.; ; ; :`. .' "-.__j+. `._.-"
;`. `. : : : : .--"" t "-( `. \
/ "-.`. \; ; ;`.-" .--"".^. `. `.-"\
:\ `. :__: :`. .-T__.-".-: \ : _ "-._
; `. `. \; `\ : Y-" _.-" \ ; ;: "-._/
: "-. `. \ : ; ; / .'/ ; : :; U
"-._ `. \ ;j:/ : / : : ;
/ ""--..__`-""+:-+.\ ; ; /
,--^-...__ _.-"; `| "--: : .'
; _. _.-" : ; | ;"
:.-".-"_.-" ; ; ; /
J.-".-" .--"-. .-" | : /
.-".-" : "" : | /
: / : ; ; /
;: _..-' | : /
: ; \ : | /
; ; \ ; ; :
: ; ; : : `.
; : ; ; \ , `.
: \ / : \;"-.__\
: `.: /; ; \ ;
\ "-. /: : \ ;
`. `. ; ; :/`. \ :
"-. `. :: ; `-:\ :
"-._ `. .-"; | : \ ;
"-._ `..-" : : : \ :__
"-. `. .' ; | ; ) ;
"-.J.' | | : :
: ; ; :
; ; : \
| :_ ; ;
: .' \ | /
; / :_.'
; :
: ;
; :
| ;
:_/
</pre>
=Eagle=
<pre>
/T /I
/ |/ | .-~/
T\ Y I |/ / _
/T | \I | I Y.-~/
I l /I T\ | | l | T /
T\ | \ Y l /T | \I l \ ` l Y
__ | \l \l \I l __l l \ ` _. |
\ ~-l `\ `\ \ \\ ~\ \ `. .-~ |
\ ~-. "-. ` \ ^._ ^. "-. / \ |
.--~-._ ~- ` _ ~-_.-"-." ._ /._ ." ./
>--. ~-. ._ ~>-" "\\ 7 7 ]
^.___~"--._ ~-{ .-~ . `\ Y . / |
<__ ~"-. ~ /_/ \ \I Y : |
^-.__ ~(_/ \ >._: | l______
^--.,___.-~" /_/ ! `-.~"--l_ / ~"-.
(_/ . ~( /' "~"--,Y -=b-. _)
(_/ . \ : / l c"~o \
\ / `. . .^ \_.-~"~--. )
(_/ . ` / / ! )/
/ / _. '. .': / '
~(_/ . / _ ` .-<_
/_/ . ' .-~" `. / \ \ ,z=.
~( / ' : | K "-.~-.______//
"-,. l I/ \_ __{--->._(==.
//( \ < ~"~" //
/' /\ \ \ ,v=. ((
.^. / /\ " }__ //===- `
/ / ' ' "-.,__ {---(==-
.^ ' : T ~" ll
/ . . . : | :! \\
(_/ / | | j-" ~^
~-<_(_.^-~"
</pre>
=Dog=
<pre>
,--._______,-.
,',' , . ,_`-.
/ / ,' , _` ``. | ) `-..
(,';'""`/ '"`-._ ` \/ ______ \\
: ,o.-`- ,o. )\` -' `---.))
: , d8b ^-. '| `. ` `.
|/ __:_ `. | , ` ` \
| ( ,-.`-. ;' ; ` : ;
| | , `. / ; : \
;-'`:::._,`.__),' : ;
/ , `- `-- ; |
/ \ ` , |
( ` : : ,\ |
\ `. : : : ,' \ :
\ `|-- ` \ ,' ,-' :-.-';
: |`--.______; | : :
: / | | | \
| ; ; ; / ;
_/--' | :`-- / \_:_:_|
,',',' | |___ \
`^._,--' / , , .)
`-._,-'
</pre>
=kitten=
<pre>
. ,.
T."-._..---.._,-"/|
l|"-. _.v._ (" |
[l /.'_ \; _~"-.`-t
Y " _(o} _{o)._ ^.|
j T ,-<v>-. T ]
\ l ( /-^-\ ) ! !
\. \. "~" ./ /c-..,__
^r- .._ .- .-" `- . ~"--.
> \. \
] ^. \
3 . "> . Y
,.__.--._ _j \ ~ . ; |
( ~"-._~"^._\ ^. ^._ I . l
"-._ ___ ~"-,_7 .Z-._ 7" Y ; \ _
/" "~-(r r _/_--._~-/ / /,.--^-._ / Y
"-._ '"~~~>-._~]>--^---./____,.^~ ^.^ !
~--._ ' Y---. \./
~~--._ l_ ) \
~-._~~~---._,____..--- \
~----"~ \
\
</pre>

Ascii

2026-03-24T13:54:50Z

Ekaanbj: /* Suricat */

Stolen with pride from https://www.ascii-art.de/ascii/
=Ferdinad=
<pre>
|\ _____
|\ J \ _.--' `-.__
\`. \ \--.-'" `-.-.__
\ `-. .' \ `.__.`. \ `-.
`. J | `. ) ` `.
`-. /\ | )-.__.<_ __ \
\\/ \|>- ' `.'.') \
`\ / \ -._.-' / \
|| | /\ `-.__.' \
|| | | | \
'' |-'-'/ \
. .-.' _.\'' `.
|| ( /.-.|`-._ / . L
\\ \ (_.' /|| /_.'-' L
\ .'//__.-' >_`. J
`.__.'-' | `-`-. J
/_/\ \ \ _ L
||| /- |`- \ . .' `- J
| || F/ ) \ | / | J \ L
\ L.'// / \ J L| F J \-. |
_ \/ // .-'| \ \ \| / J | J
_ .-()-| / ____.-<_(/` .'`-. \ | J.-' F F \ F__.--"""-.
`. / `._ _ _) V/// . (_.( /.--.\`- \ / F F `. _.---. J
`.\ / ' \|\||\\///.' ( \ /' `--._ | | \ J L \" _.'.'
`.\\_F .''./\ -./)/.'/ _ `.__`-.--' `.-| / \ Y | .-' `)
`.(/`.(\||/)\\-'/ .')/) "" `) / `-..-""`. `. || / \
.-'| /\\$)'_|/-'/'()-'-> F J-._J_ `.. \_.' \ | )
.'``\\\//\\/).'/\\/)\\" _.' | .' \_.-. J____.) `. (
/ ___-(`.|//-(\|_/-`-' .' ' | (__./ )-' `--.\
__\|/`-()-<(/()-< .-' `. ___| (__.-'
`-()(.'|_)-<\_)-' <___.-| F
|/$ \_ \ | .-'
`\ "
</pre>
=Haircut=
<pre>
|
|/ |
,,,,, ,+ /|
/ \ () | ||
\ C '\ /|_() ||
) _| .'___/,,,// ||
.'=. (____E.' / / \ ||
| \)`-\ _F_.' \ c `\ ||
\ \ !'__/ ) _| ||
\ \,' / /`._( ||
|`. .' / \ \ ||
\ `-' | .-. | | \ E ||
>====[] | \ |__| | O OE ||
/ |_/ | |___)| `.__j____ \|E ||
\_ | || __`.________ `. |""|\|
\ |\ ||| \///_ _|__|_|
\ __ | \ ||`""\\""""//"' \`. \ |
|[__]| \ ||.---\\__//---. | | \____|
||__|/ / \|____________|\ |/ |
| | / || || /| | |
-----| |/------------||-||-/`| |----------|
/| | || ||/`-|___| |
/\| | || \\._ [____] h|
/`.|____| || \\ `-/ '`._ j|
`=.\____/ || \\__`-.____) w|
) '`--. _.-||-._ `""""""" |
`='====' ,-' ' ` `-. |
`-.________.-' |
</pre>
=Batman=
<pre>
. .
|\_|\
| a_a\
| | "]
____| '-\___
/.----.___.-'\
// _ \
// .-. (~v~) /|
|'| /\: .-- / \
// |-/ \_/____/\/~|
|/ \ | []_|_|_] \ |
| \ | \ |___ _\ ]_}
| | '-' / '.' |
| | / /|: |
| | | / |: /\
| | / / | / \
| | | / / | \
\ | |/\/ |/|/\ \
\|\ |\| | | / /\/\__\
\ \| | / | |__
/ | |____)
|_/
</pre>
=Skull=
<pre>
_,.---,---.,_
,;~' '~;,
,; ;,
; ;
,' '
,; ;,
; ; . . ; :
| ; ______ ______ ; |
| '/~" ~" . "~ "~\' |
| ~ ,-~~~^~, | ,~^~~~-, ~ |
| | }:{ | |
| l / | \ ! |
.~ (__,.--" .^. "--.,__) ~.
| ----;' / | \ `;---- |
\__. \/^\/ .__/
V| \ / |V
| |T~\___!___!___/~T| |
| |`IIII_I_I_I_IIII'| |
| \,III I I I III,/ |
\ `~~~~~~~~~~' /
\ . . /
\. ^ ./
^~~~^~~~^
</pre>
=Castle=
<pre>
._-_.
|_-_(
I
/_\ ___
._-_. |,|/ \
|_-_( | /_____\ ._-_.
I \| u -| _ |_-_(
/ \ -_-_-_-_--|/ \ I
/___\ \._._._./-|___\ / \
|_u | |_ _| -| u_| /___\
|_-_-_-_-_- U_| -| _| | u_|
|_\._._._./ _|-_-_-_-_-_-_|
\_|- -| _| .. -|_|
\|- U| _| U ++ U-|/
|U -| U _| ____ -|
|- _ -| _| /|-|-\ -|
|-/#\-| _| |-|-|| -|
,___|_MEB_|-----'__I|-|-I__|__,
._/ / \____/ \,
/ \ \ \```\ \,
(__ _\ |'''| L_,
/ ./ / \```\ / _\
| / / |'''| \, |
/ ( \```\ / _/ \
/_ |'''| _,|
| \
</pre>
=kentaur=
<pre>
(_______
-.__\ __\
_) / \
\_ _ ( "("
_>_ \_-/
)/ ,-' (-.
)/ _ - - )
/,'| _)_)|
(_____ // | /||
.___\ \----._//___/ '( \\
_> / __// ',,,\ )\
_) /| /,-/ )'\|
\ ( | , |
/_,$ \ \-.__\ (_, /
( ' \ | | ) |\ /
_) _/ _/ /, )/ )
_) <\ ( ) |) |
) $_\_ / / \(
/_,\ \_\ )| /_\
)_\ /_,) )_\
|_\
</pre>
=bull=
<pre>
/| /|
| \ __ _ _ / ;
___ \ \ _.-"-" `~"\ `"--' /
_.-' ""-._\ "" ._," ; "\"--._./
_.-' \./ "-""", ) ~" |
/ ,- .' , ' `o. ; )
\ ;/ ' ; /
|/ ' | \ ' |
/ | J."\ , |
" : \ .' : | ,. _)
| | / f | |`--"--'
\_ \ \ / _/ |
\ "-._ _.| ( j/; -'/
\ | "/ ( | /, |
| \ | /\ |\_/// /
\ / \ | \ \ / /
|| \ \| | | |
|| \ \ | | /
|\ |_|/ ||
L \ || ||
`"' |\ |\
( \. \ `.
|_ _\|_ _\
" "
</pre>
=Deer=
<pre>
/| |\
`__\\ //__'
|| ||
\__`\ |'__/
`_\\ //_'
_.,:---;,._
\_: :_/
|@. .@|
| |
,\.-./ \
;;`-' `---__________-----.-.
;;; \_\
';;; |
; | ;
\ \ \ | /
\_, \ / \ |\
|';| |,,,,,,,,/ \ \ \_
| | | \ / |
\ \ | | / \ |
| || | | | | |
| || | | | | |
| || | | | | |
|_||_| |_| |_|
/_//_/ /_/ /_/
</pre>
=dinosaur=
<pre>
. .
/ `. .' \
.---. < > < > .---.
| \ \ - ~ ~ - / / |
~-..-~ ~-..-~
\~~~\.' `./~~~/
\__/ \__/
/ .- . \
_._ _.- .-~ ~-. / } \/~~~/
_.-'q }~ / } { ; \__/
{'__, / ( / { / `. ,~~| . .
`''''='~~-.__( /_ | /- _ `..-' \\ //
/ \ =/ ~~--~~{ ./| ~-. `-..__\\_//_.-'
{ \ +\ \ =\ ( ~ - . _ _ _..---~
| | { } \ \_\
'---.o___,' .o___,'
</pre>
=Dinosaur=
<pre>
__.--'~~~~~`--.
.. __. .-~ ~-.
((\ / `}.~ `.
\\\ .{ } / \ \
(\ \\~~ } | } \
\`.-~ -@~ } ,-,. | ) \
(___ ) _} ( : | / / `._
`----._-~. _\ \ |_ \ / /-.__ `._
~~----~~ \ \| ~~--~~~( + / ~-._ ~-._
/ / \ \ ~--.,___~_-_.
__/ / _\ )
.<___.' .<___/
</pre>
=Dog=
<pre>
_
,:'/ _..._
// ( `""-.._.'
\| / 6\___
| 6 4
| /
\_ .--'
(_'---'`)
/ `'---`()
,' |
, .'` |
)\ _.-' ;
/ | .'` _ /
/` / .' '. , |
/ / / \ ; | |
| \ | | .| | |
\ `"| /.-' | | |
'-..-\ _.;.._ | |.;-.
\ <`.._ )) | .;-. ))
(__. ` ))-' \_ ))'
`'--"` `"""`
</pre>
=Boss=
<pre>
.-.
/ 7, `\,')/,
( \\ =/= )))
) \\ < . D/
( \\ `e_ /
\ \\_ __\ \___
) / 7// ~ `\
/ |( / ) ) , \
( ' `\(_ (_' \ \
\ \__/ \ (\ )
) )) \\ |
/( ( )\|
( \_ / '( \
| ( |'\/\
| | |
| | /
( ` /( ,(
| ( ) \
| ) \ |
| / \ |
| / \ |
/( )\
/ / \ \
/_/ \_\
</pre>
=Dragonfly=
<pre>
.-.
()I()
"==.__:-:__.=="
"==.__/~|~\__.=="
"==._( Y )_.=="
.-'~~""~=--...,__\/|\/__,...--=~""~~'-.
( ..=\=/=.. )
`'-. ,.-"`;/=\ ;"-.,_ .-'`
`~"-=-~` .-~` |=| `~-. `~-=-"~`
.-~` /|=|\ `~-.
.~` / |=| \ `~.
.-~` .' |=| `. `~-.
(` _,.-="` |=| `"=-.,_ `)
`~"~"` |=| `"~"~`
|=|
|=|
|=|
/=\
\=/
^
</pre>
=Tuttancanon=
<pre>
___..--------..___
_.-':: '::::::' ::'-._
_.-':: :: '::' :: ::'-._
_.-':: :: :: :: :: :: ::'-._
.-':: :: :: :: :: :: :: :: ::'-.
/:::\:: :: :: :: :: :: :: :: ::/:::\
/ \:: :: :: :: :: :: :: :: ::/ \
/:::::::\:: :: :: :: :: :: :: :: ::/:::::::\
| \:: :: :: :: :: :: :: :: ::/ |
/::::::::::\:: :: :: ::/::::::::::\
/ \:: ::/ \
|:::::::::::.-\ .''''''''''''''''''''. /-.:::::::::::|
/ // \\.' .-==-. .-==-. '.// \\ \
|:::::::::::||.-| .' '. .' '. |-.||:::::::::::|
/ |||'| _.'''. \ / .'''._ |'||| \
|::::::::::::|||_|.-' :(*):'.| |.':(*): '-.|_|||::::::::::::|
/ |\_.|`''''''''' | | '''''''''`|._/| \
|:::::::::::::\(O)| | | |(O)/:::::::::::::|
| `-'| .' '. |`-' |
/:::::::::::::::::\ ( __ ) /:::::::::::::::::\
/ \ .' '. / \
|::::::::::::::::::::\ _.--..--._ /::::::::::::::::::::|
| ' '.---..---.' ' |
|::::::::::::::::::::::'. '-....-' .'::::::::::::::::::::::|
| '. .' |
'-:::::::::::::::::::::::' '.________.' ':::::::::::::::::::::::-'
/'-. | '--------' | .-'\
/ '::::::::::::::::::| |-._\\_.-| |::::::::::::::::::' \
| \ | |-._//_.-| | / |
|_..--|:::::::::::::::::| |-._\\_.-| |:::::::::::::::::|--.._|
|>.<>.<\ |._|-._//_.-|_.| />.<>.<|
|>.<>.<|::::::::::::::::|-.|-._\\_.-|.-|::::::::::::::::|>.<>.<|
|>.<>.<| |<>|-._//_.-|<>| |>.<>.<|
|>.<>.<|::::::::::::::::|<>|-._\\_.-|<>|::::::::::::::::|>.<>.<|
|>.<>.<| |<>|-._//_.-|<>| |>.<>.<|
|>.<>.<|::::::::::::::::|<>|-._\\_.-|<>|::::::::::::::::|>.<>.<|
|>.<>.<| |<>'-._//_.-'<>| |>.<>.<|
|>.<>.<|::::::::::::::::|<>.<>.<>.<>.<>|::::::::::::::::|>.<>.<|
|>.<>.<\ |<>.<>.<>.<>.<>| />.<>.<|
|>.<>.<>':::::::::::::::|<>.<>.<>.<>.<>|:::::::::::::::'<>.<>.<|
|>.<>.<>.<'. |<>.<>.<>.<>.<>| .'>.<>.<>.<|
|>.<>.<>.<>.<'::::::::::'<>.<>.<>.<>.<>'::::::::::'>.<>.<>.<>.<|
\>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<></
\>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.</
\>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>/
\>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>./
'.>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.'
'.>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<.'
'.>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<.'
'.>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<.'
''==============================''
</pre>
=Elephant=
<pre>
_,--._ _,.--'''''''---..._
,' _`''-'' `-._
/ / `. `.
/ ,_. | \ \
/ `-' | _,-'' \
| \,-' / \ `. \
| ,') ; / / |/\ \
_,.-'_,'\,-:_;;.| \\ | / | \ :
`'-'' \ \ | | \ / |/ |;
\ \ | / | / | ;;
`. \ \ |__ \ |/ ::
\ : | / `''----''`. / | \\
| ; ,\ | \ | | ;;
/ / \| | | | |
/,' || | | | |
;| | | | |
',_;-,__\ ,';-,__\.\
</pre>
=Escavator=
<pre>
.-.
/ \
_____.....-----|(o) |
_..--' _..--| .''
.' o _..--'' | | |
/ _/_..--'' | | |
________/ / / | | |
| _ ____\ / / | | |
_.-----._________|| || \\ / | | |
|=================||=||_____\\ |__|-'
| ||_||_____// (o\ |
|_________________|_________/ |-\|
`-------------._______.----' / `.
.,.,.,.,.,.,.,.,.,.,.,.,., / \
((O) o o o o ======= o o(O)) ._.' /
`-.,.,.,.,.,.,.,.,.,.,.,-' `.......'
</pre>
=Bobcat=
<pre>
______________
/.----------..-'
-. || \\
.----'-||-. \\
|o _ || | \\
| [_] || |_...-----.._\\
| [_] ||.' `-._ _
| [_] '.O)_...-----....._ `.\
/ [_]o .' _ _'''''''''_ _ `. `. __
|______/.' _ `.---.' _ `.\ `._./ \
|'''''/, .' _ '. . , .' _ '. .`. .o'| \
`---..|; : (_) : ;-; : (_) : ;-'`--.| \
' '. _ .' ' ' '. _ .' ' / \
`._ _ _,' `._ _ _,' `._____\
</pre>
=Angel=
<pre>
,_ .--.
, , _)\/ ;--.
. ' . \_\-' | .' \
-= * =- (.-, / / |
' .\' ). ))/ .' _/\ /
\_ \_ /( / \ /(
/_\ .--' `-. // \
||\/ , '._// |
||/ /`(_ (_,;`-._/ /
\_.' ) /`\ .'
.' . | ;. /`
/ |\( `.(
| |/ | ` `
| | /
| |.'
__/' /
_ .' _.-`
_.` `.-;`/
/_.-'` / /
| /
( /
/_/
</pre>
=Flamino=
<pre>
___
,' `.
/_. _,. \
( /(' \ :
\\| / ;
`' / /
/ /
: :
| : _______
: \ ,' `-._
' / . . . \
: `' ; ; ; ; , :
\`./ / / / ; ;;
`. `'../__/ / ,.\
`'-.____;-'`\\\
\ // / '|
::\
||\\
|| \\
|| ))
|| //
||//
||/
||
/||
`||-
__,';
</pre>
=Mr Gadget=
<pre>
_..__
.' I '.
|.-"""-.|
_;.-"""-.;_
_.-' _..-.-.._ '-._
';--.-(_o_I_o_)-.--;'
`. | | | | | | .`
`-\| | | |/-'
| | | |
| \_/ |
_.'; ._._. ;'._
_.-'`; | \ - / | ;'-.
.' : / | | | | \ '.
/ : /__ \ \___/ / __\ : `.
/ | / '._/_\_.' \ : `\
/ . `---;"""""'-----` . \
/ | |() () | \
/ /| | |\ \
/ / | |() () | \ \
| <jgs\_,,___|_.....____,,__/ `> |
\ \ | ][ | | ][ | / /
\ \ ;=""====='"""'====""==; / /
|/`\ \/ |() () \/ /`\|
|_/.-'; | |`-.\_|
/ | ; : \
|__.| | |.__|
; | |
| : ;
| : |
; | |
; | ;
| : |
| | ;
| | ;
'-._ ; _.-'
`;"--.....--";`
| | | |
| | | |
| | | |
T----T T----T
_..._L____J L____J _..._
.` "-. `% | | %` .-" `.
/ \ .: :. / \
'-..___|_..=:` `-:=.._|___..-'
</pre>
=Lizard=
<pre>

)/_
_.--..---"-,--c_
\L..' ._O__)_
,-. _.+ _ \..--( /
`\.-''__.-' \ ( \_
`''' `\__ /\
')
</pre>
=World=
<pre>
_.-,=_"""--,_
.-" =/7" _ .T "=.
,/7 " " ,//)`d `.
,/ " 4 ,i-/ `.
/ _)"_sm =,=T"D \
/ (_/"_`;\/gjo D-O \
/ ,d"""O-_.._.) P.___ \
, ," \\ bi- `\| Y.
| .d b\ P' V |
|\ 'O O!", |
|L. \__.=_ 7 |
' D. ) / '
\ T \ | /
\D / 7 / /
\ \ ," /" /
`. \ 7' ,'
"-_ `"' ,-'
"-._ _.-"
""""---""""
</pre>
=Gnu=
<pre>
_,-----.
_,------.__,-' `. . .
.-' `//__ \\
| ((___`-_____ ))
| \_____) \`=:'
| `=| |=,'
/ | O (|
/ /\ | |
/ / \ . \ |
| / /| / `--. ___ __,,-. |
| / // / `-' \ ,_ /'' | o o|
/ | | | | \ \ `. | ``--'
mmm | | | \ \ | |
| |\ | | || |
| | || / / `. )
\ \ \\ / / | |
|_| || / / | |
|_\ \_| | \
\__\
</pre>
=Duck=
<pre>
___
,-"" `.
,' _ e )`-._
/ ,' `-._<.===-'
/ /
/ ;
_ / ;
(`._ _.-"" ""--..__,' |
<_ `-"" \
<`- :
(__ <__. ;
`-. '-.__. _.' /
\ `-.__,-' _,'
`._ , /__,-'
""._\__,'< <____
| | `----.`.
| | \ `.
; |___ \-``
\ --<
`.`.<
`-'
</pre>
=Dog=
<pre>
()._
_.--. (##)_`-.
/ . ``u (##), ` `.
\__) _/ (##),--. \
| --' ()' \ \
/ | | |
,' \ _,' /
,' | ,;--//
/ ___\ |/ ___V__{(_
| ' \| || ,'-===- `,'|
__| ,' /| || |""""""""|-L|
,`__. < _)))_))) |________|,'
(,'
</pre>
=Giljotine=
<pre>
.___________________.
|`._______________,'|
| | | |
| |_______________| |
| || || |
| ||_ _ || |
| || ""--._._ || |
| || `-. || |
| || `. || |
| || \|| |
| || || |
| || || |
| || || |
| || || |
| || || |
| || || |
| || || |
| || || |
| || || |
| || || |
| || || |
| || || |
| || || |
| || || |
| || || |
| || || |
| || || |
| || || |
| || || |
| || || |
| ||_____________|| |
| |/ ,--. \| |
| |-(_)-( )-(_)| |
| | `--' | |
|===================|
| |
</pre>
=Gun=
<pre>
+-'~`---------------------------------/\--
||"""""""""""""""""""""""""""""""" \\\\\\ \/~)
|| \\\\\\ \/_
|~~~~~~~~-________________-_________________\ ~--_
!---------|_________ ------~~~~~(-- )--~~
\ /~~~~\~~\ )--- \_ /(
|| | | \ () \\
\\____/_ / ()\ \\
`~~~~~~~~~-. \ \\
\ \ <($)> \\
\ \ \\
\ \ \\
\ \ \\
\ \ () \|
_\_\__====~~~
</pre>
=Deer=
<pre>
( )
)) ((
// \\
| \\____// |
\~/ ~ ~\/~~/
(| _/o ~~
/ / ,|
(~~~)__.-\ |
``~~ | |
| | |
| |
/ \
`\ /'
`\_ _/'
~~~~
</pre>
=Hedgehog=
<pre>
\ / \/ \/ / ,
\ / \/ \/ \/ / ,
\ \ \/ \/ \/ \ \/ \/ /
.\ \/ \/ \/ \/ \/ / / /
' / / \/ \/ \/ \/ \/ \ \/ \
.' ) \/ \/ \/ \/ \/ \/ \ / \
/ o ) \/ \/ \/ \/ \/ \/ \// /
o'_ ',__ .' ,.,.,.,.,.,.,.,'- '%
// \\ // \\
'' '' '' ''
</pre>
=Helikopter=
<pre>
.- . _
.: ` " - . _
\ :: ` ""--..__ . . . : : :
`\ :: :' ` _ _ ""--..__ ......_._._:.:.: " " " " " "
`\.:: :' " " " - ----.....___ ""-##.____...:::""""""""""""
: : :' "::":"-----......______
." ""--..__ . .:'.: """"""-----. . . _ _ _
/.""--.._ ""--..__ : .:'. : " " "
/' .: ":-.._ ""--..__ .:'. :
`-._:__.-" ""-.._ ""--...___..:'. :
.: /.""-..__...---""-.'"-:"--.:_
" : POLICE .' ::""-."";.
:_ : :: ":: `-.
:::::.._ '-._ :: :: `.
: """:::::.._ "''-._ :: :
: "":::::.._ "': :
`. """:::::-:_ :
:. """::::::... :
..__..--"" ". . """::::::
""--..__ :.--"" ":
""-+:=:_ ("-:
: ""--.._ []'
: :""--..___..--"
: :
""--..__ :
""--.:_
""--..__.-grp
</pre>
=Halv Liter=
<pre>
| | ------------\ ,---. /------------ | |
| | ---------. `-./ "\.-' .--------- | |
| ,--. | --------\ . /-------- | ,--. |
| ( >< ) | ------`-.| .-'------ | ( >< ) |
| `--' | ---/ `/"\ \--- | `--' |
| . | `//_-_\\' 8 | |
| : . ! | (.' ',) | . : . :|
| ! ! .| | | : | ! .|
| |_| ;|_| . |_| !_| !|
`-' `-^' \o `-' `-^'
\__________________T>_________________/
`-=--=--=--=--=--=---=--=--=--=--=--=-'
] _] _] _] _] _] _L] _] _] _] _] _] _
`-------------------------------------'
`u---u---u---u---u---u---u---u---u---u'
</pre>
=Hockey=
<pre>
.---.
/_____\
_HH.H.HH
_ _-"" WHHHHHW""--__
\\ _-" __\VW=WV/__ /"".
\\ _-" \__--" "-_-" """ "_
\\/ _ ""
\\----_/_| ___ /"\ T""\====-
\\ /"-._ |%|H| ( "\|) | / .:)
\/ / |-+-| \ |_ J .:::-'
/ / |H|%| _-' '-._ " )/;"
/ / \ __ ( \ \ \ "
/ /\/ '. / \ \ \ \ _- \
"'-._/ \/ \ "-_ \ -"" _- \
_,'\\ \ \/ ) "-, -"" \
_,'_- _ \\ \ \,' \ \_\_\ \
,' _- \_\ \ \ \_\_\ \
\_ _- _- _,' \ \ \ """" )
C\_ _- _,' \ "--------. L_""""_/
" \/-' "-_________| '"-Y
</pre>
=Hockey=
<pre>
.-.-.
/_____\
:._|_|_.:
|/a> a>\|
_.-: ( ;._
,'::::\ _ /:::`-._
/:::::::`._,'|:::::::`._
/:::::_.--`._,'-.::::::::`.
:`:::;' \ ) ( `':_:;-' \
|: `' : \ \ . ,-.\
|' --._;. `:\,' .._\
|:. -.\: `;:;'.' :
:,----..(:._ ._,---.';'. `.__.'
/\,---.|:':..-(\,-, `.`..-'
/ :.--.'|:' ;',:.__.-''
: | |' ,',' /:/ /
: |,'|.-| ,',' /:/ /
/:\ : ,'_,:',' /:/ /
/ `:._\,'.`.`, -.';','
:`-._`:/ >._>.' .;\'
|`-._`:,',/_ ,'
|::::;',' ; `-'':
/\:,',| :`-..-.;
_,`,',' ; ;:::::/
,'`,','.;':_;`-::'/
<`,',;::;:-' /
,',' ( ```` ,'.::::.
,'.' /`_.__.-'::::'
_,',' `:::::::'
_______..-`.,'
,' ,----. ,'
'---`----'-''
</pre>
=Jeep=
<pre>
_.------------------.
.'____________________|
// _|||| | | | | |
______//_\__j_|||"--" "--" | | _
/-----+-|p ==,|||__________|_|-|W|
_j,====. |b_____||| _____ | |W|
|_) ,---.`.`------'|.',---.`.___|_|W|
`/ .-. \\`======__// .-. \`-----'""
\ `-' / """"""" \ `-' /
`---' `---'
</pre>
=Fool=
<pre>
,;;;;;;,
,;;;'""`;;\
,;;;/ .'`',;\
,;;;;/ | \|_
/;;;;; \ / .\
,;;;;;;| '. \/_/
/;;;;;;;| \
_,.---._ /;;;;;;;;| ; _.---.,_
.;;/ `.;;;;;;;;;| ;' \;;,
.;;;/ `;;;;;;;;;.._ .' \;;;.
/;;;;| _;-"` `"-;_ |;;;;\
|;;;;;|.---. .' __.-"```"-.__ '. .---.|;;;;;|
|;;;;;| `\/ .'/__\ /__\'. \/` |;;;;;|
|;;;;;| |_/ // \\ // \\ \_| |;;;;;|
|;;;;;| |/ |/ || || \| \| |;;;;;|
\;;;;| __ || _ .-.\| |/.-. _ || __ |;;;;/
\jgs| / _\|/ = /_o_\ /_o_\ = \|/_ \ |;;;/
\;;/ |`.- ` ` ` ` -.`| \;;/
_|;' \ | _ _ _ _ | / ';|_
/ .\ \\_ ( '--'( )'--' ) _// /. \
\/_/ \_/| /_ | | _\ |\_/ \_\/
| /|\\ \ / //|\ |
| | \'._'-'_.'/ | |
| ; '-.```.-' ; |
| \ ``` / |
__ ; '.-"""""-.' ; __
/\ \_ __..--\ `-----' /--..__ _/ /\
\_'/\`''---''`..;;;;.'.__, ,__.',;;;;..`''---''`/\'_/
'-.__'';;;;;;;;;;;,,'._ _.',,;;;;;;;;;;;''__.-'
``''--; ;;;;;;;;..`"`..;;;;;;;; ;--''`` _
.-. /,;;;;;;;';;;;;;;;;';;;;;;;,\ _.-' `\
.' /_ /,;;;;;;'/| ;;;;;;; |\';;;;;;,\ `\ '-'|
/ ) /,;;;;;',' | ;;;;;;; | ',';;;;;,\ \ .'-./
`'-..-' /,;;;;',' | ;;;;;;; | ',';;;;,\ `"`
| ;;;',' | ;;;;;;; | , ', ;;;'|
_\__.-' .-. ; ;;;;;;; ; |'-. '-.__/_
/ .\ ( ) \';;;;;'/ | | /. \
\/_/ (` `) \';;;'/ '-._| \_\/
'-/ \-' '._.' `
""" /.`\
\|_/
</pre>
=Mogly=
<pre>
.-c.
_ .., _ ( ")\
['" 6'-'</ '-/ |
; ( -=; / |
| \-` _./ |
) `'--' (
/ .. .-"`
,-"' .' '. /
__ / _.- : Y
.',-7 ) .-' ) .' ;
[ )'} < / | : |
_".(. ( \, | : \
.'-. .\.,='-' / : |
=; | |-' / : |
_/--\ | : |
/_7-'<\ \ : .(
,L / |/ \ '. .' \
'/ / \ :-; /
\> __\ / \ /_
`----' '-._\
</pre>
=King=
<pre>
.
/ \
_\ /_
. . (,'v`.) . .
\) ( ) ,' `. ( ) (/
\`. / `-' `-' \ ,'/
: ' _______ ' :
| _,-' ,-. `-._ |
|,' ( )__`-'__( ) `.|
(|,-,'-._ _.-`.-.|)
/ /<( o)> <( o)>\ \
: : | | : :
| | ; : | |
| | (.-.) | |
| | ,' ___ `. | |
; |)/ ,'---'. \(| :
_,-/ |/\( )/\| \-._
_..--'.-( | `-'''-' | )-.`--.._
`. ;`._________,': ,'
,' `/ \'`.
`------.------'
'
</pre>
=Crest=
<pre>
o .,<>., o
|\/\/\/\/|
'========'
(_ SSSSSSs
)a'`SSSSSs
/_ SSSSSS
.=## SSSSS
.#### SSSSs
###::::SSSSS
.;:::""""SSS
.:;:' . . \\
.::/ ' .'|
.::( . |
:::) \
/\( /
/) ( |
.' \ . ./ /
_-' |\ . |
_..--.. . /"---\ | ` | . |
-=====================,' _ \=(*#(7.#####() | `/_.. , (
_.-''``';'-''-) ,. \ ' '+/// | .'/ \ ``-.) \
,' _.- (( `-' `._\ `` \_/_.' ) /`-._ ) |
,'\ ,' _.'.`:-. \.-' / <_L )" |
_/ `._,' ,')`; `-'`' | L / /
/ `. ,' ,|_/ / \ ( <_-' \
\ / `./ ' / /,' \ /|` `. |
)\ /`._ ,'`._.-\ |) \'
/ `.' )-'.-,' )__) |\ `|
: /`. `.._(--.`':`':/ \ ) \ \
|::::\ ,'/::;-)) / ( )`. |
||::::: . .::': :`-( |/ . |
||::::| . :| |==[]=: . - \
|||:::| : || : | | /\ ` |
___ ___ '|;:::| | |' \=[]=| / \ \
| /_ ||``|||::::: | ; | | | \_.'\_ `-.
: \_``[]--[]|::::'\_;' )-'..`._ .-'\``:: ` . \
\___.>`''-.||:.__,' |_______`> <_____:::. . . \ _/
`+a:f:......jrei'''
</pre>
=Kiwi=
<pre>
.```. _.''..
; ``` ``'.
: d `.
/ >,: \
/.' `'., :
/' ;. . ;
/ ; \ ; ; /
`..;\: :'
__|| `...,'
`-, ) ||
/.^/ ___||
'---,_\
(/ `\
</pre>
=Knight=
<pre>
.oo.
.\. ..
,'..''\ ...oooo''
| \_/' ...oooo'''
/''.'\ . ...oooo'''
| | '| ...o!oo'''
| | |. ...oooo''./ '\
| '\, ''''\ ./ ./\ '\.
/\ooo''|''''-/ -../ / \'' '\.
/ '\. '|.''\--/-+-+-+-+-+-+-+-+.'
....- \. \. '\-'/',, /'---/' '''
././ ''\.-.-.\ '\| '',,\--;
/-/| |-'\. '> '\\
!--!| /---/' ./' |
!--!! ./---/' ,/| |
./'-/'| |----\ \-| |
./'--/ |..........|''''''./'|...........|
-'-'-' '/---/\---|' '/-\--\''''
/--/' |--\ ./---\--\
|--| \--\. ./--/' \--\
|--| |--| ./--/' \--\.
'\-| '\-| /--/' \--|
|..\ |..\ |..\ |..\
</pre>
=knight=
<pre>
.I.
/ : \
|===|
>._.<
.=-< >-=.
/.'`(`-+-')'`.\
_/`.__/ : \__.'\_
( `._/\`. : .'/\_.' )
>-(_) \ `:' / (_)-<
| | / \___/ \ | |
)^( | .' : `. | )^(
| _\|`-._:_.-'| \ |
"-<\)| : | : | "-"
(\\| : / \ : |
\\-:-| |-:-')
\\:_/ \_:_/
|\\_| |_:_|
(;\\/ \__;)
|: \\ | :|
\: /\\ \ :/
|==| \\|==|
/v-'( \\`-v\
// .-' \\. \\
`-' \\`-'
\|
</pre>
=sheep=
<pre>
,-''''-.
(. ,. L ___...__
/7} ,-` `'-==''`` ''._
//{ '`.
\_,X , : )
7 ;`
: , /
\_, \ ;
Y L_ __..--':`. L
| /| ```` ; y J
[ j J / / L ;
| |Y \ /_J | |
L_J/_) /_) L_J
/_) /_)
</pre>
=laptop=
<pre>
.-----------------------===------------------------.
:o ______________________________________________ o:
; : : ;
`. `. .' .'
: : : :
`. `. .' .'
: : : :
`. `. .' .'
: : : :
`. `. .' .'
: : : :
`. `. .' .'
: :__________________________________: :
`. .'
'-------------| |-----| |--------------'
.""""""""""""""| |"""""| |"""""""""""""".
| () '-----------' o () |
| ___________________________________ |
| :__|__|__|__|__|__|__|__|__|__|__|__: |
| |___|__|__|__|__|__|__|__|__|__|__|_| |
| |__|_|__|__|__|__|__|__|__|__|__|___| |
| |___|__|__|__|__|__|__|__|__|__|____| |
| |____|__|__|__|__|__|__|___|__|__|__| |
| :___|__|___________________|__|__|__: |
| |
| .-------------. |
| | | |
| | | |
| |_____________| |
| | | |
| | | |
| '.___________.' |
| ___ |
'-----------------------------------------'
</pre>
=grass cutter=
<pre>
---. .---
'. .'
'.'
/
/
/
/
/
/
/
/
.'.
.' \
.' |
.' \
..--/_________|.--.
// '----------'// \\
||'=:='=:='=:='||()||
\\_'--''--''--'\\__//
`--' `--`
</pre>
=lamp=
<pre>
. | ,
\ _---_ /
-_ .' `. _-
__ : .---. : __
: \ / :
-" `. | | .' "-
/ |`-'| \
' ]"-_[ `
]"-_[
"*"
</pre>
=Lion=
<pre>
,.
,_> `. ,';
,-`' `' '`'._
,,-) ---._ | .---''`-),.
,' `. \ ; / _,' `,
,--' ____ \ ' ,' ___ `-,
_> /--. `-. .-'.--\ \__
'-, ( `. `.,`~ \~'-. ,' ,' ) _\
_> \ \ ,' ') ) `. / / <,.
,-' _, \ ,' ( / `. / `-,
`-.,-' `.,' ` `.,' `\ ,-'
,' _ / ,,, ,,, \ `-. `-._
/-, ,' ; ' _ \ / _ ` ; `. `(`-\
/-, ; (o) (o) ; `'`,
,~-' ,-' \ ' ` / \ <_
/-. ,' \ / \ ,-'
'`, ,' `-/ \-' `. `-. <
/_ / / (_ _) \ \ `,
`-._; ,' | .::.`-.-' :.. | `-. _\
_/ \ `:: ,^. :.:' / `. \,-'
'`. ,-' /`-..-'-.-`-..-'\ `-.
>_ / ; (\/( ' )\/) ; `-. _<
,-' `. \`-^^^-'/ ,' \ _<
`-, ,' `. `"""""' ,' `-. <`'
') `._.,,_.' \ ,-'
'._ '`'`' \ <
> ,' , `-. <`'
`,/ \ ,-`
`, ,' | / /
'; / ; (
_)| ` (
`') .-'
<_ \ /
\ /\(
`;/ `
</pre>
=I love you=
<pre>
__,,,__
,-""-,-" "-,-""-,
/,-' , .-'-.7.-'-. , '-,\
\( / _ _ \ )/
'-, { (0) (0) } ,-'
/ > .---. < \
|/ .-' \___/ '-. \|
{, / ,_ _, \ ,}
\ {, \ / ,} /
',\. '---' ./,'
_.-""""""-._ _.-""""""-._
.' `._.` '.
_/_ _ \
.'` `\ | | \
/ | | | ;
| / |_| |
\ ;'---' _ ___ _ _ ___ ;
'. ; | | / \| || || _| _ ;
`-\ | |_ | | || |/ /| _| .' `,
`\ |___|\___/ \__/ |___| | \
\ _ _ \ |
`\ | | | /` _/
,-""-. .'`\ | | | /`-,-'` .-""-,
/ `\.' `\ \___/ /` './` \
; .--. \ '\ /' / .--. ;
| ( \ |, '\ /' | / ) |
\ ; } ;\ /; ` { ; /
`;\ \ _.-' \ / `-._ / /;`
\ \__.' _.-' Y `-._ '.__//
'.___,.-' `-.,___.'
</pre>
=Lynx=
<pre>
, ,
(\ "\
,--;.)._
).,-._ . ""-,_
/.'".- " 8 o . ";_
`L_ ,-)) o . 8.o .""-.---...,,--------.._ _"";
""" ")) 8 . . 8 . 8 8 8 8 8. 8 8 ._""._;
";. .8 .8 .8 8 8 8 8 . 8. 8 .".""
;.. 8 ; . 8. 8 8 8 . } 8 . 8 :
;.. 8 ; 8. 8 8 8 8 ( . 8 . :
;. 8 \ . .......;;; 8 . 8 :
;o ;"\\\\```````( o( 8 .;
: o: ; :. : . 8 (
:o ; ; "; ";. o :
; o; ; "; ;";..\
;.; .: )./ ;. ;
_).< .; _;./ _;./
;"__/--" ((__7 ((_J
</pre>
=Wizard=
<pre>
o
O /`-.__
/ \ '^|
o T l *
_|-..-|_
O (^ '----' `)
`\-....-/^
O o ) "/ " (
_( (-) )_
O /\ ) ( /\
/ $ ) | \
o o $ ( / \
/ |( )| \
/ o \ \( / \
__.--' O \_ / .._ \
//|)\ , (_) /(((\^)'\
| | O ) ` |
| / o___ / /
/ _.-''^^__O_^^''-._ /
.' / -''^^ ^^''- \--'^
.' .`. `'''----'''^ .`. \
.' / `'--..____..--'^ \ \
/ _.-/ \ \
.::'_/^ | | `.
.-'| | `-.
_.--'` \ / `-.
/ \ / `-._
`'---..__ `. .´_.._ __ \
``'''`. .' `'^ `''---'^
`-..______..-'
</pre>
=Suricat=
<pre>
,'''''-._
; ,. <> `-._
; \' _,--'"
; (
; , ` \
;, , \
; | |
; |, | |\
; | | | \
|.-\ ,\ |\ :
|.- `. `-. | ||
:.- `-. \ ';;
.- , \;;|
; , | ,\
; , ; \
; , /`. , )
__,;, ,' \ ,|
_,--''__,| / \ :
,'_,-'' | ,/ | :
/ / | ; ; |
| | __,-| |--..__,--| |---.--....___
___,-| |----'' / | `._`-. `----
\ \ `""" """ --
`.`. --'
`.`-._ _, ,- __,-
`-.`.
--' `;
</pre>
=Dagger=
<pre>
,-.
("O_)
/ `-/
/-. /
/ )
/ /
_ /-. /
(_)"-._ / )
"-._ "-'""( )/
"-/"-._" `.
/ "-.'._
/\ /-._"-._
_,---...__ / ) _,-"/ "-(_)
___<__(|) _ ""-/ / / /
' `----' ""-. \/ / /
) ] / /
____..-' // / )
,-"" __.,'/ / ___ /,
/ ,--""/ / / /,-"" """-. ,'/
[ ( / / / / ,.---,_ `._ _,-','
\ `-./ / / / / `-._ """ ,-'
`-._ / / / /_,' ""--"
"/ / / /"
/ / / /
/ / / /
/ |,' /
: / /
[ / ,'
| / ,'
|/,-'
P'
</pre>

=Superman=
<pre>
.=.,
;c =\
__| _/
.'-'-._/-'-._
/.. ____ \
/' _ [<_->] ) \
( / \--\_>/-/'._ )
\-;_/\__;__/ _/ _/
'._}|==o==\{_\/
/ /-._.--\ \_
// / /| \ \ \
/ | | | \; | \ \
/ / | :/ \: \ \_\
/ | /.'| /: | \ \
| | |--| . |--| \_\
/ _/ \ | : | /___--._) \
|_(---'-| >-'-| | '-'
/_/ \_\
</pre>

=Supergirl=
<pre>
,
;\
: "-.
: ""--._
; "-._
: "-.
\ `.
`. `.
""--._ \
""--._ ;
`. :
.----. `. ;
/.-J-. \ ;`. ;
:/ / \ `-; ; ;:
;_/ _."-+: , : / ;
: -= =;\ ;\ ;' /
;"\ ,: `--' ; .' :
: t -= '"-._ ( ___ .' ;
; :"-._/`-. `-"+ .-" `.__.-" ;
.-: \ :-.____..--:-" ;
__.^-:_j `;J:\_ _.' :
_.--"" : / "-,l "-;""" ;
_.--"" :' -' `. ___ ;
_.-".-" .' / : \ """--..__.-' :
/ .' _.-" / : ; . :\ ;
/ .' .-" j : / /\ \ /
/ / .' / t--' `....' / \ \ /
/ : / / : : / `. "-. :
: ; / / ;/ ; `. / : `. `. ;
\ : / : :/: ; ; : \ \ \ .'
;.\/ : j : : : ; "-._ `. `. .-"
: `. .-; /-.; ; ; :`. .' "-.__j+. `._.-"
;`. `. : : : : .--"" t "-( `. \
/ "-.`. \; ; ;`.-" .--"".^. `. `.-"\
:\ `. :__: :`. .-T__.-".-: \ : _ "-._
; `. `. \; `\ : Y-" _.-" \ ; ;: "-._/
: "-. `. \ : ; ; / .'/ ; : :; U
"-._ `. \ ;j:/ : / : : ;
/ ""--..__`-""+:-+.\ ; ; /
,--^-...__ _.-"; `| "--: : .'
; _. _.-" : ; | ;"
:.-".-"_.-" ; ; ; /
J.-".-" .--"-. .-" | : /
.-".-" : "" : | /
: / : ; ; /
;: _..-' | : /
: ; \ : | /
; ; \ ; ; :
: ; ; : : `.
; : ; ; \ , `.
: \ / : \;"-.__\
: `.: /; ; \ ;
\ "-. /: : \ ;
`. `. ; ; :/`. \ :
"-. `. :: ; `-:\ :
"-._ `. .-"; | : \ ;
"-._ `..-" : : : \ :__
"-. `. .' ; | ; ) ;
"-.J.' | | : :
: ; ; :
; ; : \
| :_ ; ;
: .' \ | /
; / :_.'
; :
: ;
; :
| ;
:_/
</pre>
=Eagle=
<pre>
/T /I
/ |/ | .-~/
T\ Y I |/ / _
/T | \I | I Y.-~/
I l /I T\ | | l | T /
T\ | \ Y l /T | \I l \ ` l Y
__ | \l \l \I l __l l \ ` _. |
\ ~-l `\ `\ \ \\ ~\ \ `. .-~ |
\ ~-. "-. ` \ ^._ ^. "-. / \ |
.--~-._ ~- ` _ ~-_.-"-." ._ /._ ." ./
>--. ~-. ._ ~>-" "\\ 7 7 ]
^.___~"--._ ~-{ .-~ . `\ Y . / |
<__ ~"-. ~ /_/ \ \I Y : |
^-.__ ~(_/ \ >._: | l______
^--.,___.-~" /_/ ! `-.~"--l_ / ~"-.
(_/ . ~( /' "~"--,Y -=b-. _)
(_/ . \ : / l c"~o \
\ / `. . .^ \_.-~"~--. )
(_/ . ` / / ! )/
/ / _. '. .': / '
~(_/ . / _ ` .-<_
/_/ . ' .-~" `. / \ \ ,z=.
~( / ' : | K "-.~-.______//
"-,. l I/ \_ __{--->._(==.
//( \ < ~"~" //
/' /\ \ \ ,v=. ((
.^. / /\ " }__ //===- `
/ / ' ' "-.,__ {---(==-
.^ ' : T ~" ll
/ . . . : | :! \\
(_/ / | | j-" ~^
~-<_(_.^-~"
</pre>
=Dog=
<pre>
,--._______,-.
,',' , . ,_`-.
/ / ,' , _` ``. | ) `-..
(,';'""`/ '"`-._ ` \/ ______ \\
: ,o.-`- ,o. )\` -' `---.))
: , d8b ^-. '| `. ` `.
|/ __:_ `. | , ` ` \
| ( ,-.`-. ;' ; ` : ;
| | , `. / ; : \
;-'`:::._,`.__),' : ;
/ , `- `-- ; |
/ \ ` , |
( ` : : ,\ |
\ `. : : : ,' \ :
\ `|-- ` \ ,' ,-' :-.-';
: |`--.______; | : :
: / | | | \
| ; ; ; / ;
_/--' | :`-- / \_:_:_|
,',',' | |___ \
`^._,--' / , , .)
`-._,-'
</pre>
=kitten=
<pre>
. ,.
T."-._..---.._,-"/|
l|"-. _.v._ (" |
[l /.'_ \; _~"-.`-t
Y " _(o} _{o)._ ^.|
j T ,-<v>-. T ]
\ l ( /-^-\ ) ! !
\. \. "~" ./ /c-..,__
^r- .._ .- .-" `- . ~"--.
> \. \
] ^. \
3 . "> . Y
,.__.--._ _j \ ~ . ; |
( ~"-._~"^._\ ^. ^._ I . l
"-._ ___ ~"-,_7 .Z-._ 7" Y ; \ _
/" "~-(r r _/_--._~-/ / /,.--^-._ / Y
"-._ '"~~~>-._~]>--^---./____,.^~ ^.^ !
~--._ ' Y---. \./
~~--._ l_ ) \
~-._~~~---._,____..--- \
~----"~ \
\
</pre>

Ascii

2026-03-24T13:54:18Z

Ekaanbj: /* Suricat */

Stolen with pride from https://www.ascii-art.de/ascii/
=Ferdinad=
<pre>
|\ _____
|\ J \ _.--' `-.__
\`. \ \--.-'" `-.-.__
\ `-. .' \ `.__.`. \ `-.
`. J | `. ) ` `.
`-. /\ | )-.__.<_ __ \
\\/ \|>- ' `.'.') \
`\ / \ -._.-' / \
|| | /\ `-.__.' \
|| | | | \
'' |-'-'/ \
. .-.' _.\'' `.
|| ( /.-.|`-._ / . L
\\ \ (_.' /|| /_.'-' L
\ .'//__.-' >_`. J
`.__.'-' | `-`-. J
/_/\ \ \ _ L
||| /- |`- \ . .' `- J
| || F/ ) \ | / | J \ L
\ L.'// / \ J L| F J \-. |
_ \/ // .-'| \ \ \| / J | J
_ .-()-| / ____.-<_(/` .'`-. \ | J.-' F F \ F__.--"""-.
`. / `._ _ _) V/// . (_.( /.--.\`- \ / F F `. _.---. J
`.\ / ' \|\||\\///.' ( \ /' `--._ | | \ J L \" _.'.'
`.\\_F .''./\ -./)/.'/ _ `.__`-.--' `.-| / \ Y | .-' `)
`.(/`.(\||/)\\-'/ .')/) "" `) / `-..-""`. `. || / \
.-'| /\\$)'_|/-'/'()-'-> F J-._J_ `.. \_.' \ | )
.'``\\\//\\/).'/\\/)\\" _.' | .' \_.-. J____.) `. (
/ ___-(`.|//-(\|_/-`-' .' ' | (__./ )-' `--.\
__\|/`-()-<(/()-< .-' `. ___| (__.-'
`-()(.'|_)-<\_)-' <___.-| F
|/$ \_ \ | .-'
`\ "
</pre>
=Haircut=
<pre>
|
|/ |
,,,,, ,+ /|
/ \ () | ||
\ C '\ /|_() ||
) _| .'___/,,,// ||
.'=. (____E.' / / \ ||
| \)`-\ _F_.' \ c `\ ||
\ \ !'__/ ) _| ||
\ \,' / /`._( ||
|`. .' / \ \ ||
\ `-' | .-. | | \ E ||
>====[] | \ |__| | O OE ||
/ |_/ | |___)| `.__j____ \|E ||
\_ | || __`.________ `. |""|\|
\ |\ ||| \///_ _|__|_|
\ __ | \ ||`""\\""""//"' \`. \ |
|[__]| \ ||.---\\__//---. | | \____|
||__|/ / \|____________|\ |/ |
| | / || || /| | |
-----| |/------------||-||-/`| |----------|
/| | || ||/`-|___| |
/\| | || \\._ [____] h|
/`.|____| || \\ `-/ '`._ j|
`=.\____/ || \\__`-.____) w|
) '`--. _.-||-._ `""""""" |
`='====' ,-' ' ` `-. |
`-.________.-' |
</pre>
=Batman=
<pre>
. .
|\_|\
| a_a\
| | "]
____| '-\___
/.----.___.-'\
// _ \
// .-. (~v~) /|
|'| /\: .-- / \
// |-/ \_/____/\/~|
|/ \ | []_|_|_] \ |
| \ | \ |___ _\ ]_}
| | '-' / '.' |
| | / /|: |
| | | / |: /\
| | / / | / \
| | | / / | \
\ | |/\/ |/|/\ \
\|\ |\| | | / /\/\__\
\ \| | / | |__
/ | |____)
|_/
</pre>
=Skull=
<pre>
_,.---,---.,_
,;~' '~;,
,; ;,
; ;
,' '
,; ;,
; ; . . ; :
| ; ______ ______ ; |
| '/~" ~" . "~ "~\' |
| ~ ,-~~~^~, | ,~^~~~-, ~ |
| | }:{ | |
| l / | \ ! |
.~ (__,.--" .^. "--.,__) ~.
| ----;' / | \ `;---- |
\__. \/^\/ .__/
V| \ / |V
| |T~\___!___!___/~T| |
| |`IIII_I_I_I_IIII'| |
| \,III I I I III,/ |
\ `~~~~~~~~~~' /
\ . . /
\. ^ ./
^~~~^~~~^
</pre>
=Castle=
<pre>
._-_.
|_-_(
I
/_\ ___
._-_. |,|/ \
|_-_( | /_____\ ._-_.
I \| u -| _ |_-_(
/ \ -_-_-_-_--|/ \ I
/___\ \._._._./-|___\ / \
|_u | |_ _| -| u_| /___\
|_-_-_-_-_- U_| -| _| | u_|
|_\._._._./ _|-_-_-_-_-_-_|
\_|- -| _| .. -|_|
\|- U| _| U ++ U-|/
|U -| U _| ____ -|
|- _ -| _| /|-|-\ -|
|-/#\-| _| |-|-|| -|
,___|_MEB_|-----'__I|-|-I__|__,
._/ / \____/ \,
/ \ \ \```\ \,
(__ _\ |'''| L_,
/ ./ / \```\ / _\
| / / |'''| \, |
/ ( \```\ / _/ \
/_ |'''| _,|
| \
</pre>
=kentaur=
<pre>
(_______
-.__\ __\
_) / \
\_ _ ( "("
_>_ \_-/
)/ ,-' (-.
)/ _ - - )
/,'| _)_)|
(_____ // | /||
.___\ \----._//___/ '( \\
_> / __// ',,,\ )\
_) /| /,-/ )'\|
\ ( | , |
/_,$ \ \-.__\ (_, /
( ' \ | | ) |\ /
_) _/ _/ /, )/ )
_) <\ ( ) |) |
) $_\_ / / \(
/_,\ \_\ )| /_\
)_\ /_,) )_\
|_\
</pre>
=bull=
<pre>
/| /|
| \ __ _ _ / ;
___ \ \ _.-"-" `~"\ `"--' /
_.-' ""-._\ "" ._," ; "\"--._./
_.-' \./ "-""", ) ~" |
/ ,- .' , ' `o. ; )
\ ;/ ' ; /
|/ ' | \ ' |
/ | J."\ , |
" : \ .' : | ,. _)
| | / f | |`--"--'
\_ \ \ / _/ |
\ "-._ _.| ( j/; -'/
\ | "/ ( | /, |
| \ | /\ |\_/// /
\ / \ | \ \ / /
|| \ \| | | |
|| \ \ | | /
|\ |_|/ ||
L \ || ||
`"' |\ |\
( \. \ `.
|_ _\|_ _\
" "
</pre>
=Deer=
<pre>
/| |\
`__\\ //__'
|| ||
\__`\ |'__/
`_\\ //_'
_.,:---;,._
\_: :_/
|@. .@|
| |
,\.-./ \
;;`-' `---__________-----.-.
;;; \_\
';;; |
; | ;
\ \ \ | /
\_, \ / \ |\
|';| |,,,,,,,,/ \ \ \_
| | | \ / |
\ \ | | / \ |
| || | | | | |
| || | | | | |
| || | | | | |
|_||_| |_| |_|
/_//_/ /_/ /_/
</pre>
=dinosaur=
<pre>
. .
/ `. .' \
.---. < > < > .---.
| \ \ - ~ ~ - / / |
~-..-~ ~-..-~
\~~~\.' `./~~~/
\__/ \__/
/ .- . \
_._ _.- .-~ ~-. / } \/~~~/
_.-'q }~ / } { ; \__/
{'__, / ( / { / `. ,~~| . .
`''''='~~-.__( /_ | /- _ `..-' \\ //
/ \ =/ ~~--~~{ ./| ~-. `-..__\\_//_.-'
{ \ +\ \ =\ ( ~ - . _ _ _..---~
| | { } \ \_\
'---.o___,' .o___,'
</pre>
=Dinosaur=
<pre>
__.--'~~~~~`--.
.. __. .-~ ~-.
((\ / `}.~ `.
\\\ .{ } / \ \
(\ \\~~ } | } \
\`.-~ -@~ } ,-,. | ) \
(___ ) _} ( : | / / `._
`----._-~. _\ \ |_ \ / /-.__ `._
~~----~~ \ \| ~~--~~~( + / ~-._ ~-._
/ / \ \ ~--.,___~_-_.
__/ / _\ )
.<___.' .<___/
</pre>
=Dog=
<pre>
_
,:'/ _..._
// ( `""-.._.'
\| / 6\___
| 6 4
| /
\_ .--'
(_'---'`)
/ `'---`()
,' |
, .'` |
)\ _.-' ;
/ | .'` _ /
/` / .' '. , |
/ / / \ ; | |
| \ | | .| | |
\ `"| /.-' | | |
'-..-\ _.;.._ | |.;-.
\ <`.._ )) | .;-. ))
(__. ` ))-' \_ ))'
`'--"` `"""`
</pre>
=Boss=
<pre>
.-.
/ 7, `\,')/,
( \\ =/= )))
) \\ < . D/
( \\ `e_ /
\ \\_ __\ \___
) / 7// ~ `\
/ |( / ) ) , \
( ' `\(_ (_' \ \
\ \__/ \ (\ )
) )) \\ |
/( ( )\|
( \_ / '( \
| ( |'\/\
| | |
| | /
( ` /( ,(
| ( ) \
| ) \ |
| / \ |
| / \ |
/( )\
/ / \ \
/_/ \_\
</pre>
=Dragonfly=
<pre>
.-.
()I()
"==.__:-:__.=="
"==.__/~|~\__.=="
"==._( Y )_.=="
.-'~~""~=--...,__\/|\/__,...--=~""~~'-.
( ..=\=/=.. )
`'-. ,.-"`;/=\ ;"-.,_ .-'`
`~"-=-~` .-~` |=| `~-. `~-=-"~`
.-~` /|=|\ `~-.
.~` / |=| \ `~.
.-~` .' |=| `. `~-.
(` _,.-="` |=| `"=-.,_ `)
`~"~"` |=| `"~"~`
|=|
|=|
|=|
/=\
\=/
^
</pre>
=Tuttancanon=
<pre>
___..--------..___
_.-':: '::::::' ::'-._
_.-':: :: '::' :: ::'-._
_.-':: :: :: :: :: :: ::'-._
.-':: :: :: :: :: :: :: :: ::'-.
/:::\:: :: :: :: :: :: :: :: ::/:::\
/ \:: :: :: :: :: :: :: :: ::/ \
/:::::::\:: :: :: :: :: :: :: :: ::/:::::::\
| \:: :: :: :: :: :: :: :: ::/ |
/::::::::::\:: :: :: ::/::::::::::\
/ \:: ::/ \
|:::::::::::.-\ .''''''''''''''''''''. /-.:::::::::::|
/ // \\.' .-==-. .-==-. '.// \\ \
|:::::::::::||.-| .' '. .' '. |-.||:::::::::::|
/ |||'| _.'''. \ / .'''._ |'||| \
|::::::::::::|||_|.-' :(*):'.| |.':(*): '-.|_|||::::::::::::|
/ |\_.|`''''''''' | | '''''''''`|._/| \
|:::::::::::::\(O)| | | |(O)/:::::::::::::|
| `-'| .' '. |`-' |
/:::::::::::::::::\ ( __ ) /:::::::::::::::::\
/ \ .' '. / \
|::::::::::::::::::::\ _.--..--._ /::::::::::::::::::::|
| ' '.---..---.' ' |
|::::::::::::::::::::::'. '-....-' .'::::::::::::::::::::::|
| '. .' |
'-:::::::::::::::::::::::' '.________.' ':::::::::::::::::::::::-'
/'-. | '--------' | .-'\
/ '::::::::::::::::::| |-._\\_.-| |::::::::::::::::::' \
| \ | |-._//_.-| | / |
|_..--|:::::::::::::::::| |-._\\_.-| |:::::::::::::::::|--.._|
|>.<>.<\ |._|-._//_.-|_.| />.<>.<|
|>.<>.<|::::::::::::::::|-.|-._\\_.-|.-|::::::::::::::::|>.<>.<|
|>.<>.<| |<>|-._//_.-|<>| |>.<>.<|
|>.<>.<|::::::::::::::::|<>|-._\\_.-|<>|::::::::::::::::|>.<>.<|
|>.<>.<| |<>|-._//_.-|<>| |>.<>.<|
|>.<>.<|::::::::::::::::|<>|-._\\_.-|<>|::::::::::::::::|>.<>.<|
|>.<>.<| |<>'-._//_.-'<>| |>.<>.<|
|>.<>.<|::::::::::::::::|<>.<>.<>.<>.<>|::::::::::::::::|>.<>.<|
|>.<>.<\ |<>.<>.<>.<>.<>| />.<>.<|
|>.<>.<>':::::::::::::::|<>.<>.<>.<>.<>|:::::::::::::::'<>.<>.<|
|>.<>.<>.<'. |<>.<>.<>.<>.<>| .'>.<>.<>.<|
|>.<>.<>.<>.<'::::::::::'<>.<>.<>.<>.<>'::::::::::'>.<>.<>.<>.<|
\>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<></
\>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.</
\>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>/
\>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>./
'.>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.'
'.>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<.'
'.>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<.'
'.>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<.'
''==============================''
</pre>
=Elephant=
<pre>
_,--._ _,.--'''''''---..._
,' _`''-'' `-._
/ / `. `.
/ ,_. | \ \
/ `-' | _,-'' \
| \,-' / \ `. \
| ,') ; / / |/\ \
_,.-'_,'\,-:_;;.| \\ | / | \ :
`'-'' \ \ | | \ / |/ |;
\ \ | / | / | ;;
`. \ \ |__ \ |/ ::
\ : | / `''----''`. / | \\
| ; ,\ | \ | | ;;
/ / \| | | | |
/,' || | | | |
;| | | | |
',_;-,__\ ,';-,__\.\
</pre>
=Escavator=
<pre>
.-.
/ \
_____.....-----|(o) |
_..--' _..--| .''
.' o _..--'' | | |
/ _/_..--'' | | |
________/ / / | | |
| _ ____\ / / | | |
_.-----._________|| || \\ / | | |
|=================||=||_____\\ |__|-'
| ||_||_____// (o\ |
|_________________|_________/ |-\|
`-------------._______.----' / `.
.,.,.,.,.,.,.,.,.,.,.,.,., / \
((O) o o o o ======= o o(O)) ._.' /
`-.,.,.,.,.,.,.,.,.,.,.,-' `.......'
</pre>
=Bobcat=
<pre>
______________
/.----------..-'
-. || \\
.----'-||-. \\
|o _ || | \\
| [_] || |_...-----.._\\
| [_] ||.' `-._ _
| [_] '.O)_...-----....._ `.\
/ [_]o .' _ _'''''''''_ _ `. `. __
|______/.' _ `.---.' _ `.\ `._./ \
|'''''/, .' _ '. . , .' _ '. .`. .o'| \
`---..|; : (_) : ;-; : (_) : ;-'`--.| \
' '. _ .' ' ' '. _ .' ' / \
`._ _ _,' `._ _ _,' `._____\
</pre>
=Angel=
<pre>
,_ .--.
, , _)\/ ;--.
. ' . \_\-' | .' \
-= * =- (.-, / / |
' .\' ). ))/ .' _/\ /
\_ \_ /( / \ /(
/_\ .--' `-. // \
||\/ , '._// |
||/ /`(_ (_,;`-._/ /
\_.' ) /`\ .'
.' . | ;. /`
/ |\( `.(
| |/ | ` `
| | /
| |.'
__/' /
_ .' _.-`
_.` `.-;`/
/_.-'` / /
| /
( /
/_/
</pre>
=Flamino=
<pre>
___
,' `.
/_. _,. \
( /(' \ :
\\| / ;
`' / /
/ /
: :
| : _______
: \ ,' `-._
' / . . . \
: `' ; ; ; ; , :
\`./ / / / ; ;;
`. `'../__/ / ,.\
`'-.____;-'`\\\
\ // / '|
::\
||\\
|| \\
|| ))
|| //
||//
||/
||
/||
`||-
__,';
</pre>
=Mr Gadget=
<pre>
_..__
.' I '.
|.-"""-.|
_;.-"""-.;_
_.-' _..-.-.._ '-._
';--.-(_o_I_o_)-.--;'
`. | | | | | | .`
`-\| | | |/-'
| | | |
| \_/ |
_.'; ._._. ;'._
_.-'`; | \ - / | ;'-.
.' : / | | | | \ '.
/ : /__ \ \___/ / __\ : `.
/ | / '._/_\_.' \ : `\
/ . `---;"""""'-----` . \
/ | |() () | \
/ /| | |\ \
/ / | |() () | \ \
| <jgs\_,,___|_.....____,,__/ `> |
\ \ | ][ | | ][ | / /
\ \ ;=""====='"""'====""==; / /
|/`\ \/ |() () \/ /`\|
|_/.-'; | |`-.\_|
/ | ; : \
|__.| | |.__|
; | |
| : ;
| : |
; | |
; | ;
| : |
| | ;
| | ;
'-._ ; _.-'
`;"--.....--";`
| | | |
| | | |
| | | |
T----T T----T
_..._L____J L____J _..._
.` "-. `% | | %` .-" `.
/ \ .: :. / \
'-..___|_..=:` `-:=.._|___..-'
</pre>
=Lizard=
<pre>

)/_
_.--..---"-,--c_
\L..' ._O__)_
,-. _.+ _ \..--( /
`\.-''__.-' \ ( \_
`''' `\__ /\
')
</pre>
=World=
<pre>
_.-,=_"""--,_
.-" =/7" _ .T "=.
,/7 " " ,//)`d `.
,/ " 4 ,i-/ `.
/ _)"_sm =,=T"D \
/ (_/"_`;\/gjo D-O \
/ ,d"""O-_.._.) P.___ \
, ," \\ bi- `\| Y.
| .d b\ P' V |
|\ 'O O!", |
|L. \__.=_ 7 |
' D. ) / '
\ T \ | /
\D / 7 / /
\ \ ," /" /
`. \ 7' ,'
"-_ `"' ,-'
"-._ _.-"
""""---""""
</pre>
=Gnu=
<pre>
_,-----.
_,------.__,-' `. . .
.-' `//__ \\
| ((___`-_____ ))
| \_____) \`=:'
| `=| |=,'
/ | O (|
/ /\ | |
/ / \ . \ |
| / /| / `--. ___ __,,-. |
| / // / `-' \ ,_ /'' | o o|
/ | | | | \ \ `. | ``--'
mmm | | | \ \ | |
| |\ | | || |
| | || / / `. )
\ \ \\ / / | |
|_| || / / | |
|_\ \_| | \
\__\
</pre>
=Duck=
<pre>
___
,-"" `.
,' _ e )`-._
/ ,' `-._<.===-'
/ /
/ ;
_ / ;
(`._ _.-"" ""--..__,' |
<_ `-"" \
<`- :
(__ <__. ;
`-. '-.__. _.' /
\ `-.__,-' _,'
`._ , /__,-'
""._\__,'< <____
| | `----.`.
| | \ `.
; |___ \-``
\ --<
`.`.<
`-'
</pre>
=Dog=
<pre>
()._
_.--. (##)_`-.
/ . ``u (##), ` `.
\__) _/ (##),--. \
| --' ()' \ \
/ | | |
,' \ _,' /
,' | ,;--//
/ ___\ |/ ___V__{(_
| ' \| || ,'-===- `,'|
__| ,' /| || |""""""""|-L|
,`__. < _)))_))) |________|,'
(,'
</pre>
=Giljotine=
<pre>
.___________________.
|`._______________,'|
| | | |
| |_______________| |
| || || |
| ||_ _ || |
| || ""--._._ || |
| || `-. || |
| || `. || |
| || \|| |
| || || |
| || || |
| || || |
| || || |
| || || |
| || || |
| || || |
| || || |
| || || |
| || || |
| || || |
| || || |
| || || |
| || || |
| || || |
| || || |
| || || |
| || || |
| || || |
| || || |
| ||_____________|| |
| |/ ,--. \| |
| |-(_)-( )-(_)| |
| | `--' | |
|===================|
| |
</pre>
=Gun=
<pre>
+-'~`---------------------------------/\--
||"""""""""""""""""""""""""""""""" \\\\\\ \/~)
|| \\\\\\ \/_
|~~~~~~~~-________________-_________________\ ~--_
!---------|_________ ------~~~~~(-- )--~~
\ /~~~~\~~\ )--- \_ /(
|| | | \ () \\
\\____/_ / ()\ \\
`~~~~~~~~~-. \ \\
\ \ <($)> \\
\ \ \\
\ \ \\
\ \ \\
\ \ () \|
_\_\__====~~~
</pre>
=Deer=
<pre>
( )
)) ((
// \\
| \\____// |
\~/ ~ ~\/~~/
(| _/o ~~
/ / ,|
(~~~)__.-\ |
``~~ | |
| | |
| |
/ \
`\ /'
`\_ _/'
~~~~
</pre>
=Hedgehog=
<pre>
\ / \/ \/ / ,
\ / \/ \/ \/ / ,
\ \ \/ \/ \/ \ \/ \/ /
.\ \/ \/ \/ \/ \/ / / /
' / / \/ \/ \/ \/ \/ \ \/ \
.' ) \/ \/ \/ \/ \/ \/ \ / \
/ o ) \/ \/ \/ \/ \/ \/ \// /
o'_ ',__ .' ,.,.,.,.,.,.,.,'- '%
// \\ // \\
'' '' '' ''
</pre>
=Helikopter=
<pre>
.- . _
.: ` " - . _
\ :: ` ""--..__ . . . : : :
`\ :: :' ` _ _ ""--..__ ......_._._:.:.: " " " " " "
`\.:: :' " " " - ----.....___ ""-##.____...:::""""""""""""
: : :' "::":"-----......______
." ""--..__ . .:'.: """"""-----. . . _ _ _
/.""--.._ ""--..__ : .:'. : " " "
/' .: ":-.._ ""--..__ .:'. :
`-._:__.-" ""-.._ ""--...___..:'. :
.: /.""-..__...---""-.'"-:"--.:_
" : POLICE .' ::""-."";.
:_ : :: ":: `-.
:::::.._ '-._ :: :: `.
: """:::::.._ "''-._ :: :
: "":::::.._ "': :
`. """:::::-:_ :
:. """::::::... :
..__..--"" ". . """::::::
""--..__ :.--"" ":
""-+:=:_ ("-:
: ""--.._ []'
: :""--..___..--"
: :
""--..__ :
""--.:_
""--..__.-grp
</pre>
=Halv Liter=
<pre>
| | ------------\ ,---. /------------ | |
| | ---------. `-./ "\.-' .--------- | |
| ,--. | --------\ . /-------- | ,--. |
| ( >< ) | ------`-.| .-'------ | ( >< ) |
| `--' | ---/ `/"\ \--- | `--' |
| . | `//_-_\\' 8 | |
| : . ! | (.' ',) | . : . :|
| ! ! .| | | : | ! .|
| |_| ;|_| . |_| !_| !|
`-' `-^' \o `-' `-^'
\__________________T>_________________/
`-=--=--=--=--=--=---=--=--=--=--=--=-'
] _] _] _] _] _] _L] _] _] _] _] _] _
`-------------------------------------'
`u---u---u---u---u---u---u---u---u---u'
</pre>
=Hockey=
<pre>
.---.
/_____\
_HH.H.HH
_ _-"" WHHHHHW""--__
\\ _-" __\VW=WV/__ /"".
\\ _-" \__--" "-_-" """ "_
\\/ _ ""
\\----_/_| ___ /"\ T""\====-
\\ /"-._ |%|H| ( "\|) | / .:)
\/ / |-+-| \ |_ J .:::-'
/ / |H|%| _-' '-._ " )/;"
/ / \ __ ( \ \ \ "
/ /\/ '. / \ \ \ \ _- \
"'-._/ \/ \ "-_ \ -"" _- \
_,'\\ \ \/ ) "-, -"" \
_,'_- _ \\ \ \,' \ \_\_\ \
,' _- \_\ \ \ \_\_\ \
\_ _- _- _,' \ \ \ """" )
C\_ _- _,' \ "--------. L_""""_/
" \/-' "-_________| '"-Y
</pre>
=Hockey=
<pre>
.-.-.
/_____\
:._|_|_.:
|/a> a>\|
_.-: ( ;._
,'::::\ _ /:::`-._
/:::::::`._,'|:::::::`._
/:::::_.--`._,'-.::::::::`.
:`:::;' \ ) ( `':_:;-' \
|: `' : \ \ . ,-.\
|' --._;. `:\,' .._\
|:. -.\: `;:;'.' :
:,----..(:._ ._,---.';'. `.__.'
/\,---.|:':..-(\,-, `.`..-'
/ :.--.'|:' ;',:.__.-''
: | |' ,',' /:/ /
: |,'|.-| ,',' /:/ /
/:\ : ,'_,:',' /:/ /
/ `:._\,'.`.`, -.';','
:`-._`:/ >._>.' .;\'
|`-._`:,',/_ ,'
|::::;',' ; `-'':
/\:,',| :`-..-.;
_,`,',' ; ;:::::/
,'`,','.;':_;`-::'/
<`,',;::;:-' /
,',' ( ```` ,'.::::.
,'.' /`_.__.-'::::'
_,',' `:::::::'
_______..-`.,'
,' ,----. ,'
'---`----'-''
</pre>
=Jeep=
<pre>
_.------------------.
.'____________________|
// _|||| | | | | |
______//_\__j_|||"--" "--" | | _
/-----+-|p ==,|||__________|_|-|W|
_j,====. |b_____||| _____ | |W|
|_) ,---.`.`------'|.',---.`.___|_|W|
`/ .-. \\`======__// .-. \`-----'""
\ `-' / """"""" \ `-' /
`---' `---'
</pre>
=Fool=
<pre>
,;;;;;;,
,;;;'""`;;\
,;;;/ .'`',;\
,;;;;/ | \|_
/;;;;; \ / .\
,;;;;;;| '. \/_/
/;;;;;;;| \
_,.---._ /;;;;;;;;| ; _.---.,_
.;;/ `.;;;;;;;;;| ;' \;;,
.;;;/ `;;;;;;;;;.._ .' \;;;.
/;;;;| _;-"` `"-;_ |;;;;\
|;;;;;|.---. .' __.-"```"-.__ '. .---.|;;;;;|
|;;;;;| `\/ .'/__\ /__\'. \/` |;;;;;|
|;;;;;| |_/ // \\ // \\ \_| |;;;;;|
|;;;;;| |/ |/ || || \| \| |;;;;;|
\;;;;| __ || _ .-.\| |/.-. _ || __ |;;;;/
\jgs| / _\|/ = /_o_\ /_o_\ = \|/_ \ |;;;/
\;;/ |`.- ` ` ` ` -.`| \;;/
_|;' \ | _ _ _ _ | / ';|_
/ .\ \\_ ( '--'( )'--' ) _// /. \
\/_/ \_/| /_ | | _\ |\_/ \_\/
| /|\\ \ / //|\ |
| | \'._'-'_.'/ | |
| ; '-.```.-' ; |
| \ ``` / |
__ ; '.-"""""-.' ; __
/\ \_ __..--\ `-----' /--..__ _/ /\
\_'/\`''---''`..;;;;.'.__, ,__.',;;;;..`''---''`/\'_/
'-.__'';;;;;;;;;;;,,'._ _.',,;;;;;;;;;;;''__.-'
``''--; ;;;;;;;;..`"`..;;;;;;;; ;--''`` _
.-. /,;;;;;;;';;;;;;;;;';;;;;;;,\ _.-' `\
.' /_ /,;;;;;;'/| ;;;;;;; |\';;;;;;,\ `\ '-'|
/ ) /,;;;;;',' | ;;;;;;; | ',';;;;;,\ \ .'-./
`'-..-' /,;;;;',' | ;;;;;;; | ',';;;;,\ `"`
| ;;;',' | ;;;;;;; | , ', ;;;'|
_\__.-' .-. ; ;;;;;;; ; |'-. '-.__/_
/ .\ ( ) \';;;;;'/ | | /. \
\/_/ (` `) \';;;'/ '-._| \_\/
'-/ \-' '._.' `
""" /.`\
\|_/
</pre>
=Mogly=
<pre>
.-c.
_ .., _ ( ")\
['" 6'-'</ '-/ |
; ( -=; / |
| \-` _./ |
) `'--' (
/ .. .-"`
,-"' .' '. /
__ / _.- : Y
.',-7 ) .-' ) .' ;
[ )'} < / | : |
_".(. ( \, | : \
.'-. .\.,='-' / : |
=; | |-' / : |
_/--\ | : |
/_7-'<\ \ : .(
,L / |/ \ '. .' \
'/ / \ :-; /
\> __\ / \ /_
`----' '-._\
</pre>
=King=
<pre>
.
/ \
_\ /_
. . (,'v`.) . .
\) ( ) ,' `. ( ) (/
\`. / `-' `-' \ ,'/
: ' _______ ' :
| _,-' ,-. `-._ |
|,' ( )__`-'__( ) `.|
(|,-,'-._ _.-`.-.|)
/ /<( o)> <( o)>\ \
: : | | : :
| | ; : | |
| | (.-.) | |
| | ,' ___ `. | |
; |)/ ,'---'. \(| :
_,-/ |/\( )/\| \-._
_..--'.-( | `-'''-' | )-.`--.._
`. ;`._________,': ,'
,' `/ \'`.
`------.------'
'
</pre>
=Crest=
<pre>
o .,<>., o
|\/\/\/\/|
'========'
(_ SSSSSSs
)a'`SSSSSs
/_ SSSSSS
.=## SSSSS
.#### SSSSs
###::::SSSSS
.;:::""""SSS
.:;:' . . \\
.::/ ' .'|
.::( . |
:::) \
/\( /
/) ( |
.' \ . ./ /
_-' |\ . |
_..--.. . /"---\ | ` | . |
-=====================,' _ \=(*#(7.#####() | `/_.. , (
_.-''``';'-''-) ,. \ ' '+/// | .'/ \ ``-.) \
,' _.- (( `-' `._\ `` \_/_.' ) /`-._ ) |
,'\ ,' _.'.`:-. \.-' / <_L )" |
_/ `._,' ,')`; `-'`' | L / /
/ `. ,' ,|_/ / \ ( <_-' \
\ / `./ ' / /,' \ /|` `. |
)\ /`._ ,'`._.-\ |) \'
/ `.' )-'.-,' )__) |\ `|
: /`. `.._(--.`':`':/ \ ) \ \
|::::\ ,'/::;-)) / ( )`. |
||::::: . .::': :`-( |/ . |
||::::| . :| |==[]=: . - \
|||:::| : || : | | /\ ` |
___ ___ '|;:::| | |' \=[]=| / \ \
| /_ ||``|||::::: | ; | | | \_.'\_ `-.
: \_``[]--[]|::::'\_;' )-'..`._ .-'\``:: ` . \
\___.>`''-.||:.__,' |_______`> <_____:::. . . \ _/
`+a:f:......jrei'''
</pre>
=Kiwi=
<pre>
.```. _.''..
; ``` ``'.
: d `.
/ >,: \
/.' `'., :
/' ;. . ;
/ ; \ ; ; /
`..;\: :'
__|| `...,'
`-, ) ||
/.^/ ___||
'---,_\
(/ `\
</pre>
=Knight=
<pre>
.oo.
.\. ..
,'..''\ ...oooo''
| \_/' ...oooo'''
/''.'\ . ...oooo'''
| | '| ...o!oo'''
| | |. ...oooo''./ '\
| '\, ''''\ ./ ./\ '\.
/\ooo''|''''-/ -../ / \'' '\.
/ '\. '|.''\--/-+-+-+-+-+-+-+-+.'
....- \. \. '\-'/',, /'---/' '''
././ ''\.-.-.\ '\| '',,\--;
/-/| |-'\. '> '\\
!--!| /---/' ./' |
!--!! ./---/' ,/| |
./'-/'| |----\ \-| |
./'--/ |..........|''''''./'|...........|
-'-'-' '/---/\---|' '/-\--\''''
/--/' |--\ ./---\--\
|--| \--\. ./--/' \--\
|--| |--| ./--/' \--\.
'\-| '\-| /--/' \--|
|..\ |..\ |..\ |..\
</pre>
=knight=
<pre>
.I.
/ : \
|===|
>._.<
.=-< >-=.
/.'`(`-+-')'`.\
_/`.__/ : \__.'\_
( `._/\`. : .'/\_.' )
>-(_) \ `:' / (_)-<
| | / \___/ \ | |
)^( | .' : `. | )^(
| _\|`-._:_.-'| \ |
"-<\)| : | : | "-"
(\\| : / \ : |
\\-:-| |-:-')
\\:_/ \_:_/
|\\_| |_:_|
(;\\/ \__;)
|: \\ | :|
\: /\\ \ :/
|==| \\|==|
/v-'( \\`-v\
// .-' \\. \\
`-' \\`-'
\|
</pre>
=sheep=
<pre>
,-''''-.
(. ,. L ___...__
/7} ,-` `'-==''`` ''._
//{ '`.
\_,X , : )
7 ;`
: , /
\_, \ ;
Y L_ __..--':`. L
| /| ```` ; y J
[ j J / / L ;
| |Y \ /_J | |
L_J/_) /_) L_J
/_) /_)
</pre>
=laptop=
<pre>
.-----------------------===------------------------.
:o ______________________________________________ o:
; : : ;
`. `. .' .'
: : : :
`. `. .' .'
: : : :
`. `. .' .'
: : : :
`. `. .' .'
: : : :
`. `. .' .'
: :__________________________________: :
`. .'
'-------------| |-----| |--------------'
.""""""""""""""| |"""""| |"""""""""""""".
| () '-----------' o () |
| ___________________________________ |
| :__|__|__|__|__|__|__|__|__|__|__|__: |
| |___|__|__|__|__|__|__|__|__|__|__|_| |
| |__|_|__|__|__|__|__|__|__|__|__|___| |
| |___|__|__|__|__|__|__|__|__|__|____| |
| |____|__|__|__|__|__|__|___|__|__|__| |
| :___|__|___________________|__|__|__: |
| |
| .-------------. |
| | | |
| | | |
| |_____________| |
| | | |
| | | |
| '.___________.' |
| ___ |
'-----------------------------------------'
</pre>
=grass cutter=
<pre>
---. .---
'. .'
'.'
/
/
/
/
/
/
/
/
.'.
.' \
.' |
.' \
..--/_________|.--.
// '----------'// \\
||'=:='=:='=:='||()||
\\_'--''--''--'\\__//
`--' `--`
</pre>
=lamp=
<pre>
. | ,
\ _---_ /
-_ .' `. _-
__ : .---. : __
: \ / :
-" `. | | .' "-
/ |`-'| \
' ]"-_[ `
]"-_[
"*"
</pre>
=Lion=
<pre>
,.
,_> `. ,';
,-`' `' '`'._
,,-) ---._ | .---''`-),.
,' `. \ ; / _,' `,
,--' ____ \ ' ,' ___ `-,
_> /--. `-. .-'.--\ \__
'-, ( `. `.,`~ \~'-. ,' ,' ) _\
_> \ \ ,' ') ) `. / / <,.
,-' _, \ ,' ( / `. / `-,
`-.,-' `.,' ` `.,' `\ ,-'
,' _ / ,,, ,,, \ `-. `-._
/-, ,' ; ' _ \ / _ ` ; `. `(`-\
/-, ; (o) (o) ; `'`,
,~-' ,-' \ ' ` / \ <_
/-. ,' \ / \ ,-'
'`, ,' `-/ \-' `. `-. <
/_ / / (_ _) \ \ `,
`-._; ,' | .::.`-.-' :.. | `-. _\
_/ \ `:: ,^. :.:' / `. \,-'
'`. ,-' /`-..-'-.-`-..-'\ `-.
>_ / ; (\/( ' )\/) ; `-. _<
,-' `. \`-^^^-'/ ,' \ _<
`-, ,' `. `"""""' ,' `-. <`'
') `._.,,_.' \ ,-'
'._ '`'`' \ <
> ,' , `-. <`'
`,/ \ ,-`
`, ,' | / /
'; / ; (
_)| ` (
`') .-'
<_ \ /
\ /\(
`;/ `
</pre>
=I love you=
<pre>
__,,,__
,-""-,-" "-,-""-,
/,-' , .-'-.7.-'-. , '-,\
\( / _ _ \ )/
'-, { (0) (0) } ,-'
/ > .---. < \
|/ .-' \___/ '-. \|
{, / ,_ _, \ ,}
\ {, \ / ,} /
',\. '---' ./,'
_.-""""""-._ _.-""""""-._
.' `._.` '.
_/_ _ \
.'` `\ | | \
/ | | | ;
| / |_| |
\ ;'---' _ ___ _ _ ___ ;
'. ; | | / \| || || _| _ ;
`-\ | |_ | | || |/ /| _| .' `,
`\ |___|\___/ \__/ |___| | \
\ _ _ \ |
`\ | | | /` _/
,-""-. .'`\ | | | /`-,-'` .-""-,
/ `\.' `\ \___/ /` './` \
; .--. \ '\ /' / .--. ;
| ( \ |, '\ /' | / ) |
\ ; } ;\ /; ` { ; /
`;\ \ _.-' \ / `-._ / /;`
\ \__.' _.-' Y `-._ '.__//
'.___,.-' `-.,___.'
</pre>
=Lynx=
<pre>
, ,
(\ "\
,--;.)._
).,-._ . ""-,_
/.'".- " 8 o . ";_
`L_ ,-)) o . 8.o .""-.---...,,--------.._ _"";
""" ")) 8 . . 8 . 8 8 8 8 8. 8 8 ._""._;
";. .8 .8 .8 8 8 8 8 . 8. 8 .".""
;.. 8 ; . 8. 8 8 8 . } 8 . 8 :
;.. 8 ; 8. 8 8 8 8 ( . 8 . :
;. 8 \ . .......;;; 8 . 8 :
;o ;"\\\\```````( o( 8 .;
: o: ; :. : . 8 (
:o ; ; "; ";. o :
; o; ; "; ;";..\
;.; .: )./ ;. ;
_).< .; _;./ _;./
;"__/--" ((__7 ((_J
</pre>
=Wizard=
<pre>
o
O /`-.__
/ \ '^|
o T l *
_|-..-|_
O (^ '----' `)
`\-....-/^
O o ) "/ " (
_( (-) )_
O /\ ) ( /\
/ $ ) | \
o o $ ( / \
/ |( )| \
/ o \ \( / \
__.--' O \_ / .._ \
//|)\ , (_) /(((\^)'\
| | O ) ` |
| / o___ / /
/ _.-''^^__O_^^''-._ /
.' / -''^^ ^^''- \--'^
.' .`. `'''----'''^ .`. \
.' / `'--..____..--'^ \ \
/ _.-/ \ \
.::'_/^ | | `.
.-'| | `-.
_.--'` \ / `-.
/ \ / `-._
`'---..__ `. .´_.._ __ \
``'''`. .' `'^ `''---'^
`-..______..-'
</pre>
=Suricat=
<pre>
,'''''-._
; ,. <> `-._
; \' _,--'"
; (
; , ` \
;, , \
; | |
; |, | |\
; | | | \
|.-\ ,\ |\ :
|.- `. `-. | ||
:.- `-. \ ';;
.- , \;;|
; , | ,\
; , ; \
; , /`. , )
__,;, ,' \ ,|
_,--''__,| / \ :
,'_,-'' | ,/ | :
/ / | ; ; |
| | __,-| |--..__,--| |---.--....___
___,-| |----'' / | `._`-. `----
\ \ `""" """ --
`.`. --'
`.`-._ _, ,- __,-
`-.`.
--' `;
</pre
=Dagger=
<pre>
,-.
("O_)
/ `-/
/-. /
/ )
/ /
_ /-. /
(_)"-._ / )
"-._ "-'""( )/
"-/"-._" `.
/ "-.'._
/\ /-._"-._
_,---...__ / ) _,-"/ "-(_)
___<__(|) _ ""-/ / / /
' `----' ""-. \/ / /
) ] / /
____..-' // / )
,-"" __.,'/ / ___ /,
/ ,--""/ / / /,-"" """-. ,'/
[ ( / / / / ,.---,_ `._ _,-','
\ `-./ / / / / `-._ """ ,-'
`-._ / / / /_,' ""--"
"/ / / /"
/ / / /
/ / / /
/ |,' /
: / /
[ / ,'
| / ,'
|/,-'
P'
</pre>
=Superman=
<pre>
.=.,
;c =\
__| _/
.'-'-._/-'-._
/.. ____ \
/' _ [<_->] ) \
( / \--\_>/-/'._ )
\-;_/\__;__/ _/ _/
'._}|==o==\{_\/
/ /-._.--\ \_
// / /| \ \ \
/ | | | \; | \ \
/ / | :/ \: \ \_\
/ | /.'| /: | \ \
| | |--| . |--| \_\
/ _/ \ | : | /___--._) \
|_(---'-| >-'-| | '-'
/_/ \_\
</pre>

=Supergirl=
<pre>
,
;\
: "-.
: ""--._
; "-._
: "-.
\ `.
`. `.
""--._ \
""--._ ;
`. :
.----. `. ;
/.-J-. \ ;`. ;
:/ / \ `-; ; ;:
;_/ _."-+: , : / ;
: -= =;\ ;\ ;' /
;"\ ,: `--' ; .' :
: t -= '"-._ ( ___ .' ;
; :"-._/`-. `-"+ .-" `.__.-" ;
.-: \ :-.____..--:-" ;
__.^-:_j `;J:\_ _.' :
_.--"" : / "-,l "-;""" ;
_.--"" :' -' `. ___ ;
_.-".-" .' / : \ """--..__.-' :
/ .' _.-" / : ; . :\ ;
/ .' .-" j : / /\ \ /
/ / .' / t--' `....' / \ \ /
/ : / / : : / `. "-. :
: ; / / ;/ ; `. / : `. `. ;
\ : / : :/: ; ; : \ \ \ .'
;.\/ : j : : : ; "-._ `. `. .-"
: `. .-; /-.; ; ; :`. .' "-.__j+. `._.-"
;`. `. : : : : .--"" t "-( `. \
/ "-.`. \; ; ;`.-" .--"".^. `. `.-"\
:\ `. :__: :`. .-T__.-".-: \ : _ "-._
; `. `. \; `\ : Y-" _.-" \ ; ;: "-._/
: "-. `. \ : ; ; / .'/ ; : :; U
"-._ `. \ ;j:/ : / : : ;
/ ""--..__`-""+:-+.\ ; ; /
,--^-...__ _.-"; `| "--: : .'
; _. _.-" : ; | ;"
:.-".-"_.-" ; ; ; /
J.-".-" .--"-. .-" | : /
.-".-" : "" : | /
: / : ; ; /
;: _..-' | : /
: ; \ : | /
; ; \ ; ; :
: ; ; : : `.
; : ; ; \ , `.
: \ / : \;"-.__\
: `.: /; ; \ ;
\ "-. /: : \ ;
`. `. ; ; :/`. \ :
"-. `. :: ; `-:\ :
"-._ `. .-"; | : \ ;
"-._ `..-" : : : \ :__
"-. `. .' ; | ; ) ;
"-.J.' | | : :
: ; ; :
; ; : \
| :_ ; ;
: .' \ | /
; / :_.'
; :
: ;
; :
| ;
:_/
</pre>
=Eagle=
<pre>
/T /I
/ |/ | .-~/
T\ Y I |/ / _
/T | \I | I Y.-~/
I l /I T\ | | l | T /
T\ | \ Y l /T | \I l \ ` l Y
__ | \l \l \I l __l l \ ` _. |
\ ~-l `\ `\ \ \\ ~\ \ `. .-~ |
\ ~-. "-. ` \ ^._ ^. "-. / \ |
.--~-._ ~- ` _ ~-_.-"-." ._ /._ ." ./
>--. ~-. ._ ~>-" "\\ 7 7 ]
^.___~"--._ ~-{ .-~ . `\ Y . / |
<__ ~"-. ~ /_/ \ \I Y : |
^-.__ ~(_/ \ >._: | l______
^--.,___.-~" /_/ ! `-.~"--l_ / ~"-.
(_/ . ~( /' "~"--,Y -=b-. _)
(_/ . \ : / l c"~o \
\ / `. . .^ \_.-~"~--. )
(_/ . ` / / ! )/
/ / _. '. .': / '
~(_/ . / _ ` .-<_
/_/ . ' .-~" `. / \ \ ,z=.
~( / ' : | K "-.~-.______//
"-,. l I/ \_ __{--->._(==.
//( \ < ~"~" //
/' /\ \ \ ,v=. ((
.^. / /\ " }__ //===- `
/ / ' ' "-.,__ {---(==-
.^ ' : T ~" ll
/ . . . : | :! \\
(_/ / | | j-" ~^
~-<_(_.^-~"
</pre>
=Dog=
<pre>
,--._______,-.
,',' , . ,_`-.
/ / ,' , _` ``. | ) `-..
(,';'""`/ '"`-._ ` \/ ______ \\
: ,o.-`- ,o. )\` -' `---.))
: , d8b ^-. '| `. ` `.
|/ __:_ `. | , ` ` \
| ( ,-.`-. ;' ; ` : ;
| | , `. / ; : \
;-'`:::._,`.__),' : ;
/ , `- `-- ; |
/ \ ` , |
( ` : : ,\ |
\ `. : : : ,' \ :
\ `|-- ` \ ,' ,-' :-.-';
: |`--.______; | : :
: / | | | \
| ; ; ; / ;
_/--' | :`-- / \_:_:_|
,',',' | |___ \
`^._,--' / , , .)
`-._,-'
</pre>
=kitten=
<pre>
. ,.
T."-._..---.._,-"/|
l|"-. _.v._ (" |
[l /.'_ \; _~"-.`-t
Y " _(o} _{o)._ ^.|
j T ,-<v>-. T ]
\ l ( /-^-\ ) ! !
\. \. "~" ./ /c-..,__
^r- .._ .- .-" `- . ~"--.
> \. \
] ^. \
3 . "> . Y
,.__.--._ _j \ ~ . ; |
( ~"-._~"^._\ ^. ^._ I . l
"-._ ___ ~"-,_7 .Z-._ 7" Y ; \ _
/" "~-(r r _/_--._~-/ / /,.--^-._ / Y
"-._ '"~~~>-._~]>--^---./____,.^~ ^.^ !
~--._ ' Y---. \./
~~--._ l_ ) \
~-._~~~---._,____..--- \
~----"~ \
\
</pre>

Ascii

2026-03-24T13:52:57Z

Ekaanbj: /* Dagger */

Stolen with pride from https://www.ascii-art.de/ascii/
=Ferdinad=
<pre>
|\ _____
|\ J \ _.--' `-.__
\`. \ \--.-'" `-.-.__
\ `-. .' \ `.__.`. \ `-.
`. J | `. ) ` `.
`-. /\ | )-.__.<_ __ \
\\/ \|>- ' `.'.') \
`\ / \ -._.-' / \
|| | /\ `-.__.' \
|| | | | \
'' |-'-'/ \
. .-.' _.\'' `.
|| ( /.-.|`-._ / . L
\\ \ (_.' /|| /_.'-' L
\ .'//__.-' >_`. J
`.__.'-' | `-`-. J
/_/\ \ \ _ L
||| /- |`- \ . .' `- J
| || F/ ) \ | / | J \ L
\ L.'// / \ J L| F J \-. |
_ \/ // .-'| \ \ \| / J | J
_ .-()-| / ____.-<_(/` .'`-. \ | J.-' F F \ F__.--"""-.
`. / `._ _ _) V/// . (_.( /.--.\`- \ / F F `. _.---. J
`.\ / ' \|\||\\///.' ( \ /' `--._ | | \ J L \" _.'.'
`.\\_F .''./\ -./)/.'/ _ `.__`-.--' `.-| / \ Y | .-' `)
`.(/`.(\||/)\\-'/ .')/) "" `) / `-..-""`. `. || / \
.-'| /\\$)'_|/-'/'()-'-> F J-._J_ `.. \_.' \ | )
.'``\\\//\\/).'/\\/)\\" _.' | .' \_.-. J____.) `. (
/ ___-(`.|//-(\|_/-`-' .' ' | (__./ )-' `--.\
__\|/`-()-<(/()-< .-' `. ___| (__.-'
`-()(.'|_)-<\_)-' <___.-| F
|/$ \_ \ | .-'
`\ "
</pre>
=Haircut=
<pre>
|
|/ |
,,,,, ,+ /|
/ \ () | ||
\ C '\ /|_() ||
) _| .'___/,,,// ||
.'=. (____E.' / / \ ||
| \)`-\ _F_.' \ c `\ ||
\ \ !'__/ ) _| ||
\ \,' / /`._( ||
|`. .' / \ \ ||
\ `-' | .-. | | \ E ||
>====[] | \ |__| | O OE ||
/ |_/ | |___)| `.__j____ \|E ||
\_ | || __`.________ `. |""|\|
\ |\ ||| \///_ _|__|_|
\ __ | \ ||`""\\""""//"' \`. \ |
|[__]| \ ||.---\\__//---. | | \____|
||__|/ / \|____________|\ |/ |
| | / || || /| | |
-----| |/------------||-||-/`| |----------|
/| | || ||/`-|___| |
/\| | || \\._ [____] h|
/`.|____| || \\ `-/ '`._ j|
`=.\____/ || \\__`-.____) w|
) '`--. _.-||-._ `""""""" |
`='====' ,-' ' ` `-. |
`-.________.-' |
</pre>
=Batman=
<pre>
. .
|\_|\
| a_a\
| | "]
____| '-\___
/.----.___.-'\
// _ \
// .-. (~v~) /|
|'| /\: .-- / \
// |-/ \_/____/\/~|
|/ \ | []_|_|_] \ |
| \ | \ |___ _\ ]_}
| | '-' / '.' |
| | / /|: |
| | | / |: /\
| | / / | / \
| | | / / | \
\ | |/\/ |/|/\ \
\|\ |\| | | / /\/\__\
\ \| | / | |__
/ | |____)
|_/
</pre>
=Skull=
<pre>
_,.---,---.,_
,;~' '~;,
,; ;,
; ;
,' '
,; ;,
; ; . . ; :
| ; ______ ______ ; |
| '/~" ~" . "~ "~\' |
| ~ ,-~~~^~, | ,~^~~~-, ~ |
| | }:{ | |
| l / | \ ! |
.~ (__,.--" .^. "--.,__) ~.
| ----;' / | \ `;---- |
\__. \/^\/ .__/
V| \ / |V
| |T~\___!___!___/~T| |
| |`IIII_I_I_I_IIII'| |
| \,III I I I III,/ |
\ `~~~~~~~~~~' /
\ . . /
\. ^ ./
^~~~^~~~^
</pre>
=Castle=
<pre>
._-_.
|_-_(
I
/_\ ___
._-_. |,|/ \
|_-_( | /_____\ ._-_.
I \| u -| _ |_-_(
/ \ -_-_-_-_--|/ \ I
/___\ \._._._./-|___\ / \
|_u | |_ _| -| u_| /___\
|_-_-_-_-_- U_| -| _| | u_|
|_\._._._./ _|-_-_-_-_-_-_|
\_|- -| _| .. -|_|
\|- U| _| U ++ U-|/
|U -| U _| ____ -|
|- _ -| _| /|-|-\ -|
|-/#\-| _| |-|-|| -|
,___|_MEB_|-----'__I|-|-I__|__,
._/ / \____/ \,
/ \ \ \```\ \,
(__ _\ |'''| L_,
/ ./ / \```\ / _\
| / / |'''| \, |
/ ( \```\ / _/ \
/_ |'''| _,|
| \
</pre>
=kentaur=
<pre>
(_______
-.__\ __\
_) / \
\_ _ ( "("
_>_ \_-/
)/ ,-' (-.
)/ _ - - )
/,'| _)_)|
(_____ // | /||
.___\ \----._//___/ '( \\
_> / __// ',,,\ )\
_) /| /,-/ )'\|
\ ( | , |
/_,$ \ \-.__\ (_, /
( ' \ | | ) |\ /
_) _/ _/ /, )/ )
_) <\ ( ) |) |
) $_\_ / / \(
/_,\ \_\ )| /_\
)_\ /_,) )_\
|_\
</pre>
=bull=
<pre>
/| /|
| \ __ _ _ / ;
___ \ \ _.-"-" `~"\ `"--' /
_.-' ""-._\ "" ._," ; "\"--._./
_.-' \./ "-""", ) ~" |
/ ,- .' , ' `o. ; )
\ ;/ ' ; /
|/ ' | \ ' |
/ | J."\ , |
" : \ .' : | ,. _)
| | / f | |`--"--'
\_ \ \ / _/ |
\ "-._ _.| ( j/; -'/
\ | "/ ( | /, |
| \ | /\ |\_/// /
\ / \ | \ \ / /
|| \ \| | | |
|| \ \ | | /
|\ |_|/ ||
L \ || ||
`"' |\ |\
( \. \ `.
|_ _\|_ _\
" "
</pre>
=Deer=
<pre>
/| |\
`__\\ //__'
|| ||
\__`\ |'__/
`_\\ //_'
_.,:---;,._
\_: :_/
|@. .@|
| |
,\.-./ \
;;`-' `---__________-----.-.
;;; \_\
';;; |
; | ;
\ \ \ | /
\_, \ / \ |\
|';| |,,,,,,,,/ \ \ \_
| | | \ / |
\ \ | | / \ |
| || | | | | |
| || | | | | |
| || | | | | |
|_||_| |_| |_|
/_//_/ /_/ /_/
</pre>
=dinosaur=
<pre>
. .
/ `. .' \
.---. < > < > .---.
| \ \ - ~ ~ - / / |
~-..-~ ~-..-~
\~~~\.' `./~~~/
\__/ \__/
/ .- . \
_._ _.- .-~ ~-. / } \/~~~/
_.-'q }~ / } { ; \__/
{'__, / ( / { / `. ,~~| . .
`''''='~~-.__( /_ | /- _ `..-' \\ //
/ \ =/ ~~--~~{ ./| ~-. `-..__\\_//_.-'
{ \ +\ \ =\ ( ~ - . _ _ _..---~
| | { } \ \_\
'---.o___,' .o___,'
</pre>
=Dinosaur=
<pre>
__.--'~~~~~`--.
.. __. .-~ ~-.
((\ / `}.~ `.
\\\ .{ } / \ \
(\ \\~~ } | } \
\`.-~ -@~ } ,-,. | ) \
(___ ) _} ( : | / / `._
`----._-~. _\ \ |_ \ / /-.__ `._
~~----~~ \ \| ~~--~~~( + / ~-._ ~-._
/ / \ \ ~--.,___~_-_.
__/ / _\ )
.<___.' .<___/
</pre>
=Dog=
<pre>
_
,:'/ _..._
// ( `""-.._.'
\| / 6\___
| 6 4
| /
\_ .--'
(_'---'`)
/ `'---`()
,' |
, .'` |
)\ _.-' ;
/ | .'` _ /
/` / .' '. , |
/ / / \ ; | |
| \ | | .| | |
\ `"| /.-' | | |
'-..-\ _.;.._ | |.;-.
\ <`.._ )) | .;-. ))
(__. ` ))-' \_ ))'
`'--"` `"""`
</pre>
=Boss=
<pre>
.-.
/ 7, `\,')/,
( \\ =/= )))
) \\ < . D/
( \\ `e_ /
\ \\_ __\ \___
) / 7// ~ `\
/ |( / ) ) , \
( ' `\(_ (_' \ \
\ \__/ \ (\ )
) )) \\ |
/( ( )\|
( \_ / '( \
| ( |'\/\
| | |
| | /
( ` /( ,(
| ( ) \
| ) \ |
| / \ |
| / \ |
/( )\
/ / \ \
/_/ \_\
</pre>
=Dragonfly=
<pre>
.-.
()I()
"==.__:-:__.=="
"==.__/~|~\__.=="
"==._( Y )_.=="
.-'~~""~=--...,__\/|\/__,...--=~""~~'-.
( ..=\=/=.. )
`'-. ,.-"`;/=\ ;"-.,_ .-'`
`~"-=-~` .-~` |=| `~-. `~-=-"~`
.-~` /|=|\ `~-.
.~` / |=| \ `~.
.-~` .' |=| `. `~-.
(` _,.-="` |=| `"=-.,_ `)
`~"~"` |=| `"~"~`
|=|
|=|
|=|
/=\
\=/
^
</pre>
=Tuttancanon=
<pre>
___..--------..___
_.-':: '::::::' ::'-._
_.-':: :: '::' :: ::'-._
_.-':: :: :: :: :: :: ::'-._
.-':: :: :: :: :: :: :: :: ::'-.
/:::\:: :: :: :: :: :: :: :: ::/:::\
/ \:: :: :: :: :: :: :: :: ::/ \
/:::::::\:: :: :: :: :: :: :: :: ::/:::::::\
| \:: :: :: :: :: :: :: :: ::/ |
/::::::::::\:: :: :: ::/::::::::::\
/ \:: ::/ \
|:::::::::::.-\ .''''''''''''''''''''. /-.:::::::::::|
/ // \\.' .-==-. .-==-. '.// \\ \
|:::::::::::||.-| .' '. .' '. |-.||:::::::::::|
/ |||'| _.'''. \ / .'''._ |'||| \
|::::::::::::|||_|.-' :(*):'.| |.':(*): '-.|_|||::::::::::::|
/ |\_.|`''''''''' | | '''''''''`|._/| \
|:::::::::::::\(O)| | | |(O)/:::::::::::::|
| `-'| .' '. |`-' |
/:::::::::::::::::\ ( __ ) /:::::::::::::::::\
/ \ .' '. / \
|::::::::::::::::::::\ _.--..--._ /::::::::::::::::::::|
| ' '.---..---.' ' |
|::::::::::::::::::::::'. '-....-' .'::::::::::::::::::::::|
| '. .' |
'-:::::::::::::::::::::::' '.________.' ':::::::::::::::::::::::-'
/'-. | '--------' | .-'\
/ '::::::::::::::::::| |-._\\_.-| |::::::::::::::::::' \
| \ | |-._//_.-| | / |
|_..--|:::::::::::::::::| |-._\\_.-| |:::::::::::::::::|--.._|
|>.<>.<\ |._|-._//_.-|_.| />.<>.<|
|>.<>.<|::::::::::::::::|-.|-._\\_.-|.-|::::::::::::::::|>.<>.<|
|>.<>.<| |<>|-._//_.-|<>| |>.<>.<|
|>.<>.<|::::::::::::::::|<>|-._\\_.-|<>|::::::::::::::::|>.<>.<|
|>.<>.<| |<>|-._//_.-|<>| |>.<>.<|
|>.<>.<|::::::::::::::::|<>|-._\\_.-|<>|::::::::::::::::|>.<>.<|
|>.<>.<| |<>'-._//_.-'<>| |>.<>.<|
|>.<>.<|::::::::::::::::|<>.<>.<>.<>.<>|::::::::::::::::|>.<>.<|
|>.<>.<\ |<>.<>.<>.<>.<>| />.<>.<|
|>.<>.<>':::::::::::::::|<>.<>.<>.<>.<>|:::::::::::::::'<>.<>.<|
|>.<>.<>.<'. |<>.<>.<>.<>.<>| .'>.<>.<>.<|
|>.<>.<>.<>.<'::::::::::'<>.<>.<>.<>.<>'::::::::::'>.<>.<>.<>.<|
\>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<></
\>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.</
\>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>/
\>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>./
'.>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.'
'.>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<.'
'.>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<.'
'.>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<>.<.'
''==============================''
</pre>
=Elephant=
<pre>
_,--._ _,.--'''''''---..._
,' _`''-'' `-._
/ / `. `.
/ ,_. | \ \
/ `-' | _,-'' \
| \,-' / \ `. \
| ,') ; / / |/\ \
_,.-'_,'\,-:_;;.| \\ | / | \ :
`'-'' \ \ | | \ / |/ |;
\ \ | / | / | ;;
`. \ \ |__ \ |/ ::
\ : | / `''----''`. / | \\
| ; ,\ | \ | | ;;
/ / \| | | | |
/,' || | | | |
;| | | | |
',_;-,__\ ,';-,__\.\
</pre>
=Escavator=
<pre>
.-.
/ \
_____.....-----|(o) |
_..--' _..--| .''
.' o _..--'' | | |
/ _/_..--'' | | |
________/ / / | | |
| _ ____\ / / | | |
_.-----._________|| || \\ / | | |
|=================||=||_____\\ |__|-'
| ||_||_____// (o\ |
|_________________|_________/ |-\|
`-------------._______.----' / `.
.,.,.,.,.,.,.,.,.,.,.,.,., / \
((O) o o o o ======= o o(O)) ._.' /
`-.,.,.,.,.,.,.,.,.,.,.,-' `.......'
</pre>
=Bobcat=
<pre>
______________
/.----------..-'
-. || \\
.----'-||-. \\
|o _ || | \\
| [_] || |_...-----.._\\
| [_] ||.' `-._ _
| [_] '.O)_...-----....._ `.\
/ [_]o .' _ _'''''''''_ _ `. `. __
|______/.' _ `.---.' _ `.\ `._./ \
|'''''/, .' _ '. . , .' _ '. .`. .o'| \
`---..|; : (_) : ;-; : (_) : ;-'`--.| \
' '. _ .' ' ' '. _ .' ' / \
`._ _ _,' `._ _ _,' `._____\
</pre>
=Angel=
<pre>
,_ .--.
, , _)\/ ;--.
. ' . \_\-' | .' \
-= * =- (.-, / / |
' .\' ). ))/ .' _/\ /
\_ \_ /( / \ /(
/_\ .--' `-. // \
||\/ , '._// |
||/ /`(_ (_,;`-._/ /
\_.' ) /`\ .'
.' . | ;. /`
/ |\( `.(
| |/ | ` `
| | /
| |.'
__/' /
_ .' _.-`
_.` `.-;`/
/_.-'` / /
| /
( /
/_/
</pre>
=Flamino=
<pre>
___
,' `.
/_. _,. \
( /(' \ :
\\| / ;
`' / /
/ /
: :
| : _______
: \ ,' `-._
' / . . . \
: `' ; ; ; ; , :
\`./ / / / ; ;;
`. `'../__/ / ,.\
`'-.____;-'`\\\
\ // / '|
::\
||\\
|| \\
|| ))
|| //
||//
||/
||
/||
`||-
__,';
</pre>
=Mr Gadget=
<pre>
_..__
.' I '.
|.-"""-.|
_;.-"""-.;_
_.-' _..-.-.._ '-._
';--.-(_o_I_o_)-.--;'
`. | | | | | | .`
`-\| | | |/-'
| | | |
| \_/ |
_.'; ._._. ;'._
_.-'`; | \ - / | ;'-.
.' : / | | | | \ '.
/ : /__ \ \___/ / __\ : `.
/ | / '._/_\_.' \ : `\
/ . `---;"""""'-----` . \
/ | |() () | \
/ /| | |\ \
/ / | |() () | \ \
| <jgs\_,,___|_.....____,,__/ `> |
\ \ | ][ | | ][ | / /
\ \ ;=""====='"""'====""==; / /
|/`\ \/ |() () \/ /`\|
|_/.-'; | |`-.\_|
/ | ; : \
|__.| | |.__|
; | |
| : ;
| : |
; | |
; | ;
| : |
| | ;
| | ;
'-._ ; _.-'
`;"--.....--";`
| | | |
| | | |
| | | |
T----T T----T
_..._L____J L____J _..._
.` "-. `% | | %` .-" `.
/ \ .: :. / \
'-..___|_..=:` `-:=.._|___..-'
</pre>
=Lizard=
<pre>

)/_
_.--..---"-,--c_
\L..' ._O__)_
,-. _.+ _ \..--( /
`\.-''__.-' \ ( \_
`''' `\__ /\
')
</pre>
=World=
<pre>
_.-,=_"""--,_
.-" =/7" _ .T "=.
,/7 " " ,//)`d `.
,/ " 4 ,i-/ `.
/ _)"_sm =,=T"D \
/ (_/"_`;\/gjo D-O \
/ ,d"""O-_.._.) P.___ \
, ," \\ bi- `\| Y.
| .d b\ P' V |
|\ 'O O!", |
|L. \__.=_ 7 |
' D. ) / '
\ T \ | /
\D / 7 / /
\ \ ," /" /
`. \ 7' ,'
"-_ `"' ,-'
"-._ _.-"
""""---""""
</pre>
=Gnu=
<pre>
_,-----.
_,------.__,-' `. . .
.-' `//__ \\
| ((___`-_____ ))
| \_____) \`=:'
| `=| |=,'
/ | O (|
/ /\ | |
/ / \ . \ |
| / /| / `--. ___ __,,-. |
| / // / `-' \ ,_ /'' | o o|
/ | | | | \ \ `. | ``--'
mmm | | | \ \ | |
| |\ | | || |
| | || / / `. )
\ \ \\ / / | |
|_| || / / | |
|_\ \_| | \
\__\
</pre>
=Duck=
<pre>
___
,-"" `.
,' _ e )`-._
/ ,' `-._<.===-'
/ /
/ ;
_ / ;
(`._ _.-"" ""--..__,' |
<_ `-"" \
<`- :
(__ <__. ;
`-. '-.__. _.' /
\ `-.__,-' _,'
`._ , /__,-'
""._\__,'< <____
| | `----.`.
| | \ `.
; |___ \-``
\ --<
`.`.<
`-'
</pre>
=Dog=
<pre>
()._
_.--. (##)_`-.
/ . ``u (##), ` `.
\__) _/ (##),--. \
| --' ()' \ \
/ | | |
,' \ _,' /
,' | ,;--//
/ ___\ |/ ___V__{(_
| ' \| || ,'-===- `,'|
__| ,' /| || |""""""""|-L|
,`__. < _)))_))) |________|,'
(,'
</pre>
=Giljotine=
<pre>
.___________________.
|`._______________,'|
| | | |
| |_______________| |
| || || |
| ||_ _ || |
| || ""--._._ || |
| || `-. || |
| || `. || |
| || \|| |
| || || |
| || || |
| || || |
| || || |
| || || |
| || || |
| || || |
| || || |
| || || |
| || || |
| || || |
| || || |
| || || |
| || || |
| || || |
| || || |
| || || |
| || || |
| || || |
| || || |
| ||_____________|| |
| |/ ,--. \| |
| |-(_)-( )-(_)| |
| | `--' | |
|===================|
| |
</pre>
=Gun=
<pre>
+-'~`---------------------------------/\--
||"""""""""""""""""""""""""""""""" \\\\\\ \/~)
|| \\\\\\ \/_
|~~~~~~~~-________________-_________________\ ~--_
!---------|_________ ------~~~~~(-- )--~~
\ /~~~~\~~\ )--- \_ /(
|| | | \ () \\
\\____/_ / ()\ \\
`~~~~~~~~~-. \ \\
\ \ <($)> \\
\ \ \\
\ \ \\
\ \ \\
\ \ () \|
_\_\__====~~~
</pre>
=Deer=
<pre>
( )
)) ((
// \\
| \\____// |
\~/ ~ ~\/~~/
(| _/o ~~
/ / ,|
(~~~)__.-\ |
``~~ | |
| | |
| |
/ \
`\ /'
`\_ _/'
~~~~
</pre>
=Hedgehog=
<pre>
\ / \/ \/ / ,
\ / \/ \/ \/ / ,
\ \ \/ \/ \/ \ \/ \/ /
.\ \/ \/ \/ \/ \/ / / /
' / / \/ \/ \/ \/ \/ \ \/ \
.' ) \/ \/ \/ \/ \/ \/ \ / \
/ o ) \/ \/ \/ \/ \/ \/ \// /
o'_ ',__ .' ,.,.,.,.,.,.,.,'- '%
// \\ // \\
'' '' '' ''
</pre>
=Helikopter=
<pre>
.- . _
.: ` " - . _
\ :: ` ""--..__ . . . : : :
`\ :: :' ` _ _ ""--..__ ......_._._:.:.: " " " " " "
`\.:: :' " " " - ----.....___ ""-##.____...:::""""""""""""
: : :' "::":"-----......______
." ""--..__ . .:'.: """"""-----. . . _ _ _
/.""--.._ ""--..__ : .:'. : " " "
/' .: ":-.._ ""--..__ .:'. :
`-._:__.-" ""-.._ ""--...___..:'. :
.: /.""-..__...---""-.'"-:"--.:_
" : POLICE .' ::""-."";.
:_ : :: ":: `-.
:::::.._ '-._ :: :: `.
: """:::::.._ "''-._ :: :
: "":::::.._ "': :
`. """:::::-:_ :
:. """::::::... :
..__..--"" ". . """::::::
""--..__ :.--"" ":
""-+:=:_ ("-:
: ""--.._ []'
: :""--..___..--"
: :
""--..__ :
""--.:_
""--..__.-grp
</pre>
=Halv Liter=
<pre>
| | ------------\ ,---. /------------ | |
| | ---------. `-./ "\.-' .--------- | |
| ,--. | --------\ . /-------- | ,--. |
| ( >< ) | ------`-.| .-'------ | ( >< ) |
| `--' | ---/ `/"\ \--- | `--' |
| . | `//_-_\\' 8 | |
| : . ! | (.' ',) | . : . :|
| ! ! .| | | : | ! .|
| |_| ;|_| . |_| !_| !|
`-' `-^' \o `-' `-^'
\__________________T>_________________/
`-=--=--=--=--=--=---=--=--=--=--=--=-'
] _] _] _] _] _] _L] _] _] _] _] _] _
`-------------------------------------'
`u---u---u---u---u---u---u---u---u---u'
</pre>
=Hockey=
<pre>
.---.
/_____\
_HH.H.HH
_ _-"" WHHHHHW""--__
\\ _-" __\VW=WV/__ /"".
\\ _-" \__--" "-_-" """ "_
\\/ _ ""
\\----_/_| ___ /"\ T""\====-
\\ /"-._ |%|H| ( "\|) | / .:)
\/ / |-+-| \ |_ J .:::-'
/ / |H|%| _-' '-._ " )/;"
/ / \ __ ( \ \ \ "
/ /\/ '. / \ \ \ \ _- \
"'-._/ \/ \ "-_ \ -"" _- \
_,'\\ \ \/ ) "-, -"" \
_,'_- _ \\ \ \,' \ \_\_\ \
,' _- \_\ \ \ \_\_\ \
\_ _- _- _,' \ \ \ """" )
C\_ _- _,' \ "--------. L_""""_/
" \/-' "-_________| '"-Y
</pre>
=Hockey=
<pre>
.-.-.
/_____\
:._|_|_.:
|/a> a>\|
_.-: ( ;._
,'::::\ _ /:::`-._
/:::::::`._,'|:::::::`._
/:::::_.--`._,'-.::::::::`.
:`:::;' \ ) ( `':_:;-' \
|: `' : \ \ . ,-.\
|' --._;. `:\,' .._\
|:. -.\: `;:;'.' :
:,----..(:._ ._,---.';'. `.__.'
/\,---.|:':..-(\,-, `.`..-'
/ :.--.'|:' ;',:.__.-''
: | |' ,',' /:/ /
: |,'|.-| ,',' /:/ /
/:\ : ,'_,:',' /:/ /
/ `:._\,'.`.`, -.';','
:`-._`:/ >._>.' .;\'
|`-._`:,',/_ ,'
|::::;',' ; `-'':
/\:,',| :`-..-.;
_,`,',' ; ;:::::/
,'`,','.;':_;`-::'/
<`,',;::;:-' /
,',' ( ```` ,'.::::.
,'.' /`_.__.-'::::'
_,',' `:::::::'
_______..-`.,'
,' ,----. ,'
'---`----'-''
</pre>
=Jeep=
<pre>
_.------------------.
.'____________________|
// _|||| | | | | |
______//_\__j_|||"--" "--" | | _
/-----+-|p ==,|||__________|_|-|W|
_j,====. |b_____||| _____ | |W|
|_) ,---.`.`------'|.',---.`.___|_|W|
`/ .-. \\`======__// .-. \`-----'""
\ `-' / """"""" \ `-' /
`---' `---'
</pre>
=Fool=
<pre>
,;;;;;;,
,;;;'""`;;\
,;;;/ .'`',;\
,;;;;/ | \|_
/;;;;; \ / .\
,;;;;;;| '. \/_/
/;;;;;;;| \
_,.---._ /;;;;;;;;| ; _.---.,_
.;;/ `.;;;;;;;;;| ;' \;;,
.;;;/ `;;;;;;;;;.._ .' \;;;.
/;;;;| _;-"` `"-;_ |;;;;\
|;;;;;|.---. .' __.-"```"-.__ '. .---.|;;;;;|
|;;;;;| `\/ .'/__\ /__\'. \/` |;;;;;|
|;;;;;| |_/ // \\ // \\ \_| |;;;;;|
|;;;;;| |/ |/ || || \| \| |;;;;;|
\;;;;| __ || _ .-.\| |/.-. _ || __ |;;;;/
\jgs| / _\|/ = /_o_\ /_o_\ = \|/_ \ |;;;/
\;;/ |`.- ` ` ` ` -.`| \;;/
_|;' \ | _ _ _ _ | / ';|_
/ .\ \\_ ( '--'( )'--' ) _// /. \
\/_/ \_/| /_ | | _\ |\_/ \_\/
| /|\\ \ / //|\ |
| | \'._'-'_.'/ | |
| ; '-.```.-' ; |
| \ ``` / |
__ ; '.-"""""-.' ; __
/\ \_ __..--\ `-----' /--..__ _/ /\
\_'/\`''---''`..;;;;.'.__, ,__.',;;;;..`''---''`/\'_/
'-.__'';;;;;;;;;;;,,'._ _.',,;;;;;;;;;;;''__.-'
``''--; ;;;;;;;;..`"`..;;;;;;;; ;--''`` _
.-. /,;;;;;;;';;;;;;;;;';;;;;;;,\ _.-' `\
.' /_ /,;;;;;;'/| ;;;;;;; |\';;;;;;,\ `\ '-'|
/ ) /,;;;;;',' | ;;;;;;; | ',';;;;;,\ \ .'-./
`'-..-' /,;;;;',' | ;;;;;;; | ',';;;;,\ `"`
| ;;;',' | ;;;;;;; | , ', ;;;'|
_\__.-' .-. ; ;;;;;;; ; |'-. '-.__/_
/ .\ ( ) \';;;;;'/ | | /. \
\/_/ (` `) \';;;'/ '-._| \_\/
'-/ \-' '._.' `
""" /.`\
\|_/
</pre>
=Mogly=
<pre>
.-c.
_ .., _ ( ")\
['" 6'-'</ '-/ |
; ( -=; / |
| \-` _./ |
) `'--' (
/ .. .-"`
,-"' .' '. /
__ / _.- : Y
.',-7 ) .-' ) .' ;
[ )'} < / | : |
_".(. ( \, | : \
.'-. .\.,='-' / : |
=; | |-' / : |
_/--\ | : |
/_7-'<\ \ : .(
,L / |/ \ '. .' \
'/ / \ :-; /
\> __\ / \ /_
`----' '-._\
</pre>
=King=
<pre>
.
/ \
_\ /_
. . (,'v`.) . .
\) ( ) ,' `. ( ) (/
\`. / `-' `-' \ ,'/
: ' _______ ' :
| _,-' ,-. `-._ |
|,' ( )__`-'__( ) `.|
(|,-,'-._ _.-`.-.|)
/ /<( o)> <( o)>\ \
: : | | : :
| | ; : | |
| | (.-.) | |
| | ,' ___ `. | |
; |)/ ,'---'. \(| :
_,-/ |/\( )/\| \-._
_..--'.-( | `-'''-' | )-.`--.._
`. ;`._________,': ,'
,' `/ \'`.
`------.------'
'
</pre>
=Crest=
<pre>
o .,<>., o
|\/\/\/\/|
'========'
(_ SSSSSSs
)a'`SSSSSs
/_ SSSSSS
.=## SSSSS
.#### SSSSs
###::::SSSSS
.;:::""""SSS
.:;:' . . \\
.::/ ' .'|
.::( . |
:::) \
/\( /
/) ( |
.' \ . ./ /
_-' |\ . |
_..--.. . /"---\ | ` | . |
-=====================,' _ \=(*#(7.#####() | `/_.. , (
_.-''``';'-''-) ,. \ ' '+/// | .'/ \ ``-.) \
,' _.- (( `-' `._\ `` \_/_.' ) /`-._ ) |
,'\ ,' _.'.`:-. \.-' / <_L )" |
_/ `._,' ,')`; `-'`' | L / /
/ `. ,' ,|_/ / \ ( <_-' \
\ / `./ ' / /,' \ /|` `. |
)\ /`._ ,'`._.-\ |) \'
/ `.' )-'.-,' )__) |\ `|
: /`. `.._(--.`':`':/ \ ) \ \
|::::\ ,'/::;-)) / ( )`. |
||::::: . .::': :`-( |/ . |
||::::| . :| |==[]=: . - \
|||:::| : || : | | /\ ` |
___ ___ '|;:::| | |' \=[]=| / \ \
| /_ ||``|||::::: | ; | | | \_.'\_ `-.
: \_``[]--[]|::::'\_;' )-'..`._ .-'\``:: ` . \
\___.>`''-.||:.__,' |_______`> <_____:::. . . \ _/
`+a:f:......jrei'''
</pre>
=Kiwi=
<pre>
.```. _.''..
; ``` ``'.
: d `.
/ >,: \
/.' `'., :
/' ;. . ;
/ ; \ ; ; /
`..;\: :'
__|| `...,'
`-, ) ||
/.^/ ___||
'---,_\
(/ `\
</pre>
=Knight=
<pre>
.oo.
.\. ..
,'..''\ ...oooo''
| \_/' ...oooo'''
/''.'\ . ...oooo'''
| | '| ...o!oo'''
| | |. ...oooo''./ '\
| '\, ''''\ ./ ./\ '\.
/\ooo''|''''-/ -../ / \'' '\.
/ '\. '|.''\--/-+-+-+-+-+-+-+-+.'
....- \. \. '\-'/',, /'---/' '''
././ ''\.-.-.\ '\| '',,\--;
/-/| |-'\. '> '\\
!--!| /---/' ./' |
!--!! ./---/' ,/| |
./'-/'| |----\ \-| |
./'--/ |..........|''''''./'|...........|
-'-'-' '/---/\---|' '/-\--\''''
/--/' |--\ ./---\--\
|--| \--\. ./--/' \--\
|--| |--| ./--/' \--\.
'\-| '\-| /--/' \--|
|..\ |..\ |..\ |..\
</pre>
=knight=
<pre>
.I.
/ : \
|===|
>._.<
.=-< >-=.
/.'`(`-+-')'`.\
_/`.__/ : \__.'\_
( `._/\`. : .'/\_.' )
>-(_) \ `:' / (_)-<
| | / \___/ \ | |
)^( | .' : `. | )^(
| _\|`-._:_.-'| \ |
"-<\)| : | : | "-"
(\\| : / \ : |
\\-:-| |-:-')
\\:_/ \_:_/
|\\_| |_:_|
(;\\/ \__;)
|: \\ | :|
\: /\\ \ :/
|==| \\|==|
/v-'( \\`-v\
// .-' \\. \\
`-' \\`-'
\|
</pre>
=sheep=
<pre>
,-''''-.
(. ,. L ___...__
/7} ,-` `'-==''`` ''._
//{ '`.
\_,X , : )
7 ;`
: , /
\_, \ ;
Y L_ __..--':`. L
| /| ```` ; y J
[ j J / / L ;
| |Y \ /_J | |
L_J/_) /_) L_J
/_) /_)
</pre>
=laptop=
<pre>
.-----------------------===------------------------.
:o ______________________________________________ o:
; : : ;
`. `. .' .'
: : : :
`. `. .' .'
: : : :
`. `. .' .'
: : : :
`. `. .' .'
: : : :
`. `. .' .'
: :__________________________________: :
`. .'
'-------------| |-----| |--------------'
.""""""""""""""| |"""""| |"""""""""""""".
| () '-----------' o () |
| ___________________________________ |
| :__|__|__|__|__|__|__|__|__|__|__|__: |
| |___|__|__|__|__|__|__|__|__|__|__|_| |
| |__|_|__|__|__|__|__|__|__|__|__|___| |
| |___|__|__|__|__|__|__|__|__|__|____| |
| |____|__|__|__|__|__|__|___|__|__|__| |
| :___|__|___________________|__|__|__: |
| |
| .-------------. |
| | | |
| | | |
| |_____________| |
| | | |
| | | |
| '.___________.' |
| ___ |
'-----------------------------------------'
</pre>
=grass cutter=
<pre>
---. .---
'. .'
'.'
/
/
/
/
/
/
/
/
.'.
.' \
.' |
.' \
..--/_________|.--.
// '----------'// \\
||'=:='=:='=:='||()||
\\_'--''--''--'\\__//
`--' `--`
</pre>
=lamp=
<pre>
. | ,
\ _---_ /
-_ .' `. _-
__ : .---. : __
: \ / :
-" `. | | .' "-
/ |`-'| \
' ]"-_[ `
]"-_[
"*"
</pre>
=Lion=
<pre>
,.
,_> `. ,';
,-`' `' '`'._
,,-) ---._ | .---''`-),.
,' `. \ ; / _,' `,
,--' ____ \ ' ,' ___ `-,
_> /--. `-. .-'.--\ \__
'-, ( `. `.,`~ \~'-. ,' ,' ) _\
_> \ \ ,' ') ) `. / / <,.
,-' _, \ ,' ( / `. / `-,
`-.,-' `.,' ` `.,' `\ ,-'
,' _ / ,,, ,,, \ `-. `-._
/-, ,' ; ' _ \ / _ ` ; `. `(`-\
/-, ; (o) (o) ; `'`,
,~-' ,-' \ ' ` / \ <_
/-. ,' \ / \ ,-'
'`, ,' `-/ \-' `. `-. <
/_ / / (_ _) \ \ `,
`-._; ,' | .::.`-.-' :.. | `-. _\
_/ \ `:: ,^. :.:' / `. \,-'
'`. ,-' /`-..-'-.-`-..-'\ `-.
>_ / ; (\/( ' )\/) ; `-. _<
,-' `. \`-^^^-'/ ,' \ _<
`-, ,' `. `"""""' ,' `-. <`'
') `._.,,_.' \ ,-'
'._ '`'`' \ <
> ,' , `-. <`'
`,/ \ ,-`
`, ,' | / /
'; / ; (
_)| ` (
`') .-'
<_ \ /
\ /\(
`;/ `
</pre>
=I love you=
<pre>
__,,,__
,-""-,-" "-,-""-,
/,-' , .-'-.7.-'-. , '-,\
\( / _ _ \ )/
'-, { (0) (0) } ,-'
/ > .---. < \
|/ .-' \___/ '-. \|
{, / ,_ _, \ ,}
\ {, \ / ,} /
',\. '---' ./,'
_.-""""""-._ _.-""""""-._
.' `._.` '.
_/_ _ \
.'` `\ | | \
/ | | | ;
| / |_| |
\ ;'---' _ ___ _ _ ___ ;
'. ; | | / \| || || _| _ ;
`-\ | |_ | | || |/ /| _| .' `,
`\ |___|\___/ \__/ |___| | \
\ _ _ \ |
`\ | | | /` _/
,-""-. .'`\ | | | /`-,-'` .-""-,
/ `\.' `\ \___/ /` './` \
; .--. \ '\ /' / .--. ;
| ( \ |, '\ /' | / ) |
\ ; } ;\ /; ` { ; /
`;\ \ _.-' \ / `-._ / /;`
\ \__.' _.-' Y `-._ '.__//
'.___,.-' `-.,___.'
</pre>
=Lynx=
<pre>
, ,
(\ "\
,--;.)._
).,-._ . ""-,_
/.'".- " 8 o . ";_
`L_ ,-)) o . 8.o .""-.---...,,--------.._ _"";
""" ")) 8 . . 8 . 8 8 8 8 8. 8 8 ._""._;
";. .8 .8 .8 8 8 8 8 . 8. 8 .".""
;.. 8 ; . 8. 8 8 8 . } 8 . 8 :
;.. 8 ; 8. 8 8 8 8 ( . 8 . :
;. 8 \ . .......;;; 8 . 8 :
;o ;"\\\\```````( o( 8 .;
: o: ; :. : . 8 (
:o ; ; "; ";. o :
; o; ; "; ;";..\
;.; .: )./ ;. ;
_).< .; _;./ _;./
;"__/--" ((__7 ((_J
</pre>
=Wizard=
<pre>
o
O /`-.__
/ \ '^|
o T l *
_|-..-|_
O (^ '----' `)
`\-....-/^
O o ) "/ " (
_( (-) )_
O /\ ) ( /\
/ $ ) | \
o o $ ( / \
/ |( )| \
/ o \ \( / \
__.--' O \_ / .._ \
//|)\ , (_) /(((\^)'\
| | O ) ` |
| / o___ / /
/ _.-''^^__O_^^''-._ /
.' / -''^^ ^^''- \--'^
.' .`. `'''----'''^ .`. \
.' / `'--..____..--'^ \ \
/ _.-/ \ \
.::'_/^ | | `.
.-'| | `-.
_.--'` \ / `-.
/ \ / `-._
`'---..__ `. .´_.._ __ \
``'''`. .' `'^ `''---'^
`-..______..-'
</pre>
=Suricat=
<pre>
,'''''-._
; ,. <> `-._
; \' _,--'"
; (
; , ` \
;, , \
; | |
; |, | |\
; | | | \
|.-\ ,\ |\ :
|.- `. `-. | ||
:.- `-. \ ';;
.- , \;;|
; , | ,\
; , ; \
; , /`. , )
__,;, ,' \ ,|
_,--''__,| / \ :
,'_,-'' | ,/ | :
/ / | ; ; |
| | __,-| |--..__,--| |---.--....___
___,-| |----'' / | `._`-. `----
\ \ `""" """ --
`.`. --'
`.`-._ _, ,- __,-
`-.`.
--' `;
</pre>
<pre>
=Dagger=
,-.
("O_)
/ `-/
/-. /
/ )
/ /
_ /-. /
(_)"-._ / )
"-._ "-'""( )/
"-/"-._" `.
/ "-.'._
/\ /-._"-._
_,---...__ / ) _,-"/ "-(_)
___<__(|) _ ""-/ / / /
' `----' ""-. \/ / /
) ] / /
____..-' // / )
,-"" __.,'/ / ___ /,
/ ,--""/ / / /,-"" """-. ,'/
[ ( / / / / ,.---,_ `._ _,-','
\ `-./ / / / / `-._ """ ,-'
`-._ / / / /_,' ""--"
"/ / / /"
/ / / /
/ / / /
/ |,' /
: / /
[ / ,'
| / ,'
|/,-'
P'
<pre>
=Superman=
</pre>
.=.,
;c =\
__| _/
.'-'-._/-'-._
/.. ____ \
/' _ [<_->] ) \
( / \--\_>/-/'._ )
\-;_/\__;__/ _/ _/
'._}|==o==\{_\/
/ /-._.--\ \_
// / /| \ \ \
/ | | | \; | \ \
/ / | :/ \: \ \_\
/ | /.'| /: | \ \
| | |--| . |--| \_\
/ _/ \ | : | /___--._) \
|_(---'-| >-'-| | '-'
/_/ \_\
</pre>

=Supergirl=
<pre>
,
;\
: "-.
: ""--._
; "-._
: "-.
\ `.
`. `.
""--._ \
""--._ ;
`. :
.----. `. ;
/.-J-. \ ;`. ;
:/ / \ `-; ; ;:
;_/ _."-+: , : / ;
: -= =;\ ;\ ;' /
;"\ ,: `--' ; .' :
: t -= '"-._ ( ___ .' ;
; :"-._/`-. `-"+ .-" `.__.-" ;
.-: \ :-.____..--:-" ;
__.^-:_j `;J:\_ _.' :
_.--"" : / "-,l "-;""" ;
_.--"" :' -' `. ___ ;
_.-".-" .' / : \ """--..__.-' :
/ .' _.-" / : ; . :\ ;
/ .' .-" j : / /\ \ /
/ / .' / t--' `....' / \ \ /
/ : / / : : / `. "-. :
: ; / / ;/ ; `. / : `. `. ;
\ : / : :/: ; ; : \ \ \ .'
;.\/ : j : : : ; "-._ `. `. .-"
: `. .-; /-.; ; ; :`. .' "-.__j+. `._.-"
;`. `. : : : : .--"" t "-( `. \
/ "-.`. \; ; ;`.-" .--"".^. `. `.-"\
:\ `. :__: :`. .-T__.-".-: \ : _ "-._
; `. `. \; `\ : Y-" _.-" \ ; ;: "-._/
: "-. `. \ : ; ; / .'/ ; : :; U
"-._ `. \ ;j:/ : / : : ;
/ ""--..__`-""+:-+.\ ; ; /
,--^-...__ _.-"; `| "--: : .'
; _. _.-" : ; | ;"
:.-".-"_.-" ; ; ; /
J.-".-" .--"-. .-" | : /
.-".-" : "" : | /
: / : ; ; /
;: _..-' | : /
: ; \ : | /
; ; \ ; ; :
: ; ; : : `.
; : ; ; \ , `.
: \ / : \;"-.__\
: `.: /; ; \ ;
\ "-. /: : \ ;
`. `. ; ; :/`. \ :
"-. `. :: ; `-:\ :
"-._ `. .-"; | : \ ;
"-._ `..-" : : : \ :__
"-. `. .' ; | ; ) ;
"-.J.' | | : :
: ; ; :
; ; : \
| :_ ; ;
: .' \ | /
; / :_.'
; :
: ;
; :
| ;
:_/
</pre>
=Eagle=
<pre>
/T /I
/ |/ | .-~/
T\ Y I |/ / _
/T | \I | I Y.-~/
I l /I T\ | | l | T /
T\ | \ Y l /T | \I l \ ` l Y
__ | \l \l \I l __l l \ ` _. |
\ ~-l `\ `\ \ \\ ~\ \ `. .-~ |
\ ~-. "-. ` \ ^._ ^. "-. / \ |
.--~-._ ~- ` _ ~-_.-"-." ._ /._ ." ./
>--. ~-. ._ ~>-" "\\ 7 7 ]
^.___~"--._ ~-{ .-~ . `\ Y . / |
<__ ~"-. ~ /_/ \ \I Y : |
^-.__ ~(_/ \ >._: | l______
^--.,___.-~" /_/ ! `-.~"--l_ / ~"-.
(_/ . ~( /' "~"--,Y -=b-. _)
(_/ . \ : / l c"~o \
\ / `. . .^ \_.-~"~--. )
(_/ . ` / / ! )/
/ / _. '. .': / '
~(_/ . / _ ` .-<_
/_/ . ' .-~" `. / \ \ ,z=.
~( / ' : | K "-.~-.______//
"-,. l I/ \_ __{--->._(==.
//( \ < ~"~" //
/' /\ \ \ ,v=. ((
.^. / /\ " }__ //===- `
/ / ' ' "-.,__ {---(==-
.^ ' : T ~" ll
/ . . . : | :! \\
(_/ / | | j-" ~^
~-<_(_.^-~"
</pre>
=Dog=
<pre>
,--._______,-.
,',' , . ,_`-.
/ / ,' , _` ``. | ) `-..
(,';'""`/ '"`-._ ` \/ ______ \\
: ,o.-`- ,o. )\` -' `---.))
: , d8b ^-. '| `. ` `.
|/ __:_ `. | , ` ` \
| ( ,-.`-. ;' ; ` : ;
| | , `. / ; : \
;-'`:::._,`.__),' : ;
/ , `- `-- ; |
/ \ ` , |
( ` : : ,\ |
\ `. : : : ,' \ :
\ `|-- ` \ ,' ,-' :-.-';
: |`--.______; | : :
: / | | | \
| ; ; ; / ;
_/--' | :`-- / \_:_:_|
,',',' | |___ \
`^._,--' / , , .)
`-._,-'
</pre>
=kitten=
<pre>
. ,.
T."-._..---.._,-"/|
l|"-. _.v._ (" |
[l /.'_ \; _~"-.`-t
Y " _(o} _{o)._ ^.|
j T ,-<v>-. T ]
\ l ( /-^-\ ) ! !
\. \. "~" ./ /c-..,__
^r- .._ .- .-" `- . ~"--.
> \. \
] ^. \
3 . "> . Y
,.__.--._ _j \ ~ . ; |
( ~"-._~"^._\ ^. ^._ I . l
"-._ ___ ~"-,_7 .Z-._ 7" Y ; \ _
/" "~-(r r _/_--._~-/ / /,.--^-._ / Y
"-._ '"~~~>-._~]>--^---./____,.^~ ^.^ !
~--._ ' Y---. \./
~~--._ l_ ) \
~-._~~~---._,____..--- \
~----"~ \
\
</pre>

Jq

2026-03-24T07:16:23Z

Ekaanbj: /* Find entries with a length greater than 0 */

=jq=
==how many stores are actually in there:==
$ cat file.json | jq 'length'
1134
==retrieves the “name” field of each element of the input array.==
cat file.json | jq '.[] | .name'
"Graz"
"Baden"
"Zürich"
...
==Give us first store.==
jq '.[0]'
==Select specific fields==
jq '.[] | {eta: .eta, ticketID: .ticketID}'
==Select specific files shortended.==
jq '.[] | {eta, ticketID}'
==url encode a string.==
jq -sRr @uri <<< "${IPRADAR_SERVICE}" | sed 's/%0A$//g'
==Pick extra_vars under results in raw format.==
jq -r '.results[]|.extra_vars'
==Select array name based on content.==
jq -r '.[]|select(.name=="the name you want to print")'

==Display keys==
jq 'keys'
==Get keys and expand base64 encoded values==
oc get secrets -n kafka postgres-cdc-credentials -o json | jq '.data | map_values(@base64d)'

==Select specific key==
jq -r '. | {all}'
==select key based on content==
jq 'map_values(select(.group_declare == "true"))' /tmp/tmp
Select values in a chain.
oc get machinesets -n openshift-machine-api -o json | jq -r '.items[] | select(.spec.template.metadata.labels."machine.openshift.io/cluster-api-machine-role" == "worker")| .metadata.name'
Select multiple strings
|select(.name == "<string_1>" or .name == "string_2" or .name == "string_3" or .name == "string_4")|

==select with regex against string in output==
openstack command list -f json | jq -r '.[].Commands[]|select (match("list$"))'
==select where value is not null==
select(.spec.template.metadata.labels."machine.openshift.io/cluster-api-machine-role" == "worker")
==search if containing string==
jq '.[] | select(.original_resource_id | contains("0dbc59e0-f66f-40b5-a407-ca93951a6c39"))'

=create list of all keys in array.=
curl -sk -H "Authorization: Bearer $(oc whoami -t)" https://$(oc get routes -n openshift-monitoring thanos-querier -o jsonpath='{.status.ingress[0].host}')/api/v1/metadata | jq .
echo '{
"data": {
"aggregator_openapi_v2_regeneration_count": [
{
"unit": ""
}
],
"alertmanager_alerts": [
{
"unit": ""
}
]
}
}' | jq -r '.data | keys | flatten[]'
aggregator_openapi_v2_regeneration_count
alertmanager_alerts
=convert yaml too json=
dnf install python3-pyyaml
oc get node -o yaml | python -c 'import sys, yaml, json; json.dump(yaml.safe_load(sys.stdin), sys.stdout, indent=4)' | jq .
=jwt=
jq -R 'split(".") | .[0],.[1] | @base64d | fromjson' <file>
=join results=
oc get endpoints -o json -A | jq -r '.items[].subsets[] | [.addresses[0].ip,.ports[0].port]|join(":")'
oc get clusterversion -o json | jq -r '.items[0].status.history[] | [.version, .startedTime, .completionTime] | join(" ")'
=Get key valuepair base64 decoded in text only format=
oc get secrets -n kafka postgres-cdc-credentials -o json | jq -r '.data | map_values(@base64d) | to_entries[] | "\(.key)\t\(.value)"' | column -t -s $'\t'
=compact format=
jq -c .
=case insentive search=
jq select(.severity | ascii_downcase == "warning") | select(.alertstate | ascii_downcase == "firing") | .alertname'
=Sort by lastTransitionTime.=
oc get network.config cluster -o=json | jq '.status.conditions | sort_by(.lastTransitionTime)'
=sort complete json=
jq --sort-keys .
=dont print null=
oc get argocd -n $ARGOCD_NAMESPACE -o json | jq -r '.items[].spec.disableAdmin // empty'
=Find entries with a length greater than 0=
jq -r '.[] | select(.login.fido2Credentials | length > 0)' <json>
=Find entries where value is not=
jq '.[]|select(.login.fido2Credentials != [])' <json>

Jq

2026-03-24T07:14:57Z

Ekaanbj: /* dont print null */

Openshift

2026-03-23T15:38:12Z

Ekaanbj: /* serverGroupName/server_groups */

=What does it mean?=
acme Automated Certificate Management Environment
annotations Key=value pairs. That provides metadata for object.
atomic Operation or process is indivisible, meaning it is performed as a single, uninterruptible unit, it either completes successfully in its entirety, or it has no effect at all — there is no partial execution or intermediate state.
ceph Delivers object, block, and file storage in one unified system.
ceph-osd object storage daemon for the Ceph distributed file system. It is responsible for storing objects on a local file system and providing access to them over the network.
clbo CrashLoopBackOff
clo Cluster Logging Operator
cmo Cluster Monitoring Operator
cncf Cloud Native Computing Foundation
cni Container Network Interface (OVNKubernetes OpenShiftSDN)
cns Cloud Native Storage
cnv Container-native Virtualization, add-on to OpenShift Container Platform that allows virtual machine workloads to run and be managed alongside container workloads.
co Cluster Operator
ControllerRevision API object used primarily by controllers that manage versioned, declarative resources such as StatefulSets and DaemonSets. It stores a snapshot of the configuration.
cpi Cloud Provider Interface
cr Custom Resource. (I found it like something added by enabling something. You get it from "oc api-resources")
crd Custom Resource Definition. The name of a CRD object must be a valid DNS subdomain name.
cri Container Runtime Interface
cri-o Lightweight container runtime for kubernetes.
csi Container Storage Interface
csm Container Storage Modules
csv cluster service version. OLM manifest that defines version of an Operator and its metadata, deployment requirements, and permissions.
cvo Cluster Version Operator
cvss Common Vulnerability Scoring System
daemonset Ensures that all (or some) Nodes run a copy of a Pod
deployment You describe a desired state in a Deployment. Deployment object describes how to create or modify pods that hold a containerized application by defining the desired state of a particular component. Deployments create and manage how ReplicaSets are deployed.
eo ElasticSearch Operator
ephemeral Short lived, temporary
eus Extended Update Support
evict remove, preempt.
Fluentd data collector designed to handle logging by unifying and processing data from various sources.
fluent bit lightweight and high-performance data collector. logs but can handle metrics too.
fsgroup Group which Kubernetes will change the permissions of all files in volumes to when volumes are mounted by a pod.
geneve Generic Network Virtualization Encapsulation OVN-Kubernetes uses Geneve.
grcp Google Remote Procedure Call, framework that brings performance benefits and modern features to client-server applications. Like RPC
hpa Horizontal Pod Autoscaler, automatically scales the number of pods in a deployment, stateful set, or replica set based on CPU, memory, or custom metrics.
icsp ImageContentSourcePolicy. Blocking a payload registry.
idp identity provider
idps identity providers
implicit indirect, hinted,
ingressclass use multiple ingress controllers managing network traffic routing within a cluster.
ipc namespace Each IPC namespace has its own set of System V IPC identifiers and its own POSIX message queue filesystem. .
ipi Installer-Provisioned Infrastructure
kcs Knowledge Centered Support, Red Hat's way of offering solutions and articles for known questions or problems.
kubelet Kubelet is the primary "node agent" that runs on each node. Takes a set of PodSpecs (primarily through the apiserver) and ensures the containers described are running and healthy.
kvdb key-value store (portworx)
machineset Managing a set of machines with similar characteristics, manage a group of machines. Desired number of machines.
manifest Manifest is a YAML or JSON file that describes the desired state of a Kubernetes object.
mco machine-config-operator
mcp machine config pools
Metricbeat leightweight shipper for metrics
noobaa data service for cloud environments, providing S3 object-store interface with flexible tiering, mirroring, and spread placement policies, over any storage resource that allows GET/PUT including S3,GCS..
nsfs virtual filesystem making Linux-kernel namespaces available.
oadp openshift api data protection
oci Open Container Initiative
ocm OpenShift Cluster Manager
ocp OpenShift Container Platform
ocs OpenShift Container Storage
odf OpenShift Data Foundation
oidc OpenID Connect, is an identity layer on top of the OAuth 2.0 protocol.
olm Operator Lifecycle Manager
osm Open Service Mesh. Lightweight, extensible, cloud native service mesh
ovnk Open Virtual Network Kubernetes
pdb Pod Disruption Budget. poddisruptionbudgets
pvc Persistent volume claim. binding between a Pod and Persistent Volume.
pv Persistent volume. Persistent storage. low level representation of a storage volume.
preempt higher priority pod cannot be scheduled due to insufficient resources, preempt (evict) one or more lower-priority pods to free up resources for higher-priority pod
prometheus Prometheus is a time-series database (TSDB). handle the collection, storage, and querying of time-series data. Alerting
provisioner A StorageClass object contains a provisioner that decides which volume plugin is used to provision PersistentVolumes.
quay.io builds, analyzes, distributes your container images. Owned by IBM
ReadWriteMany Storage read/write for many.
Reconciliation Mechanism that ensures the cluster behaves as intended by comparing the current state of resources with the desired state specified in your manifests or custom resources.
register Container registry is a storage and distribution system for container images. In Kubernetes, container images are the building blocks for deploying applications. A registry is used to store, manage, and distribute these images.
registrar The node-driver-registrar is a sidecar container that registers the CSI driver with Kubelet using the kubelet plugin registration mechanism.
replicaset Maintain a stable set of replica Pods running at any given time
rhacm Red Hat Advanced Cluster Management for Kubernetes
rhcos Red Hat Enterprise Linux CoreOS
rhcp Red Hat Ceph Storage
rhcs Red Hat Cluster Suite
rhocp Red Hat OpenShift Container Platform
rhol Red Hat OpenShift Logging
rook Operator. File, block, and object storage for your cloud native environment and is based on battle tested ceph storage.
rosa Red Hat OpenShift Service on AWS
runc run container. Container runtime that implements the OCI runtime specification.
s2i source-to-image
sa Service Account
scc security context constraints
sc security context
seccomp Secure computing mode profiles can be associated with a container to restrict available system calls.
SelfLink URL representing the given object.
service Logical abstraction for a deployed group of pods in a cluster (which all perform the same function).
skopeo Command line utility used to interact with local and remote container images and container image registries
StatefulSet Workload object to manage stateful applications. Deployment and scaling Pods, ordering and uniqueness of Pods.
Storage Class allows for dynamic provisioning of Persistent Volumes.
svc service
taint Taints ensure that pods are scheduled onto appropriate nodes. You can apply one or more taints on a node.
tekton Container-native way to manage CI/CD. It's also the basis for OpenShift Pipelines.
thanos Long-Term storage for your Prometheus Metrics on OpenShift
toleration You can apply tolerations to pods. Tolerations allow the scheduler to schedule pods with matching taints.
ubi Universal Base Images OCI-compliant container base operating system images with complementary runtime languages and packages that are freely redistributable.
upi User-Provisioned Infrastructure
uts Unix Timesharing System namespace. Controls the hostname and the NIS domain.
uWSGI Project aims at developing a full stack for building hosting services.
vxlan virtual extensible LAN, The OpenShift SDN uses OpenvSwitch tunnels, OpenFlow rules, and iptables.
wwn world wide names. Fiber channel

=where do I start=
. <(oc completion bash) Get bash completion running.
oc help Get commands
oc api-resources What can you use commands on.
oc options Which options apply to all commands

=read=
https://kubernetes.io/docs/concepts/overview/working-with-objects/kubernetes-objects/
=Projects that I have read about but forgotten=
OpenEBS Storage solution. Possible backends. local, nfs, zfs, nvme. CStor to serve iSCSI block storage using the underlying disks or cloud volumes in a cloud native way

=files of value=
metadata.json File created during install. Used by openshift-install destroy cluster

=oc get=
Available resources to ask about.
oc api-resources
Get everything
oc api-resources -o name --no-headers | while read i ; do echo '***' $i ; oc get $i -A -o yaml 2>&1 ; done > /tmp/oc_api-resourece.$(oc whoami --show-server | awk -F ':|/' '{print $4}').$(date +%F_%H-%M-%S)

=login=
oc login --username developerhttps://openshift:6443
=switch user=
oc login --username developer
=which clusters have you logged into=
oc config get-clusters

=List projects=
oc projects
oc get projects

=select project=
oc project $project
kubectl config set-context --current --namespace=kube-public

=create project/namespace=
oc create namespace redis

=list pods=
oc get pods
oc get pods --all-namespaces
oc get pods -o wide
wide will give you on which node pod is running.
oc get pods -o wide --all-namespaces
Get pods that are not runing.
oc get pods --field-selector status.phase!=Running --all-namespaces
oc get pods -A --no-headers | grep -v Completed | while read LINE ; do PODS=$(awk '{print $3}' <<< "${LINE}") ; if [ "${PODS%%/*}" != "${PODS##*/}" ] ; then echo "${LINE}" ; fi ; done
Get pods matching two states
oc get pods --field-selector=status.phase!=Running,spec.restartPolicy=Always
oc get nodes --no-headers --selector='node-role.kubernetes.io/worker,!node-role.kubernetes.io/infra'
Get pods running on specific node
oc get pods -A -o wide --field-selector spec.nodeName=<node>
Get pods with label name=portworx-proxy
oc get pods -A -l name=portworx-proxy
Get pods with several labels
oc get pod -l 'app in (rook-ceph-mon,rook-ceph-operator,rook-ceph-osd,rook-ceph-rgw,rook-ceph-mgr,rook-ceph-mds,rook-ceph-crashcollector)'
Get pods with extra column port.
kubectl get pods --output=custom-columns=NAME:.metadata.name,NAMESPACE:.metadata.namespace,IP:.status.podIPs[*].ip,POD_PORT:.spec.containers[*].ports[*].containerPort
Get pods with column restarts
oc get pods -o custom-columns='NAMESPACE:.metadata.namespace,POD:.metadata.name,RESTART:.status.containerStatuses[*].restartCount' -A | sort -k3 -n | tail -10

=Endpoint=
An Endpoint is an object that represents the IP addresses and ports of the Pods that back a Service. When a Service is created, Kubernetes automatically creates an associated Endpoints object.
=EndpointSlices=
EndpointSlices offer a scalable, efficient, and feature-rich alternative to traditional Endpoints, topology.

=get shell on node=
It is possible to debug more than nodes. (deployment, build, or job)
oc debug node/infra-2.ocpdev.lkl.ltkalmar.se
Get working env
chroot /host
Connect to node in eks.
kubectl debug node/<node> -it --image=halfface/rockylinux-toolbox:v3

=get debug information from oc=
oc debug --loglevel=10 node/$node
=debug pod run as root disable health checks=
oc debug deployment/my-deployment-name --as-root

=get nodes=
oc get nodes
oc get nodes -o jsonpath='{.items[*].metadata.name}'
# Get nodes without headears. name, cpu:s, disk size, mem, ip address.
oc get nodes --no-headers --selector="node-role.kubernetes.io/worker" -o=custom-columns='NAME:.metadata.name,CPU:.status.capacity.cpu,DISK:.status.capacity.ephemeral-storage,MEM:.status.capacity.memory,IP:.status.addresses[?(@.type=="InternalIP")].address'
# Get node name and ip address.
oc get nodes --no-headers --selector="node-role.kubernetes.io/worker" -o=custom-columns='NAME:.metadata.name,IP:.status.addresses[?(@.type=="InternalIP")].address'
=ip address of node=
Outside pod.
oc get pod --template '{{.status.podIP}}' openshift-gitops-application-controller-0
Inside pod.
echo $POD_IP

=get nodes that are overcommited=
oc get nodes -o jsonpath='{range .items[*]}{@.metadata.name}:{range @.status.conditions[*]}{@.type}={@.status};{end}{end}' | sed 's/:/=node;/g' | sed 's/;/\n/g' | grep -vE 'MemoryPressure=False|DiskPressure=False|PIDPressure=False|Ready=True'
Does any node stick out.
oc get nodes --no-headers -o=custom-columns=NAME:.metadata.name,CONDITIONS:.status.conditions

=connect to pod=
oc rsh $pod bash
=list containers in pod=
oc get pod/router-default-6b76b87c6-5m7h6 -n openshift-ingress -o json | jq -r '.spec.containers[].name'
router
logs
=list all containers running in a cluster=
<pre>
kubectl get pods --all-namespaces -o jsonpath="{.items[*].spec['initContainers', 'containers'][*].image}" | tr -s '[[:space:]]' '\n' | sort | uniq -c
</pre>

=connect to container in pod=
oc rsh -c router pod/router-default-6b76b87c6-5m7h6

=get logs from all containers excluding namespace ^openshift from last 24 hours with timestamp=
oc get pods --no-headers --field-selector status.phase=Running -A -o custom-columns=NAMESPACE:.metadata.namespace,POD:.metadata.name | grep -v ^openshift | while read NAMESPACE POD ; do for CONTAINER in $(oc get pod $POD -n $NAMESPACE -o json | jq -r '.spec.containers[].name') ; do echo oc logs -n ${NAMESPACE} ${POD} -c ${CONTAINER} ; oc logs -n ${NAMESPACE} $POD -c $CONTAINER --since=24h --timestamps=true 2>&1 | grep "Error: getaddrinfo EAI_AGAIN " ; done ; done

=get all container logs(good for pods stuck in init)=
oc logs <pod> --all-containers
=tail logs for pods matching label=
oc logs -n openshift-storage -l app=csi-cephfsplugin -c driver-registrar -f --max-log-requests 8 --tail=1
oc logs -n openshift-cluster-storage-operator -l name=vsphere-problem-detector-operator --tail=-1
oc logs -f --tail=0 router-default-6c666984fd-ct8zf logs
oc logs -f --namespace openshift-gitops deployment/openshift-gitops-server

=Search for log entries locally on node=
ls -la $(ls -la $(grep -l EAI_AGAIN /var/log/containers/*) | awk '{print $NF}')
grep -rl EAI_AGAIN /var/log/pods/

=execute command in pod=
oc exec pod/router-default-545ffb97db-4h9rx -- $command
kubectl exec --stdin --tty shell-demo -- /bin/bash

=execute command on all nodes=
oc get nodes -o name | xargs -I {} oc debug {} -- chroot /host sh -c 'echo $HOSTNAME && chronyc sources'

=execute command in all containers=
oc get pods --no-headers -o 'custom-columns=:.metadata.namespace,:.metadata.name' -A | while read NAMESPACE POD ; do
for CONTAINER in $(oc get -n $NAMESPACE pod/$POD -o json | jq -r '.spec.containers[].name') ; do
echo '***' $NAMESPACE $POD $CONTAINER
echo $(oc exec -c $CONTAINER -n $NAMESPACE $POD -- curl -m1 -skv https://inter.net 2>&1 | tr -d '\n')
done
done | tee /tmp/$(oc whoami --show-server | awk -F ':|/' '{print $4}').$(date +%F_%H-%M-%S)

=where am i=
POD_NAME=rook-ceph-operator-6c86f788d5-f8mqf
POD_NAMESPACE=openshift-storage

=describe pods=
oc describe pods
oc describe pod stage-sales-62-qjd

=To get (almost) all object with a specific label from the current project, execute:=
oc get all -l '<label_name>=<label_value>'
oc get pods -n openshift-storage -o name -l app=rook-ceph-operator

=get config from pod in yaml format=
oc get pods router-default-545ffb97db-kgsdb -o yaml
=get deployments=
oc get deployments --all-namespaces

=set environment variable in pod=
oc set env dc/your-app-name COLOR=blue
=unset environment variable in pod=
oc set env dc/your-app-name COLOR-

=list environment variables=
oc set env pod/router-default-545ffb97db-lj2t5 --list

=list templates=
oc get templates -n openshift
=Custom resource definitions.(crd)=
oc get crd
=sort=
CREATED AT
oc get crd --sort-by=.metadata.creationTimestamp
=edit=
oc edit deployment.apps/router-default
Watch changes taking place.
watch -n1 oc get all
=grant permission to project=
oc adm policy add-role-to-user view developer -n mysecrets
=grant permission to group=
oc adm policy add-cluster-role-to-group cluster-admin admin
==grant a user cluster-admin permissions through group==
# create a new group.
oc adm groups new cluster-admin
# Bind cluster-admin Role to the Group
oc adm policy add-cluster-role-to-group cluster-admin cluster-admin
# Add user to group
oc adm groups add-users cluster-admin T1.anbj15

=grant unrestriced access to service account=
oc adm policy add-scc-to-user privileged system:serviceaccount:isilon:isilon-node
...
oc adm policy add-scc-to-user anyuid -z ak-authentik
oc adm policy add-scc-to-user privileged -z ak-authentik

=which pods use scc?=
oc get project -o=custom-columns='NAME:.metadata.name' --no-headers | grep -v openshift | while read NAMESPACE ; do echo '*' $NAMESPACE ; oc get pods -o=custom-columns='NAME:.metadata.name,SCC:.metadata.annotations.openshift\.io\/scc' --no-headers -n $NAMESPACE | grep restricted-v2 ; done
oc get pods --all-namespaces -o=jsonpath='{range .items[*]}{@.metadata.name}{"\t"}{@.metadata.namespace}{"\t"}{@.metadata.annotations.openshift\.io/scc}{"\n"}' | column_tab | less

=crictl=
==List running containers==
crictl ps
crictl ps --all | grep -i coredns

==List all pods==
crictl pods
==List all images==
crictl images
==Execute a command in a running container==
crictl exec -it 1f73f2d81bf98 /bin/sh
==crictl logs==
crictl logs

=nsenter=
run program in different namespaces
=which version=
Get version of various objects
oc version
Only get cluster version
oc get clusterversion
oc get clusterversion -o json|jq -r '.items[0].spec| .channel, .desiredUpdate.version'

=copy files from pod=
Copy session keys locally.
oc rsync caas-2-8s6cl:/tmp/sslkeylog .
=tcpdump from nodes=
ssh $node
toolbox
=rm toolbox=
toolbox rm --force <container>

=oc get route -A=
get routing.
=oc describe route sales -n hlt-prod=
Name: sales
Namespace: hlt-prod
Created: 13 months ago
Labels: <none>
Annotations: haproxy.router.openshift.io/balance=roundrobin
haproxy.router.openshift.io/disable_cookies=true
Requested Host: sales.prod.bobcat.hlt.se
exposed on router default (host apps.ocpprod.lkl.ltkalmar.se) 13 months ago
Path: <none>
TLS Termination: edge
Insecure Policy: <none>
Endpoint Port: port-8000-tcp

Service: sales
Weight: 100 (100%)
Endpoints: 10.160.7.166:8000, 10.160.7.167:8000, 10.160.7.168:8000 + 35 more...
=oc get pods (selecting specific pods)=
Only name without headers
oc get pods -o custom-columns=POD:.metadata.name --no-headers -A
Describe Failing pods.
oc get pods -A --field-selector=status.phase=Failed --no-headers | while read NAME_SPACE POD REST_OF_LINE ; do echo '*' $POD ${NAME_SPACE} ; oc describe pod $POD -n "${NAME_SPACE}" ; done | less -ISRM

=get pod label:s=
oc get pods --show-labels

=get subscriptions=
oc get subscriptions -A
=delete subscription=
oc delete subscription openshift-gitops-operator -n openshift-operators
=get available channels for subscription=
oc get PackageManifest $OPERATOR -o json | jq -r '.status.channels[] | .name,.currentCSV'
=update channel=
oc patch subscriptions -n $NAMESPACE $OPERATOR --type merge -p '{"spec": {"channel": "stable-4.12"}}'

=delete clusterserviceversion=
oc delete clusterserviceversion openshift-gitops-operator.v1.7.4

=whoami=
oc whoami
oc config current-context
oc whoami --show-console=true --show-context=true
Which is the console url?
oc whoami --show-console
Which is the api url?
oc whoami --show-server

=get instance url=
oc get routes -n openshift-console console

=create an htpasswd user=
kubernetes create htpasswd user
oc create user imageregistry
oc create identity htpasswd:imageregistry
oc create useridentitymapping htpasswd:imageregistry imageregistry
Create user/password to feed kubernetes with.
htpasswd -c -B -b htpasswd imageregistry P@ssW0rd
oc create secret generic htpass-secret --from-file=htpasswd=htpasswd -n openshift-config
Get htpasswd users.
oc get secret htpass-secret -ojsonpath={.data.htpasswd} -n openshift-config | base64 --decode
Enable htpasswd login.
oc edit oauth cluster
apiVersion: config.openshift.io/v1
kind: OAuth
metadata:
name: cluster
spec:
identityProviders:
- name: htpasswd
mappingMethod: claim
type: HTPasswd
htpasswd:
fileData:
name: htpass-secret
look at oauth config.
oc get oauth cluster -o yaml
Create service account.
https://docs.openshift.com/container-platform/4.13/authentication/understanding-and-creating-service-accounts.html
=get list of user=
oc config view -o jsonpath='{.users[*].name}'

=list contexts=
oc config get-contexts

=use-context=
oc config use-context openshift-marketplace/api-abjorklund-01-rbcloud-net:6443/kube:admin

=oc explain pv=
oc explain pv
=oc get configmap cluster-monitoring-config=

=put node offline=
Mark a node as unschedulable.
oc adm cordon node1
Drain a node in preparation for maintenance.
oc adm drain --force --delete-local-data --ignore-daemonsets --grace-period=30 <node>
oc adm drain --force --delete-emptydir-data --ignore-daemonsets <node>
oc adm drain --force --delete-emptydir-data --ignore-daemonsets --grace-period=1 <node>
Mark node as online.
oc adm uncordon node1
Extend memory on node.
# Add memory to master nodes.
NODE=costest-ph9l4-master-1
oc adm cordon $NODE
oc adm drain $NODE --force --delete-emptydir-data --grace-period=1 --ignore-daemonsets
timeout 10 oc debug node/$NODE -- chroot /host sh -c 'echo $HOSTNAME && sudo shutdown -P now'
govc vm.power -off /RGK/vm/costest-ph9l4/$NODE
govc vm.info /RGK/vm/costest-ph9l4/$NODE
govc vm.change -vm /RGK/vm/costest-ph9l4/$NODE -m 20480
govc vm.power -on /RGK/vm/costest-ph9l4/$NODE
oc adm uncordon $NODE
oc adm top nodes -l node-role.kubernetes.io/master

=Get pv:s=
oc get pv
Sorted by size.
oc get pv --sort-by=.spec.capacity.storage -A
Get more info about a pv.
oc describe pv $PV
=Access modes for pv:s. AccessMode=
RWO - ReadWriteOnce the volume can be mounted as read-write by a single node
ROX - ReadOnlyMany the volume can be mounted read-only by many nodes
RWX - ReadWriteMany the volume can be mounted as read-write by many nodes
RWOP - ReadWriteOncePod the volume can be mounted as read-write by a single Pod.

=get pvc:s=
oc get pvc --all-namespaces | less
sort by
oc get pvc --sort-by=.spec.resources.requests.storage -A
=list pvc by creation time=
oc get pvc --all-namespaces -o custom-columns="NAMESPACE:.metadata.namespace,NAME:.metadata.name,CREATED:.metadata.creationTimestamp"

=create pvc=
# oc create pvc
cat <<EOF | oc apply -f -
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: abjorklund-pvc1
spec:
accessModes:
- ReadWriteMany
resources:
requests:
storage: 5Gi
EOF
=use pvc. Create pod using pvc=
# Create test pod.
cat <<EOF | oc apply -f -
apiVersion: v1
kind: Pod
metadata:
name: abjorklund-test-pvc-claim1-pod
spec:
volumes:
- name: abjorklund-test-pvc
persistentVolumeClaim:
claimName: abjorklund-test-pvc
containers:
- name: abjorklund-test-pvc
image: halfface/rockylinux-toolbox:v3
volumeMounts:
- mountPath: "/mnt/abjorklund-test-pvc"
name: abjorklund-test-pvc
command: ["sleep"]
args: ["infinity"]
EOF

=extend/increase pvc=
Set new size
PVC=<pvc> ;NAMESPACE=<namespace> ; oc patch pvc ${PVC} --type=merge -p '{"spec":{"resources":{"requests":{"storage": "2Gi"}}}}' -n ${NAMESPACE}

=which pods are using pvc=
oc get pods --all-namespaces -o=json | jq -c '.items[] | {name: .metadata.name, namespace: .metadata.namespace, claimName:.spec.volumes[]? | select( has ("persistentVolumeClaim") ).persistentVolumeClaim.claimName }'
List pvc:s with the pod using them.
kubectl describe pvc -A | awk '/^Name:/ {name=$2} /^Namespace:/ {namespace=$2} /^Used By:/ {usedby=$3; print namespace "\t" name "\t" usedby}' | column -t -s $'\t'

=create storage class and create pvc=
==Install nfs csi==
helm repo add nfs-subdir-external-provisioner https://kubernetes-sigs.github.io/nfs-subdir-external-provisioner/
helm install nfs-provisioner nfs-subdir-external-provisioner/nfs-subdir-external-provisioner \
--set nfs.server=10.111.222.1 \
--set nfs.path=/storage/temp/kafka_nfs_root \
--set storageClass.name=nfs
==Make storage class default==
oc patch storageclass nfs -p '{"metadata": {"annotations":{"storageclass.kubernetes.io/is-default-class":"true"}}}'
==Create pvc using sc==
kubectl apply -f - <<EOF
apiVersion: v1
kind: PersistentVolumeClaim
metadata: {name: nfs-pvc, namespace: kafka}
spec: {accessModes: [ReadWriteOnce], resources: {requests: {storage: 1Gi}}, storageClassName: nfs}
EOF

=kubectl=
List contexts
kubectl config get-contexts
Select context
kubectl config use-context default/api-blabla-halfface-se:6443/kube:admin
=permissions=
==list groups==
oc get groups -o wide
==list cluserroles==
oc get clusterrole --all-namespaces
==list clusterrolebindings==
oc get crb
oc get clusterrolebindings

=scale=
oc scale --replicas=2 rc/postgresql-1
oc scale -n abjorklund deployment stress-hm-6x32 --replicas=0
oc scale --replicas=3 machineset <machineset> -n openshift-machine-api

=top(disable wikimedia top)=
oc adm top pods --use-protocol-buffers --all-namespaces
oc adm top pods --use-protocol-buffers --all-namespaces --sort-by=cpu | head -20| cut -c -200
oc adm top nodes --sort-by=cpu
oc adm top nodes --sort-by=memory

=get memory usage of all running pods in MB=
oc get pods -o custom-columns=POD:.metadata.name --no-headers --field-selector status.phase=Running| while read POD ; do echo $POD $(( $(oc exec -it $POD -- cat /sys/fs/cgroup/memory/memory.usage_in_bytes </dev/null 2>/dev/null) / 1024 / 1024 )) MB ; done
oc get pods -A -o wide --no-headers --field-selector spec.nodeName=ocp-04-9lxgz-worker-wlw9p --field-selector status.phase=Running | while read NAMESPACE POD NULL ; do oc project $NAMESPACE >/dev/null 2>&1 ; oc adm top pod $POD --containers --no-headers ; done | sort -k 4 -n| less
Get memory usage per pod on specific node.
NODE=ocp-01-4dfqx-worker-4n6mk ; oc get pods -A -o wide --no-headers --field-selector "spec.nodeName=${NODE},status.phase=Running" | while read NAMESPACE POD NULL ; do oc project $NAMESPACE >/dev/null 2>&1 ; oc adm top pod $POD --containers --no-headers ; done | sed 's/ */\t/g' | sort -k 4 -n | column -t -s $'\t'
=get memory usage of all nodes in % of total available ram=
oc get nodes -o name | xargs -I % oc debug % -- chroot /host sh -c 'BUFFER=($(free | grep Mem:)) ; echo $HOSTNAME $(( $(( ${BUFFER[1]} - ${BUFFER[6]} )) / $(( ${BUFFER[1]} / 100 )) ))' 2>/dev/null

=oc get crd=
Get Custom Resource Definitions.
oc get crd
=operators=
Automatically setup of a instances.
=list installed operators=
oc get ClusterServiceVersions -A
oc get csv -A
oc get operators -o json | jq -r '.items[].status.components.refs[]?|select(.kind=="ClusterServiceVersion")|.name'
Search all namespaces. Exclude namespace.
oc get csv -A -o=custom-columns='NAME:.metadata.name,VERSION:.spec.version,DISPLAY:.spec.displayName' --no-headers | sort | uniq

=list available operators=
oc get packagemanifests
=delete operator=
Delete via gui. If traces are left. Or unable to install again.
https://access.redhat.com/solutions/6762071 Remove potentially blocking references.
https://access.redhat.com/solutions/7026146 Remove label so operator is not recreated.
oc get operator prometheus.prometheus -o yaml -n openshift-operators | grep -i CustomResourceDefinition -A1 //It will list the CRDs
currently being referenced by the operator
oc edit crd thanosrulers.monitoring.coreos.com
-----------output truncated------------
labels:
operators.coreos.com/prometheus.prometheus: "" //Remove this line and then save and exit
# Remove possibly broken jobs.
oc get jobs.batch -n openshift-marketplace | grep -i 0/1
# If job was not broken then remove all references to that operator. Remove jobs and configmaps.
oc get job -n openshift-marketplace -o json | jq -r '.items[] | select(.spec.template.spec.containers[].env[].value|contains ("elasticsearch-operator")) | .metadata.name' | while read i ; do echo oc delete job $i -n openshift-marketplace ; echo oc delete configmap $i -n openshift-marketplace ; done
=delete operator=
export OPERATOR=gitops ; oc get csv,subscriptions -n openshift-operators | grep "${OPERATOR}" | awk '{print $1}' | while read i ; do oc_script_log_yaml_kubectl-neat oc get $i -n openshift-operators </dev/null; echo oc delete $i ; done ; oc get installplan -n openshift-operators --sort-by=.metadata.creationTimestamp | grep "${OPERATOR}" | tail -n1 | awk '{print $1}' | while read i ; do oc_script_log_yaml_kubectl-neat oc get installplan $i -n openshift-operators </dev/null ; echo oc delete installplan $i; done

=Select channel=
oc patch clusterversion version --type merge -p '{"spec": {"channel": "candidate-4.12"}}' # candidate-... channel offers unsupported early access to releases as soon as they are built.
oc patch clusterversion version --type merge -p '{"spec": {"channel": "fast-4.12"}}' # As soon as version as a general availability (GA) release. Fully supported. Used in production environments.
oc patch clusterversion version --type merge -p '{"spec": {"channel": "stable-4.12"}}' # Delay from fast. Looking at quality from fast. If found good then moved to stable
oc patch clusterversion version --type merge -p '{"spec": {"channel": "eus-4.12"}}' # Extended Update Support

=find if image exitst=
oc adm release info quay.io/openshift-release-dev/ocp-release:4.15.38-x86_64
=Upgrade to version that you found on github okd=
oc adm upgrade --to-image=

=oc adm upgrade=
Upgrade okd images.
=Launch a new instance of a pod for gathering debug information. Compress and deliver in support case=
cd /tmp && oc adm must-gather && tar czf /tmp/must-gather.$(oc whoami --show-server | awk -F ':|/' '{print $4}').$(date +%F_%H-%M-%S).tar.gz must-gather.local.*
=Must gather for odf=
DATE=$(date +%F_%H-%M-%S)
mkdir /tmp/${DATE} ; cd /tmp/${DATE} && oc adm must-gather --image=registry.redhat.io/odf4/odf-must-gather-rhel9:v$(oc version -o json | jq -r .openshiftVersion | grep -o '^[0-9]*\.[0-9]*')
tar czf /tmp/must-gather.$(oc whoami --show-server | awk -F ':|/' '{print $4}').${DATE}.tar.gz /tmp/${DATE}/

=oc adm certificate approve <csr_name>=
Approve csr certificate
==Approve all csr==
oc get csr --no-headers | grep -vE 'Pending|Issued' | awk '{print $1}' | xargs -r oc adm certificate approve

=certmanager=
==cert-manager design==
( +---------+ )
( | Ingress | ) Optional ACME Only!
( +---------+ )
| |
| +-------------+ +--------------------+ | +-------+ +-----------+
|-> | Certificate |----> | CertificateRequest | ----> | | Order | ----> | Challenge |
+-------------+ +--------------------+ | +-------+ +-----------+
==look at cert-manager cr==
oc api-resources | grep cert | awk '{print $1}' | while read i ; do echo '*' $i ; oc get $i -A ; done
==list certificates==
oc get certificate -A
==list ClusterIssuer==
oc get ClusterIssuer -A
==list orders by date==
oc get orders -n openshift-config --sort-by=.metadata.creationTimestamp
==install cmctl==
<pre>
curl -fsSL https://github.com/cert-manager/cert-manager/releases/latest/download/cmctl-linux-amd64.tar.gz | (cd /usr/local/bin/ ; sudo tar zxf - cmctl)
</pre>

==completion==
. <(cmctl completion bash)
==renew cert==
cmctl renew -n openshift-config cert-api
==status of cert==
cmctl status certificate -n openshift-ingress le-wildcard-apps-certificate
=cert-utils=
==cert check==
<pre>
apiVersion: monitoring.coreos.com/v1
kind: PrometheusRule
metadata:
name: cert-utils-operator-certificate-rule-alerts
namespace: cert-utils-operator
spec:
groups:
- name: cert-utils-operator-recording-rules
rules:
- expr: certutils_certificate_expiry_time - certutils_certificate_issue_time
record: cert:validity_duration:sec
- expr: certutils_certificate_expiry_time - time()
record: cert:time_to_expiration:sec
- name: cert-utils-operator-alerting-rules
rules:
- alert: CertificateApproachingExpiration
annotations:
message: Certificate {{ $labels.namespace }}/{{ $labels.name }} has less than 30 days left.
summary: Certificate {{ $labels.namespace }}/{{ $labels.name }} is approaching expiration (30 days left).
expr: |
cert:validity_duration:sec >= 7776000 and cert:time_to_expiration:sec < 2592000
labels:
severity: warning
- alert: CertificateIsAboutToExpire
annotations:
message: Certificate {{ $labels.namespace }}/{{ $labels.name }} has less than 15 days left.
summary: Certificate {{ $labels.namespace }}/{{ $labels.name }} is about to expire (15 days left).
expr: |
cert:validity_duration:sec >= 7776000 and cert:time_to_expiration:sec < 1296000
labels:
severity: critical
</pre>

=oc adm release info=
# Show information about the cluster's current release
oc adm release info
# Show the source code that comprises a release
oc adm release info 4.2.2 --commit-urls
# Show the source code difference between two releases
oc adm release info 4.2.0 4.2.2 --commits
# Show where the images referenced by the release are located
oc adm release info quay.io/openshift-release-dev/ocp-release:4.2.2 --pullspecs
# Show release info about a release
oc adm release info 4.10.47 --pullspecs
=release notes=
find changes between ocp versions / release note.
https://access.redhat.com/labs/ocpupgradegraph/update_path
Select source and destination.
At bottom there is graphical display.
Press each bubble and read rhba.
Point releases in the end.
https://docs.openshift.com/container-platform/4.12/release_notes/ocp-4-12-release-notes.html

=oc adm node-logs=
Look at logs from crio from master nodes.
oc adm node-logs --role master -u crio
Get logs from one node from unit crio
oc adm node-logs abjorklund-01-5tsbc-worker-0-kcr54 -u crio
Look at specific log
oc adm node-logs --role master --path=openshift-apiserver/audit.log
List logs
oc adm node-logs --role=master --path=/
List logs from specific node.
oc adm node-logs nord-ic-bc84t-master-0 --path=/oauth-server/
Logs since older reboots
oc adm node-logs --role=master --path=/
Search recursive where log file exist.
oc_debug_run_command_all_nodes 'find /var/log 2>&1 | grep <name_pod>'
==download logfile==
CONTAINER_PATH="/containers" ; SEARCH_STRING="rabbit" ; oc adm node-logs --role=worker --path="${CONTAINER_PATH}" | grep "${SEARCH_STRING}" | while read NODE LOGFILE ; do echo $NODE --path="${CONTAINER_PATH}/${LOGFILE}" ; oc adm node-logs $NODE --path="${CONTAINER_PATH}/${LOGFILE}" > ${NODE}:${CONTAINER_PATH//\//%}%${LOGFILE} ; done

=openshift upgrade path=
https://access.redhat.com/labs/ocpupgradegraph/update_path?channel=stable-4.9&arch=x86_64&is_show_hot_fix=false&current_ocp_version=4.9.15&target_ocp_version=4.10.11
=Upgrade openshift/okd=
https://docs.okd.io/latest/updating/preparing_for_updates/updating-cluster-prepare.html
Run below and look to se if api:s that are being removed has a count.
oc get apirequestcounts

=upgrade openshift=
# look for existing alerts.
# look for troublesome pods.
oc get pods -A | grep -Ev ' Running | Completed '
# Set channel
oc patch clusterversion version --type merge -p '{"spec": {"channel": "stable-4.10"}}'
oc adm upgrade --to=4.10.47
oc adm upgrade --include-not-recommended
oc adm upgrade --allow-not-recommended --to=4.10.0 --include-not-recommended
oc get clusterversion -o json|jq ".items[0].spec"
# View openshift version history.
oc get clusterversion -o json | jq -r '.items[0].status.history[] | [.version, .startedTime, .completionTime] | join(" ")'
# View progress of update.
watch -n1 oc whoami --show-console \; oc adm upgrade
watch -cn1 "oc get clusteroperators | grep --color=always -E \"$(oc get clusterversions.config.openshift.io version -o json | jq -r .status.desired.version)|\""
# Upgrade all operators
oc get installplan -A | grep Manual | grep false
oc patch installplan $INSTALLPLAN -n $NAMESPACE --type merge --patch '{"spec":{"approved":true}}'

=upgrade okd=
==Get upgrade path.==
Look here to find latest version https://github.com/okd-project/okd/releases
(cd /usr/local/bin/ ; sudo curl -s -O https://gist.githubusercontent.com/Goose29/ca7debd6aec7d1a4959faa2d1b661d93/raw/4584d89c49d4af197480539bdd873f6d9ca2dd83/upgrade-path.py ; sudo chmod 755 upgrade-path.py ) && (curl -sH 'Accept:application/json' 'https://amd64.origin.releases.ci.openshift.org/graph?channel=stable-4' | upgrade-path.py 4.13.0-0.okd-2023-07-23-051208 4.14.0-0.okd-2024-01-26-175629 )
==To view status of update process run. Command is harmless and gives information about ongoing process and blockers.==
oc adm upgrade
watch -cn1 "oc whoami --show-console ; echo ; oc get clusteroperators | grep --color=always -E \"$(oc get clusterversions.config.openshift.io version -o json|jq -r '.spec.desiredUpdate.version')|\""
==To get slightly other view. VERSION column gives information about version. When update is done all cluster operators will have same version number.==
oc get clusteroperators
==Make a report of cluster status before installing. To rule out issues that you have not caused.==
"status of kubernetes" below.

==Look for api:s that are used that are flagged for being removed.==
oc get apirequestcounts
==Upgrade okd until there are no more updates or you have reached wanted version.==
oc adm upgrade --to-latest=true --allow-explicit-upgrade
==If complaining about cert. ReleaseAccepted=False==
oc patch --type='merge' --patch='{"spec":{"desiredUpdate":{"force":true}}}' clusterversion version
==If client want specific version pinpoint that.==
oc adm upgrade --to=<version from oc adm upgrade> --allow-explicit-upgrade
oc adm upgrade gives: Upgradeable=False Reason: AdminAckRequiredn Follow instructions from link. Command will be something like below.
oc -n openshift-config patch cm admin-acks --patch '{"data":{"ack-<version>-kube-<version>-api-removals-in-<version>":"true"}}' --type=merge
==Get pods that are less than perfekt.==
oc get pods -A --no-headers | grep -v Completed | while read LINE ; do PODS=$(awk '{print $3}' <<< "${LINE}") ; if [ "${PODS%%/*}" != "${PODS##*/}" ] ; then echo "${LINE}" ; fi ; done
==Get critical alerts.==
oc -n openshift-monitoring exec -c prometheus prometheus-k8s-0 -- curl -s "http://localhost:9090/api/v1/alerts" | jq '.data.alerts[]|select(.state=="firing")|select(.labels.severity=="critical")'
==Get warning alerts.==
oc -n openshift-monitoring exec -c prometheus prometheus-k8s-0 -- curl -s "http://localhost:9090/api/v1/alerts" | jq '.data.alerts[]|select(.state=="firing")|select(.labels.severity=="warning")'

=upgrade odf=
# View existing config.
oc get subscriptions -n openshift-storage odf-operator -o yaml
# Patch subscription
oc patch subscriptions -n openshift-storage odf-operator --type merge -p '{"spec": {"channel": "<channel>"}}'
# Get install plans
oc get installplan -n openshift-storage -o wide
# Approve install plan.
oc get installplans.operators.coreos.com -A --no-headers | awk '$5 ~ /false/' | awk '$4 ~ /Manual/' | while read NAMESPACE INSTALLPLAN END ; do echo '*' $NAMESPACE $INSTALLPLAN ; oc patch installplan $INSTALLPLAN -n $NAMESPACE --type merge --patch '{"spec":{"approved":true}}' ; done

=odf troubleshooting=
# ceph problem. Run commands from rook-ceph-operator
oc rsh -n openshift-storage $(oc get pods -n openshift-storage -o name -l app=rook-ceph-operator)
export CEPH_ARGS='-c /var/lib/rook/openshift-storage/openshift-storage.config'
ceph -s
ceph osd pool ls
ceph osd pool autoscale-status
ceph config dump
# disable autoscaling
ceph osd pool ls | while read i ; do echo '*' $i ; ceph osd pool set $i pg_autoscale_mode off ; done
# Look to see how much data is being used for pg:s.
# Number of PGLog Entries, size of PGLog data in megabytes, and Average size of each PGLog item
for i in 0 1 2 ; do echo '*' $i ; osdid=$i ; ceph tell osd.$osdid dump_mempools | jq -r '.mempool.by_pool.osd_pglog | [ .items, .bytes /1024/1024, .bytes / .items ] | @csv' ;done
ceph df

=cronjobs=
oc get cj
oc get cronjobs -o wide -A
Run cronjob manually
export CRONJOB=ldap-sync ; oc create job --from=cronjob/${CRONJOB} ${CRONJOB}-manual-$(date '+%Y-%m-%d-%H-%M-%S')
Disable cronjob
.spec.suspend: true
Enable cronjob
oc patch cronjobs.batch write-to-nfs --type merge -p '{"spec": {"suspend": false}}'

=delete po (stop, kill)=
stop pod
oc delete po --all --force
oc delete pod openshift-gitops-server --namespace openshift-gitops
oc delete pods -n openshift-oauth-apiserver --all
oc get po -A | grep -v ^NAME | awk '$4 !~ /Running/' | sort -k4 | while read NAMESPACE POD READY STATUS END ; do echo '****' $POD $STATUS ; echo oc delete po $POD -n $NAMESPACE --force --grace-period=0 ; done
oc get pods -A --field-selector=status.phase!=Running --no-headers | while read NAME_SPACE POD REST_OF_LINE ; do echo oc delete pod $POD -n "${NAME_SPACE}" --force --grace-period=0 ; done
(oc get pods --field-selector="status.phase=Pending" --no-headers -A ; oc get pods --field-selector="status.phase=Failed" --no-headers -A) | while read NAME_SPACE POD REST_OF_LINE ; do echo oc delete pod $POD -n "${NAME_SPACE}" --force --grace-period=0 ; done
# Delete pods and generate report on what has been removed.
LOG=/tmp/oc_delete_pod_$(oc config current-context | awk -F '/|:' '{print $2}').$(date '+%Y-%m-%d_%H-%M-%S').log ; (oc get pods --field-selector="status.phase=Pending" --no-headers -A ; oc get pods --field-selector="status.phase=Failed" --no-headers -A) | while read NAME_SPACE POD REST_OF_LINE ; do oc delete pod $POD -n "${NAME_SPACE}" --force --grace-period=0 ; done | tee $LOG ; awk -F\" '{print $2}' $LOG | sed 's/-[a-z0-9]*$//g'| sed 's/-[a-z0-9]*$//g' | sort | uniq -c | sort -n | tail -20

=use other namespace=
oc rsh --namespace namespace-name pod-name
oc rsh --namespace namespace-name-operator pod-name bash -c 'echo $PATH $HOSTNAME'

=list namespaces=
oc get namespace
=use namespace=
oc rsh --namespace openshift-gitops openshift-gitops-application-controller-0
=kubectl get netnamespace=
Command line utility used to configure network. Egress address can be used to define outgoing address. Which can also cause other issues.
oc get netnamespace openshift-gitops -oyaml

=oc get routes=
oc get routes --namespace openshift-gitops
=oc get oauth=
Describe authentication methods.
oc get oauth cluster -o yaml
=decode token. base64=
https://jwt.io/
=view secrets=
oc get secret ca-key-pair -o go-template='{{range $k,$v := .data}}{{"### "}}{{$k}}{{"\n"}}{{$v|base64decode}}{{"\n\n"}}{{end}}'
=delete cluster=
openshift-install destroy cluster
=storageclasses(sc)=
oc get storageclasses
=get storageclasses defined as default=
oc get sc -o json | jq -r '.items[]|select(."metadata".annotations."storageclass.kubernetes.io/is-default-class"=="true")|.metadata.name'
=set default storageclass=
# Set all sc to default false.
oc get sc -o json | jq -r '.items[]|select(."metadata".annotations."storageclass.kubernetes.io/is-default-class"=="true")|.metadata.name' | while read i ; do echo '*' $i ; oc patch storageclass $i -p '{"metadata": {"annotations":{"storageclass.kubernetes.io/is-default-class":"false"}}}'; done
# Set default storageclass.
oc patch storageclass ocs-storagecluster-cephfs -p '{"metadata": {"annotations":{"storageclass.kubernetes.io/is-default-class":"true"}}}'

=get service accounts=
oc get serviceaccounts -A
oc get sa -A

=which permissions do I have=
oc auth can-i --as=fjuza --list
oc get groups -o wide
oc auth can-i --as-group=<group> --list

=alerts=
==How is alertmanager configured==
oc get secret -n openshift-monitoring alertmanager-main -o json | jq -r '.data."alertmanager.yaml"|@base64d'

==Save alertmanger config==
<pre>
oc get secret alertmanager-main -n openshift-monitoring --template='{{index .data "alertmanager.yaml" | base64decode}}' > /tmp/oc_get_secret_alertmanager-main.alertmanager.yaml.$(oc whoami --show-console=true | awk -F / '{print $3}').$(date '+%Y-%m-%d_%H-%M-%S')
oc extract secret/alertmanager-main --confirm -n openshift-monitoring
</pre>

==Restore alertmanager config==
oc set data secret alertmanager-main -n openshift-monitoring --from-file=alertmanager.yaml=<file_alertmanager.yaml>

==alertmanager==
View Alertmanager configured alerts.
oc get prometheusrules -A -o yaml | grep alert: | sort
View configuration of alert
oc get prometheusrules -A -o json | jq '.items[].spec.groups[].rules[]| select(.alert=="AlertmanagerReceiversNotConfigured")'
view alerts.
oc -n openshift-monitoring exec -c prometheus prometheus-k8s-0 -- curl -s "http://localhost:9090/api/v1/alerts" | jq . | less -ISRM
View specific alert.
oc rsh -n openshift-monitoring -c prometheus prometheus-k8s-0 -- curl 'http://localhost:9090/api/v1/query?query=absent%28up%7Bjob%3D"fluentd"%7D+%3D%3D+1%29' | jq .
View alerts in state firing
oc -n openshift-monitoring exec -c prometheus prometheus-k8s-0 -- curl -s "http://localhost:9090/api/v1/alerts" | jq '.data.alerts[]|select(.state=="firing")' | less -ISRM
View alerts in state firing with severity warning
oc -n openshift-monitoring exec -c prometheus prometheus-k8s-0 -- curl -s "http://localhost:9090/api/v1/alerts" | jq '.data.alerts[]|select(.state=="firing")|select(.labels.severity=="warning")' | less -ISRM
View historical alerts.
oc -n openshift-monitoring exec -c prometheus prometheus-k8s-0 -- curl -s "http://localhost:9090/api/v1/query_range?query=ALERTS&start=2022-08-08T00:00:00.781Z&end=2022-08-09T00:00:00.781Z&step=1m"
oc -n openshift-monitoring exec -c prometheus prometheus-k8s-0 -- curl -s "http://localhost:9090/api/v1/query_range?query=ALERTS&start=$(date '+%Y-%m-%d' --date '-2 days')T00:00:00.781Z&end=$(date '+%Y-%m-%dT%H:%M:%S').781Z&step=1m" | jq . | less -ISRM
Get warning alerts since the last week.
echo '***' $(oc whoami --show-console) ; oc -n openshift-monitoring exec -c prometheus prometheus-k8s-0 -- curl -s "http://localhost:9090/api/v1/query_range?query=ALERTS&start=$(TZ=UTC date '+%Y-%m-%dT%H:%M:%S.000Z' --date '-6 days')&end=$(TZ=UTC date '+%Y-%m-%dT%H:%M:%S').000Z&step=1m" | jq -r '.data.result[].metric | {alertname, severity, alertstate}| select(.severity=="warning")|select(.alertstate=="firing") | .alertname'
Get more info about fired alerts.
echo '***' $(oc whoami --show-console) ; oc -n openshift-monitoring exec -c prometheus prometheus-k8s-0 -- curl -s "http://localhost:9090/api/v1/query_range?query=ALERTS&start=$(TZ=UTC date '+%Y-%m-%dT%H:%M:%S.000Z' --date '-6 days')&end=$(TZ=UTC date '+%Y-%m-%dT%H:%M:%S').000Z&step=1m" | jq -r '.data.result[].metric | {alertname, severity, alertstate, pod, namespace}| select(.severity=="warning")|select(.alertstate=="firing")'
Get alert during the last 6 days. Give times when alert has fired.
oc -n openshift-monitoring exec -c prometheus prometheus-k8s-0 -- curl -s "http://localhost:9090/api/v1/query_range?query=ALERTS&start=$(TZ=UTC date '+%Y-%m-%dT%H:%M:%S.000Z' --date '-6 days')&end=$(TZ=UTC date '+%Y-%m-%dT%H:%M:%S').000Z&step=1m" | jq -r . | python3 -c "import sys, re, datetime; print(re.sub(r'\b\d{10}\b', lambda x: datetime.datetime.utcfromtimestamp(int(x.group())).isoformat() + 'Z', sys.stdin.read()))" | less -ISRM

=disable alermanager alert=
oc -n openshift-monitoring exec -ti alertmanager-main-0 -c alertmanager -- amtool silence add --alertmanager.url http://localhost:9093 alertname=AlertmanagerReceiversNotConfigured --end="2053-11-07T00:00:00-00:00" --comment "silence alertmanager"
=list silenced alerts=
oc -n openshift-monitoring exec -ti alertmanager-main-0 -c alertmanager -- amtool silence query --alertmanager.url http://localhost:9093
=Parsed config to alertmanager=
oc -n openshift-monitoring exec -ti alertmanager-main-0 -c alertmanager -- curl http://localhost:9093/api/v2/status | jq -r .config.original
=Version of alertmanager=
oc -n openshift-monitoring exec -ti alertmanager-main-0 -c alertmanager -- curl http://localhost:9093/api/v2/status | jq -r .versionInfo.version | strings

=Silence alertmanager not configured alert=
oc set data secret alertmanager-main -n openshift-monitoring --from-file=alertmanager.yaml=<(cat <<'EOF'
"global":
"resolve_timeout": "5m"
"inhibit_rules":
- "equal":
- "namespace"
- "alertname"
"source_match":
"severity": "critical"
"target_match_re":
"severity": "warning|info"
- "equal":
- "namespace"
- "alertname"
"source_match":
"severity": "warning"
"target_match_re":
"severity": "info"
"receivers":
- "name": "Default"
- "name": "Watchdog"
- "name": "Critical"
- "name": "testrec" # Dummy receiver with webhook config
"webhook_configs":
- "url": "http://xxxxdumyxxx.com"
"route":
"group_by":
- "namespace"
"group_interval": "5m"
"group_wait": "30s"
"receiver": "Default"
"repeat_interval": "12h"
"routes":
- "match":
"alertname": "dummyalert" # Dummy alert being routed to dummy receiver
"receiver": "testrec"
EOF
)

=prometheus=
Url to web interface.
https://prometheus-k8s-openshift-monitoring.apps.<url>
echo https://prometheus-k8s-openshift-monitoring.$(oc whoami --show-console | awk -F 'console-openshift-console.' '{print $2}')
echo https://$(oc get route -n openshift-monitoring prometheus-k8s -o jsonpath="{.spec.host}")
Get disk usage from odf
oc -n openshift-monitoring exec -c prometheus prometheus-k8s-0 -- curl -s "http://localhost:9090/api/v1/query?query=odf_system_raw_capacity_used_bytes" | jq -r .
Get disk usage from odf over time.(metrics)
oc -n openshift-monitoring exec -c prometheus prometheus-k8s-0 -- curl -s "http://localhost:9090/api/v1/query_range?query=odf_system_raw_capacity_used_bytes&start=$(date '+%Y-%m-%d' --date '-20 days')T00:00:00.781Z&end=$(date '+%Y-%m-%dT%H:%M:%S').781Z&step=1h" | jq . | less -ISRM
Search tips
https://prometheus.io/docs/prometheus/latest/querying/basics/
Disk usage per project. Taken from RH ticket.
oc -n openshift-monitoring exec prometheus-k8s-0 -c prometheus -- curl -s -g 'http://localhost:9090/api/v1/query?' --data-urlencode 'query=(sort_desc(topk(25,(sum(kubelet_volume_stats_used_bytes * on (namespace,persistentvolumeclaim) group_left(storageclass, provisioner) (kube_persistentvolumeclaim_info * on (storageclass) group_left(provisioner) kube_storageclass_info {provisioner=~"(.*cephfs.csi.ceph.com)"})) by (namespace)))))'

=openshift-user-workload-monitoring=
"annotations": {
"description": "Prometheus operator in openshift-user-workload-monitoring namespace rejected 2 prometheus/ServiceMonitor resources.",
"summary": "Resources rejected by Prometheus operator"
},...
# Look at what is causing.
oc logs -l app.kubernetes.io/name=prometheus-operator -n openshift-user-workload-monitoring
# After tweaking with monitoring settings kill pod and view log.
oc delete pod -l app.kubernetes.io/name=prometheus-operator -n openshift-user-workload-monitoring
oc logs -l app.kubernetes.io/name=prometheus-operator -n openshift-user-workload-monitoring | less
# Stop monitoring.
oc label namespace openshift-local-storage openshift.io/cluster-monitoring-
oc label namespace openshift-local-storage openshift.io/user-monitoring=false
# Allow monitoring.
oc label namespace openshift-operators openshift.io/cluster-monitoring=true

=Talk to api with Bearer.=
HOST=$(oc -n openshift-monitoring get route alertmanager-main -ojsonpath={.spec.host})
TOKEN=$(oc whoami -t)
curl -skH "Authorization: Bearer $TOKEN" "https://$HOST/api/v2/alerts" | jq .
=token=
token=`oc sa get-token prometheus-k8s -n openshift-monitoring` ## --- In OCP client 4.10 or lower ---
OR
token=`oc create token prometheus-k8s -n openshift-monitoring` ## --- In OCP client 4.11 or higher ---
curl using token
curl -k -H "Authorization: Bearer $token" 'https://alertmanager-main-openshift-monitoring.apps.domain/api/v1/alerts' | jq '.data[].labels'
=ServiceMonitor=
Prometheus Operator:
When using Prometheus Operator, custom resources like ServiceMonitor and PodMonitor might include metricsConfig settings to customize how Prometheus should scrape metrics from various services or pods.

=bash completion=
. <(oc completion bash)

=machineconfig=
view settings
oc describe machineconfigpool
==set ntp servers==
echo 'variant: openshift
version: 4.9.0
metadata:
name: 99-master-chrony
labels:
machineconfiguration.openshift.io/role: master
storage:
files:
- path: /etc/chrony.conf
mode: 0644
overwrite: true
contents:
inline: |
server ntp.lio.se iburst
driftfile /var/lib/chrony/drift
makestep 1.0 3
rtcsync
logdir /var/log/chrony' | butane | oc apply -f -
==get machineconfig value==
oc get mc 00-master -o json | jq -r '.spec.config.storage.files[]|select(.path=="/var/lib/kubelet/config.json")|.contents.source' | perl -pe 's/%([0-9a-f]{2})/sprintf("%s", pack("H2",$1))/eig' | sed 's/^data:,//g' | jq .

==List machineconfigs by creation time==
oc get mc --sort-by=.metadata.creationTimestamp

=get users=
oc get users
=give me kubeadmin ecrypted password=
oc get secret kubeadmin -n kube-system -o json -o=jsonpath='{.data.kubeadmin}' | base64 -d
=Give kubeadmin a new password=
==generate password hash==
htpasswd -bnBC 10 "" '<password>' | tr -d ':\n' | base64 -w0

==patch password hash==
oc patch secret/kubeadmin -n kube-system -p '{"data": {"kubeadmin": "UGFzc3dvcmQK=="}}'

=work with oc without login=
export KUBECONFIG=/var/lib/kubelet/kubeconfig
if on bootstrap node.
export KUBECONFIG=/etc/kubernetes/kubeconfig

=Add the following if cert is not trusted.ssl/tls/ignore/expired=
- cluster:
insecure-skip-tls-verify: true
server: https://127.0.0.1:443
name: my-cluster

=run oc when on node=
oc get pod -n openshift-monitoring --kubeconfig=/var/lib/kubelet/kubeconfig

=etcdctl=
oc rsh -c etcdctl -n openshift-etcd $(oc get pod -l app=etcd -oname -n openshift-etcd | awk -F"/" 'NR==1{ print $2 }')
[root@ocp-03-lm8km-master-1 /]# etcdctl --write-out=table endpoint status
+---------------------------+------------------+---------+---------+-----------+------------+-----------+------------+--------------------+--------+
| ENDPOINT | ID | VERSION | DB SIZE | IS LEADER | IS LEARNER | RAFT TERM | RAFT INDEX | RAFT APPLIED INDEX | ERRORS |
+---------------------------+------------------+---------+---------+-----------+------------+-----------+------------+--------------------+--------+
| htt://172.19.14.36:2379 | c4f7b42b92713818 | 3.5.0 | 105 MB | false | false | 6 | 2632074 | 2632074 | |
| htt://172.19.14.37:2379 | 5dea668b432969fc | 3.5.0 | 105 MB | false | false | 6 | 2632074 | 2632074 | |
| htt://172.19.14.41:2379 | 51cecd971b657ee5 | 3.5.0 | 105 MB | true | false | 6 | 2632074 | 2632074 | |
+---------------------------+------------------+---------+---------+-----------+------------+-----------+------------+--------------------+--------+
Verifying etcd while openshift is less than perfekt
# List etcd containers
crictl ps --label io.kubernetes.pod.namespace=openshift-etcd
# Execute command to verify health of etcd using crictl
crictl exec -it <container-id> etcdctl endpoint status --write-out=table

=create troubleshooting/debug/test pod=
oc run abjorklund-redhat-ubi8 --image=redhat/ubi8 -i --tty -- sh
oc run abjorklund-curlimage-curl --image=curlimages/curl -i --tty -- sh
oc run -it busybox --image=busybox --restart=Never -- ash
oc run abjorklund-rocky-rocky --image=rockylinux/rockylinux -i --tty -- bash
oc run ${USER}-rocky-rocky --image=rockylinux/rockylinux -i --tty -- bash # dnf -y install procps-ng iproute
oc run ${USER}-rocky-rocky --image=rockylinux/rockylinux --restart=Never --command sleep infinity
==install packages to get running==
yum install -y lsof procps-ng bind-utils

=proxy settings=
oc get proxy cluster -o yaml
Change ca
oc patch proxy/cluster --type=merge --patch='{"spec":{"trustedCA":{"name":"custom-ca"}}}'
=oc proxy=
Run a proxy to the Kubernetes API server
=port forward to pod=
oc port-forward <my-pod-name> <local-port>:<remote-port>
=alertmanager=
oc port-forward -n monitoring svc/kube-prometheus-stack-alertmanager 9093:9093 # http://localhost:9093/
=grafana access=
oc port-forward -n monitoring svc/kube-prometheus-stack-grafana 3000:80 # http://localhost:3000 admin prom-operator
=prometheus access=
oc port-forward -n monitoring svc/kube-prometheus-stack-prometheus 9090:9090 # http://localhost:9090
=akhq=
<pre>
kubectl port-forward service/akhq 8080:80
http://localhost:8080
</pre>

=thanos-queries=
oc port-forward -n openshift-monitoring svc/thanos-querier 9091:9091 # access via: curl -sk -H "Authorization: Bearer $(oc whoami -t)" https://localhost:9091/api/v1/status/buildinfo | jq . (via browser use requestly)

==proxy via pod==
# Create tunnel pod. Please remove when done.
oc apply -f - << 'EOF'
apiVersion: v1
kind: Pod
metadata:
name: proxy-pod
namespace: default
spec:
containers:
- name: socat-proxy
image: alpine/socat:latest
command: ["/bin/sh", "-c"]
args:
- |
apk add --no-cache socat && # Install socat if not in image
socat TCP-LISTEN:443,fork,reuseaddr TCP:scm.devops.cambio.se:443
ports:
- containerPort: 443
restartPolicy: Never
EOF
# Tunnel on localhost reaching destination.
sudo oc --kubeconfig=$KUBECONFIG port-forward pod/proxy-pod -n default 443:443
# Add hosts entry to use browser as "usual".
grep scm.devops.cambio.se /etc/hosts
127.0.0.1 localhost scm.devops.cambio.se

=Install additional ca certificate=
apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
metadata:
labels:
machineconfiguration.openshift.io/role: worker
name: 50-company-ca-cert
spec:
config:
ignition:
version: 3.1.0
storage:
files:
- contents:
source: data:text/plain;charset=utf-8;base64,LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURrVENDQW5tZ0F3SUJBZ0lFSC93Skh6QU5CZ2txaGtpRzl3MEJBUXNGQURBM01SVXdFd1lEVlFRS0RBeFMKUlVSQ1VrbEVSMFV1VTBVeEhqQWNCZ05WQkFNTUZVTmxjblJwWm1sallYUmxJRUYxZEdodmNtbDBlVEFlRncweQpNVEF5TWpNd056RTVOVFphRncwME1UQXlNak13TnpFNU5UWmFNRGN4RlRBVEJnTlZCQW9NREZKRlJFSlNTVVJIClJTNVRSVEVlTUJ3R0ExVUVBd3dWUTJWeWRHbG1hV05oZEdVZ1FYVjBhRzl5YVhSNU1JSUJJakFOQmdrcWhraUcKOXcwQkFRRUZBQU9DQVE4QU1JSUJDZ0tDQVFFQW5mY1F3YURwcEdzNWJxaUc5ajE5aFJVaG1sMzhjb2JGT2tzRQpsZFo3Y3RkV1d6VHJqSTFCRGxZSEd5SXBYMEo4ZU1PaDhvbUZqbVR6VTEzTkpWSnJrWm5RaDRhTzA1UGtKRlJRCkg1ZVA2N3R0S2pEb0txOFZVWXRZUldxRlFaalNxY2lQMzJobXZSNG42QVZDWDdCaUVBZjd2Y05ZVys0a1k5OUsKbTluV1BNbEpGU056M1puRnlWc1BtR1ZWeVN2RmFVL0dBTmt1Z25uSGdUM1VUUTNsc2NidU5keUpBcVEya3dHSwpKbkdZKzBSajVrUWpvdXptUjBDZ3pJN0hWSmhwK2Z6R1lyenRYQXA1Zkt0Z3ZTZFRtTndVVXZJR3pLTmU4WklGCmY0WVVUUDFPdU9jUmNIRDJQclVodDgzWlRLYzNwOUhLYk5CazIzWFFtYU85QVBqeEl3SURBUUFCbzRHa01JR2gKTUI4R0ExVWRJd1FZTUJhQUZMbWFrNHdDamtuakZvWkd6M1daRGErY2N4RGxNQjBHQTFVZERnUVdCQlM1bXBPTQpBbzVKNHhhR1JzOTFtUTJ2bkhNUTVUQVBCZ05WSFJNQkFmOEVCVEFEQVFIL01BNEdBMVVkRHdFQi93UUVBd0lCCnhqQStCZ2dyQmdFRkJRY0JBUVF5TURBd0xnWUlLd1lCQlFVSE1BR0dJbWgwZEhBNkx5OXBjR0V0WTJFdWNtVmsKWW5KcFpHZGxMbk5sTDJOaEwyOWpjM0F3RFFZSktvWklodmNOQVFFTEJRQURnZ0VCQURabURvUytJY1ZMcERBRwpiSXM0SWRJKzcxY0xINk90NjNkYWhBT25QRDJnMUhvVUFIZFdUcGdobER3TkFQWjg3UXQybFc4Q1B4eDhCQVZOCnlrZWlEN2paeVA5dmVCcDRxNjBiSTVYSENndWV5U2lGdjBBKzloKzMzekMrYy9WbStJVHJNTkZ0dlZMNE1kRWQKaVE4UVBhaFJEWW1qVkJVb1VIZWErMDdkWEY3TzQxY2t2YzZRb0lad2F5Y1Zhc0gvd05lVGNrdzl1TlNiajNTQwoyNHdpOUthQnpxdDZsWlF3TG5uUjVnNjNWUDZNZUprR2FXMTBxdExiQVM4NGZwQ1NWTUx3U051MGZqeFU2d2lPCkRjaWlKKzNZOG5ldjM5NGJHRkwxcG5ZVmM4YmpoL0xaaHM1dTRQUnhlNFBLRER2Y09NZUhpUkN1M1YySWRRTTgKbDl3enBQZz0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQoK
mode: 0644
overwrite: true
path: /etc/pki/ca-trust/source/anchors/company-ca.crt

=get raw api data=
oc get --raw "/api/v1/nodes/[node]/proxy/stats/summary"
Via proxy.
oc proxy &
Starting to serve on 127.0.0.1:8001
curl -s http://localhost:8001/api/v1/nodes/crc-lgph7-master-0/proxy/stats/summary
curl -s http://localhost:8001/api/v1/nodes/crc-lgph7-master-0/proxy/metrics/resource
=explain=
Get documentation for a resource. Get available attributes for an resource.
oc explain deployment

=events=
Get events.
oc get events -A --sort-by=.metadata.creationTimestamp
=jsonpath=
Get names of MachineConfigs one value per line.
oc get mc -o jsonpath='{range .items[*]}{.metadata.name}{"\n"}{end}' --no-headers
=ImageStreamTag=
ImageStreamTag represents an Image that is retrieved by tag name from an ImageStream.
=imagestream=
apiVersion: image.openshift.io/v1
kind: ImageStream
metadata:
name: myapp
==Tagging Images: When you tag an image, it is added to the ImageStream with a specified tag.==
oc tag myregistry/myapp:latest myapp:latest
==Using ImageStreams in Deployment Configurations: Deployment configurations can reference ImageStreams instead of direct image URLs.==
apiVersion: apps.openshift.io/v1
kind: DeploymentConfig
metadata:
name: myapp
spec:
template:
spec:
containers:
- name: myapp
image: image-registry.openshift-image-registry.svc:5000/myproject/myapp:latest

=BuildConfig=
Build configurations define a build process for new container images.
=download okd openshift-install=
# Show latest.
curl -skL https://github.com/okd-project/okd/releases | elinks --dump | sed 's/^ *//g' | grep " Latest"
# Download and install in /usr/local/bin. Keep old versions.
export OKD_VERSION=4.15.0-0.okd-2024-03-10-010116 ; (cd /temp/ ; oc adm release extract --tools quay.io/openshift/okd:${OKD_VERSION} ; cd /usr/local/bin/ ; sudo tar xf /temp/openshift-install-linux-${OKD_VERSION}.tar.gz openshift-install ; sudo mv openshift-install openshift-install.${OKD_VERSION})

=setup openshift cluster=
Download binary
<pre>
cd /tmp/ ; curl -L -O https://mirror.openshift.com/pub/openshift-v4/x86_64/clients/ocp/4.10.47/openshift-install-linux.tar.gz && sudo tar xf openshift-install-linux.tar.gz -C /usr/local/bin/
</pre>
Add vmware certs if using that backend.
(cd /tmp/ ; curl -sk https://${vspherer_server}/certs/download.zip -O) ; cd /etc/pki/ca-trust/source/anchors ; sudo unzip -oj /tmp/download.zip certs/lin/\* ; sudo update-ca-trust
Create config file
install-config.yaml
Then fire off install
openshift-install create cluster
Another example
ln -s install-config.yaml.2023-03-23 install-config.yaml
./openshift-install-4.12.0-0.okd-2023-04-16-041331 create cluster

=Edit install config after setup=
Save config
<pre>
oc get cm cluster-config-v1 -n kube-system --template='{{index .data "install-config" }}' > /tmp/cm_cluster-config-v1_-n_kube-system.$(oc whoami --show-console=true | awk -F / '{print $3}').$(date '+%Y-%m-%d_%H-%M-%S')
</pre>
Edit downloaded file and apply edited file.
oc set data cm cluster-config-v1 -n kube-system --from-file=install-config=/tmp/cm_cluster-config-v1_-n_kube-system.<suitable_name>

=look at install settings=
oc get -n kube-system cm/cluster-config-v1 -o yaml

=argocd login=
argocd login openshift-gitops-server-openshift-gitops.apps.costest.ltkronoberg.se --username kubeadmin --password asdfasfasdfas --sso --insecure
argocd login $(oc get routes -n openshift-gitops openshift-gitops-server -o json | jq -r .spec.host) --username $USER --password $COMPANY_PASSWORD --sso --insecure

=git sync heal=
argocd app list | grep -v NAME | awk '{print $1}' | while read i ; do echo '*' $i ; argocd app set $i --self-heal ; done

=metrics=
==Get available values==
Thanos monitoring points
curl -sk -H "Authorization: Bearer $(oc whoami -t)" https://$(oc get routes -n openshift-monitoring thanos-querier -o jsonpath='{.status.ingress[0].host}')/api/v1/metadata | jq .
node-exporter
oc --request-timeout=3 -n openshift-monitoring exec -c node-exporter $(oc get pod -n openshift-monitoring -l app.kubernetes.io/name=node-exporter -o=custom-columns='NAME:.metadata.name' --no-headers | head -1) -- curl -s 'http://localhost:9100/metrics' | grep -vE "^#|^$"
==Cpu usage per node.==
100 - (avg by (instance) (irate(node_cpu_seconds_total{mode="idle"}[30m])) * 100)
instance:node_cpu_utilisation:rate1m{job="node-exporter", cluster=""} != 0
instance:node_cpu_utilisation:rate1m{job="node-exporter"} != 0
==cpu usage per pod on node==
sum(node_namespace_pod_container:container_cpu_usage_seconds_total:sum_irate{cluster="", node=~"<node>"}) by (pod)
==iowait==
avg by (instance) (irate(node_cpu_seconds_total{mode="iowait"}[30m]))
==namespace==
cpu usage per namespace.
sum(node_namespace_pod_container:container_cpu_usage_seconds_total:sum_irate{cluster=""}) by (namespace)
==load==
Load 1 graph
instance:node_load1_per_cpu:ratio{job="node-exporter", cluster=""} != 0
==usage for pvc==
kubelet_volume_stats_used_bytes
kubelet_volume_stats_available_bytes
kubelet_volume_stats_used_bytes{persistentvolumeclaim="prometheus-prometheus-k8s-1"}
With % usage of all pvc
( kubelet_volume_stats_used_bytes / kubelet_volume_stats_capacity_bytes ) * 100

==Memory usage==
Memory usage of node.
instance:node_memory_utilisation:ratio
node_memory_MemAvailable_bytes
100 * (1 - (node_memory_MemAvailable_bytes / node_memory_MemTotal_bytes))
==Memory usage per pod on a node==
sum(container_memory_usage_bytes{node="<node_name>"}) by (pod, namespace)
==OOMKilled==
sum by (namespace, pod) (kube_pod_container_status_restarts_total) * on(namespace, pod) group_left(reason) kube_pod_container_status_last_terminated_reason{reason="OOMKilled"}
oc -n openshift-monitoring exec -c prometheus prometheus-k8s-0 -- curl -s "http://localhost:9090/api/v1/query_range?query=sum%20by%20(namespace,%20pod)%20(kube_pod_container_status_restarts_total)%20*%20on(namespace,%20pod)%20group_left(reason)%20kube_pod_container_status_last_terminated_reason%7Breason%3D%22OOMKilled%22%7D&start=$(date '+%Y-%m-%d' --date '-20 days')T00:00:00.781Z&end=$(date '+%Y-%m-%dT%H:%M:%S').781Z&step=1h" | jq .
==uptime==
oc exec -n openshift-monitoring -c prometheus prometheus-k8s-0 -- curl -s 'http://localhost:9090/api/v1/query?query=time%28%29%20-%20node_boot_time_seconds%7Bjob%3D%22node-exporter%22%7D%0A' | jq -r '.data.result[]|.metric.instance +"\t"+ (.value[1] | tonumber | floor | tostring)' | column_tab
==disk usage==
(1 - (node_filesystem_avail_bytes{mountpoint="/"} / node_filesystem_size_bytes{mountpoint="/"})) * 100
==disk inode usage==
(1 - (node_filesystem_files_free{mountpoint="/"} / node_filesystem_files{mountpoint="/"})) * 100
==disk utalization==
100 * (rate(node_disk_io_time_seconds_total[5m]) / 300)

==steal==
sum by (instance) (rate(node_cpu_seconds_total{mode="steal"}[1m])) * 100
==request memory==
sum by (node) ( kube_pod_container_resource_requests{resource="memory"} * on (namespace, pod) group_left kube_pod_status_phase{phase="Running"} ) / 1024 / 1024

=install oc and kubectl=
curl -fsSL https://mirror.openshift.com/pub/openshift-v4/x86_64/clients/ocp/latest/openshift-client-linux.tar.gz | (cd /usr/local/bin/ ; sudo tar zxf - oc kubectl )

=time and timezone in first pod(date)=
oc get pods --no-headers -o 'custom-columns=:.metadata.namespace,:.metadata.name' -A | grep -v cert-manager | head -1 | while read NAMESPACE POD ; do oc rsh -n $NAMESPACE $POD bash -c 'date "+%Y-%m-%d %H:%M:%S %Z"' 2>/dev/null ; done

=oc get installplan=
InstallPlan defines the installation of a set of operators.
oc get installplan install-bk8hw -n openshift-operators -o yaml
Approve all manual updates.
oc get installplans.operators.coreos.com -A --no-headers | awk '$5 ~ /false/' | awk '$4 ~ /Manual/' | while read NAMESPACE INSTALLPLAN END ; do echo '*' $NAMESPACE $INSTALLPLAN ; oc patch installplan $INSTALLPLAN -n $NAMESPACE --type merge --patch '{"spec":{"approved":true}}' ; done
Get selected info from all installplans
oc get installplans.operators.coreos.com -A --no-headers -o=custom-columns='DATE:.metadata.creationTimestamp,NAME:.metadata.name,PHASE:.status.phase,CSV:.spec.clusterServiceVersionNames,NAMESPACE:.metadata.namespace' --sort-by=.metadata.creationTimestamp

=oc extract=
Extract secrets or config maps to disk
# Extract only the key "nginx.conf" from config map "nginx" to the /tmp directory
oc extract configmap/nginx --to=/tmp --keys=nginx.conf
=dependencies,owner=
Search in output from
oc describe ...
Search for this.
Controlled By: ReplicaSet/rook-ceph-osd-0-6dcdc7fb48
=metadata.ownerReferences=
Define object that owns object

=nodeAffinity=
Pin pod to node with label (kubectl label nodes <your-node-name> disktype=ssd)
spec:
affinity:
nodeAffinity:
requiredDuringSchedulingIgnoredDuringExecution:
nodeSelectorTerms:
- matchExpressions:
- key: disktype
operator: In
values:
- ssd

=Add user to group=
oc adm groups add-users openshift-admins rb_janitor
=api-int=
api-int.<fqdn>
for i in api-int:6443 api:6443 test.apps:443 ; do ping -c1 -W1 ${i%%:*} 2>&1 | xargs ; curl -skI https://${i%%:*}:${i##*:} 2>&1 | xargs ; done | cut -c -150
for i in api-int:6443 api:6443 test.apps:443 ; do ping -c1 -W1 ${i%%:*} 2>&1 | xargs ; set -x ; curl -skv https://${i%%:*}:${i##*:} -o /dev/null 2>&1 | grep "Server certificate:" -A5 ; set +x ; done | cut -c -150
=test talk to api-int=
CACERT=/tmp/%var%lib%kubelet%kubeconfig%certificate-authority-data ; grep certificate-authority-data: /var/lib/kubelet/kubeconfig | awk '{print $2}' | base64 -d > /$CACERT ; curl -s --key /var/lib/kubelet/pki/kubelet-client-current.pem --cert /var/lib/kubelet/pki/kubelet-client-current.pem --cacert $CACERT -XGET "$(grep server /etc/kubernetes/kubeconfig | awk '{print $2}')/api/v1/namespaces/default/pods?limit=500"
=api urls=
kubernetes generic: reference to the Kubernetes API server.
kubernetes.default: reference to the Kubernetes API server within the "default" namespace.
kubernetes.default.svc: refers to the Kubernetes service within the "default" namespace.
kubernetes.default.svc.cluster.local: This is the fully-qualified domain name (FQDN) for the Kubernetes service within the "default" namespace.
openshift: Similar to "kubernetes," this is a generic reference to the OpenShift API server.
openshift.default: reference to the OpenShift API server within the "default" namespace.
openshift.default.svc: refers to the OpenShift service within the "default" namespace.
openshift.default.svc.cluster.local: fully-qualified domain name (FQDN) for the OpenShift service within the "default" namespace.

=okd setup fix=
# On bootstrap node. Could work on all clusters. First a test to se if it work already.
DOMAIN=$(grep " baseDomain: " /etc/mcc/bootstrap/cluster-dns-02-config.yml | awk '{print $2}')
for i in api-int api ; do ping -c1 -W1 $i.${DOMAIN} 2>&1 | xargs; done | cut -c -150
echo "10.1.0.5 api-int.${DOMAIN} api.${DOMAIN}" >> /etc/hosts

=oc annotate=
Update the annotations on one or more resources.
oc annotate pods foo description='my frontend'
=setuid setgid=
securityContext:
runAsUser: 10004000
runAsGroup: 10004000
=patch examples=
==Look at oc get ... -o json and copy line after line.==
oc patch redis redis-standalone --type merge --patch '{"spec": {"securityContext": {"runAsGroup": 1000400000}}}'
==Enable disable clusterlogging # Unmanaged/Managed==
oc patch clusterlogging -n openshift-logging instance --type merge -p '{"spec": {"managementState": "Unmanaged"}}'
==Enable disable elasticsearch(Unmanaged/Managed)==
oc patch elasticsearch -n openshift-logging elasticsearch --type merge -p '{"spec": {"managementState": "Unmanaged"}}' #
==Remove finalizers from pod.==
oc patch pod <pod> -n <namespace> -p '{"metadata":{"finalizers":null}}'
==remove value==
Remove .spec.kafka.version
oc patch kafka kafka-cluster --type='json' -p='[{"op": "remove", "path": "/spec/kafka/version"}]'

==Add finalizer==
oc patch pod <pod> -n <namespace> -p '{"metadata":{"finalizers":["kubernetes.io/pvc-protection"]}}'
==Replace finalizers value with this.==
oc patch pod <pod> -n <namespace> --type merge -p '{"metadata":{"finalizers":["kubernetes.io/pvc-protection","kubernetes"]}}'
==patch replicas deployment==
oc patch deployment <deployment-name> --patch '{"spec": {"replicas": 0}}'
==patch list entries do not wipe existing list entries==
oc patch deployment -n openshift-kube-apiserver-operator kube-apiserver-operator --type json -p '[{"op": "replace", "path": "/spec/template/spec/containers/0/image", "value": "quay.io/okd/scos-content@sha256:37d6b6c13d864deb7ea925acf2b2cb34305333f92ce64e7906d3f973a8071642"}]'
oc get deployment kube-apiserver-operator -n openshift-kube-apiserver-operator -o json | jq '.spec.template.spec.containers[0].env |= map(if .name == "IMAGE" then .value = "quay.io/okd/scos-content@sha256:5c9128668752a9b891a24a9ec36e0724d975d6d49e6e4e2d516b5ba80ae2fb23" else . end)' | oc apply -f -
oc get deployment kube-apiserver-operator -n openshift-kube-apiserver-operator -o json | jq '.spec.template.spec.containers[0].env |= map(if .name == "OPERATOR_IMAGE" then .value = "quay.io/okd/scos-content@sha256:37d6b6c13d864deb7ea925acf2b2cb34305333f92ce64e7906d3f973a8071642" else . end)' | oc apply -f -
oc get deployment kube-apiserver-operator -n openshift-kube-apiserver-operator -o json | jq '.spec.template.spec.containers[0].env |= map(if .name == "OPERAND_IMAGE_VERSION" then .value = "1.29.6" else . end)' | oc apply -f -
==patch service monitor==
kubectl patch servicemonitor cert-utils-operator-controller-manager-metrics-monitor -n openshift-operators -p='[{"op": "replace", "path": "/spec/endpoints/0/tlsConfig/serverName", "value": "cert-utils-operator-controller-manager-metrics-service.openshift-operators.svc"}]' --type='json'
==edit text/cert entry==
#!/bin/bash
SSL_URL=halfface.se
SSL_PORT=443
DATE_FILE=$(date +%F_%H-%M-%S)
openssl s_client -connect ${SSL_URL}:${SSL_PORT} -servername ${SSL_URL} -verify 5 -showcerts -certform pem </dev/null 2>/dev/null | sed -n '/^----/,/^----/p' > chain.${SSL_URL}.${SSL_PORT}.${DATE_FILE}.pem
ln chain.${SSL_URL}.${SSL_PORT}.${DATE_FILE}.pem ${SSL_URL}
oc create cm argocd-tls-certs-cm -n argocd --from-file ${SSL_URL} --dry-run=client -o yaml >> /tmp/chain.${SSL_URL}.${SSL_PORT}.${DATE_FILE}.pem.patch
oc patch configmap argocd-tls-certs-cm -n argocd --patch-file /tmp/chain.${SSL_URL}.${SSL_PORT}.${DATE_FILE}.pem.patch

=limits=
When your need to increase your cpu and memory resources.
cpu limit is either written as a number. 0.5 for half a cpu. Or rather a definition in milli. 500m for half a cpu.
spec:
containers:
...
resources:
limits:
cpu: "2"
memory: 5Gi
requests:
cpu: "2"
memory: 5Gi

=quotas on cpu memory pvc... per project=
oc get ResourceQuota
=tolerations|node selectors|...=
oc describe pod
Node-Selectors: node-role.kubernetes.io/app=
Tolerations: node.kubernetes.io/memory-pressure:NoSchedule op=Exists
node.kubernetes.io/not-ready:NoExecute op=Exists for 300s
node.kubernetes.io/unreachable:NoExecute op=Exists for 5s
node.ocs.openshift.io/storage=true:NoSchedule
=tolerate any taint=
tolerations:
- operator: Exists

=enable monitoring=
cat <<EOF | oc apply -f -
apiVersion: v1
kind: ConfigMap
metadata:
name: cluster-monitoring-config
namespace: openshift-monitoring
data:
config.yaml: |
prometheusK8s:
retention: 2d
EOF

=retention elasticsearch=
Edit the ClusterLogging CR to add or modify the retentionPolicy parameter:
apiVersion: "logging.openshift.io/v1"
kind: "ClusterLogging"
...
spec:
managementState: "Managed"
logStore:
type: "elasticsearch"
retentionPolicy:
application:
maxAge: 1d
infra:
maxAge: 7d
audit:
maxAge: 7d
elasticsearch:
nodeCount: 3
...

=retention prometheus=
Prometheus retention. https://docs.openshift.com/container-platform/4.10/monitoring/configuring-the-monitoring-stack.html#modifying-retention-time-for-prometheus-metrics-data_configuring-the-monitoring-stack
oc edit configmap cluster-monitoring-config -n openshift-monitoring
# Enable prometheus.
cat <<EOF | oc apply -f -
apiVersion: v1
kind: ConfigMap
metadata:
name: cluster-monitoring-config
namespace: openshift-monitoring
data:
config.yaml: |
prometheusK8s:
retention: 2d
EOF
=retention prometheus default=
oc get Prometheus k8s -n openshift-monitoring -o json | jq -r .spec.retention
oc -n openshift-monitoring exec -c prometheus prometheus-k8s-0 -- curl -s "http://localhost:9090/api/v1/status/runtimeinfo" | jq -r '.data.storageRetention'

=EFK(elk)=
ElasticSearch
# Fluentd
processing pipeline
# Kibana.
https://kibana-openshift-logging.apps.<url>

=grafana=
# grafana
https://grafana-openshift-monitoring.apps.<url>
=pull secret=
Get pull secret
<pre>
oc get secret/pull-secret -n openshift-config -o jsonpath='{.data.\.dockerconfigjson}' | base64 -d | jq .
oc get secret/pull-secret -n openshift-config --template='Template:Index .data ".dockerconfigjson"' -o json | jq .
oc get secret/pull-secret -n openshift-config --template='{{index .data ".dockerconfigjson" | base64decode}}' -o json | jq .
</pre>
Just the keys.
oc get secret/pull-secret -n openshift-config --template='Template:Index .data ".dockerconfigjson"' -o json | jq -r '.data.".dockerconfigjson"' | base64 -d | jq .
Name of each key and email.
oc get secret/pull-secret -n openshift-config --template='Template:Index .data ".dockerconfigjson"' -o json | jq -r '.data.".dockerconfigjson"' | base64 -d | jq -r '.auths | with_entries(.value = .value.email)' | sed 's/{//g;s/}//g;s/"//g' | grep -v '^$' | sed 's/ *//g' | sort
Download pull secret.
<pre>
oc get secret/pull-secret -n openshift-config --template='{{index .data ".dockerconfigjson" | base64decode}}' > /tmp/pull_secret.$(oc whoami --show-console=true | awk -F / '{print $3}').$(date '+%Y-%m-%d_%H-%M-%S')
</pre>
Set pull secret.
oc set data secret/pull-secret -n openshift-config --from-file=.dockerconfigjson=/tmp/pull_secret_<file_name>
==has pull secret been update==
<pre>
echo '#' pull-secret ; oc get secret/pull-secret -n openshift-config --template='{{index .data ".dockerconfigjson" | base64decode}}' | jq -r '.auths[].email'
echo '#' apiserver ; oc exec deployment/apiserver -n openshift-apiserver -c openshift-apiserver -- cat /var/lib/kubelet/config.json | jq
echo '#' nodes ; oc get nodes -o name | xargs -I {} oc debug {} -- chroot /host sh -c 'cat /var/lib/kubelet/config.json | jq'
</pre>

==Does pull secret work==
jq . /tmp/pull_secret.2024-01-10_12-00-01.registry.redhat.io
{
"auths": {
"registry.redhat.io": {
"auth": "YmxhYmxh"
}
}
}
podman pull --authfile /tmp/pull_secret.2024-01-10_12-00-01.registry.redhat.io registry.redhat.io/ubi8/ubi:latest
==Which pull secret does machineconfig contain==
oc get mc 00-master -o json | jq -r '.spec.config.storage.files[]|select(.path=="/var/lib/kubelet/config.json")|.contents.source' | perl -pe 's/%([0-9a-f]{2})/sprintf("%s", pack("H2",$1))/eig' | sed 's/^data:,//g' | jq .
==Is pull secret correct in machineconfigpool. Rendered config==
oc get mc rendered-master-3626460c7752fc1605e94c19b7a9aba7 -o json | jq -r '.spec.config.storage.files[]|select(.path=="/var/lib/kubelet/config.json")|.contents.source' | sed 's/^data:,//g' | perl -pe 's/%([0-9a-f]{2})/sprintf("%s", pack("H2",$1))/eig'| jq .

=change number of nodes=
oc get machineset -n openshift-machine-api
oc edit machineset -n openshift-machine-api <MachineSet>
=Elasticsearch status=
oc exec -n openshift-logging -c elasticsearch $(oc get pods -n openshift-logging -l component=elasticsearch -o custom-columns=:.metadata.name --no-headers | head -1) -- es_util --query=_cat/health?v
oc exec -n openshift-logging -c elasticsearch $(oc get pods -n openshift-logging -l component=elasticsearch -o custom-columns=:.metadata.name --no-headers | head -1) -- es_util --query=_cluster/health?pretty

=talk to elasticsearch=
oc rsh elasticsearch-cdm-q8apadpa-1-65f99d99b4-8b9wg
curl -s --key /etc/elasticsearch/secret/admin-key --cert /etc/elasticsearch/secret/admin-cert --cacert /etc/elasticsearch/secret/admin-ca https://localhost:9200
Oneliner
oc exec -n openshift-logging -c elasticsearch $(oc get pods -l component=elasticsearch -o custom-columns=:.metadata.name --no-headers -n openshift-logging | head -1) -- curl -s --key /etc/elasticsearch/secret/admin-key --cert /etc/elasticsearch/secret/admin-cert --cacert /etc/elasticsearch/secret/admin-ca https://localhost:9200
=Free disk space/reclaim=
oc exec -n openshift-logging -c elasticsearch $(oc get pods -l component=elasticsearch -o custom-columns=:.metadata.name --no-headers -n openshift-logging | head -1) -- curl -s --key /etc/elasticsearch/secret/admin-key --cert /etc/elasticsearch/secret/admin-cert --cacert /etc/elasticsearch/secret/admin-ca "https://localhost:9200/_forcemerge?only_expunge_deletes=true" -X POST

=which version of elasticsearch operator is installed=
oc get csv -n openshift-operators-redhat -l operators.coreos.com/elasticsearch-operator.openshift-operators-redhat="" -o=custom-columns='VERSION:.spec.version' --no-headers
==list nodes==
oc exec -c elasticsearch $(oc get pods -l component=elasticsearch -o custom-columns=:.metadata.name --no-headers | tail -1) -- es_util --query="_cat/nodes?v"
==Who is master node==
oc exec -c elasticsearch $(oc get pods -l component=elasticsearch -o custom-columns=:.metadata.name --no-headers | tail -1) -- es_util --query="_cat/master?v"
==Is cluster recovering==
oc exec -c elasticsearch $(oc get pods -l component=elasticsearch -o custom-columns=:.metadata.name --no-headers | tail -1) -- es_util --query="_cat/recovery?active_only=true"
==Look at all indices==
oc exec -n openshift-logging -c elasticsearch $(oc get pods -n openshift-logging -l component=elasticsearch -o custom-columns=:.metadata.name --no-headers | tail -1) -- es_util --query=_cat/indices?v

export INDICE=<indice> ; oc exec -n openshift-logging -c elasticsearch $(oc get pods -n openshift-logging -l component=elasticsearch -o custom-columns=:.metadata.name --no-headers | tail -1) -- es_util --query=$INDICE -XDELETE

=look at chards=
oc exec -c elasticsearch $(oc get pods -l component=elasticsearch -o custom-columns=:.metadata.name --no-headers | tail -1) -- es_util --query=_cat/indices?v
=Create audit index=
oc exec -n openshift-logging -c elasticsearch $(oc get pods -n openshift-logging -l component=elasticsearch -o custom-columns=:.metadata.name --no-headers | head -1) -- es_util --query=audit-000001 -XPUT
==Remove all red indices.==
oc exec -c elasticsearch $(oc get pods -l component=elasticsearch -o custom-columns=:.metadata.name --no-headers | tail -1) -- es_util --query=_cat/indices?v | grep ^red | awk '{print $3}' | while read i ; do echo '*' $i ; oc exec -c elasticsearch $(oc get pods -l component=elasticsearch -o custom-columns=:.metadata.name --no-headers | tail -1) -- es_util --query=${i} -X DELETE ; done
==recreate elasticsearch pvc:s==
# scale down elasticsearch to 0 pods to be able to remove pvc:s
oc get deployment -l component=elasticsearch -o custom-columns=NAME:.metadata.name --no-headers -n openshift-logging | while read DEPLOYMENT ; do echo '*' $DEPLOYMENT ; oc scale deployment $DEPLOYMENT --replicas 0 ; done
# Remove pvc:s.
oc delete pvc -l logging-cluster=elasticsearch -n openshift-logging
# scale up elasticsearch to 0 pods to be able to remove pvc:s
oc get deployment -l component=elasticsearch -o custom-columns=NAME:.metadata.name --no-headers -n openshift-logging | while read DEPLOYMENT ; do echo '*' $DEPLOYMENT ; oc scale deployment $DEPLOYMENT --replicas 1 ; done

=vsphere creds=
oc get -n kube-system cm/cluster-config-v1 -o yaml
=does vsphere account have expected permissions=
oc logs -n openshift-cluster-storage-operator -l name=vsphere-problem-detector-operator --timestamps --tail=100 | less

=Enable openshift/okd logging=
==Enable redhat-operators==
oc patch OperatorHub cluster --type json -p '[{"op": "add", "path": "/spec/disableAllDefaultSources", "value": false}]'
Or edit individual operator.
oc edit operatorhubs
Spec:
Disable All Default Sources: true
Sources:
Disabled: false
Name: community-operators
Disabled: false
Name: redhat-operators
Or patch OperatorHub for individual operators
oc patch operatorhub cluster --type='json' -p='[{"op": "add", "path": "/spec/sources/-", "value":{"name":"redhat-operators","disabled":false}}]'

==Create namespace==
cat <<EOF | oc apply -f -
apiVersion: v1
kind: Namespace
metadata:
name: openshift-operators-redhat
annotations:
openshift.io/node-selector: ""
labels:
openshift.io/cluster-monitoring: "true"
EOF
==Create namespace==
cat <<EOF | oc apply -f -
apiVersion: v1
kind: Namespace
metadata:
name: openshift-logging
annotations:
openshift.io/node-selector: ""
labels:
openshift.io/cluster-monitoring: "true"
EOF
==Create operatorgroup==
cat <<EOF | oc apply -f -
apiVersion: operators.coreos.com/v1
kind: OperatorGroup
metadata:
name: openshift-operators-redhat
namespace: openshift-operators-redhat
spec: {}
EOF
==Subscribe to OpenShift Elasticsearch Operator==
cat <<EOF | oc apply -f -
apiVersion: operators.coreos.com/v1alpha1
kind: Subscription
metadata:
name: "elasticsearch-operator"
namespace: "openshift-operators-redhat"
spec:
channel: "stable"
installPlanApproval: "Automatic"
source: "redhat-operators"
sourceNamespace: "openshift-marketplace"
name: "elasticsearch-operator"
EOF
==Install the openshift logging operator.==
cat <<EOF | oc apply -f -
apiVersion: operators.coreos.com/v1
kind: OperatorGroup
metadata:
name: cluster-logging
namespace: openshift-logging
spec:
targetNamespaces:
- openshift-logging
EOF
==Create a subscription object yaml file.==
cat <<EOF | oc apply -f -
apiVersion: operators.coreos.com/v1alpha1
kind: Subscription
metadata:
name: cluster-logging
namespace: openshift-logging
spec:
channel: "stable"
name: cluster-logging
source: redhat-operators
sourceNamespace: openshift-marketplace
EOF
==Create OpenShift Logging instance.==
cat <<EOF | oc apply -f -
apiVersion: "logging.openshift.io/v1"
kind: "ClusterLogging"
metadata:
name: "instance"
namespace: "openshift-logging"
spec:
managementState: "Managed"
logStore:
type: "elasticsearch"
retentionPolicy:
application:
maxAge: 1d
infra:
maxAge: 7d
audit:
maxAge: 7d
elasticsearch:
nodeCount: 3
storage:
storageClassName: "standard-csi"
size: 200G
resources:
limits:
memory: "16Gi"
requests:
memory: "16Gi"
proxy:
resources:
limits:
memory: 256Mi
requests:
memory: 256Mi
redundancyPolicy: "SingleRedundancy"
visualization:
type: "kibana"
kibana:
replicas: 1
collection:
logs:
type: "fluentd"
fluentd: {}
EOF

=telemetry=
Restart telemetry.
oc delete pod -n openshift-monitoring -l app.kubernetes.io/component=telemetry-metrics-collector
=Update vsphere/openstack creds=
oc edit cm cloud-provider-config -n openshift-config
default-datastore = "cl07-2-fc-loc-001"

=Get datastore=
oc get cm cloud-provider-config -n openshift-config -o json | jq -r .data.config | sed -nr "/^\[Workspace\]/ { :l /^default-datastore[ ]*=/ { s/[^=]*=[ ]*//; p; q;}; n; b l;}"

=Manage labels.=
Add a label to a node or pod:
oc label node node001.krenger.ch mylabel=myvalue
oc label pod mypod-34-g0f7k mylabel=myvalue
Remove a label (in the example “mylabel”) from a node or pod:
oc label node node001.krenger.ch mylabel-
oc label pod mypod-34-g0f7k mylabel-
Permanently label a node
oc edit machineset ocp-qz7hf-worker-us-west-1b -n openshift-machine-api
=rollout=
Restart pod in an deployment
oc rollout restart deployment -n openshift-storage csi-rbdplugin-provisioner
=api.<URL>=
openssl_x509_multi_line <(oc get secrets external-loadbalancer-serving-certkey -n openshift-kube-apiserver -o json | jq -r '.data."tls.crt"|@base64d')
=ssl certificates replace=
How to replace api.<url> and star.apps.<url> certs.
# api. Create full chain cert. Public - intermediate - root ca.
api.<url>.crt
api.<url>.key
# create secret
oc delete secret api-cert -n openshift-config
oc create secret tls api-cert --cert=api.<url>.crt --key=api.<url>.key -n openshift-config
# patch apiserver
oc patch apiserver cluster --type=merge -p '{"spec":{"servingCerts": {"namedCertificates": [{"names": ["api.<url>"], "servingCertificate": {"name": "api-cert"}}]}}}'
...
# star.apps. Create full chain cert. Public - intermediate - root ca.
star.apps.<url>.crt
star.apps.<url>.key
# create secret
oc delete secret custom-certs-default -n openshift-ingress
oc create secret tls custom-certs-default --cert=star.apps.<url>.crt --key=star.apps.<url>.key -n openshift-ingress
# patch ingress controller
oc patch --type=merge --namespace openshift-ingress-operator ingresscontrollers/default --patch '{"spec":{"defaultCertificate":{"name":"custom-certs-default"}}}'
==edit serving certs==
look at api cert
oc get secret -n openshift-config $(oc get apiservers cluster -o json | jq -r '.spec.servingCerts.namedCertificates[].servingCertificate.name') -o json | jq -r '.data."tls.crt"' | base64 -d
Patch secret api cert
oc patch secret -n openshift-config $(oc get apiservers cluster -o json | jq -r '.spec.servingCerts.namedCertificates[].servingCertificate.name') -p '{"data":{"tls.crt": "<new-base64-encoded-certificate>"}}'
Look at ingress cert. wildcard.apps.<url>
oc get secret -n openshift-ingress $(oc get -n openshift-ingress-operator ingresscontrollers default -o json | jq -r .spec.defaultCertificate.name) -o json | jq -r '.data."tls.crt"' | base64 -d
Patch secret ingress wildcard.apps.<url>
oc patch secret -n openshift-ingress $(oc get -n openshift-ingress-operator ingresscontrollers default -o json | jq -r .spec.defaultCertificate.name) -p '{"data":{"tls.crt": "<new-base64-encoded-certificate>"}}'

=After you update above certificates then the following config map is updated to reflect that=
openssl_x509_multi_line <(oc get cm kube-root-ca.crt -o json | jq -r '.data."ca.crt"')
=get cluster-id=
oc get clusterversion/version -o jsonpath="{.spec.clusterID}"

=api=
Process running api server. They scale horizontally. They all serve requests.
openshift-kube-apiserver
kube-apiserver
=kube-proxy=
kube-proxy is a network proxy that runs on each node in your cluster, implementing part of the Kubernetes Service concept.
kube-proxy maintains network rules on nodes. These network rules allow network communication to your Pods from network sessions inside or outside of your cluster.
kube-proxy uses the operating system packet filtering layer if there is one and it's available. Otherwise, kube-proxy forwards the traffic itself.
=Resource Allocation=
OS and Kubernetes overhead. You can see the reserved OS & Kubernetes overhead by comparing the Allocatable (what the Kubernetes Scheduler can allocate to Pods) and the Capacity.
Capacity:
->cpu: 4
ephemeral-storage: 125293548Ki
hugepages-1Gi: 0
hugepages-2Mi: 0
->memory: 16409360Ki
pods: 250
Allocatable:
->cpu: 3500m
ephemeral-storage: 114396791822
hugepages-1Gi: 0
hugepages-2Mi: 0
->memory: 15258384Ki
pods: 250
==requests/limits==
User pod allocation is calculated by looking at the “Requests” resource columns from the kubectl get nodes output.
The relevant columns here are the “Requests, not Limits.
Requests impact how the pod is scheduled, and what resources are allocated to it,
whereas limits are used to enable pods to burst beyond their allocation.
==look at current Allocated resources==
oc get nodes --no-headers --selector="node-role.kubernetes.io/worker" -o=custom-columns='NAME:.metadata.name' | while read NODE ; do oc describe node $NODE | grep "Allocated resources:" -A10 | grep -E ' cpu | memory ' | while read RESOURCE ; do echo $NODE $RESOURCE ; done ; done

==empty space==
Allocatable - Allocated resources = empty
Allocatable:
cpu: 3500m
ephemeral-storage: 114396791822
hugepages-1Gi: 0
hugepages-2Mi: 0
memory: 15258384Ki
pods: 250
...
Allocated resources:
(Total limits may be over 100 percent, i.e., overcommitted.)
Resource Requests Limits
-------- -------- ------
cpu 834m (23%) 0 (0%)
memory 2474Mi (16%) 736Mi (4%)
ephemeral-storage 0 (0%) 0 (0%)
hugepages-1Gi 0 (0%) 0 (0%)
hugepages-2Mi 0 (0%) 0 (0%)
=status of namespace=
Show an overview of the current project
oc status
=age of cluster=
Looking at age of machines.
oc get nodes -o json | jq -r '.items[].metadata.creationTimestamp' | sort -n | sed 's/T/ /g;s/Z//g'
=oc adm inspect=
oc adm inspect namespace/isilon
tar cf /tmp/inspect.isilon.$(date_file ) inspect.local.*
=Operations Lifecycle manager(olm)=
oc logs -l app=olm-operator -n openshift-operator-lifecycle-manager --tail=-1
=Reinstall operator that is no longer available with current openshift version=
# Force install odf which is not possible to install because openshift has moved more than 1 version.
# Save subscription
for i in operators.coreos.com/mcg-operator.openshift-storage= operators.coreos.com/ocs-operator.openshift-storage= operators.coreos.com/odf-csi-addons-operator.openshift-storage= operators.coreos.com/odf-operator.openshift-storage= ; do
oc get subscription -o yaml -l $i > oc_get_subscription_${i//\//_}.yaml ; done
...
# Save operators
for i in operators.coreos.com/odf-operator.openshift-storage= operators.coreos.com/ocs-operator.openshift-storage= operators.coreos.com/mcg-operator.openshift-storage= operators.coreos.com/odf-csi-addons-operator.openshift-storage= ; do
oc get csv -l $i -o yaml > oc_get_csv_-l_${i//\//_}.yaml ; done
...
# Confirm backup files contain usable yaml. Have we forgotten any operators or csv:s. Remove resources clearly not related to odf.
...
# delete the existing ODF related subscriptions and the ClusterServiceVersions related:
for i in operators.coreos.com/mcg-operator.openshift-storage= operators.coreos.com/ocs-operator.openshift-storage= operators.coreos.com/odf-csi-addons-operator.openshift-storage= operators.coreos.com/odf-operator.openshift-storage= ; do
oc delete subscription -l $i; done
for i in operators.coreos.com/odf-operator.openshift-storage= operators.coreos.com/ocs-operator.openshift-storage= operators.coreos.com/mcg-operator.openshift-storage= operators.coreos.com/odf-csi-addons-operator.openshift-storage= ; do
oc delete csv -l $i ; done
...
# Make sure you wait for the CSVs to be deleted before creating a subscription again.
...
# create only the the Subscription again:
# (optional: edit the subscription before recreate, changing the channel version to the goal version)
...
# Recreate subscription
oc create -f 'oc_get_subscription_operators.coreos.com_odf-operator.openshift-storage=.yaml'
# wait watching the events:
oc get events -w

=increase disk on node=
Update worker machineset.
oc patch machinesets -n openshift-machine-api $(oc get machinesets -n openshift-machine-api -o json | jq -r '.items[] | select(.spec.template.metadata.labels."machine.openshift.io/cluster-api-machine-role" == "worker")| .metadata.name') --type merge -p '{"spec": {"template": {"spec": {"providerSpec": {"value": {"rootVolume": {"diskSize" : 50}}}}}}}'
==View results from above==
oc get machinesets -n openshift-machine-api $(oc get machinesets -n openshift-machine-api -o json | jq -r '.items[] | select(.spec.template.metadata.labels."machine.openshift.io/cluster-api-machine-role" == "worker")| .metadata.name') -o yaml | tee /tmp/$(oc get DNS cluster -o=jsonpath='{.spec.baseDomain}').$(date +%F_%H-%M-%S).yaml

==Update on node only==
VOLUME=abjorklund-01-h4sxm-worker-0-rkk87-root
os volume set --size 40 $VOLUME --os-volume-api-version 3.42
dnf install cloud-utils-growpart xfsprogs
ssh core@worker
growpart /dev/sda 4
xfs_growfs /

=increase ram on worker nodes=
oc patch machinesets -n openshift-machine-api $(oc get machinesets -n openshift-machine-api -o json | jq -r '.items[] | select(.spec.template.metadata.labels."machine.openshift.io/cluster-api-machine-role" == "worker")| .metadata.name') --type merge -p '{"spec": {"template": {"spec": {"providerSpec": {"value": {"memoryMiB" : 24576}}}}}}'
=Change flavor of worker node=
oc patch machinesets -n openshift-machine-api $(oc get machinesets -n openshift-machine-api -o json | jq -r '.items[] | select(.spec.template.metadata.labels."machine.openshift.io/cluster-api-machine-role" == "worker")| .metadata.name') --type merge -p '{"spec": {"template": {"spec": {"providerSpec": {"value": {"flavor" : "hm.4x16"}}}}}}'

=set number of worker nodes=
oc patch machinesets -n openshift-machine-api $(oc get machinesets -n openshift-machine-api -o json | jq -r '.items[] | select(.spec.template.metadata.labels."machine.openshift.io/cluster-api-machine-role" == "worker")| .metadata.name') --type merge -p '{"spec": {"replicas" : 2}}'

=clusteroperator=
ClusterOperator is the Custom Resource object which holds the current state of an operator. Clusteroperator is resposible for core, systemwide functions like dns and so on.
oc get clusteroperators
oc get co
oc get clusteroperators -o custom-columns=NAME:.metadata.name,ANNOTATIONS:.metadata.annotations

=ignition=
Retrieve rendered ignition data.
curl https://api-int.$(grep ^search /etc/resolv.conf | awk '{print $NF}'):22623/config/master
curl -v https://api-int.$(grep ^search /etc/resolv.conf | awk '{print $2}'):22623/config/worker

=rockylinux container names=
ubi ("Standard"): OpenSSL, microdnf, and utilities like gzip and vi
ubi-minimal ("Minimal"): Minimized binaries and minimal yum stack.
ubi-init ("Multi-service"): Less than standard but more than minimal, plus systemd.
ubi-micro ("Micro"): Most minimal image without even a package manager.
=create a job/pod/script=

==Create config map of script==
Notice that I have to escape $. Since I give date in a here document. Where $ is being expanded.
cat <<EOF | oc apply -f -
apiVersion: v1
kind: ConfigMap
metadata:
name: dns-lookup.sh
data:
dns-lookup.sh: |
#!/bin/bash
# Verify if dns resolution works and how fast.
while true ; do
for DNS in \$(awk '/^nameserver / {print \$2}' /etc/resolv.conf) 10.2.0.10 ; do
echo \$(date '+%F %H:%M:%S %Z') \$DNS \$(host -v -t A ibm.se 2>&1 | tail -3 )
done
sleep 5
done
EOF

==create job==
cat <<EOF | oc apply -f -
apiVersion: batch/v1
kind: Job
metadata:
name: dns-lookup
spec:
template:
spec:
containers:
- name: dns-lookup
# image: rockylinux/rockylinux:9
image: halfface/rockylinux-toolbox:v2
command: ["/script/dns-lookup.sh"]
volumeMounts:
- name: script
mountPath: "/script"
# securityContext:
# runAsUser: 0
# privileged: true
volumes:
- name: script
configMap:
name: dns-lookup.sh
defaultMode: 0755
restartPolicy: Never
activeDeadlineSeconds: 1209600
EOF

=terminal fix=
No line wraps
tput rmam
=list operatorhub/catalogsources=
oc get catalogsources -n openshift-marketplace
oc get catalogsources -n openshift-marketplace -o custom-columns=NAME:.metadata.name,DISPLAY:.spec.displayName,STATE:.status.connectionState.lastObservedState,TYPE:.spec.sourceType,PUBLISHER:.spec.publisher,IMAGE:.spec.image

=remove catalogsources=
oc get catalogsources.operators.coreos.com -n openshift-marketplace -l company=cambio --no-headers -o custom-columns=:.metadata.name | while read i ; do echo oc get catalogsources $i -n openshift-marketplace -o yaml \>oc_get_catalogsources.$(oc_api_url).$i.$(date_file).yaml ; echo oc delete catalogsource -n openshift-marketplace $i ; done

=which changes will occure=
. /etc/node-sizing-enabled.env ; NODE_SIZES_ENV=/tmp/node-sizing.env /usr/local/sbin/dynamic-system-reserved-calc.sh true ${SYSTEM_RESERVED_MEMORY} ${SYSTEM_RESERVED_CPU} ${SYSTEM_RESERVED_ES} ; sdiff /etc/node-sizing.env /tmp/node-sizing.env
=SYSTEM_RESERVED=
cat <<EOF | oc apply -f -
apiVersion: machineconfiguration.openshift.io/v1
kind: KubeletConfig
metadata:
name: dynamic-node
spec:
autoSizingReserved: true
machineConfigPoolSelector:
matchLabels:
pools.operator.machineconfiguration.openshift.io/worker: ""
EOF

Which changes will occur.
oc get nodes -o name | xargs -I {} oc debug {} -- chroot /host sh -c 'hostname ; . /etc/node-sizing-enabled.env ; NODE_SIZES_ENV=/tmp/node-sizing.env /usr/local/sbin/dynamic-system-reserved-calc.sh true ${SYSTEM_RESERVED_MEMORY} ${SYSTEM_RESERVED_CPU} ${SYSTEM_RESERVED_ES} ; sdiff /etc/node-sizing.env /tmp/node-sizing.env' 2>/dev/null
==which processes is it complaining about==
systemd-cgls /system.slice | grep -o '[^─]*\.service' | cat -v | sed 's/^\^\[\[0m//g' | while read i ; do echo -e "$(systemctl show -p MemoryCurrent $i | awk -F = '{print $2}')\t$i" ; done | column -t -s $'\t' | sort -n

=CNI=
oc get networks cluster -o 'custom-columns=NETWORKTYPE:.spec.networkType'
Cni from install
echo -e "$(oc --request-timeout=5 get -n kube-system cm/cluster-config-v1 -o json | jq -r '."data"."install-config"')" | python -c 'import sys, yaml, json; json.dump(yaml.safe_load(sys.stdin), sys.stdout, indent=4)' | jq -r .networking.networkType
=autoscale.=
https://docs.openshift.com/container-platform/4.12/machine_management/applying-autoscaling.html
==ClusterAutoscaler==
# The two below has to be configured.
apiVersion: autoscaling.openshift.io/v1
kind: ClusterAutoscaler
metadata:
name: default
spec:
logVerbosity: 4
podPriorityThreshold: -10
resourceLimits:
cores:
max: 128
min: 0
maxNodesTotal: 24
memory:
max: 256
min: 0
scaleDown:
delayAfterAdd: 10m
delayAfterDelete: 5m
delayAfterFailure: 30s
enabled: true
unneededTime: 5m
utilizationThreshold: "0.4"
==MachineAutoscaler==
apiVersion: autoscaling.openshift.io/v1beta1
kind: MachineAutoscaler
metadata:
name: abjorklund-01-4rp8x-worker-1
namespace: openshift-machine-api
spec:
maxReplicas: 12
minReplicas: 0
scaleTargetRef:
apiVersion: machine.openshift.io/v1beta1
kind: MachineSet
name: abjorklund-01-4rp8x-worker-1
==Machineset example where machine is labeled and tainted.==
apiVersion: machine.openshift.io/v1beta1
kind: MachineSet
metadata:
annotations:
autoscaling.openshift.io/machineautoscaler: openshift-machine-api/abjorklund-01-4rp8x-worker-1
capacity.cluster-autoscaler.kubernetes.io/cpu: "4"
capacity.cluster-autoscaler.kubernetes.io/memory: "17179869184"
machine.openshift.io/cluster-api-autoscaler-node-group-max-size: "12"
machine.openshift.io/cluster-api-autoscaler-node-group-min-size: "0"
machine.openshift.io/memoryMb: "16384"
machine.openshift.io/vCPU: "4"
labels:
machine.openshift.io/cluster-api-cluster: abjorklund-01-4rp8x
machine.openshift.io/cluster-api-machine-role: worker
machine.openshift.io/cluster-api-machine-type: worker
name: abjorklund-01-4rp8x-worker-1
namespace: openshift-machine-api
spec:
replicas: 0
selector:
matchLabels:
machine.openshift.io/cluster-api-cluster: abjorklund-01-4rp8x
machine.openshift.io/cluster-api-machineset: abjorklund-01-4rp8x-worker-1
template:
metadata:
labels:
machine.openshift.io/cluster-api-cluster: abjorklund-01-4rp8x
machine.openshift.io/cluster-api-machine-role: worker
machine.openshift.io/cluster-api-machine-type: worker
machine.openshift.io/cluster-api-machineset: abjorklund-01-4rp8x-worker-1
spec:
metadata:
labels:
stress: stress
providerSpec:
value:
apiVersion: machine.openshift.io/v1alpha1
cloudName: openstack
cloudsSecret:
name: openstack-cloud-credentials
namespace: openshift-machine-api
flavor: hm.4x16
image: ""
kind: OpenstackProviderSpec
metadata:
creationTimestamp: null
networks:
- subnets:
- filter:
name: abjorklund-01-4rp8x-nodes
tags: openshiftClusterID=abjorklund-01-4rp8x
rootVolume:
diskSize: 64
sourceUUID: abjorklund-01-4rp8x-rhcos
volumeType: ssd
securityGroups:
- name: abjorklund-01-4rp8x-worker
- uuid: 1de812c6-ed8b-4212-a486-ca283dbe1444
serverGroupName: abjorklund-01-4rp8x-worker-1
serverMetadata:
Name: abjorklund-01-4rp8x-worker
openshiftClusterID: abjorklund-01-4rp8x
tags:
- openshiftClusterID=abjorklund-01-4rp8x
userDataSecret:
name: worker-user-data
taints:
- effect: NoExecute
key: stress
value: stress

==autoscaler does not scale down==
oc logs -l cluster-autoscaler=default -n openshift-machine-api --tail=-1 --timestamps=true
==Add dynamic load to cluster. deployment==
apiVersion: apps/v1
kind: Deployment
metadata:
annotations:
deployment.kubernetes.io/revision: "7"
labels:
app: stress
name: stress
namespace: stress
spec:
progressDeadlineSeconds: 600
replicas: 0
revisionHistoryLimit: 10
selector:
matchLabels:
app: stress
strategy:
rollingUpdate:
maxSurge: 25%
maxUnavailable: 25%
type: RollingUpdate
template:
metadata:
annotations:
kubectl.kubernetes.io/restartedAt: "2025-01-24T09:52:22+01:00"
creationTimestamp: null
labels:
app: stress
spec:
containers:
- command:
- /mnt/bin/stress.sh
image: halfface/rockylinux-toolbox:v3
imagePullPolicy: IfNotPresent
livenessProbe:
exec:
command:
- bash
- -c
- ps uxawww | grep -q [s]tress && echo 0 || echo 1
failureThreshold: 3
periodSeconds: 10
successThreshold: 1
timeoutSeconds: 1
name: stress
resources:
requests:
cpu: 700m
memory: 300Mi
terminationMessagePath: /dev/termination-log
terminationMessagePolicy: File
volumeMounts:
- mountPath: /mnt/bin/
name: stress
dnsPolicy: ClusterFirst
nodeSelector:
stress: stress
restartPolicy: Always
schedulerName: default-scheduler
terminationGracePeriodSeconds: 30
tolerations:
- effect: NoExecute
key: stress
value: stress
volumes:
- configMap:
defaultMode: 493
name: stress.sh
name: stress
==configmap==
apiVersion: v1
data:
stress.sh: |
#!/bin/bash
# stress pod.
while true ; do
echo $(date '+%F %H:%M:%S %Z') $( stress -m 1 --vm-bytes 1000M --vm-keep -t 300s )
sleep 5
done
kind: ConfigMap
metadata:
name: stress.sh
namespace: stress

=change dns server for domain=
oc edit dns.operator/default
apiVersion: operator.openshift.io/v1
kind: DNS
metadata:
name: default
spec:
servers:
- name: halffce-server
zones:
- halfface.se
forwardPlugin:
policy: Random
upstreams: 10.111.222.2
# View config.
oc get configmap/dns-default -n openshift-dns -o yaml

=coredns=
# tail logs.
oc get events -A --sort-by=.metadata.creationTimestamp
# Change debug level.
oc patch dnses.operator.openshift.io/default -p '{"spec":{"logLevel":"Debug"}}' --type=merge
Sets
log . {
class denial error
}
oc patch dnses.operator.openshift.io/default -p '{"spec":{"logLevel":"Trace"}}' --type=merge
Sets
log . {
class all
}
oc patch dnses.operator.openshift.io/default -p '{"spec":{"logLevel":"Normal"}}' --type=merge
Sets
log . {
class error
}
==Get log files for analyze==
oc get pods -l dns.operator.openshift.io/daemonset-dns=default -o custom-columns=POD:.metadata.name,NODE:.spec.nodeName --no-headers -n openshift-dns | while read i j ; do oc logs $i --tail=-1 -c dns --timestamps=true -n openshift-dns > /tmp/oc_logs_$j.$i.$(oc get DNS cluster -o=jsonpath='{.spec.baseDomain}').$(date +%F_%H-%M-%S) ; done

=get instance dns name=
oc get DNS cluster -o=jsonpath='{.spec.baseDomain}'
=Read values provided by coredns /metrics=
oc exec -it -n openshift-dns $(oc get pods -l dns.operator.openshift.io/daemonset-dns=default --no-headers -n openshift-dns| head -1) -- curl -s http://localhost:9153/metrics
=coredns default logformat=
# Default format
{remote}:{port} - {>id} "{type} {class} {name} {proto} {size} {>do} {>bufsize}" {rcode} {>rflags} {rsize} {duration}
# Values explained
{port}: client’s port
{remote}: client’s IP address, for IPv6 addresses these are enclosed in brackets: [::1]
{>id}: query ID
{type}: qtype of the request
{class}: qclass of the request
{name}: qname of the request
{proto}: protocol used (tcp or udp)
{size}: request size in bytes
{>do}: is the EDNS0 DO (DNSSEC OK) bit set in the query
{>bufsize}: the EDNS0 buffer size advertised in the query
{rcode}: response RCODE
{>rflags}: response flags, each set flag will be displayed, e.g. “aa, tc”. This includes the qr bit as well
{rsize}: raw (uncompressed), response size (a client may receive a smaller response)
{duration}: response duration
=Confirm that coredns hosts are possible to resolve=
<pre>
grep match /etc/coredns/Corefile | uniq | sed 's/\[//g;s/\]//g;s/^ *match //g;s/\.\*/test/g;s/^\^//g' | while read i ; do echo $(dig +short ${i}.) ${i}. ; done
</pre>

=Create lets encrypt certificates on dns domain in route53 which is managed by certmanager.=
#Create a domain in route 53.
#Create a user with a token for "Application running outside AWS"
==Fill in below values to be able to update config below.==
Hosted_Zone_id: <Hosted_Zone_id>
Access_key: <Access_key>
Secret_access_key: <Secret_access_key>
DNS_Domain: <DNS_Domain>
DNS_shortname: <DNS_shortname>
==Attach the following policy to your newly created user.==
(Populate all <Values> below.)
{
"Version": "2023-11-22",
"Statement": [
{
"Effect": "Allow",
"Action": "route53:GetChange",
"Resource": "arn:aws:route53:::change/*"
},
{
"Effect": "Allow",
"Action": "route53:ChangeResourceRecordSets",
"Resource": "arn:aws:route53:::hostedzone/<Hosted_Zone_id>"
},
{
"Effect": "Allow",
"Action": "route53:ListHostedZonesByName",
"Resource": "*"
}
]
}
==Create namespace==
oc create namespace cert-manager
==Install cert-manager community version via graphical fluff.==
==Create secret that includes <Secret_access_key>.==
oc create secret generic route53-secret --from-literal=secret-access-key="<Secret_access_key>" -n cert-manager
==Create ClusterIssuer for letsencrypt which uses route53 to show that you own dns.==
cat <<EOF | oc apply -f -
apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
name: letsencrypt-prod-dns
namespace: cert-manager
spec:
acme:
server: https://acme-v02.api.letsencrypt.org/directory
email: support@company.se
# Name of a secret used to store the ACME account private key
privateKeySecretRef:
name: <DNS_shortname>-issuer-account-key
solvers:
- selector:
dnsZones:
- "<DNS_Domain>"
dns01:
route53:
accessKeyID: <Access_key>
secretAccessKeySecretRef:
name: route53-secret
key: secret-access-key
hostedZoneID: <Hosted_Zone_id>
region: 'us-east-1'
EOF

==Create api certificate.==
cat <<EOF | oc apply -f -
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
name: cert-api
namespace: openshift-config
spec:
issuerRef:
name: letsencrypt-prod-dns
kind: ClusterIssuer
dnsNames:
- "api.<DNS_Domain>"
secretName: le-api-cert
commonName: "api.<DNS_Domain>"
EOF
==Start to use api certificate.==
oc patch apiserver cluster --type=merge -p '{"spec":{"servingCerts": {"namedCertificates": [{"names": ["api.<DNS_Domain>"], "servingCertificate": {"name": "le-api-cert"}}]}}}'

==Create ingress certificate==
cat <<EOF | oc apply -f -
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
name: le-wildcard-apps-certificate
namespace: openshift-ingress
spec:
issuerRef:
name: letsencrypt-prod-dns
kind: ClusterIssuer
dnsNames:
- "*.apps.<DNS_Domain>"
secretName: le-wildcard-apps-certificate
commonName: "*.apps.<DNS_Domain>"
EOF
==Start to use ingress certificate.==
oc patch --type=merge --namespace openshift-ingress-operator ingresscontrollers/default --patch '{"spec":{"defaultCertificate":{"name":"le-wildcard-apps-certificate"}}}'
=resolv.conf=
ndots 5. This means that the DNS client will automatically consider a domain name to be fully qualified (which will allow it to skip the search path iteration) if it has five or more dots.
=bind to external login sources ldap ad=
oc get authentications.operator.openshift.io cluster -o yaml
=get machine name and creation time=
oc get machines -o=custom-columns='NAME:.metadata.name,CREATIONTIMESTAMP:.metadata.creationTimestamp,TYPE:.spec.providerSpec.value.flavor,STATUS:.status.phase' -n openshift-machine-api

=setup nfs server=
nfs export shared between pods.
==Create server==
openstack server create --flavor gp.1x2 --availability-zone europe-se-1a --image rocky-8-x86_64 --boot-from-volume 30 --network abjorklund-01-bmc7w-openshift --security-group ssh_allow --key-name abjorklund_ed25519 abjorklund_$(date_file)
openstack volume create --size 50 --type ssd --description "nfs storage block device 0" nfs_storage_abjorklund-01
openstack server add volume e93d2db1-6d95-4364-a236-0bd1b9255e90 28adbdb9-c88d-4397-9a79-b13c505016a8 --device /dev/vdb
==install nfs dependencis==
dnf -y install cloud-utils-growpart nfs-utils iptables-utils epel-release vim-enhanced
==How to grow filesystem.==
partx growpart
os volume set --size 60 nfs_storage_abjorklund-01 --os-volume-api-version 3.42
==Create partion and disk.==
gdisk /dev/sdb
mkfs.ext4 /dev/sdb1
find /dev/ -ls | grep sdb | grep by-uuid
==Mount drive. /etc/fstab==
UUID=66998126-9f18-44ce-a462-827c870a57bd /netstorage ext4 defaults 0 0
mkdir /netstorage
mount /netstorage/
mkdir /netstorage/abjorklund-01
chmod 777 /netstorage/abjorklund-01
==export drive==
systemctl enable nfs-server.service --now
/etc/exports
/netstorage/abjorklund-01 10.1.0.0/16(rw,root_squash)
exportfs -rav

==setup deployment==
# deployment.yaml
cat <<EOF | oc apply -f -
apiVersion: apps/v1
kind: Deployment
metadata:
name: nfs-client-provisioner
labels:
app: nfs-client-provisioner
# replace with namespace where provisioner is deployed
namespace: default
spec:
replicas: 1
strategy:
type: Recreate
selector:
matchLabels:
app: nfs-client-provisioner
template:
metadata:
labels:
app: nfs-client-provisioner
spec:
affinity:
nodeAffinity:
requiredDuringSchedulingIgnoredDuringExecution:
nodeSelectorTerms:
- matchExpressions:
- key: node-role.kubernetes.io/worker
operator: Exists
serviceAccountName: nfs-client-provisioner
securityContext:
supplementalGroups:
- 65534
- 1261150637
containers:
- name: nfs-client-provisioner
image: gcr.io/k8s-staging-sig-storage/nfs-subdir-external-provisioner:v4.0.0
volumeMounts:
- name: nfs-client-root
mountPath: /persistentvolumes
env:
- name: PROVISIONER_NAME
value: auto-nfs-storage
- name: NFS_SERVER
value: 10.1.0.48
- name: NFS_PATH
value: "/netstorage/abjorklund-01"
volumes:
- name: nfs-client-root
nfs:
server: 10.1.0.48
path: /netstorage/abjorklund-01
EOF
# nfs-clusterrolebinding.yaml
cat <<EOF | oc apply -f -
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: run-nfs-client-provisioner
subjects:
- kind: ServiceAccount
name: nfs-client-provisioner
# replace with namespace where provisioner is deployed
namespace: default
roleRef:
kind: ClusterRole
name: nfs-client-provisioner-runner
apiGroup: rbac.authorization.k8s.io
EOF
# nfs-clusterrole.yaml
cat <<EOF | oc apply -f -
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: nfs-client-provisioner-runner
rules:
- apiGroups: [""]
resources: ["persistentvolumes"]
verbs: ["get", "list", "watch", "create", "delete"]
- apiGroups: [""]
resources: ["persistentvolumeclaims"]
verbs: ["get", "list", "watch", "update"]
- apiGroups: ["storage.k8s.io"]
resources: ["storageclasses"]
verbs: ["get", "list", "watch"]
- apiGroups: [""]
resources: ["events"]
verbs: ["create", "update", "patch"]
EOF
# nfs-rolebinding.yaml
cat <<EOF | oc apply -f -
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: leader-locking-nfs-client-provisioner
# replace with namespace where provisioner is deployed
namespace: default
subjects:
- kind: ServiceAccount
name: nfs-client-provisioner
# replace with namespace where provisioner is deployed
namespace: default
roleRef:
kind: Role
name: leader-locking-nfs-client-provisioner
apiGroup: rbac.authorization.k8s.io
EOF
# nfs-role.yaml
cat <<EOF | oc apply -f -
kind: Role
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: leader-locking-nfs-client-provisioner
# replace with namespace where provisioner is deployed
namespace: default
rules:
- apiGroups: [""]
resources: ["endpoints"]
verbs: ["get", "list", "watch", "create", "update", "patch"]
EOF
# nfs-sa.yaml
cat <<EOF | oc apply -f -
apiVersion: v1
kind: ServiceAccount
metadata:
name: nfs-client-provisioner
# replace with namespace where provisioner is deployed
namespace: default
EOF
# storageclass.yaml
cat <<EOF | oc apply -f -
apiVersion: storage.k8s.io/v1
kind: StorageClass
metadata:
name: managed-nfs-storage
provisioner: auto-nfs-storage # or choose another name, must match deployment's env PROVISIONER_NAME'
parameters:
onDelete: delete
EOF
# test-claim.yaml
cat <<EOF | oc apply -f -
kind: PersistentVolumeClaim
apiVersion: v1
metadata:
name: test-claim
namespace: default
spec:
storageClassName: managed-nfs-storage
accessModes:
- ReadWriteMany
resources:
requests:
storage: 1Mi
EOF
=set nfs csi driver=
https://github.com/kubernetes-csi/csi-driver-nfs

=dns=
https://access.redhat.com/solutions/3804501
==confirm upstream dns works==
for UPSTREAM_DNS_IP in 10.46.201.1 10.46.201.2 10.46.201.3 ; do UPSTREAM_DNS_PORT=53 ; echo -e "\nTCP\n"; for dnspod in `oc get pods -n openshift-dns -o name --no-headers -l dns.operator.openshift.io/daemonset-dns=default`; do echo "Pod $dnspod"; oc exec -n openshift-dns -c dns $dnspod -- dig @${UPSTREAM_DNS_IP} redhat.com -p ${UPSTREAM_DNS_PORT} +tcp +short; echo; done ; done
for UPSTREAM_DNS_IP in 10.46.201.1 10.46.201.2 10.46.201.3 ; do UPSTREAM_DNS_PORT=53 ; echo -e "\nUDP\n"; for dnspod in `oc get pods -n openshift-dns -o name --no-headers -l dns.operator.openshift.io/daemonset-dns=default`; do echo "Pod $dnspod"; oc exec -n openshift-dns -c dns $dnspod -- dig @${UPSTREAM_DNS_IP} redhat.com -p ${UPSTREAM_DNS_PORT} +notcp +short; echo; done ; done

=image=
Which images are ok.
oc get image.config.openshift.io cluster -o yaml
=enable sso with keycloak=
apiVersion: config.openshift.io/v1
kind: OAuth
metadata:
annotations: {}
labels:
app.kubernetes.io/instance: sso
name: cluster
spec:
identityProviders:
- mappingMethod: add
name: SSO
openID:
claims:
email:
- email
groups:
- groups
name:
- name
preferredUsername:
- preferred_username
clientID: <Client name in keycloak>
clientSecret:
name: keycloak-client-secret
extraScopes: []
issuer: <URL to issuer>
type: OpenID
---
apiVersion: v1
data:
clientSecret: <base64 secret>
kind: Secret
metadata:
labels:
app.kubernetes.io/instance: sso
name: keycloak-client-secret
namespace: openshift-config

=keepalive/api/ingress=
On nodes where nodes server the same ip for api or ingress.
oc get nodes -o name | xargs -I {} oc debug {} -- chroot /host sh -c 'echo "# unicast_peer" > /etc/keepalived/keepalived.conf'
Get info about where ingress is running.
oc get nodes -o name | xargs -I {} oc debug {} -- chroot /host sh -c 'ip a' 2>&1 | tee /tmp/tmp ; grep $(host $(oc whoami --show-server | awk -F ':|/' '{print $4}') | awk '{print $NF}') /tmp/tmp

=diff rendered mc=
export OLD_RENDERED=rendered-infra-6c7e5fc796264dd32341950aea971807 ; export NEW_RENDERED=rendered-infra-bac1dd431374a5c4c21742e547739c7c ; diff -NrU 5 <(oc get mc ${OLD_RENDERED} -o json) <(oc get mc ${NEW_RENDERED} -o json)
=secret management=
List secrets of they type tls.
get secrets --field-selector type=kubernetes.io/tls
=ocm=
==ocm install==
(cd /usr/local/bin/ ; sudo curl -vLsk https://github.com/openshift-online/ocm-cli/releases/download/v0.1.72/ocm-linux-amd64 -o ocm ; sudo chmod 755 ocm)
==ocm search examples==
ocm list clusters --parameter search="name like 'da0d9ade-d649-4948-8bc6-744a1fcb0960'"
ocm get /api/clusters_mgmt/v1/clusters --parameter search="name like '0047ccf6-134b-4bff-99e0-5f2d6532a3ea'"
ocm get /api/accounts_mgmt/v1/subscriptions/ --parameter size=1000 | jq -r '.items[]| .display_name +"\t"+ .status +"\t"+ .cluster_id +"\t"+ .created_at' | grep -v Archived | column_tab
Search for two states.
ocm get /api/accounts_mgmt/v1/subscriptions/ --parameter search="status like 'Active' or status like 'Stale'" --parameter size=1000

=PodDisruptionBudget=
API object that specifies the minimum number of replicas that must be up at a time.
=pod placement=
Does it look sane which pods run on worker nodes. Search for pods on worker nodes and look for the same pods on all nodes.
oc get nodes --no-headers --selector='node-role.kubernetes.io/worker,!node-role.kubernetes.io/infra' -o=custom-columns='NAME:.metadata.name' | while read NODE ; do oc get pods -A -o wide --no-headers --field-selector "spec.nodeName=$NODE" | while read NAMESPACE POD REST ; do echo '#' $NAMESPACE ${POD%-*} ; oc get pods -n $NAMESPACE -o wide | grep ${POD%-*} ; done ; done | less -ISRM
Are any user pods running outside worker nodes?
oc get project --no-headers -o=custom-columns='NAME:.metadata.name' | grep -v ^openshift- | while read NAMESPACE ; do echo '*' $NAMESPACE ; oc get pods -o wide -n $NAMESPACE ; done
=wait=
Wait for kafka getting ready.
kubectl wait kafka/my-cluster --for=condition=Ready --timeout=300s -n kafka
=list configured ssh public keys=
oc get machineconfig --no-headers -o custom-columns=":metadata.name" | grep -E '^99-.*-ssh$' | while read MACHINECONFIG ; do echo '*' "${MACHINECONFIG}" ; oc get machineconfig "${MACHINECONFIG}" -o json | jq -r '.spec.config.passwd.users[].sshAuthorizedKeys[]'; done
=Add key for ssh login=
oc get machineconfig --no-headers -o custom-columns=":metadata.name" | grep -E '^99-.*-ssh$' | while read MACHINE_CONFIG_SSH ; do echo '*' $MACHINE_CONFIG_SSH ; oc patch machineconfig $MACHINE_CONFIG_SSH --type=json --patch="[{\"op\":\"add\", \"path\":\"/spec/config/passwd/users/0/sshAuthorizedKeys/-\", \"value\":\"$(cat $HOME/.ssh/id_ed25519.pub)\"}]" ; done
With a save.
oc get machineconfig --no-headers -o custom-columns=":metadata.name" | grep -E '^99-.*-ssh$' | while read MACHINE_CONFIG_SSH ; do echo '*' $MACHINE_CONFIG_SSH ; oc_script_log oc get machineconfig $MACHINE_CONFIG_SSH -o yaml </dev/null ; oc patch machineconfig $MACHINE_CONFIG_SSH --type=json --patch="[{\"op\":\"add\", \"path\":\"/spec/config/passwd/users/0/sshAuthorizedKeys/-\", \"value\":\"$(cat $HOME/.ssh/id_ed25519.pub)\"}]" ; done

=readable output from df.=
df -lh | grep -Ev '^overlay|^tmpfs|^shm|^nsfs|^cgroup|^devtmpfs'
=give me openstack credentials=
oc get secret -n kube-system openstack-credentials -o json | jq -r '.data."clouds.yaml" | @base64d'
=extract content of container=
CONT_ID=$(docker create nginx:latest)
docker export ${CONT_ID} -o nginx.tar.gz

=shut down openshift=
Stolen with pride: https://docs.openshift.com/container-platform/4.12/backup_and_restore/graceful-cluster-shutdown.html
# Etcd bacup.
# Do we use proxy.
oc get proxy cluster -o yaml
# Make an etcd backup.
oc debug --as-root node/$(oc get nodes --no-headers --selector='node-role.kubernetes.io/master' -o=custom-columns='NAME:.metadata.name' | head -1) -- chroot /host sh -c '/usr/local/bin/cluster-backup.sh /home/core/assets/backup'
# Copy files locally.
MASTER=node/$(oc get nodes --no-headers --selector='node-role.kubernetes.io/master' -o=custom-columns='NAME:.metadata.name' | head -1) ; oc debug $MASTER -- chroot /host sh -c 'ls /home/core/assets/backup/*' 2>/dev/null | while read ETCD_BACKUP ; do echo '*' Copying ${ETCD_BACKUP##*/} ; oc debug $MASTER -- chroot /host sh -c "cat $ETCD_BACKUP | gzip -9" | zcat > ${ETCD_BACKUP##*/} ; done
# Confirm files are ok.
MASTER=node/$(oc get nodes --no-headers --selector='node-role.kubernetes.io/master' -o=custom-columns='NAME:.metadata.name' | head -1) ; oc debug $MASTER -- chroot /host sh -c 'ls /home/core/assets/backup/*' 2>/dev/null | while read ETCD_BACKUP ; do echo '*' md5sum ${ETCD_BACKUP##*/} ; oc debug $MASTER -- chroot /host sh -c "md5sum $ETCD_BACKUP" 2>/dev/null ; md5sum ${ETCD_BACKUP##*/} ; done
# When does certificate run out.
oc -n openshift-kube-apiserver-operator get secret kube-apiserver-to-kubelet-signer -o jsonpath='{.metadata.annotations.auth\.openshift\.io/certificate-not-after}{"\n"}'
# kubelet client/server certificate expiration.
oc get nodes -o name | xargs -I {} oc debug {} -- chroot /host sh -c 'openssl x509 -in /var/lib/kubelet/pki/kubelet-client-current.pem -noout -enddate; openssl x509 -in /var/lib/kubelet/pki/kubelet-server-current.pem -noout -enddate'
# If certs expire while being shut down. Then we manually have to approve csr:s when cluster comes up.
# oc get csr -o name | xargs oc adm certificate approve
# Shutdown all nodes.
oc get nodes -o name | xargs -I {} oc debug {} -- chroot /host sh -c 'shutdown -h 1'
# Now nodes can stay dead until reviving.
# To start up use command similar to this which is from openstack.
openstack server list -f value | grep SHUTOFF | awk '{print $2}' | xargs openstack server start

=statefulset=
StatefulSet is a Kubernetes controller designed to manage stateful applications that require stable network identities and persistent storage. It handles the deployment, scaling, and management of pods in an ordered and predictable manner, making it ideal for databases, distributed systems, and other applications where state preservation is critical.
=oc diff=
Se which changes would be made
kubectl diff -f <manifest>.yaml
=taint=
Remove taint from node.
kubectl taint node control-plane0.novalocal control-plane1.novalocal control-plane2.novalocal node.cloudprovider.kubernetes.io/uninitialized-
=list nodes with taints=
oc get nodes -o custom-columns=NAME:.metadata.name,TAINTS:.spec.taints

=Sealed secrets=
==create sealed secret==
kubeseal --controller-namespace=kube-system --format yaml --namespace openshift-config <ldap-secret.yaml > ldap-secret-sealed.yaml
==get secret that you want to unencrypt==
oc get sealedsecrets -n openshift-config ldap-secret -o yaml > sealedsecrets_-n_openshift-config_ldap-secret
==Unencrypt sealed secrets==
kubeseal --recovery-private-key <private_key_file> --recovery-unseal < sealedsecrets_-n_openshift-config_ldap-secret > sealedsecrets_-n_openshift-config_ldap-secret.unsealed
==Get private keys from from Sealed secrets==
oc get secret -n kube-system -l sealedsecrets.bitnami.com/sealed-secrets-key -o json | jq -r '.items[].data."tls.key"' | while read LINE ; do echo $LINE | base64 -d > $(echo "${LINE}" | cut -c -100) ; done

=imagetag=
ImageTag represents a single tag within an image stream and includes the spec, the status history, and the currently referenced image (if any) of the provided tag
"alertname": "SamplesImagestreamImportFailing",
"namespace": "openshift-cluster-samples-operator",
# Remove import fail
oc -n openshift get imagetag | grep "ImportFailed" | awk -e '{ print $1 }' | xargs -r oc -n openshift tag -d
oc delete pod -l name=cluster-samples-operator -n openshift-cluster-samples-operator

=custom-column examples=
oc get machine -n openshift-machine-api -o custom-columns=MACHINE:.metadata.name,SERVERGROUPNAME:.spec.providerSpec.value.serverGroupName,CREATIONTIME:.metadata.creationTimestamp --no-headers
=/etc/hosts=
BASE_URL=$(oc get DNS cluster -o=jsonpath='{.spec.baseDomain}')
cat << EOF
$( host api.${BASE_URL} | awk '{print $NF}') api.${BASE_URL}
$( host oauth-openshift.apps.${BASE_URL} | awk '{print $NF}') oauth-openshift.apps.${BASE_URL}
EOF
=--field-selector: examples=
List pods on node.
kubectl get pods --all-namespaces -o wide --field-selector spec.nodeName=<node-name>
List running pods
oc get pods --field-selector status.phase==Running
List not running pods
oc get pods --field-selector status.phase!=Running
=node is not ready. What could cause it=
oc logs -n openshift-machine-config-operator -l k8s-app=machine-config-controller
=Copy file from pod to your machine=
kubectl cp -n kafka $(oc get kafka -n kafka --no-headers -o custom-columns=:.metadata.name)-kafka-0:/opt/kafka/libs/kafka-tools-3.9.0.jar /temp/kafka-tools-3.9.0.jar
=category=
oc get crd -o jsonpath='{range .items[?(@.spec.names.categories)]}{.metadata.name}{"\t"}{.spec.names.categories}{"\n"}{end}' | awk -F '"' '{print $2}' | sort | uniq | while read i ; do echo '*' $i oc get $i -A ; done
* cluster-api oc get cluster-api -A
* coreoperators oc get coreoperators -A
* olm oc get olm -A
* prometheus-operator oc get prometheus-operator -A
=noobaa=
==recreate noobaa==
# Recreate noobaa. https://access.redhat.com/solutions/5948631
oc patch -n openshift-storage noobaa noobaa --type='merge' -p '{"spec":{"cleanupPolicy":{"allowNoobaaDeletion":true}}}'
oc delete -n openshift-storage noobaas.noobaa.io --all
# possibly run this command if hanging.
oc patch -n openshift-storage noobaas/noobaa --type=merge -p '{"metadata": {"finalizers":null}}'
# confirm working.
oc get pv,deployment,pods,sts -n openshift-storage|grep noobaa

=hdd to ssd convertion=
ceph osd crush rm-device-class osd.<id>
ceph osd crush set-device-class ssd osd.<id>
ROTA 1 means spinning platter
oc get nodes -l cluster.ocs.openshift.io/openshift-storage="" --no-headers -o custom-columns=:.metadata.name | xargs -I % oc debug node/% -- chroot /host sh -c "lsblk -d -o NAME,ROTA,MODEL" 2>/dev/null | grep -Ev '^loop|^sr0|^nbd|^rbd' ; oc exec -n openshift-storage $(oc get pods -n openshift-storage -o name -l app=rook-ceph-operator) -it -- bash -c "export CEPH_ARGS='-c /var/lib/rook/openshift-storage/openshift-storage.config'; exec ceph osd tree"

=lease=
I way of distributing resouces. In the case of nodes report back within time defined.
oc get leases -o custom-columns=NAMESPACE:.metadata.name,NAME:.metadata.name,HOLDER:.spec.holderIdentity,LEASEDURATION:.spec.leaseDurationSeconds,RENEWTIME:.spec.renewTime -A
=download oc for windows=
https://mirror.openshift.com/pub/openshift-v4/clients/oc/latest/
==missing commands==
ps_ls(){
echo "PID STATE COMMAND"
for pid in /proc/[0-9]*; do
[ -d "$pid" ] || continue
pid_num=$(basename "$pid")
cmd=$(cat "$pid/cmdline" 2>/dev/null | tr '\0' ' ')
state=$(cat "$pid/stat" 2>/dev/null | cut -d' ' -f3)
[ -n "$cmd" ] && printf "%-8s %-5s %s\n" "$pid_num" "$state" "$cmd"
done
}
=Create pod for testing read and write to pvc=
<pre>
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: odf-simple-test-pvc
namespace: default
spec:
accessModes:
- ReadWriteMany
resources:
requests:
storage: 1Gi
storageClassName: ocs-storagecluster-cephfs
---
apiVersion: v1
kind: Pod
metadata:
name: odf-simple-test-pod
namespace: default
spec:
containers:
- name: test-container
image: registry.redhat.io/ubi8/ubi:latest
command: ["/bin/bash"]
args:
- -c
- |
echo "Starting simple ODF PVC test..."
TEST_FILE="/mnt/test/simple-test.txt"

while true ; do
DATE=$(TZ=Europe/Stockholm date '+%F %H:%M:%S %Z')
# Write test
echo "${DATE}" > $TEST_FILE
# Read test
READ_RESULT=$(timeout 1 cat $TEST_FILE 2>/dev/null)
if [ "$READ_RESULT" = "${DATE}" ]; then
echo "${DATE} PVC Read/Write test PASSED"
else
echo "${DATE} PVC Read/Write test FAILED"
exit 1
fi
sleep 1
done
volumeMounts:
- name: test-volume
mountPath: /mnt/test
readinessProbe:
exec:
command: ["true"]
initialDelaySeconds: 5
periodSeconds: 5
livenessProbe:
exec:
command: ["true"]
initialDelaySeconds: 10
periodSeconds: 10
volumes:
- name: test-volume
persistentVolumeClaim:
claimName: odf-simple-test-pvc
restartPolicy: Never
</pre>
=PrometheusDuplicateTimestamps=
https://access.redhat.com/solutions/7101689
# Save yaml that you want to edit.
oc get configmap cluster-monitoring-config -n openshift-monitoring -o json | jq -r '.data."config.yaml"' | yq -e '.prometheusK8s.logLevel = "debug"' > config.yaml
# Upload the same
oc create configmap cluster-monitoring-config -n openshift-monitoring --from-file=config.yaml --dry-run=client -o yaml | kubectl apply -f -
# If above fails it may be caused by argocd managing the manifest. Disable sync
oc label application <argo-app> -n openshift-gitops owner-
# Command above should do the same as below command.
argocd app set openshift-gitops/<argo-app> --sync-policy=none
# Find trouble
oc logs -n openshift-monitoring prometheus-k8s-1 --tail=-1 | grep "Duplicate sample for timestam" | awk -F ' msg="Duplicate sample for timestamp"' '{print $2}' | sort | uniq -c
49 series="kube_persistentvolumeclaim_access_mode{namespace=\"rjh-mh-test\",persistentvolumeclaim=\"postgres-1\",access_mode=\"ReadWriteOnce\"}"
# Enable sync
oc label application <argo-app> -n openshift-gitops owner=rjh
# If above does not start sync.
argocd app set <argo-app> --sync-policy=automated --auto-prune --self-heal
=serverGroupName/server_groups=
<pre>
# Look at machinegroup on machineset and machine
oc get machinesets -n openshift-machine-api -o custom-columns=NAME:.metadata.name,SERVERGROUP:.spec.template.spec.providerSpec.value.serverGroupName
oc get machine -n openshift-machine-api -o custom-columns=NAME:.metadata.name,SERVERGROUPNAME:.spec.providerSpec.value.serverGroupName,CREATIONTIME:.metadata.creationTimestamp
# Patch machineset to suitable machinegroup
oc patch --namespace openshift-machine-api machineset <machineset> --type=merge --patch '{"spec":{"template":{"spec":{"providerSpec":{"value":{"serverGroupName":"<server-group>"}}}}}}'
# List servergroups.
openstack server group list
# Create servergroup with soft-affinity
openstack server group create --policy soft-anti-affinity <server_group_name>
# look at openstack what server group is.
openstack server list -f value -c ID | while read ID ; do openstack server show $ID -f json | jq -r '.|[.name,.server_groups[]]|@tsv' ; done
</pre>
=When creating new machines. Os template comes from the following values=
oc get machinesets -o name -n openshift-machine-api | while read i ; do echo $i $( oc get -n openshift-machine-api $i -o json | jq -r '.spec.template.spec.providerSpec.value|.rootVolume.sourceUUID,.template' ) ; done

Terraform

2026-03-20T15:30:31Z

Ekaanbj: /* formatting check and fix lint */

=what does it mean=
<pre>
aws_iam_role_policy_attachment Attaches a Managed IAM Policy to an IAM role
coalesce Function. Takes any number of arguments and returns the first one that isn't null or an empty string.
locals.tf Locals also known as local values or local variables, locals provide the means for expressing and storing values in the context of a specific code block.
variables.tf variable "cluster_name" { description = "The name of the kubernetes cluster" type = string }
</pre>

=install terraform=
sudo dnf install -y dnf-plugins-core
sudo dnf config-manager --add-repo https://rpm.releases.hashicorp.com/fedora/hashicorp.repo
sudo dnf install terraform
Hardcoded install
cd /tmp/ ; curl -sk -L https://releases.hashicorp.com/terraform/1.5.5/terraform_1.5.5_linux_amd64.zip -O ; cd /usr/bin/ ; sudo unzip /tmp/terraform_1.5.5_linux_amd64.zip

=file completion=
complete -C /usr/bin/terraform terraform
=Initiate terraform=
terraform init

=plan=
Creates an execution plan, which lets you preview the changes that Terraform plans to make to your infrastructure.
terraform plan

=show=
Show what has been done.
terraform show
terraform show -json

=state=
list resources within a Terraform state.
terraform state list
Show more info about individual entity.
terraform state show openstack_networking_network_v2.net3
Import state
terraform import module.kafka_eks.kubernetes_manifest.configmap_kafka_akhq "apiVersion=v1,kind=ConfigMap,namespace=kafka,name=akhq"
terraform import module.kafka_eks.helm_release.akhq kafka/akhq
Name of statefile
terraform.tfstate
=state nuke=
rm -rf .terraform* terraform*
==save and restore s3 state==
Save state
terraform state pull > terraform.tfstate.backup-$(date +%F_%H-%M-%S)
Restore state
terraform state push terraform.tfstate.backup-YYYYMMDDHHMMSS

=apply=
Performs a plan just like terraform plan does, but then actually carries out the planned changes to each resource using the relevant infrastructure provider's API.
terraform apply
=debug=
TF_LOG=trace terraform init
TRACE DEBUG INFO WARN ERROR
=terraform output=
Reads and output variable from a Terraform state file
=cloud-init=
==set password on user==
ssh_pwauth: false
chpasswd:
expire: false
users:
- name: root
password: password
type: text
=tofu=
Apply without asking.
tofu apply -auto-approve
destroy without asking(delete, rm)
tofu destroy -auto-approve

=tfk8s=
contvert k8s yaml to terraform
tfk8s --strip --file <input> --output <output>
=dynamodb=
List tables
aws dynamodb list-tables
Look at table.
aws dynamodb scan --table-name <table>
Delete row from table.
aws dynamodb delete-item --table-name <your-lock-table> --key '{"LockID": {"S": "<lock-id>"}}'
=remove lock=
terraform force-unlock 2f0bda9f-f6fd-0d82-5b8f-0fb6e2b1defb

=Remove terraform infrastructure=
terraform destroy
terraform destroy -auto-approve -refresh=false -target=libvirt_domain.crash-test-dummy

=formatting check and fix lint=
terraform fmt -recursive
=run specifig tf files=
Only use one module
terraform apply -target=module.eks

Commands

2026-03-19T13:54:18Z

Ekaanbj: /* curl ipv6 */

=7za=
decompress file
7za e myfiles.7z
=ab=
apache benchmarking
ab -n 50 https://www.halfface.se/photos/
ab -n 1000 -c 10 https://www.halfface.se/wiki/index.php/Halfface

=abcde=
Rip cd.
abcde
=adb android=
# install adb
dnf install android-tools
# enable debug. On phone. Settings. about phone. build version. Click until prompted. Enable debug via selector.
# Connect phone via usb.
# List phones.
adb devices
# Get shell on phone.
adb shell
# list installed packages.
pm list packages -f
adb shell pm list packages -f | grep game
# Uninstall
adb shell pm uninstall -k --user 0 com.samsung.android.game.gos
adb shell pm uninstall -k --user 0 com.samsung.android.game.gametools
adb shell pm disable-user --user 0 com.sec.android.app.samsungapps

=agrep=
Aproximate grep. 3 differences from andreas
agrep -3 andreas /var/log/messages
=alacritty(Terminal emulator hw accellerated)=
Terminal copy mode.
CTRL + SHIFT + SPACE
=alsactl=
Reload alsa drivers
systemctl restart alsa-state
sudo alsactl restore

=alternatives=
alternatives --set mta /usr/sbin/sendmail.postfix
sudo alternatives --config java

=antiword=
antiword bad.doc > pure.txt

=arecord=
List soundcards.
arecord -l
Chose source.
alsamixer
Create mp3 from source.
arecord -f cd -d 5 -t raw | lame -x -r - out.mp3
=arp-scan=
Scan ip addresses on local subnet
arp-scan --localnet | sort -n -k4 -t. | grep ^[0-9]

=at=
Run command at specific time. Look at queue.
echo '/usr/bin/espeak -s120 "I will say this only once."' | at -t $(date +%Y%m%d%H%M --date="+2 min")
atq
List at jobs.
atq ; atq | awk '{print $1}' | while read i ; do echo '***' $i ; at -c $i 2>&1 | tail -3 | head -1 ; done
2 Sun May 17 04:00:00 2020 a root
*** 2
/usr/bin/systemctl restart springboot_uc_supportrouter.service

=authselect=
Redhat command to manage connection to underlying services and features.
# To change content of nsswitch.conf do to your used profile.
vim /usr/share/authselect/default/local/nsswitch.conf
authselect select local --force

=base64=
base64 -d /tmp/html | elinks --dump | less -ISRM
No wrapping
base64 --wrap=0
base64 -w 0
=bash=
curl
exec 3<>/dev/tcp/localhost/8080 ; echo -e "GET /health HTTP/1.1\r\nHost: localhost\r\nConnection: close\r\n\r\n" >&3 ; cat <&3

=bbk_cli_...=
Bredbandskollen via cli.
bbk_cli_linux_amd64-1.0

=bc=
Simplify using bercerly calculator
calc(){ echo -e "scale=8\n${@}\nquit\n" | bc ; }
To the power of(upphöjt i)
2^10 = 1024
scientific (aka exponential) notation
echo 1.6945991213315015e+09 | sed -E 's/([+-]?[0-9.]+)[eE]\+?(-?)([0-9]+)/(\1*10^\2\3)/g' | bc
=bitwarden=
# Install bw.
curl -L -o /tmp/bw.zip 'https://vault.bitwarden.com/download/?app=cli&platform=linux' ; (cd /usr/local/bin ; sudo unzip -o /tmp/bw.zip)
# Remove bitwarden config.
unset BW_CLIENTID BW_CLIENTSECRET BW_SESSION
\rm -r /home/abjorklund/.config/Bitwarden*
# Set bitwarden server.
bw config server https://halfface.se/vaultwarden/
# api login
bw login --apikey
# sso login. When web server opens write "Binero SSO"
bw login
# Unlock
bw unlock
# Sync from server.
bw sync
# List items.
bw list items | jq -r '.[].name'
# get totp
bw_halfface get totp ginatricot_user
# get login info.
bw get item bareos-webui | jq .login
# which version
curl https://halfface.se/vaultwarden/api/version
podman image inspect docker.io/vaultwarden/server | jq -r '.[].Config.Labels."org.opencontainers.image.version"'

=bluetoothctl=
Enable bluetooth
sudo systemctl enable bluetooth --now
Scan
bluetoothctl scan on
Pair
bluetoothctl pair <MAC address>
Connect
bluetoothctl connect <MAC address>
Trust
bluetoothctl trust <MAC address>
Remove
bluetoothctl remove <MAC address>
List paired devices
bluetoothctl devices
Get info about paired device
bluetoothctl info 00:00:00:00:3E:E2

=blkid=
Get uuid of disk.
blkid /dev/sdb1
/dev/sdb1: UUID="64cd54f7-5330-425d-81e5-a0e473a5f5e7" TYPE="ext4" PARTLABEL="primary" PARTUUID="21f38e48-af2d-4fdd-854a-5910f392a6e0"

=bonnie++=
Report performance on disk. benchmark
bonnie++ -u 0:0
On machine running out of disk
sudo bonnie++ -d ./ -s 400 -r 200 -u root
Example command.
bonnie++ -d /storage/temp/ -s 32G -n 0 -m TEST -f -b -u abjorklund

=boot=
Booting singe user mode.
kernel ... single

=bootchart=
Analyze startup times.

=bootgraph=
How to use.
Kernel later than 2.6.28
kernel option initcall_debug
dmesg | /usr/src/linux-headers-2.6.28-11-generic/scripts/bootgraph.pl > /tmp/bootgraph.svg
=bpftrace=
run code at each system call
#!/usr/bin/bpftrace

interval:s:5
{
exit();
}

kprobe:do_sys_open
{
printf("%s %s\n", comm, str(arg1));
}
=busctl=
busctl may be used to introspect and monitor the D-Bus bus.

=bzip2=
Extract keep original
bzip2 -dk /compressed_file.bz2 and extract standard out via tar.
Extract bunzip2 file and extract via tar from standard out.
bzip2 -c /compressed_file.bz2 | tar -xivf -

=cdrecord=
Blank cd/dvd rw
cdrecord -v gracetime=2 dev=/dev/cdrom -eject blank=all -force
=certutil=
Test password. Password should be part of file called by -f
certutil -K -d /etc/dirsrv/slapd-halfface -f /tmp/pin.txt
Remove cert if it already exist.
certutil -D -n "Self-Signed-CA" -d /etc/dirsrv/slapd-halfface/ -f /tmp/pin.txt
Create new certificate.
certutil -S -n Self-Signed-CA -s CN=ssca.389ds.halfface,O=halfface,L=389ds,ST=Stockholm,C=SE -x -t "CT,," -v 480 -d /etc/dirsrv/slapd-halfface/ -k rsa -g 2048 -f /tmp/pin.txt
List certificates
certutil -L -d /etc/dirsrv/slapd-halfface/
Look at a specific certificate
certutil -L -d /etc/dirsrv/slapd-halfface/ -n "Self-Signed-CA"
Remove orphan key
certutil -F -d /etc/dirsrv/slapd-halfface/ -f /tmp/pin.txt -k 27e0fcb7a201cf0f0c3674eae03c8d94b47b4de0
Generate a new csr
certutil -R -s "CN=www.halfface.se,O=halfface,L=389ds,ST=Stockholm,C=SE" -o server.csr -d /etc/dirsrv/slapd-halfface/ -k rsa -g 2048 -f /tmp/pin.txt --extSAN "dns:www.halfface.se,dns:ldap.halfface.se" -v 240
sign certificate
certutil -C -i server.csr -o server-cert.crt -c "Self-Signed-CA" -d /etc/dirsrv/slapd-halfface/ -f /tmp/pin.txt
Import signed cert
certutil -A -n "Server-Cert" -t "u,u,u" -i server-cert.crt -d /etc/dirsrv/slapd-halfface/ -f /tmp/pin.txt
==Add certs to chrome==
for i in $(ls) ; do echo '*' $i ; certutil -d sql:${HOME}/.pki/nssdb -A -t "C,," -n "vSphere Root CA $i" -i $i ; done

=cfdisk=
Disk partitioning via ncurses interface. like fdisk.
=chage=
List password properties of user
chage -l abjorklund
Unlimited login
chage -I -1 -m 0 -M 99999 -E -1 sftponly

=chattr/lsattr=
Set extendet attributes of files.
# Lock file for most activities.
chattr +i file
# Unlock file
chattr -i file
# recursive lsattr looking for imutable.
lsattr -aR -- .//. 2>/dev/null | sed -rn '/i.+\.\/\/\./s/\.\/\///p'

=chmod=
Sticky bit on directory. Only owners of files are able to delete.
chmod 1755 /file.
-rwxr-xr-t
GUID on file. binaries started will have the group set to the defined group.
chmod 2755 /file
-rwxr-sr-x
SUID on file.
chmod 4755 /file
-rwsr-xr-x
Remover permissions for others
chmod o-rwx

=chntpw=
# Change windows passwords offline
mkdir /mnt/disk ; mount /dev/sd1 /mnt/disk; cd /mnt/disk/Windows/System32/config
# List local users.
chntpw -l SAM
# clear password on user.
chntpw -u Administrator SAM
=chrony=
# setup time sync via ntp.
/etc/chrony.conf
# look at status
chronyc tracking
# List ntp sources.
chronyc sources
.-- Source mode '^' = server, '=' = peer, '#' = local clock.
/ .- Source state '*' = current synced, '+' = combined , '-' = not combined,
| / '?' = unreachable, 'x' = time may be in error, '~' = time too variable.
|| .- xxxx [ yyyy ] +/- zzzz
|| Reachability register (octal) -. | xxxx = adjusted offset,
|| Log2(Polling interval) --. | | yyyy = measured offset,
|| \ | | zzzz = estimated error.
|| | | \
MS Name/IP address Stratum Poll Reach LastRx Last sample
===============================================================================
#? PHC0 0 3 0 19d +41ns[ +349ns] +/- 104ns
Force syncronize
sudo chronyc -a 'burst 4/4'
Make a big step. Did not work for me.
chronyc -a makestep
Verify clock
chronyd -q 'server pool.ntp.org iburst'

=chvt=
From a script change to a virtual interface and connect script to that terminal.
chvt 3 exec < /dev/tty3 > /dev/tty3

=cacafire=
View some fire in ascii.

=clean=
Clean file from comments and blank lines.
sed '/ *#/d; /^ *$/d'

=codepage=
Change codepage of file.
convmv -f cp850 -t iso-8859-1 --notest *
convmv -f utf8 -t iso8859-1 -r --notest *
convmv -f iso8859-1 -t en_US.UTF-8 -r --notest .
Change codepage of file.
iconv --from-code=ISO-8859-15 --to-code=UTF-8 document.csv > document_iconv.csv
View nfo files
iconv -f CP437 -t UTF-8 KaOs.nfo

=column=
Create nice column. Use tab as delimiter.
column -t -s $'\t' /file.tsv
=compgen=
List all commands
compgen -A function -abck

=convert=
Convert Image to 8 bit grey with threshold for white.
for tif in *.tif; do convert -depth 8 -white-threshold 70% ${tif} ${tif%%.*}.png;done
Resize image
convert -resize 25% -gamma 1.5 2011-08-03_11-09-43.jpg 2011-08-03_11-09-43_new.jpg
Multipage pdf.
convert -adjoin -page A4 -compress jpeg Infineon1.tif Infineon2.tif Infineon.pdf
pdfunite RegionUppsala01.pdf RegionUppsala02.pdf RegionUppsala03.pdf RegionUppsala04.pdf RegionUppsala.pdf
Prepare photos for printing.
convert -rotate 90 -gamma 1.5 -resize 25% -compress jpeg -quality 80 -adjoin -page A4 * print.pdf
Resize change aspect.
convert Slide1.PNG -resize 1920x1080\! slide01.png
animated gif
convert -delay 100 -loop 0 *.jpg animation.gif
Create multipage pdf of photos.
convert -resize 25% -adjoin -page A4 -rotate 90 -compress jpeg *.jpg test.pdf ; pdfjam test.pdf --no-landscape --frame true --nup 2x2 --suffix 4up --outfile /temp/photos/Alva/test_2x2.pdf
For vertical stacking (top to bottom):
convert -append 1.jpg 2.jpg out.jpg
For horizontal stacking (left to right):
convert +append 1.jpg 2.jpg out.jpg
Remove transparancy
convert image.png -background white -flatten image.jpg

=cpio=
Copy wanted partitions.
#!/bin/bash
ssh root@192.168.2.148 "(cd /boot/ ; find ./ -xdev -depth -print0 | cpio -o -0Hnewc )" | (cd /mnt/sysimage/boot ; cpio -idvuma )
ssh root@192.168.2.148 "(cd / ; find ./ -xdev -depth -print0 | cpio -o -0Hnewc)" | (cd /mnt/sysimage ; cpio -idvuma )
# -o copy out mode.
# -0 terminated by null character.
# -Hnewc som storing format.
# -i extract copy in mode.
# -d make directories.
# -v verbose.
# -V print dot.
# -u replace all files.
# -m preserve modification time.
# -a preserve access time.
=cpulimit=
Limit application cpu usage to 25% cpu utilization. Inherit limit to spawned processes.
cpulimit -i -l 25 /apps

=crash=
Troubleshoot hung Redhat vm.
Dump vm.
virsh dump <vm> --memory-only --verbose /tmp/<vm>.core
Login to machine you dump:ed and rebooted. Verify kernel version. uname -r
Setup vm similar to the one you dumped.
Install rpm:s to be able to debug.
export UNAME_R=5.14.0-554.el9.x86_64
dnf install --enablerepo=* crash kernel-modules-${UNAME_R} kernel-core-${UNAME_R} kernel-${UNAME_R} kernel-modules-core-${UNAME_R} kernel-debuginfo-common-x86_64-${UNAME_R} kernel-debuginfo-${UNAME_R}
Tips to find rpm:s.
<pre>
https://kojihub.stream.centos.org/koji/builds -> Dropdown: builds -> Search: kernel-5.14.0-554.el9
https://kojihub.stream.centos.org/kojifiles/packages/kernel/ -> find your way down the tree.
</pre>
Start crash. Write help to give advice. LLMS are quite useful for troubleshooting advice.
crash /usr/lib/debug/lib/modules/${UNAME_R}/vmlinux /tmp/<vm>.core
Scripting with crash
cd /temp/ ;cat commands.txt ; for i in $(ls instance-0002da2b_osc-compute27-sto1-prod.cloud.binero.net_okd01-ppj65-master-0_2025-04-15_15-03-04*) ; do crash -i commands.txt /usr/lib/debug/lib/modules/5.14.0-554.el9.x86_64/vmlinux /temp/instance-0002da2b_osc-compute27-sto1-prod.cloud.binero.net_okd01-ppj65-master-0_2025-04-15_15-03-04.core > $i.log </dev/null ; done
ps
runq

=cronie=
Start cronie in foreground. Write what it is doing.
/usr/sbin/crond -n -x sch

=crontab/cron=
crontab.
* * * * * command to be executed
- - - - -
| | | | |
| | | | +----- day of week (0 - 6) (Sunday=0)
| | | +------- month (1 - 12)
| | +--------- day of month (1 - 31)
| +----------- hour (0 - 23)
+------------- min (0 - 59)
0 Sunday
1 Monday
2 Tuesday
3 Wednesday
4 Thursday
5 Friday
6 Saturday
@reboot "run command at reboot"
If you need % in crontab escape it. \%

Run command every 10 minutes.
*/10 * * * * command

Run command at 12:00 and 24:00 hours.
00 0,12 * * * command

Run command between 8-17 every 2 hours.
0 8-17/2 * * * /path/command
0 8,10,12,14,16 * * * /path/command

Start program under crontab.
#!/bin/bash
COMMAND="screen -L -d -m ping www.dn.se"
if [ "$(ps -ef | grep -i ping | grep -v grep)" ]
then
echo "\"${COMMAND}\" already running."
else
echo "Starting \"${COMMAND}\"."
cd /tmp
${COMMAND}
fi

=crudini=
Edit ini files och cli.
crudini --set /lib/systemd/system/icinga2.service Service Nice -10 ; systemctl daemon-reload ; systemctl restart icinga2.service

=cryptsetup=
luks. Process to unlock disk. Mount it and unmount and encrypt.
cryptsetup luksOpen /dev/nvme0n1p3 secure
mount /dev/mapper/secure /mnt
umount /mnt
cryptsetup luksClose secure
==create luks encrypted disk==
# Add block device and add gpt label. Create partition.
cfdisk /dev/sde
# Encypt partition
sudo cryptsetup luksFormat /dev/vdb1
# open encrypted disk
sudo cryptsetup open /dev/vdb1 encrypted-disk
# Format disk
sudo mkfs.ext4 /dev/mapper/encrypted-disk
# Info about partition
sudo blkid /dev/vdb1
/dev/vdb1: UUID="cb2e7238-8245-41cb-9811-6804f602e5e8" TYPE="crypto_LUKS" PARTUUID="56b829b6-8295-4963-9562-29e8937819a8"
# Setup crypttab if you want to decrypt at boot splash
echo 'encrypted-disk UUID=cb2e7238-8245-41cb-9811-6804f602e5e8 none luks' | sudo tee -a /etc/crypttab
# Manually unlock luks partition
sudo cryptsetup luksOpen UUID=cb2e7238-8245-41cb-9811-6804f602e5e8 encrypted-disk
# Manuall lock luks partition
sudo cryptsetup luksClose encrypted-disk
# Add disk to fstab
echo '/dev/mapper/encrypted-disk /mnt/encrypted-disk ext4 noauto 0 2' | sudo tee -a /etc/fstab
# Create mount point
sudo mkdir /mnt/encrypted-disk ; sudo chmod 777 /mnt/encrypted-disk
# mount disk
sudo umount /mnt/encrypted-disk
# Change password of luks partition
sudo cryptsetup luksAddKey UUID=cb2e7238-8245-41cb-9811-6804f602e5e8
sudo cryptsetup --test-passphrase -v open UUID=cb2e7238-8245-41cb-9811-6804f602e5e8
sudo cryptsetup luksRemoveKey UUID=cb2e7238-8245-4

=cups=
Install cups
dnf install cups
enable cups
systemctl enable cups.service --now
Configure printer in cups.
http://localhost:631/

=cut=
Cuf everything from field 5.
cut -f5- -d ' '

=curl=
==Get http return code.==
curl --connect-timeout 3 --max-time 9 -ksL -w '%{http_code}\n' 'http://www.dn.se' -o /dev/null
==get external ip. what is my ip==
curl ifconfig.me
==get external ip and all related browser information.==
curl ifconfig.me/all
==Alternative address for domain.==
<pre>
curl -sk --resolve www.halfface.se:80:127.0.0.1 http://www.halfface.se
curl http://127.0.0.1/ -H "Host: halfface.se" -H "X-Forwarded-Proto: https" -I
</pre>

==Get header / mime type==
curl -I http://url.se
==post file==
curl -X POST -d @myfilename http://user:pass@myhost/hudson/job/_jobName_/postBuildResult
==post file via ftp using proxy==
curl -p --proxy http://proxy.example.se:3128 -v -T backup.tar ftp://user:password@ftp.example.se/directory/

==cookie format. tab delimited.==
domain - The domain that created AND that can read the variable. .halfface.se
flag - A TRUE/FALSE value indicating if all machines within a given domain can access the variable. This value is set automatically by the browser, depending on the value you set for domain.
path - The path within the domain that the variable is valid for.
secure - A TRUE/FALSE value indicating if a secure connection with the domain is needed to access the variable.
expiration - The UNIX time that the variable will expire on. UNIX time is defined as the number of seconds since Jan 1, 1970 0:00:00 GMT.
name - The name of the variable.
value - The value of the variable.

==add certificate authority to openssl==
Redhat based os:es this file gets updated. /etc/pki/ca-trust/extracted/openssl/ca-bundle.trust.crt
cp /tmp/ca.crt /etc/pki/ca-trust/source/anchors/
update-ca-trust
Debian based
cp /tmp/ca.crt /usr/share/ca-certificates/extra
update-ca-certificates
Debian 2
cp foo.crt /usr/local/share/ca-certificates/foo.crt
update-ca-certificates

==curl ipv6==
<pre>
curl -6 -g "http://[::1]:80/"
curl -g "http://[2001:9b1:402d:0:ffff:f038:ec3e:b5d4]/"
</pre>

==proxy==
curl --proxy http://proxy.se:3128 -sk "http://mirrorlist.centos.org"
===no_proxy===
export https_proxy=http://proxy.se:3128 ; export http_proxy=$https_proxy ; export HTTPS_PROXY=$https_proxy ; export HTTP_PROXY=$https_proxy ; export no_proxy=localhost,127.0.0.1,.inter.net,$(echo 10.217.{4..5}.{1..254}, 10.217.5.255) ; export NO_PROXY=$no_proxy
===time spent===
-w "time_namelookup: %{time_namelookup}, time_connect: %{time_connect}, time_appconnect: %{time_appconnect}, time_pretransfer: %{time_pretransfer}, time_redirect: %{time_redirect}, time_starttransfer: %{time_starttransfer}, time_total: %{time_total}\n"
=Is it a free day?=
<pre>
curl -sk https://sholiday.faboul.se/dagar/v2.1/2023 | jq -r '.dagar[] |select(."arbetsfri dag"=="Ja")|.datum'
</pre>

=qr code=
encode
qrencode "Andreas" -o /tmp/qr_Andreas.png
decode
zbarimg /tmp/qr_Andreas.png

=date=
Get date in requested format.
date '+%Y-%m-%d %H:%M'
date +%Y-%m-%d-%H%M
date "+%F_%T" # 2017-01-16_19:41:41

date 033121422003.55
Mon Mar 31 21:42:55 PST 2003
date MMDDhhmmCCYY.ss

Whats the date in 1000 years. Or any other increment.
date --date="+1000 years" +%C%y-%m-%d
date --date="-2 hour" +%C%y-%m-%d\ %H:%M
TZ=CEST date --date="-2 hour" +%C%y-%m-%d\ %H:%M

What is the time in other timezone given in unixtime/epoch.
TZ=GMT date -d '@1345064585'
Wed Aug 15 21:03:05 GMT 2012

Unix time.
date +%s
Unix to normal
date -d @1234567890

scew clock by a second.
DATE_OFF=$(date --date="-5 second" +%C%y-%m-%d\ %H:%M:%S\ %Z) ; date --set="${DATE_OFF}"
Set clock
date '+%Y-%m-%d %T %Z' -s "2008-11-28 08:08:08 UTC"
=datefudge=
Fake date for command.
datefudge "2020-04-01 10:23" date

=dateseq=
Create date sequense.
dateseq 2017-04-01 2017-04-05

=db2=
Empty catalog remove node
for DB2 in $(db2 list node directory | grep "Node name" | awk '{print $4}') ; do db2 uncatalog node $DB2;done
Empty catalog remove db
for DB2 in $(db2 list db directory | grep "Database name" | awk '{print $4}') ; do db2 uncatalog db $DB2;done
# Load db2 environment.
. /home/db2/sqllib/db2profile

# Connect to database.
db2 connect to ${database_name} user ${user} using ${password}

# Test query.
SELECT service_level, fixpack_num, bld_level FROM TABLE (sysproc.env_get_inst_info()) as A;

# System Database Directory
db2 list db directory

# Node Directory
db2 list node directory

# setup directory
db2 "catalog tcpip node db2datan remote 1.2.3.4 server 5000"
db2 "catalog db db2datadb as db2datadb at node db2datan"

# Drop connection.
db2 terminate

=dbus-monitor=
dbus-monitor # Monitor activity on the dbus to see what system and sessions are doing.

=dd=
output your microphone to a remote computer's speaker
dd if=/dev/dsp | ssh -c arcfour -C username@host dd of=/dev/dsp
Add 2GB to disk image.
dd if=/dev/zero of=/system_image.img bs=1M oflag=append conv=notrunc count=2000
dd with progress bar.
dd if=kali.iso of=/dev/sdc status=progress
pv -ptre /install/backup/machine/raspberry/ipcenter_view.img | sudo dd of=/dev/mmcblk0 bs=1M
dd to position on disk
dd of=/dev/disk1 if=/dev/urandom obs=500000 seek=1 bs=1MB count=1 conv=notrunc
==consume 100GB ram==
mount -o remount,size=300G /dev/shm
dd if=/dev/zero of=/dev/shm/$(date '+%Y-%m-%d_%H-%M-%S') bs=1073741824 count=100 status=progress

=debugfs=
ctime: Shows file change time.
atime: Shows file access time.
mtime: Shows file modification time.
crtime: Shows file creation time. Birth.
Example
debugfs -R 'stat /etc/exports.bkp-2021-11-17_10-07-46' /dev/mapper/vg_rbnetstorage0-lv_root
debugfs 1.41.12 (17-May-2010)
Inode: 924905 Type: regular Mode: 0644 Flags: 0x80000
Generation: 2068409071 Version: 0x00000000:00000001
User: 0 Group: 0 Size: 4775
File ACL: 0 Directory ACL: 0
Links: 1 Blockcount: 16
Fragment: Address: 0 Number: 0 Size: 0
ctime: 0x6194c662:deae4368 -- Wed Nov 17 10:07:46 2021
atime: 0x6193bd7f:c4faf658 -- Tue Nov 16 15:17:35 2021
mtime: 0x61925419:34c06f18 -- Mon Nov 15 13:35:37 2021
crtime: 0x6194c662:deae4368 -- Wed Nov 17 10:07:46 2021
Size of extra inode fields: 28
Extended attributes stored in inode body:
selinux = "unconfined_u:object_r:etc_t:s0\000" (31)
EXTENTS:
(0-1): 3718194-3718195
=ddclient=
Debug
ddclient -daemon=0 -debug -verbose -noquiet

=df=
df output one per line. Without header.
df -Plk / /apps | tail -n+2

=dhclient=
[root@wall sysconfig]# cat /etc/dhclient.conf
interface "eth0" {
prepend domain-name-servers 127.0.0.1;
supersede domain-name "bltprojektering.se";
}

=dialog=
Create dialog in terminal. Example a progressbar.
for i in {0..100} ; do echo $i | dialog --gauge "Please wait" 7 70 1 ; sleep .1 ; done
=diff=
sdiff <(echo -e 'hej\nda\nvi\nses\ni\nmorgon') <(echo -e 'hej\ndå\nvi\nSES\ni\nmorgon')
Only show files that differ.
-q --brief
Only show change between files.
diff -u file1.txt file2.txt | grep -vE '^(---|\+\+\+|@@|\+|-)'

=dig=
==Get all dns information about host.==
dig any www.halfface.se
==Trace dns lookups from root dns. Use 8.8.8.8 for lookups.==
dig +trace @8.8.8.8 www.halfface.se
==Recursive lookup.==
dig -tAXFR halfface.se
==backward resolve==
dig -x 89.253.75.84
==get ttl==
dig +nocmd +multiline +noall +answer any halfface.se
==Get external ip.==
dig +short myip.opendns.com @resolver1.opendns.com
==Get txt record.==
dig google.com txt
==You can find the authoritative servers by asking for the NS records for a domain==
dig example.com NS
==dig using alternative port==
dig +short -p 5353 halfface.se @10.130.0.35

=digitemp=
digitemp_DS9097 -c /etc/.digitemprc -t0

=disk=
disk usage
baobab
foremost
recover deleted files.
=disown=
Disconnect process(pid) so that is survives a logout.
disown %2

=display=
Change resolution
xrandr --output LVDS --mode 1280x800
xrandr --output default --mode 1280x1024
Query graphics card capabilities.
xrandr -q
Change dpi
xrandr --dpi 138/eDP1
=du=
du -amx / | sort -n | tail -5
=duplicity=
Encrypted backups over rsync

=dmesg=
dmesg with iso time format
dmesg --ctime --time-format iso
Write to dmesg
echo "$USER $(date '+%Y-%m-%d %H:%M:%S %Z')" | sudo tee /dev/kmsg

=dmidecode=
List memory banks
sudo dmidecode -t 17

=dnf=
install skip if not exist
sudo dnf install --setopt=strict=0 $(sort -u /temp/other_machine_rpm)
==update system==
dnf -y upgrade --refresh
reboot
dnf -y install dnf-plugin-system-upgrade
dnf -y system-upgrade download --refresh --allowerasing --releasever=43
# Before 42:
dnf -y system-upgrade reboot
# From 42 and onward
dnf5 offline reboot
# broken deps.
dnf repoquery --unsatisfied
# look for duplicates
dnf repoquery --duplicated
# which rpms do not exit in repo.
dnf list extras
# remove no longer used.
dnf autoremove
dnf remove $(rpm -qa| grep \.fc23)
# reinstall rpm
dnf reinstall sssd-common

==auto update==
# Install auto updates.
dnf install dnf-automatic
# Enable auto update.
sed -i "s/apply_updates = no/apply_updates = yes/g;s/email_from = root@example.com/email_from = root@${HOSTNAME}/g;s/email_to = root/email_to = anden@halfface.se/g" /etc/dnf/automatic.conf
# Enable timer.
systemctl enable dnf-automatic.timer && systemctl start dnf-automatic.timer
# Trigger timer.
systemctl start dnf-automatic.timer
# Check status of dnf-automatic:
systemctl list-timers *dnf-*
==build environment==
dnf group install "C Development Tools and Libraries"
==update to specific version==
View available version.
dnf --showduplicates list gitlab-ee
Update to specific version
dnf install gitlab-ee-13.12.15-ee.0.el8

=Setup dnsmasq on ubuntu=
<pre>
# Install dnsmasq
apt install dnsmasq
systemctl enable dnsmasq --now
# Disable systemd-resolved.
sudo systemctl disable --now systemd-resolved
# Make NetworkManager ignore dns.
sudo tee /etc/NetworkManager/conf.d/no-dns.conf <<'EOF'
[main]
dns=none
EOF
systemctl restart NetworkManager
# Fix /etc/resolv.conf
sudo \rm /etc/resolv.conf
sudo tee /etc/resolv.conf <<'EOF'
nameserver 127.0.0.1
search int.redbridge.se halfface.se cloud.binero.net
options timeout:1 attempts:1
EOF
# Create config
sudo tee /etc/dnsmasq.d/custom.conf <<'EOF'
listen-address=127.0.0.1
bind-interfaces
server=/redbridge.se/185.53.164.25
#server=/halfface.se/10.111.222.2
server=8.8.8.8
EOF
# Restart dnsmasq
systemctl restart dnsmasq
</pre>

=dovecot=
# List files with doveadm
MAIL=mbox:/var/vmail/fordonskontroll.app doveadm mailbox list
# Remove mails with doveadm
MAIL=mbox:/var/vmail/fordonskontroll.app doveadm expunge -u n

=dovecot=
# List files with doveadm
MAIL=mbox:/var/vmail/fordonskontroll.app doveadm mailbox list
# Remove mails with doveadm
MAIL=mbox:/var/vmail/fordonskontroll.app doveadm expunge -u n

=dracut=
Dracut is a tool used to create an initial RAM filesystem (initramfs) for Linux systems.

=dvgrab=
Capture dv material
dvgrab -f dv2 -i -showstatus -s 0 -timestamp California-2

=e2fsck=
Scan for bad blocks.
e2fsck -ycv /dev/VolGroup00/LogVol00

=edid/ddc=
startx -- -logverbose 5.
The EDID information turns up in /var/log/Xorg.0.log.
=enca=
detect and convert encoding of text files. (codepage utf)
enca -L none /temp/locale2
=esmtp=
# Install dependency
dnf install procmail
# Put the following config in either /etc/esmtprc or more specific ~/.esmtprc. chmod 644.
SMTP_SERVER=halfface.se
cat << EOF > ~/.esmtprc
hostname = $SMTP_SERVER:25
# Set the Mail Delivery Agent (MDA)
mda = "/usr/bin/procmail -d %T"
EOF
chmod 0710 ~/.esmtprc

=etckeeper=
Keep your /etc/ directory under git revision control.
What has happened.
git log -p /etc/resolv.conf
Wipe /etc/.git
etckeeper uninit
etckeeper init

=ethtool=
show-features
ethtool -k <device>
generic-segmentation-offload = gso
tcp-segmentation-offload = tso
...
Enable wake on lan magic package.
ethtool --change <interface> wol g
Permanently add wol
find /sys/class/net -type l -not -lname '*virtual*' -printf '%f\n' | while read i ; do INTERFACE_INFO=$(ip address show $i) ; MAC=$(grep link/ether <<< "${INTERFACE_INFO}" | awk '{print $2}') ; echo "# /etc/systemd/network/50-wired.link
[Match]
MACAddress=$MAC

[Link]
NamePolicy=kernel database onboard slot path
MACAddressPolicy=persistent
WakeOnLan=magic" ; done

=exiftool=
Change meta data for files, exif, jpg, mp3...
Get info from file.
exiftool $file.mp4
gps format
41°24'12.2"N 2°10'26.5"E
gps format known to maps.google.com
exiftool -c "%.6f" 2022-03-06_10-39-40.mp4 | grep -i gps

=exportfs=
Install server
dnf install nfs-utils
Start nfs server
systemctl enable nfs-server --now
Reexport everything.
exportfs -avr
Example export.
*(rw,no_root_squash,async,insecure)
rw rewritable
no_root_squash Allow root on remote machine same permissions as local root
async
insecure NFS version 2 and 3 servers only provide (insecure) host-based authentication: Hosts are allowed/denied based on hostnames and/or IP addresses. Authorization of users is controlled on the clients using the permissions of the files based on user/group IDs. allows clients with NFS implementations that don't use a reserved port for NFS

=fdupes=
Find duplicate files.
fdupes -r /home
=feh=
Image viewer

=ffmpeg=
ffmpeg
ffmpeg -y -deinterlace -aspect 16:9 -author "Andreas Bjorklund" -title "Tanzania" -year 2007 -i Tanzania.m2t -acodec mp3 -vcodec mpeg4 -b 3000k -s 720x540 test.avi
Create swf/flv from mpeg2 stream
ffmpeg -deinterlace -i VTS_01_1.VOB -ab 56 -ar 22050 -b 500000 -r 15 -s 360x288 sisyfos.swf
Create horse movie.
ffmpeg -deinterlace -i /temp/VTS_01_1.VOB -ab 100 -ar 22050 -b 1200000 -r 25 -s 360x288 3horses.swf
Cut video from command prompt.
ffmpeg -i video.avi -vcodec copy -acodec copy -ss 00:00:00 -t 00:00:04 trimmed_video.avi
Record desktop.
ffmpeg -f alsa -ac 2 -i pulse -f x11grab -r 5 -s 1920x1080 -i :0.0 -acodec pcm_s16le -vcodec libx264 -threads 0 -y output.mkv
ffmpeg -f x11grab -s $(xrandr | grep \*+|awk '{print $1}') -r 25 -i :0.0 -sameq /tmp/out.mpg
Change container.
ffmpeg -i film.mov -vcodec copy -acodec copy film.mp4
Transcode to h264 aac
ffmpeg -i original.avi -vcodec libx264 -acodec aac -strict experimental new_file.mp4
Transcode mp3 to ogg vorbis
for file in *.mp3; do ffmpeg -i "${file}" -acodec libvorbis "${file/%mp3/ogg}";done
Take one photo from video stream.
ffmpeg -ss 00:00:01 -i <video input> -frames:v 1 -q:v 2 <photo created>
Take photo
ffmpeg -f video4linux2 -s 1280x720 -i /dev/video0 -f image2 snapshot.jpg
ls /dev/video* | while read i ; do echo $i ; ffmpeg -f video4linux2 -i $i -vframes 1 -q:v 2 /tmp/${i//\//%}.$(date +%F_%H-%M-%S).jpg ; done ; ls -la /tmp/%*
Take a photo from a video steam every 10 seconds.
ffmpeg -i video.mp4 -r 0.1 -f image2 %03dandreas.jpg
Take a photo every 1 put it in a file.
ffmpeg -y -i http://balcony.halfface.se:8080 -r 1 -f image2 -update 1 stream_image.jpg -probesize 5e+07
Rotate 180 degrees.
ffmpeg -i input.mp4 -filter:v "transpose=1,transpose=1" output.mp4
Change rotation without transcoding.
ffmpeg -i IMG_0703.MOV -metadata:s:v rotate="" -codec copy rotate_IMG_0703.MOV
Concaternate videos.
ffmpeg -f concat -safe 0 -i mylist.txt -c copy output

=find=
==Find exluding directory==
find . -wholename '/var/' -prune -o -ls
==Find text file in directoy execpt directory. Grep for text in that file and show it with colours in less==
find /opt/ongame/ -wholename '/opt/ongame/napsjb/server/naps/tmp' -prune -o -type f -exec grep --color=always -r '/fraud' /dev/null {} \; | less -SR
==Find excluding several directories==
find / -type d $ -path /proc -o -path /dev -o -path /net $ -prune -o -gid 1002 -exec chgrp -h 1001 {} \;
==Find excluding svn==
find . -path '*/.svn' -prune -o -type f -print
==Searches for files modified up to 4 days ago==
find ./ -type f -mtime -4
==Searches for files modified between certain dates. Here for files older than 30 days but younger than 60 (penultimate month)==
find ./ -type f -mtime -60 ! -mtime -30
sudo find . -newermt "2014-10-19 09:30" ! -newermt "2014-10-19 09:35"
==Find which dir is consuming inodes==
find /var -xdev -printf '%h\n' | sort | uniq -c | sort -k 1 -n
for i in $(ls) ; do echo $(find $i | wc -l) $i ; done | sort -n
==How much data is consumed by pattern==
export NFS_DIR=/netstorage/cam/ocp-01 ; find ${NFS_DIR} -maxdepth 1 | grep ^${NFS_DIR}/archived- | while read NFS_DIR_REMOVE ; do du -sk "${NFS_DIR_REMOVE}" ; done | awk '{ SUM += $1} END { print SUM "KiB" }' | numfmt --from=auto --to=iec-i --suffix=B
==find search small files==
find . -type f -size -1M -exec grep -H 'your_search_pattern' {} +
=find physical network interfaces=
find /sys/class/net -type l -not -lname '*virtual*' -printf '%f\n'

=findmnt=
view the mount tree
findmnt

=flash=
When firefox is complaining about outdated flash plugin
rm pluginreg.dat
=flatpak=
=Install flatpak=
sudo apt install -y flatpak gnome-software-plugin-flatpak
sudo flatpak remote-add --if-not-exists flathub https://dl.flathub.org/repo/flathub.flatpakrepo
=Install flatpak application and replace system binary=
sudo flatpak install -y flathub com.freerdp.FreeRDP
cat <<'EOF' | sudo tee /usr/local/bin/xfreerdp
#!/bin/bash
flatpak run com.freerdp.FreeRDP "$@"
EOF
sudo chmod 755 /usr/local/bin/xfreerdp
hash -r
=Run other binary from flatpack=
flatpak run --command=xfreerdp com.freerdp.FreeRDP

=List installed applications.=
flatpak list --app

=flock=
used to use cript that only used 1 time concurrently.
flock

=fmt=
Join lines
ifconfig -a | fmt -w 300

=fold=
Fold long lines. Break at 80 and blank spaces.
fold -w 80 -s text.txt
=forward traffic=
service x11
{
disable = no
socket_type = stream
protocol = tcp
wait = no
user = root
server = /usr/bin/nc
server_args = 172.28.37.152 6000
}
=fping=
fping --timeout=10 --elapsed --netdata <fqdn>
Example of testing connectivity.
for i in $(grep -E 'ocp-[0-9]{2}-' /etc/hosts | awk '{print $2}') ; do echo -e "$(fping --timeout=10 --elapsed $i)\t$(nc -v -w1 $i 22 </dev/null 2>&1 | strings | xargs)" ; done | column -t -s $'\t'

=free=
You have 15956MB physical ram. 9033MB is used by applications. 6922MB is free.
free -m
total used free shared buffers cached
Mem: 15956 15755 200 0 300 6421
-/+ buffers/cache: 9033 6922
Swap: 19998 2405 17593

=free new=
Total memory 8076624k and 5169152 free.
total used free shared buff/cache available
Mem: 8076624 2536328 1069132 284152 4471164 5169152
Swap: 7815164 2809244 5005920

Free memory usage from /proc/zoneinfo and /proc/meminfo
awk -v low=$(grep low /proc/zoneinfo | awk '{k+=$2}END{print k}') '{a[$1]=$2} END{print a["MemFree:"]+a["Active(file):"]+a["Inactive(file):"]+a["SReclaimable:"]-(12*low);}' /proc/meminfo
5168456
==physical memory==
Show physical memory in machine. Consider points below.
grep MemTotal /proc/meminfo
meminfo:
Provides information about distribution and utilisation of memory. This varies by architecture and compile options...
MemTotal:
Total usable ram (i.e. physical ram minus a few reserved bits and the kernel binary code)
Gives more information not really sure how.
dmesg|grep Memory:
==List memory modules==
dmidecode -t memory
lshw -class memory

=fstab=
Use ram for some logfiles.
none /var/log/ tmpfs defauls,noatime,size=10% 0 0
none /tmp/ tmpfs defauls,noatime,size=10% 0 0
none /var/tmp/ tmpfs defauls,noatime,size=10% 0 0
none /var/spool/ tmpfs defauls,noatime,size=10% 0 0

=fswebcam=
Capture photo.
fswebcam -r 1920x1080 --jpeg 85 -D 1 --quiet --no-banner shot.jpg
fswebcam -d /dev/video0 -i 0 -r 2592x1944 -p YUYV /net/10.111.222.1/storage/temp/logitech.jpg
=fwupdmgr=
fwupdmgr get-devices --show-all-devices
fwupdmgr get-upgrades
fwupdmgr update $device_id

=genisoimage=
genisoimage -o nuc.iso nuc
=gnome-font-viewer=
view fonts
gnome-font-viewer /file.woff2
=gnome-monitor-config=
Set one monitor. Disable all others.
gnome-monitor-config set -LpM HDMI-2
Get monitor settings
WINDOWS + p

=gpg=
Password encryption decryption with gnupg.
gpg -c --force-mdc /temp/shadow
echo "$(gpg -qd /temp/shadow.gpg)"
==create keys==
gpg --full-generate-key
==list secret keys==
gpg --list-secret-keys --keyid-format LONG
==delete secret keys==
gpg --delete-secret-key liza

==list public keys==
gpg --list-public-keys --keyid-format LONG

==export public key==
gpg --armor --export 3AA5C34371567BD2
==export private key==
gpg --armor --export-secret-keys 3AA5C34371567BD2
==export secret subkey==
gpg --armor --export-secret-subkeys 3AA5C34371567BD2
==import keys==
gpg --import pub.key
gpg --import sec.key
gpg --import sub.key
==add trust to private key==
gpg --edit-key 6252FC9A029A2669 trust quit # 5 y

==edit gpg key==
gpg --edit-key 6252FC9A029A2669
==send gpg key==
gpg --send-key 6252FC9A029A2669
==delete public key==
gpg --delete-key "User Name"
==change trust level on all keys==
gpg --list-keys --fingerprint |grep pub -A 1|egrep -Ev "pub|--"|tr -d ' ' | awk 'BEGIN { FS = "\n" } ; { print $1":6:" } ' | gpg --import-ownertrust
==get info about gpg encrypted file==
gpg --list-packets crypto-text.pgp
==list keys in gpg file==
gpg --list-packets crypto-text.pgp # | grep keyid
==get public key from command above==
gpg --recv-keys 754817487F42735A
==encrypt file==
gpg --encrypt --recipient user1@inter.net --recipient user2@inter.net --recipient user3@inter.net file.txt

==decrypt gpg file==
gpg --decrypt vpn-0ea602e33ab9c49fd.txt.gpg

==who has encrypted file==
gpg --pinentry-mode cancel --list-packets file.gpg
==remove expired public keys==
for i in $(gpg --list-public-keys --keyid-format LONG 2>&1 | grep -A1 -B1 expired | grep -Ev '^$|^pub|^uid') ; do gpg --delete-key $i ; done

=pgpdump=
pgpdump <(curl -sS https://download.spotify.com/debian/pubkey_C85668DF69375001.gpg)
=gphoto2=
Capture photo from the command line linux.
gphoto2 --camera='Canon EOS 40D (PTP mode)' --port=usb: --capture-image-and-download

=graphviz=
Create graph.
dot -Tps /flow -o /tmp/flow.ps

=grep=
Colorize grep output.
grep --color=always -r '10\.7\.' /opt/ongame/
Show non comment lines ending with a blank.
find . -name '*.properties' -exec grep --color=always -E '^[^#].*\ $' {} \; | less -SR
grep ipaddress from message file.
sudo grep DHCP /var/log/messages | grep -oir --color=always '192\.168\.[0-9]*\.[0-9]*' | sort -u
grep -E '([0-9]|[1-9][0-9]|1([0-9][0-9])|2([0-4][0-9]|5[0-5]))\.([0-9]|[1-9][0-9]|1([0-9][0-9])|2([0-4][0-9]|5[0-5]))\.([0-9]|[1-9][0-9]|1([0-9][0-9])|2([0-4][0-9]|5[0-5]))\.([0-9]|[1-9][0-9]|1([0-9][0-9])|2([0-4][0-9]|5[0-5]))'
grep ipaddress from file
grep -E '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}'
grep for tab
grep 10.199.2.1$'\t' /etc/hosts
grep from word containing regex space separated.
grep -oE '\S*regex\S*' /file
When grep start to complain about file being binary run the following command to define where.
grep -Pa '\x00' /temp/file_name
Remove binary part of file.
sed -i 's/\x00//g' /temp/file_name
Grep email addresses.
grep -E -o "\b[a-zA-Z0-9.-]+@[a-zA-Z0-9.-]+\.[a-zA-Z0-9.-]+\b" filename.txt
Grep for exact string like \
grep -F \\ blabla.json
=grepcidr=
grepcidr -v 10.0.0.0/8,172.16.0.0/12,192.168.0.0/16

=growpart=
growpart /dev/vda 5
btrfs filesystem resize max /

=gsettings=
Emulate 3 button mouse
gsettings set org.gnome.settings-daemon.peripherals.mouse middle-button-enabled true
Blinking cursor disable
gsettings set org.gnome.Terminal.Legacy.Profile:/org/gnome/terminal/legacy/profiles:/:$(gsettings get org.gnome.Terminal.ProfilesList default|tr -d \')/ cursor-blink-mode off
List settings
gsettings list-recursively

=gsync=
Install gsync
git clone https://github.com/iwonbigbro/gsync.git
cd gsync/
sudo python setup.py install
Download data.
gsync -u -r -t -v --progress --delete -l -s drive://motion/ /temp/motion2/

=gzip=
Compress a stream.
find . | gzip -9 > /tmp/file_list.gz

=gscan2pdf=
Scan and ocr pdf dokuments

=Handbrake=
Compress dvd
#Rip dvd.
sudo vobcopy -o /storage/temp/ -v -x -l
#compress video.
HandBrakeCLI -e x264 -Z Normal -i source.vob -o destination.mkv -a 2 -r 25 -E faac -f mkv -d -S 600 --crop 0:0:0:0
#Create film for android.
HandBrakeCLI -i 01.Alla.Vi.Barn.I.Bullerbyn.1986.SWEDiSH.vob -o 01.Alla.Vi.Barn.I.Bullerbyn.1986.SWEDiSH.mp4 -x level=30:bframes=0:cabac=0:ref=1:vbv-maxrate=1500:vbv-bufsize=2000:analyse=all:me=umh:no-fast-pskip=1 -e x264 --vb 300 -E faac --ab 128 --maxWidth 320 -2 -T -d
# Compress.
SOURCE=/ssd/temp ; DESTINATION=/temp ; for FILM in $(cd ${SOURCE}; ls *.mov | sed 's/\.mov$//g'); do HandBrakeCLI -e x264 -q 20 -B 160 -i ${SOURCE}/${FILM}.mov -o ${DESTINATION}/${FILM}.mp4 ;done
# High profile
HandBrakeCLI -i DVD -o ~/Movies/movie.mp4 -e x264 -q 20.0 -a 1 -E faac -B 160 -6 dpl2 -R Auto -D 0.0 -f mp4 --strict-anamorphic -m -x ref=2:bframes=2:subme=6:mixed-refs=0:weightb=0:8x8dct=0:trellis=0
=hashid=
Identify hash strings.
hashid

=heif-convert=
heif-convert image.HEIC new-image.jpg
=hostnamectl=
hostnamectl set-hostname rocky_8_1

=htmldoc=
Convert html document to pdf
htmldoc --webpage -f php_html_doc.pdf /home/andreasbj/php_manual_en.html 2>/tmp/htmldoc
=htpasswd=
Add user to htpasswd file.
htpasswd -b /etc/httpd/conf/htpasswd <username> <password>

=hunspell=
hunspell -d sv_SE swedish.txt
=hydra=
Password checking.
hydra -l root -P /etc/passwdknown -t 5 192.168.29.62 ssh2

=ifconfig=
Configure network.
ifconfig eth0 192.168.0.1 netmask 255.255.255.0 up
ip address alias
ifconfig eth0:0 192.168.1.2 netmask 255.255.255.0
Network configuration Full config.
echo -e "options timeout:1 attempts:1
domain halfface.se
nameserver 84.246.88.10
nameserver 84.246.88.20" > /etc/resolv.conf
ifconfig eth0 89.253.75.84 netmask 255.255.255.224 up
route add default gw 89.253.75.65 eth0
Vip on loopback /etc/sysconfig/network-scripts/ifcfg-lo:ipdbm
DEVICE=lo:ipdbm
IPADDR=192.168.122.2
NETMASK=255.255.255.255
NETWORK=192.168.122.0
ONBOOT=yes
Setting up multiple addresses. ifcfg-eth0-range0
TYPE=Ethernet
IPADDR_START=192.168.122.3
IPADDR_END=192.168.122.15
ifcfg-eth0
DEVICE=eth0
BOOTPROTO=static
ONBOOT=yes
TYPE=Ethernet
IPADDR=10.111.222.2
NETMASK=255.255.255.0
GATEWAY=10.111.222.1
DNS1=10.111.222.253
DNS2=10.111.222.254
DOMAIN="halfface.se subdomain.halfface.se"

=imv=
Image viewer for wayland
imv . -f -s full

=ilo=
log in to ilo
env -u LANG ssh -v Ongame@10.1.1.94
restart ilo
reset map1
start system
start system1

=install=
Crete directory
install -d --mode=755 --owner=user --group=group /apps/IP/IPim/var/log
Create empty file
install -o 0664 -o user -g group /dev/null ${ALFRESCO_DIR}/logs/catalina.out
=inotifywathc=
Se what access /dev/random
inotifywatch -v -t 60 /dev/random

=inxi=
inventory report.
inxi -Frmxx
=iostat=
iostat -xtc 5
-x extended statistics.
-t print time for each report.
-c display the cpu utalization report.
-y Omit first report with statistics since the system boot
==iostat -xty 5 1 dm-3==
Linux 2.6.32-573.7.1.el6.x86_64 (machine.se) 12/30/2021 _x86_64_ (12 CPU)
12/30/2021 11:47:42 AM
avg-cpu: %user %nice %system %iowait %steal %idle
0.12 0.00 2.01 4.23 0.00 93.65
Device: rrqm/s wrqm/s r/s w/s rsec/s wsec/s avgrq-sz avgqu-sz await svctm %util
dm-3 0.00 0.00 5806.20 0.00 1485056.00 0.00 255.77 1.54 0.27 0.17 97.44

# Explained.
rrqm/s The number of read requests merged per second that were queued to the device.
wrqm/s The number of write requests merged per second that were queued to the device.
r/s The number of read requests that were issued to the device per second.
w/s The number of write requests that were issued to the device per second.
rsec/s The number of sectors read from the device per second.
wsec/s The number of sectors written to the device per second.
avgrq-sz The average size (in sectors) of the requests that were issued to the device.
avgqu-sz The average queue length of the requests that were issued to the device.
await The average time (in milliseconds) for I/O requests issued to the device to be served. This includes the time spent by the requests in queue and the time spent servicing them.
svctm The average service time (in milliseconds) for I/O requests that were issued to the device. Warning! Do not trust this field any more. This field will be removed in a future sysstat version.
%util Percentage of elapsed time during which I/O requests were issued to the device (bandwidth utilization for the device). Device saturation occurs when this value is close to 100%.

=iotop=
iotop with dates for output to logfile.
DATE=$(date '+%Y-%m-%d %H:%M:%S %Z') ; sudo iotop -kbon1 | head -2 | while read i ; do echo $DATE $i ; done

=ip=
==Add vlan 23==
ip link add link eno1 name eno1.23 type vlan id 23
==View vlan protocol==
ip -d link show eno1.23
==Configure vlan==
ip addr add 10.151.23.101/24 brd 10.151.23.255 dev eno1.23
ip link set dev eno1.23 up
==create default route==
ip route add default via 192.168.1.254
==show routing==
ip route show
more info
ip route show table all
==Add static route==
ip route add 10.10.20.0/24 via 192.168.50.100 dev eth0
==Remove static route.==
ip route del 10.10.20.0/24
==which outgoing interfaces are available.==
ip r l| awk '/src/{print $9}'
==Which route is used for ip.==
ip route get 192.168.122.252
==route subnet over interface.==
sudo ip route add 145.251.242.0/24 dev tun0
==Show ipaddress on interface tun0==
ip address show tun0
==vlan tag interface.==
ip link add link eth0 name eth0.8 type vlan id 8
==set ip on interface.==
ip addr add 192.168.50.5 dev eth1
ip addr add 192.168.50.5/24 dev eth1
==set secondary ip on interface==
ip addr add 192.168.1.2/24 dev eth0
==remove ip address.==
ip addr del 192.168.50.5/24 dev eth1
==enable interface==
ip link set eth1 up
==disable interface==
ip link set eth1 down
==list arp entries.==
ip neigh show
==local routing table==
ip route list table local
==rule base routing. List rules==
ip rule show
==show multicast networks==
ip maddr show
==Disable traffic to an ipaddress.==
ip route add blackhole 10.151.19.151
==dynamic/random mac wifi disable==
MAC=$(ip link show | grep link/ | grep -v 00:00:00:00:00:00 | awk '{print $2}') ; nmcli -f TYPE,NAME connection show | grep ^wifi | sed 's/^wifi *//g' | while read i ; do echo '*' $i ; nmcli connection modify "${i}" 802-11-wireless.cloned-mac-address $MAC ; done
==change mtu==
sudo ip link set dev ens3 mtu 1400
==network namespaces==
ip netns list

=ip2location=
ip2location -d /usr/share/IP2Location/IP2LOCATION-LITE-DB5.BIN -p $IP -e country_name,city_name,ip --format TAB
sed 's/ \+/\t/g' haproxy.log | cut -f 9 | sort -u | while read IP ; do ip2location -d /usr/share/IP2Location/IP2LOCATION-LITE-DB5.BIN -p $IP -e country_name,city_name,ip --format TAB | tail -n1 ; done | column_tab | sort
=ipcalc=
ipcalc -n 192.121.85.96/27 -m

=iperf=
start server on client A.
iperf -s
start measure from the other host. Limit bandwidth to 10k.
iperf -c 10.20.30.40 --bandwidth 10K
==Multicast test.==
On the listener side:
iperf -s -u -B 224.1.1.1 -i 1
On sender
iperf -c 224.1.1.1 -u -T 32 -t 3 -i 1

=ipmitool=
What is the power consumtion of dell server.
ipmitool -I lanplus -H 127.0.0.1 -U root -P calvin delloem powermonitor
ipmitool lan print
ipmitool sdr list

=iptables=
==Show iptables OUTPUT, PREROUTING and POSTROUTING==
iptables --table nat --list --exact --verbose --numeric --line-number
==Show config==
iptables -L -t nat -n
==Dnat to localhost.==
iptables -t nat -I PREROUTING --source 131.115.115.53 -p tcp --dport 22 -j REDIRECT --to-ports 222
iptables -t nat -I OUTPUT --source 131.115.115.53 --destination 127.0.0.1 -p tcp --dport 22 -j REDIRECT --to-ports 222
==Flush all rules.==

iptables -F
iptables -X
iptables -t nat -F
iptables -t nat -X
iptables -t mangle -F
iptables -t mangle -X
iptables -P INPUT ACCEPT
iptables -P FORWARD ACCEPT
iptables -P OUTPUT ACCEPT

==Block==
iptables -A OUTPUT -p tcp -d 131.115.248.82 --dport 8080 -j DROP
iptables -A OUTPUT -p tcp -d 131.115.248.82 --dport 8080 -j REJECT

==Block outgoing mail==
iptables -A OUTPUT -p tcp --dport 25 -o $INTERFACE -j REJECT

==Block all traffic except ssh in/out log to syslog.==
iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -P FORWARD DROP
iptables -A INPUT -m tcp -p tcp --dport 22 -j ACCEPT
iptables -A INPUT -m tcp -p tcp --sport 22 -j ACCEPT
iptables -A INPUT -m state --state NEW -m tcp -p tcp -j LOG --log-level info --log-prefix "dropped-in"
iptables -A OUTPUT -m tcp -p tcp --dport 22 -j ACCEPT
iptables -A OUTPUT -m tcp -p tcp --sport 22 -j ACCEPT
iptables -A OUTPUT -m state --state NEW -m tcp -p tcp -j LOG --log-level info --log-prefix "dropped-out"

==Block traffic on certain port.==
iptables -A INPUT -p tcp --dport 7009 -j REJECT
==Fake source==
iptables -t nat -A POSTROUTING -d "${DST}" -p udp --dport 162 -j SNAT --to "${SRC}" &>/dev/null
# Remove the current rules
iptables -t nat -D POSTROUTING -d "${DST}" -p udp --dport 162 -j SNAT --to "${SRC}"
==redirect ip==
Send traffic destined for one ip and port to another ip and port.
iptables -t nat -A OUTPUT -p tcp -d 146.213.6.7 --dport 1023 -j DNAT --to-destination 10.199.150.111:1023
iptables -t nat -A OUTPUT -p icmp -d 146.213.6.7 -j DNAT --to-destination 10.199.150.111
==allow trafic from subnet==
iptables -A INPUT -s 172.16.27.0/24 -j ACCEPT
==allow ssh from all==
iptables -A INPUT -p tcp -dport 22 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p tcp -dport 22 -m conntrack --ctstate ESTABLISHED -j ACCEPT
or
-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 22 -j ACCEPT
==find which rule is blocking by removing one at a time. Better way is to enable logging==
iptables -L -n --line-numbers
iptables -D <line-number>
==List rules from OUTPUT chain with line number==
iptables -t filter -L OUTPUT --line-numbers -n

==Add rule to specific row number==
iptables -I OUTPUT $ROW_NUMBER -d 54.72.175.186/32 -p tcp -m tcp --dport 443 -j ACCEPT

=irc=
Close private messages
/window close
Close public messages
/window close
Close a query
/q
=jmtpfs=
Mount disk
jmtpfs /mnt/mtp
Umount disk
fusermount -u /mnt/mtp

=john=
Test performance
john -test
Recover passwords with password list.
john -wordlist:password.lst passfile.txt
=journalctl=
==View log from last day.==
journalctl --since yesterday
==List all units.==
systemctl list-unit-files
==Current disk usage.==
journalctl --disk-usage
==Show only certain error level. (err crit)==
journalctl -p err
==List boots==
journalctl --list-boots
==Show events between two time stamps.==
journalctl --since "2017-01-23 05:56:42" --until "2017-01-23 07:56:42"
==show entries for one unit.==
journalctl -u openvpn-server@server
journalctl -u sshd -f
==iptables logs==
journalctl -k -f | grep -i iptables
==wipe logs==
journalctl --vacuum-time=1h
==compare two different boots==
journalctl --since "$(date '+%F %H:%M:%S' --date '-10 hour')" -u NetworkManager -b -1 -o cat | sed 's/\[[0-9.]*\]//g'

==persistent logging==
Enable persistent logging in systemd-journald. grep journal /usr/lib/tmpfiles.d/systemd.conf. Install syslog instead.
mkdir /var/log/journal
chmod 2755 /var/log/journal
chown root:systemd-journal /var/log/journal
killall -USR1 systemd-journald

=jpegtran=
# to lossless cut a file.
jpegtran -crop 700x400+2150+1500 2012-05-19_20-39-35.jpg > /photos/Sweden/2012/2012-05-19/2012-05-19_20-39-35.jpg
# Rotate counter clockwise.
jpegtran -copy all -rotate 270 2012-08-18_15-06-43.jpg > 2012-08-18_15-06-43_270.jpg
=kdump=
Change action to dump memory.
/etc/kdump.conf
core_collector true
Reload config.
systemctl restart kdump
=keepass=
Create database
printf '%s\n' 'P@55Word'{,} | keepassxc-cli db-create -p -q keepassxc_abjorklund.kdbx
Add entry to database.
keepassxc-cli add keepassxc_abjorklund.kdbx abjorklund
Copy password from password entry
keepassxc-cli clip keepassxc_abjorklund.kdbx abjorklund

=keyboard=
keymaps
dumpkeys
loadkeys sv-latin1
loadkeys us
setxkbmap en
setxkbmap -layout se -variant nodeadkeys
reset corrupt keyboard after using vmware.
setxkbmap

=kill=
suspend/resume a jobb.
# kill -STOP PID
# kill -CONT PID
=kpartx=
# Create device files from disk image.
sudo kpartx -av disk_image.raw
# Remove device files.
sudo kpartx -d disk_image.raw

=lastb=
Show failed ssh logins.
lastb
=less=
Toggle line wrap
- -> S
tail with less. CTRL + c = scroll around. SHIFT + f = to tail again.
less +F -B /tmp/tmp
=lftp=
lftp -u <user>,<password> <ftp_server>
With proxy.
lftp -e "set ftp:proxy http://<url>:3128 ; set ssl:verify-certificate no; open -u user,password ftp://ftp.example.se/"
Workaround.
lftp -e 'set ftp:use-feat false; set ftp:ssl-allow false' -u user,passwor ftp.example.se
Run commands from cli.
lftp -u '<user>,<password>' -e 'set ssl:verify-certificate no ; ls -la ; quit' <ftp_server>

=ln=
Create link even if it exists.
ln -sfT /destination link

=locale=
To show 24 hour format.
LC_ALL=C
=localectl=
Change keyboard.
localectl list-keymaps
localectl set-keymap se-nodeadkeys
localectl set-x11-keymap se-nodeadkeys

=lock=
locking keyboard under linux.
lock-keyboard-for-baby
=logging=
bash create log.
#!/bin/bash
exec > /logfile
alternative
exec 2>/tmp/log
Read logs on system.
tail -f $(lsof | grep log$ |awk '{ print $NF }' | sort -u |xargs)
=logrotate=
Test dry run logrotate file. -d=debug -f=force
logrotate -d -f /etc/logrotate.conf
Force logrotate in verbose mode.
logrotate -v -f /etc/logrotate.conf
Create logrotate config entry.
# Configure log rotation.
cat << EOF > /etc/logrotate.d/ipmonperfj_cleanupdaemon
/directory/logs/cleanupdaemon.log {
copytruncate
size 100M
rotate 60
compress
missingok
olddir old
}
EOF
Disable logrotate. Look for file extension to ignore.
man logrotate.conf, you can read find tabooext
Ex. mv /etc/logrotate.d/mysql{,.rpmsave}

=losetup=
Create loopback devices for partitions in image. Force the kernel to scan the partition table on a newly created loop device
losetup -P /dev/loop2 harddrive.img
Set up next available device read only.
losetup -f -r /temp/rb-slog05/sda6
Show all
losetup -a
detatach
losetup -d /dev/loop2

=ls=
ls -la --time-style="+%Y-%m-%d %H:%M:%S" *.3gp
List processes in epoch date
( cd /proc; ls -rtd --full-time --time-style=+%s [0123456789]*; )
=lsblk=
lsblk -d -o NAME,ROTA,MODEL
=lshw=
==List memory modules==
lshw -C memory

==Is cpu 32 or 64bit.==
lshw -class processor

=lsof=
List recurivly all process that have a path open.
lsof +D /apps/
which ports has a process opened?
lsof -Pan -p 13354 -i
=lspci=
List devices without drivers.
lspci -nnk

=which process listen to port=
lsof -i :443

=mail=
command line mail with changed from
echo message$(date +%F_%H-%M-%S) | mail -s Subject$(date +%F_%H-%M-%S) -r from@inter.net reciever@inter.net
command line mail with changed from with attachment
echo message | mail -s Subject -r from@inter.net -a /attach.ment reciever@inter.net
Change default sender.
# ~/.mailrc
# From address for mailx.
set from="root degn.redbridge.se <abjorklund@redbridge.se>"
set replyto="root degn.redbridge.se <abjorklund@redbridge.se>"

=man=
man correct caracters.
LANG=C man passwd

man clean for output to file.
man [manual] | col -b > file.txt
Read from section 5
man man.5

=mbr=
backup mbr.
# dd if=/dev/sdX of=/temp/sdx-mbr bs=512 count=1

restore mbr
# dd if=/temp/sdx-mbr of=/dev/sdX bs=446 count=1
=mdadm=
Add disk that was lost
mdadm /dev/md125 -a /dev/vda1

=minimodem=
Transmit file via audio.
minimodem -t 200
Recieve file via audio
minimodem -r 200

=mkfs=
Create fat32 file system.
dd if=/dev/zero of=/tmp/sdb bs=32M status=progress conv=fdatasync count=10
fdisk /tmp/sdb
n
<accept all defaults>
t
b
p
w
mkfs.vfat -F 32 -n MYDRIVE /tmp/sdb1
==mkfs.ext4==
Create ext4 filesystem. Overwrite. Label and root reserved to 0.
mkfs.ext4 -F -L looted_storage -m 0 /dev/sda1

=mkpasswd=
Create a password hash
echo password | mkpasswd -m sha-512 -s

=mogrify=
Resize, crop... a file. Removes original.
mogrify -resize 800 *.jpg
=mokutil(secure boot/secureboot=
mokutil --sb-state

=mount=
Mount a temporary ram partition
mount -t tmpfs tmpfs /mnt -o size=1024
Mount a cifs filesystem and change owner on mountpoint.
mount.cifs -o credentials=/home/user/cifs.credentials,gid=1004,uid=1004 //server/c$ /mnt/cifs
Disallow normal user to ps. If not belonging to gid 1001.
*/etc/fstab
proc /proc proc defaults,hidepid=2,gid=1001 0 0

=movgrab=
List available formats
movgrab -T http://youtu.be/ucivXRBrP_0
Get version listed.
movgrab -f mp4:1920x1080 http://www.youtube.com/v/ucivXRBrP_0

=mplayer=
mplayer in ascii mode.
mplayer -monitoraspect 4:3 -vo aa LinaFreestyler.avi
mplayer -vo aa -monitorpixelaspect 0.5 *.mp4
mplayer on second soundcard.
mplayer -ao oss:/dev/dsp *.mp3
mplayer -ao alsa:device=hw=0.0 *.mp3
Or, to specify a non-default (secondary) device either of the following commands can be used.
mplayer -ao oss:/dev/dsp1 *.mp3
mplayer -ao alsa:device=hw=1.0 *.mp3
play from v4l
mplayer -tv device=/dev/video:driver=v4l:input=1:width=640:height=480:norm=ntsc:adevice=/dev/dsp tv://1 -zoom -aspect 4:3
mplayer -fps 15 tv:// -tv driver=v4l2:width=640:height=480:device=/dev/video0play hdv material.
mplayer -monitoraspect 16:9 -vf pp=lb
play dvd image.
mplayer dvd://1 -dvd-device DVD.iso
play h264 webcam
mplayer -fps 24 tv:// -tv driver=v4l2:width=1920:height=1080:device=/dev/video0:outfmt=0x34363248 -aspect 16:10 -fs
play mjpeg webcam
mplayer -fps 24 tv:// -tv driver=v4l2:outfmt=mjpeg:width=1920:height=1080:device=/dev/video0 -aspect 16:10 -fs
play mp3 in different speed keep pitch.
mplayer -speed 1.5 -af scaletempo /mp3/music.mp3
# list chapters.
mplayer dvd://1 -dvd-device /dev/sr0 -identify -novideo -nosound
# dump chapters.
mplayer -dvd-device /dev/sr0 dvd://3 -dumpstream -dumpfile 3.vob

=MP4Box=
Combine mp4 files
MP4Box -add file1.mp4 -add file2.mp4 output.mp4
=mpv=
Video player. Enable hardware accelleration.
# Install packages.
dnf install intel-media-driver libva libva-utils gstreamer1-vaapi ffmpeg intel-gpu-tools mesa-dri-drivers mpv
# Top for intel gpu
sudo intel_gpu_top
# Enable hardware accelleration for mpv.
CONFIG_FILE=~/.config/mpv/mpv.conf ; if ! grep -q ^hwdec=auto ${CONFIG_FILE} ; then echo hwdec=auto ${CONFIG_FILE} ; fi
# Create new initramfs
sudo dracut --force
# Look at browser.
chrome://gpu/

=mpstat=
top like output of system usage
mpstat 5 5

=mtr=
ping and traceroute combined.
mtr -rc 10 8.8.8.8

=mutt=
Put the followin in .muttrc to change From.
set realname="Joe User"
set from="user@host"
set use_from=yes
command line mail with attachment
mutt -s subject -a syslogs.tar.gz admin@domain.org < /dev/null
Change sender from command line.
export EMAIL=address@inter.net && mutt -s "Subject Test" anden@halfface.se < /dev/null
echo "Test message" | mutt -s "Subject test" -e "set realname=\"Real Name\"" -e "set from=\"anden@halfface.se\"" -e "set use_from=yes" anden@halfface.se
Change envolope from
export REPLYTO=email@inter.net
export EMAIL=email@inter.net
echo "email@inter.net testing" | mutt -e "set envelope_from=yes" email@inter.net -a /tmp/attachment
oneliner
export EMAIL=email@inter.net;export REPLYTO="${EMAIL}";echo "email@inter.net testing" | mutt -e "set envelope_from=yes" email@inter.net -a /tmp/attachment
export EMAIL=email@inter.net;export REPLYTO="${EMAIL}";echo "${EMAIL} testing on ${HOSTNAME}" | mutt -e "set envelope_from=yes" -s "${EMAIL} testing on ${HOSTNAME}" "${EMAIL}"
Dont trigger out of Out Of Office reply.
echo "email@inter.net testing" | mutt -e "unignore list-id" email@inter.net
=multilog=
split standard output to logfiles. In this case keep specific size. t means to prepend a TAI timestamp on each line. 10000B. 5 logfiles. tai64nlocal program simply reads stdin and replaces TAI timestamps with human-readable ones. http://blog.teksol.info/pages/daemontools/best-practices. Compress rotated logfiles.
mkdir /tmp/myapp ; ./myapp | multilog t s10000 n5 '!tai64nlocal' '!gzip' /tmp/myapp 2>&1

=nc (netcat)=
==Check communication.==
listen on port 3333.
nc -kl 3333
talk to port 3333.
nc 192.168.0.1 3333

==Transfer data==
Cat file, calculate size listen on port 3333.
cat backup.iso | pv -b | nc -l 3333
Receive file.
nc 192.168.0.1 3333 | pv -b > backup.iso

==Setup telnet server==
nc -L -l -p1234 -d -e cmd.exe

==Test connection.==
nc -w2 -znv 10.1.22.31 7222

==tunnel==
On the server, we open a listener on the TCP port 6667 which will forward data to UDP port 53 of a specified IP. If you want to do DNS forwarding like me, you can take the first nameserver's IP you will find in /etc/resolv.conf - in this example, this is 192.168.1.1. But first, we need to create a fifo. The fifo is necessary to have two-way communication between the two channels. A simple shell pipe would only communicate left process' standard output to right process' standard input.

mkfifo /tmp/fifo
nc -l -p 6667 < /tmp/fifo | nc -u 192.168.1.1 53 > /tmp/fifo

==Dont eat up standard output.==
nc -v --send-only --recv-only localhost 22

==Talk to pop3 server over ssl.==
nc --ssl mail.tele2.se 995
==Talk to pop server==
nc -C mail.tele2.se 25

==Talk to web server==
URL_SSL=halfface.se ; echo -e "HEAD / HTTP/1.1\nHost: ${URL_SSL}\n\n" | nc --ssl ${URL_SSL} 443
echo -e 'GET /users/password/new HTTP/1.1\r\nHost: localhost\r\nConnection: Close\r\n\r\n' | nc localhost 80 | head
To overcome problems with nc closing connection too fast.
(echo -en 'GET / HTTP/1.1\r\nHost: 172.30.156.15\r\nConnection: close\r\n\r\n'; sleep .1) | nc 172.30.156.15 80 | head -30
nc --no-shutdown -v 172.30.156.15 80 <<<$(echo -en 'GET / HTTP/1.1\r\nHost: 172.30.156.15\r\nConnection: close\r\n\r\n')

=ncdu=
disk usage. Stay in one filesystem.
ncdu -x /
=net=
Start service via samba.
net rpc service start ipremote -I 172.17.255.99 -U 'domain/user%password'

=netstat=
Look at network connections. tcp/ip4.
netstat -4anpt
Look at multicast groups
netstat -g
What does it mean?=
ESTABLISHED
The socket has an established connection.
SYN_SENT
The socket is actively attempting to establish a connection.
SYN_RECV
A connection request has been received from the network.
FIN_WAIT1
The socket is closed, and the connection is shutting down.
FIN_WAIT2
Connection is closed, and the socket is waiting for a shutdown
from the remote end.
TIME_WAIT
The socket is waiting after close to handle packets still in the
network.
CLOSE The socket is not being used.
CLOSE_WAIT
The remote end has shut down, waiting for the socket to close.
LAST_ACK
The remote end has shut down, and the socket is closed. Waiting
for acknowledgement.
LISTEN The socket is listening for incoming connections. Such sockets
are not included in the output unless you specify the
--listening (-l) or --all (-a) option.
CLOSING
Both sockets are shut down but we still don't have all our data
sent.
UNKNOWN
The state of the socket is unknown.
==statistics==
netstat -s
netstat -s | retransmit

=nft=
nftables list config
nft -j list ruleset | jq .
=nmap=
Scan for open ssh ports.
nmap -p 22 --open -sV 10.0.0.*
nmap -p 22 -sV --open -oG - $(ip -4 a s $(ip route show default | awk '{print $5}') | grep inet | awk '{print $2}') | awk '/\/open\// {print $2,$3}'
Syn scan.
nmap -P0 -sS -p1023 www.halfface.se
Ping scan. Do not resolve.
nmap -sn -n 10.127.254.1-254
Which ciphers are allowed.
nmap --script ssl-enum-ciphers -p 465 www.halfface.se
arp scan.
nmap -PR 192.168.0.0/24
which kex_algorithms server_host_key_algorithms encryption_algorithms compression_algorithms
nmap --script ssh2-enum-algos -sV -p 22 ssh.server.inter.net
Which manufacturer.
nmap -sn 10.111.222.0/24

=nmcli=
==List connections==
nmcli con
==rename connection==
nmcli connection modify <old_name> con-name <new_name>

==manage network from cli==
http://fedoraproject.org/wiki/Networking/CLI
==Connect to a configured connection by name==
nmcli connection up WireLess
==Disconnection by name==
nmcli connection down Wireless
==Connect to remembered network.==
nmcli con up '[-_-] halfface 5'
==List available wireless networks.==
nmcli device wifi list
==Generate list of available wireless networks.==
nmcli device wifi rescan
sudo nmcli device wifi list --rescan yes

==Create connection for wireless network.==
nmcli device wifi connect Bredband password P4ssM0rd
==Connect to specific bssid==
nmcli connection modify MyWifiConnection 802-11-wireless.bssid 00:11:22:33:44:55

==List networks on specific interface.==
nmcli device wifi list ifname wlp0s18f2u4
==Disconnect network interface.==
nmcli device disconnect wlp0s18f2u4
==Manually setup interface.==
nmcli con add con-name "static-ens32" ifname ens32 type ethernet ip4 xxx.xxx.120.44/24 gw4 xxx.xxx.120.1
nmcli con mod "static-ens32" ipv4.dns "xxx.xxx.120.1,8.8.8.8"
nmcli con up "static-ens32" iface ens32
==list devices.==
nmcli device status
==list connections.==
nmcli connection show
==delete connection==
nmcli con delete "Wired connection 1"
==add connection with static ip.==
nmcli con add con-name ens224 ifname ens224 type ethernet ip4 172.30.109.16/24
==show properties for connection==
nmcli dev show ens224
==set dns server==
nmcli connection modify enp1s0 ipv4.dns "10.111.222.2,8.8.8.8"
==edit==
nmcli con edit $connection
print all
==autostart==
nmcli connection modify IFNAME connection.autoconnect yes|no
==dhcp option==
ip -4 addr show | grep -Ev "127.0.0.1|LOOPBACK" | awk '/^[0-9]+:/ {sub(/:/,"",$2); print $2}' | sort -u | while read NIC ; do echo '*' $NIC ; nmcli -f DHCP4 device show $NIC ; done

==Make network a bridge interface==
sudo nmcli con add ifname br0 type bridge con-name br0
sudo nmcli con add type bridge-slave ifname <network_card> master br0
sudo nmcli con modify br0 bridge.stp no
sudo nmcli con down "Wired connection 1"
sudo nmcli con up br0
==modify(change) vlan id==
nmcli connection modify <connection_name> vlan.id <new_id>

=nohup=
Start binary under nohup and tail log.
nohup ./run.sh & sleep 1 ; tail -1000f nohup.out
Start process and log to specified file.
nohup daemon > /path/daemon.log &

=nping=
nping -c 1 --tcp -p 80 www.halfface.se

=nth=
Name That Hash
nth --text '$y$j9T$jogs61gwDHB6L1oEwHeR00$L4cfYqkxKzS8dtkC5hPXFRMOIcEl6q5VKIkngrRGFM0'
=ntfs-3g=
mount ntfs filesystem. read and write.
yum install fuse fuse-libs ntfs-3g
mount /dev/sda1 /media/c_drive -t ntfs-3g -r -o umask=0222,locale=en_US
mount /dev/sda1 /media/c_drive -t ntfs-3g -rw -o umask=0000,locale=en_US
fstab read and write.
/dev/sda3 /media/e_drive ntfs-3g ro,defaults,umask=0222 0 0
/dev/sda1 /media/c_drive ntfs-3g rw,defaults,umask=0000 0 0
Create ntfs partition.
fdisk 7/gdisk 0700
mkfs.ntfs /dev/sdx1 -Q

=numbers=
series of numbers
bash:
echo {1..10}
=numfmt=
iec=accept optional single letter suffix. No output suffix. Remove B from input. change format of output, mb ,gb and so on.
numfmt --from=iec --to=none --suffix=B 8.7KB

=nwipe (dban)=
Wipe your disk
nwipe --nogui --nowait --autonuke /dev/sdb

=omping=
multicast ping
omping -c10 10.111.222.118 10.111.222.121
=openvpn3=
==Install openvpn fedora 38+ /etc/yum.repos.d/_copr\:copr.fedorainfracloud.org\:dsommers\:openvpn3-devsnapshots.repo==
[copr:copr.fedorainfracloud.org:dsommers:openvpn3-devsnapshots]
name=Copr repo for openvpn3-devsnapshots owned by dsommers
baseurl=https://download.copr.fedorainfracloud.org/results/dsommers/openvpn3-devsnapshots/fedora-$releasever-$basearch/
type=rpm-md
skip_if_unavailable=True
gpgcheck=1
gpgkey=https://download.copr.fedorainfracloud.org/results/dsommers/openvpn3-devsnapshots/pubkey.gpg
repo_gpgcheck=0
enabled=1
enabled_metadata=1
==Install package from above.==
dnf install openvpn3-client
==Add configuration==
OPENVPN_CONFIG=<name> ; openvpn3 config-import --name "$OPENVPN_CONFIG" --persistent --config "$OPENVPN_CONFIG".ovpn
==List configs==
openvpn3 configs-list
openvpn3 configs-list --verbose

==Remove config==
openvpn3 config-remove --config <config-name>
==show full config==
openvpn3 config-dump --config <config-name>

==Connect==
openvpn3 session-start --config <config-name>
==Disconnect==
openvpn3 session-manage --config <config-name> --disconnect
==Connect to the log with debug enabled. This can be run in a different terminal window after the connection has been started.==
openvpn3 log --config <config-name> --log-level 6
==Show active sessions==
openvpn3 sessions-list
==Show statistics for an active session==
openvpn3 session-stats --config <config-name>
==Show configuration settings==
openvpn3 config-manage --config <config-name> --show
==sessions disconnect==
openvpn3 sessions-list | grep Path | awk '{print $2}' | while read OPENVPN_PATH ; do echo $OPENVPN_PATH ; openvpn3 session-manage --session-path $OPENVPN_PATH --disconnect ; done
==View config files==
sudo find /var/lib/openvpn3/configs/ -type f

=openssl=
==Grab the public key.==
openssl s_client -connect www.halfface.se:443 </dev/null 2>/dev/null | sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p'
==What does the ssl cert look like.==
HOST=www.halfface.se ; PORT=443 ; echo | openssl s_client -connect ${HOST}:${PORT} -servername ${HOST}| openssl x509 -ext subjectAltName -noout -startdate -enddate -subject -issuer -nameopt RFC2253,sep_comma_plus_space

==What does crl look like. (Certificate Revocation List)==
openssl crl -inform PEM -text -noout -in crl.pem

==Connect to ssl server==
echo hello | openssl s_client -connect www.halfface.se:8140
==Connect to ssl server -cipher NULL,LOW==
echo hello | openssl s_client -connect www.halfface.se:8140
==Connect with openssl v3==
openssl s_client -ssl3 -connect ipmon01.dupont:443
==Connect with low security cipher==
echo X | openssl s_client -cipher NULL,LOW -connect www.halfface.se:8140
==PEM convert to DER==
openssl x509 -inform PEM -in /file.pem -outform DER file.der
==p12 to cer==
openssl pkcs12 -in infile.p12 -out outfile.cer -nodes
Export public
openssl pkcs12 -in path.p12 -out newfile.crt.pem -clcerts -nokeys -passin pass:<password>
export CERT=<cert>.p12 ; export PASS=<pass> ; openssl pkcs12 -in $CERT -out ${CERT}.pem -clcerts -nokeys -passin pass:${PASS}
Export private
openssl pkcs12 -in path.p12 -out newfile.key.pem -nocerts -nodes -passin pass:<password>
export CERT=<cert>.p12 ; export PASS=<pass> ; openssl pkcs12 -in $CERT -out ${CERT}.key -clcerts -nodes -passin pass:${PASS}
==p7b to pem==
openssl pkcs7 -print_certs -in <certificate>.p7b -out certificate.pem
==pem to p12==
Using file containing private, public and chain.
openssl pkcs12 -export -in sulzer.pem -out sulzer.p12 -passout pass:

==pfx to pem==
env FILE="<file>" PASSWORD="<password>" bash -c 'openssl pkcs12 -in "$FILE" -out "${FILE//\//_}.pem" -nodes -password pass:"$PASSWORD"'
Complete file.
openssl pkcs12 -in filename.pfx -out cert.pem -nodes
Get private cert. Then remove password. Decrypt
openssl pkcs12 -in filename.pfx -nocerts -out key.pem
openssl rsa -in key.pem -out server.key
Get public cert.
openssl pkcs12 -in filename.pfx -clcerts -nokeys -out cert.pem

==Extract p12 password protected keys in==
openssl pkcs12 -in /file.p12 -passin file:/password -nokey -nodes -out /file.nokeys
openssl pkcs12 -info -in </path/to/file.pfx> -passin pass:<pfx's password>

==Encrypt file==
openssl aes-256-cbc -a -salt -in file -out file,encoded -passin file:passfile
==Decrypte file==
openssl aes-256-cbc -d -a -salt -in file -out file,encoded -passin file:passfile
==Install new root ca==
# Change to the directory:
cd /etc/pki/tls/certs
# Next download the College root certificate:
wget https://icca2.ic.ac.uk/certenroll/ic-root.crt
# Convert the certificate to PEM format:
openssl x509 -inform der -in ic-root.crt -out ic-root.pem
# Create a link with the certificate hash:
ln -s ic-root.pem `openssl x509 -hash -noout -in ic-root.pem`.0
# Create sha256 base64 encoded hash
openssl dgst -binary -sha256 | openssl base64
# Verify root ca.
openssl verify -CApath /etc/pki/tls/certs ic-inter-root.pem
icrootca.cer: OK
The server certificate is the first certificate returned, and will be PEM formatted. The CA certificate is the final certificate returned, and is also PEM formatted.
openssl': echo | openssl s_client -connect www.sslsite.com:443 -showcerts
Check ca store files.
find . -name '*.pem' | while read PEM ; do echo '###' ${PEM} '###';ls -la "${PEM}" ; set -x ; curl --cacert "${PEM}" https://site.test.net/index.htm.
==Verify pop3 connectivity.==
openssl s_client -crlf -connect mail.tele2.se:110 -starttls pop3
USER yiming
PASS foobar
LIST – lists the messages available in the user’s account, returning a status message and list with each row containing a message number and the size of that message in bytes
STAT – returns a status message, the number of messages in the mailbox, and the size of the mailbox in bytes
RETR [message_num] – returns the message identified by the message number, which is the same as the message number shown in the LIST command output
TOP [message_num] [n] – returns the top n lines of the message denoted by message number.
QUIT command will end the session.
==Create wildcard self signed certificate.==
openssl req -x509 -nodes -days 3650 -newkey rsa:2048 -keyout wildcard.test.internal.zone.key -out wildcard.test.internal.zone.crt
Common Name (eg, your name or your server's hostname) []:*.test.internal.zone
==Verify certificate chain==
openssl verify -CAfile Thawte_Primary_Root_CA.pem -untrusted thawte_SSL_CA_G2.cer www.halfface.se.pem
Look at certificate chain.
openssl s_client -connect www.halfface.se:443
CONNECTED(00000003)
depth=2 O = Digital Signature Trust Co., CN = DST Root CA X3
verify return:1
depth=1 C = US, O = Let's Encrypt, CN = Let's Encrypt Authority X3
verify return:1
depth=0 CN = www.halfface.se
verify return:1
---
Certificate chain
0 s:CN = www.halfface.se
i:C = US, O = Let's Encrypt, CN = Let's Encrypt Authority X3
1 s:C = US, O = Let's Encrypt, CN = Let's Encrypt Authority X3
i:O = Digital Signature Trust Co., CN = DST Root CA X3
---
Verify chain.
openssl s_client -showcerts -verify 5 -connect www.halfface.se:443 < /dev/null 2>&1

==Connect to smtp server via ssl.==
openssl s_client -crlf -ign_eof -connect www.halfface.se:25 -starttls smtp -quiet
EHLO halfface.se
AUTH LOGIN
$(echo -n "username" | base64)
$(echo -n "password" | base64)
MAIL FROM:anden@halfface.se
RCPT TO:<anden@halfface.se>
DATA
Subject: Test from cli.

This is a test email.
.
QUIT

==Connect to imap==
openssl s_client -crlf -connect www.halfface.se:993
openssl s_client -showcerts -connect www.halfface.se:143 -starttls imap
Login
tag login abjorklund ${PASSWORD}
List mailboxes
tag LIST "" "*"
Log out
tag LOGOUT

==compare two certifactes==
Compare the use case for the certificate.
sdiff <(openssl x509 -in server.crt -noout -issuer -subject -enddate -purpose) <(openssl x509 -in uc_activemq.crt -noout -issuer -subject -enddate -purpose)| less
==create a csr==
openssl req -new -sha256 -nodes -out www.halfface.se.csr -newkey rsa:2048 -keyout www.halfface.se.key -config <(
cat <<-EOF
[req]
default_bits = 2048
prompt = no
default_md = sha256
req_extensions = req_ext
distinguished_name = dn
[ dn ]
O=Organisation: halfface
C=SE
ST=Stockholm
L=Stockholm
CN = www.halfface.se
[ req_ext ]
subjectAltName = @alt_names
[ alt_names ]
DNS.1 = halfface.se
DNS.2 = ldap.halfface.se
DNS.3 = mqtt.halfface.se
EOF
)

==csr information==
openssl req -noout -text -in file.csr | grep -vE ' [0-9A-Fa-f]{2}:[0-9A-Fa-f]{2}:'

==look at content of private key==
openssl rsa -text -noout -in key.pem

==confirm that public private and csr match==
# For your SSL certificate:
CERT_PUBLIC=$(ls *.crt)
echo $(openssl x509 -noout -modulus -in "${CERT_PUBLIC}" | openssl md5 | awk '{print $2}'),"${CERT_PUBLIC}",public cert.
# For your RSA private key:
CERT_PRIVATE=$(ls *.key)
echo $(openssl rsa -noout -modulus -in "${CERT_PRIVATE}" | openssl md5 | awk '{print $2}'),"${CERT_PRIVATE}",private key
# For your CSR:
CERT_CSR=$(ls *.csr)
echo $(openssl req -noout -modulus -in "${CERT_CSR}" | openssl md5 | awk '{print $2}'),"${CERT_CSR}",certificate signing request

==connect with ca private and public key==
openssl s_client -CAfile ca.pem -cert public.crt -key private.key -connect 10.12.118.184:1023 -tls1_2
==create a ca==
===Create ca and certificates.===
# Create folder structure.
mkdir /root/ca/
mkdir /root/ca/certs/
mkdir /root/ca/crl/
mkdir /root/ca/newcerts/
mkdir /root/ca/private/
mkdir /root/ca/requests/
touch /root/ca/index.txt
echo 1000 > /root/ca/serial
chmod 600 /root/ca
# Create private key for the CA certificate. pass phrase: $(pwgen 15)
cd /root/ca/
openssl genrsa -aes256 -out private/cakey.pem 4096
# Create a public certificate for the CA.
openssl req -new -x509 -key /root/ca/private/cakey.pem -out cacert.pem -days 36525

Country Name (2 letter code) [AU]:SE
State or Province Name (full name) [Some-State]:Stockholm
Locality Name (eg, city) []:Stockholm
Organization Name (eg, company) [Internet Widgits Pty Ltd]:Company
Organizational Unit Name (eg, section) []:Company
Common Name (e.g. server FQDN or YOUR name) []:Certificate Authority
Email Address []:anden@halfface.se

# Copy system openssl.cnf to /root/ca dir. Then change dir in config.
vim openssl.cnf
[ CA_default ]
dir = /root/ca # Where everything is kept

===Create signed certificate keypair===
cd requests/
# Create csr
openssl req -new -newkey rsa:2048 -nodes -keyout <client>.key -out <client>.csr -config ../openssl.cnf
# Issue certificate for csr.
openssl ca -in <client>.csr -out <client>.crt -config ../openssl.cnf -days 36525

==talk http via openssl==
openssl s_client -crlf -quiet -connect www.halfface.se:443 <<EOF
GET / HTTP/2.0
Host: www.halfface.se

EOF

==look at cert==
openssl asn1parse -in rb-ca.crt.2021-02-28
==performance testing==
openssl speed -evp aes-256-ecb
==confirm that ca is correct==
echo | openssl s_client -CAfile Sectigo_RSA_Domain_Validation_Secure_Server_CA.pem -no-CAfile -no-CApath -tls1_2 -connect 172.30.32.141:5044 2>&1 | grep Verification
Verification: OK
==openssl s_server==
Setup server listening as http server.
openssl s_server -status_verbose -HTTP -cert host.inter.net.crt -key host.inter.net.key
Setup https server listening on https on port 4433 providing complete chain
openssl s_server -status_verbose -HTTP -cert halfface.se.pem -cert_chain halfface.se.intermediate.pem -key halfface.se.key -accept 4433

==othername:<unsupported>==
You will have to locate the "OCTET STRING" line just below the "OBJECT :X509v3 Subject Alternative Name" line then strpars
# print section offset via
openssl asn1parse -in yourcert.pem
# parse otherName from "OCTET STRING" <offset> is the value in the beginning of the line.
openssl asn1parse -in yourcert.pem -strparse <offset>
Another way of seeing same data is through
openssl asn1parse -in /tmp/tmp -dump -strictpem

=create password string=
openssl passwd -6 -salt $RANDOM $PASSWORD

=pactl=
Pulse Audio cli tool.
List output devices.
pactl list short sinks
Set default output device
pactl set-default-sink $i
List where applications send output.
pactl list short sink-inputs
Move application to other output device.
pactl move-sink-input $applicaiton $sink

=pam=
Troubleshooting pam.
/etc/syslog.conf
# Get debugging data.
*.debug /var/log/debug.log
Create logfile and restart *syslog.
touch /var/log/debug.log
service syslog restart
Put pam in debug mode.
touch /etc/pam_debug
OR you can enable debugging only for the modules you're interested in by adding "debug" to the end of the relevant lines in /etc/pam.d/system-auth or the other /etc/pam.d/* files:
login auth required pam_unix.so debug
Debugging is found in /var/log/debug.log.

=pam_tally2=
Configured here.
/etc/pam.d/password-auth:auth required pam_tally2.so file=/var/log/tallylog onerr=fail per_user deny=6 no_magic_root
What is status from account?
pam_tally2 --user=user1
Login Failures Latest failure From
user1 8 04/20/15 11:39:54 192.168.1.1

=parallel=
Run command 10 times in parallel.
seq 10 | parallel -n0 echo "Hello, World"
Run command 10 times in parallel dryrun.
seq 10 | parallel --dry-run -n0 echo "Hello, World"
Compress logfiles in parallel.
parallel gzip ::: *.log
=partprobe=
Rescan block device to setup device files
partprobe /dev/sde
=partx=
partx /dev/sda -l ; partx /dev/sda -u ; partx /dev/sda -l

=paste=
Combine to files to one in multiple column. Replace tab with spaces.
paste /tmp/check_name_nagios /tmp/filename | column -t -s $'\t'
Combine every second line with a space in between.
paste -d' ' - -

=pcregrep=
Multiline grep
pcregrep -M 'pattern: line1\nPattern lin2' /temp/files_*
=pdftotext=
grab text from pdf document.
pdftotext document.pdf
=pdftk=
Rotate clockwise
PDF=<file.pdf> ; pdftk "${PDF}" cat 1-endwest output "${PDF}".rotate
Rotate counter clockwise
PDF=<file.pdf> ; pdftk "${PDF}" cat 1-endeast output "${PDF}".rotate
Create one pdf from others.
pdftk <file.pdf>* cat output <file_combo.pdf>
Extract one page from pdf.
pdftk input.pdf cat 11 output page11.pdf
Extract series of pages from pdf
pdftk input.pdf cat 3-7 output pages_3-7.pdf

=pidof=
which pids has a program stared. Find pid.

=ping=
Ping ipv6 loopback
ping6 ::1 -c1
Ping ipv6 broadcast
ping6 ff02::1%2 | cut -d\ -f4
Ping short output
export ADDRESS=2001:4860:4860::8888 ; PING=$(ping6 -w1 -q -c1 -i10 ${ADDRESS} 2>&1) ; RTT=$( grep rtt <<<"${PING}" | awk -F/ '{print $6}') ; RECEIVED=$(grep received <<<"${PING}") ; echo $ADDRESS $RECEIVED, rtt=${RTT}
Ping to discover mtu. 1460, 1450. When reply increase with 2. when found highest value increase with 28 to get mtu.
ping -M do -s 1472 123.45.56.78

=pip=
==which versions of django exist==
pip install pylibmc
==which versions are installed==
pip list

==which files does pip package provide.==
pip show -f $package
==Uppgrade package.==
pip install $package --upgrade
==where your own packages might end up==
/usr/local/lib/python3.9
/usr/lib/python2.7/site-packages/
==upgrade pip==
ls -la /usr/lib64/libldap_r.so /usr/lib64/libldap.so
==do not use cache==
pip3 install -r requirements.txt --no-cache-dir

=pgrep=
Grep any processlines including 1066
pgrep -lf 1066
=pmap=
Look at memory usage of process.
sudo pmap 2258

=postfix=
remove mails in queue.
mailq | grep ^[A-F0-9] | awk '{print $1}' | postsuper -d -
list mails in queue
mailq | grep "^[A-F0-9]"
Get mails in better output to better decide what to do with mails.
mailq | grep -v -- "-Queue ID-" | sed 's/^$/\x0/g' | tr -d '\n' | sed 's/\x0/\n/g'
Remove stuck emails.
postsuper -d ALL deferred
List email
postcat -q E55692442F
Read mail
postcat -vq [message-id]

=pr=
Print two files between each other.
pr -w200 -m -t /tmp/1 /tmp/2
=printf=
Convert octal to utf-8
printf '\360\237\222\200'
decimal to integral
printf "%.0f" <decimal>

=printscreen=
import -window root test.png
Gnome copy graphics to paste buffer. Copy selected portion of screen.
gnome-screenshot -a

=/proc=
*/proc/meminfo
MemTotal — Total amount of physical RAM, in kilobytes.

MemFree — The amount of physical RAM, in kilobytes, left unused by the system.

Buffers — The amount of physical RAM, in kilobytes, used for file buffers.

Cached — The amount of physical RAM, in kilobytes, used as cache memory.

SwapCached — The amount of swap, in kilobytes, used as cache memory.

Active — The total amount of buffer or page cache memory, in kilobytes, that is in active use. This is memory that has been recently used and is usually not reclaimed for other purposes.

Inactive — The total amount of buffer or page cache memory, in kilobytes, that are free and available. This is memory that has not been recently used and can be reclaimed for other purposes.

HighTotal and HighFree — The total and free amount of memory, in kilobytes, that is not directly mapped into kernel space. The HighTotal value can vary based on the type of kernel used.

LowTotal and LowFree — The total and free amount of memory, in kilobytes, that is directly mapped into kernel space. The LowTotal value can vary based on the type of kernel used.

SwapTotal — The total amount of swap available, in kilobytes.

SwapFree — The total amount of swap free, in kilobytes.

Dirty — The total amount of memory, in kilobytes, waiting to be written back to the disk.

Writeback — The total amount of memory, in kilobytes, actively being written back to the disk.

Mapped — The total amount of memory, in kilobytes, which have been used to map devices, files, or libraries using the mmap command.

Slab — The total amount of memory, in kilobytes, used by the kernel to cache data structures for its own use.

Committed_AS — The total amount of memory, in kilobytes, estimated to complete the workload. This value represents the worst case scenario value, and also includes swap memory.

PageTables — The total amount of memory, in kilobytes, dedicated to the lowest page table level.

VMallocTotal — The total amount of memory, in kilobytes, of total allocated virtual address space.

VMallocUsed — The total amount of memory, in kilobytes, of used virtual address space.

VMallocChunk — The largest contiguous block of memory, in kilobytes, of available virtual address space.

HugePages_Total — The total number of hugepages for the system. The number is derived by dividing Hugepagesize by the megabytes set aside for hugepages specified in /proc/sys/vm/hugetlb_pool. This statistic only appears on the x86, Itanium, and AMD64 architectures.

HugePages_Free — The total number of hugepages available for the system. This statistic only appears on the x86, Itanium, and AMD64 architectures.

Hugepagesize — The size for each hugepages unit in kilobytes. By default, the value is 4096 KB on uniprocessor kernels for 32 bit architectures. For SMP, hugemem kernels, and AMD64, the default is 2048 KB. For Itanium architectures, the default is 262144 KB. This statistic only appears on the x86, Itanium, and AMD64 architectures.

=ps=
==Process list in tree view.==
ps axfww
==Process sort by cpu usage.==
ps auxwww --sort -%cpu | head
==How long has process been running.==
ps -p 1 -o etime=
==Process list sorted after memory usage.==
ps aux --sort=size
==Process show memory usage... sort...==
ps axo rss,%cpu,pid,euser,cmd | sort -nr | head -n 10 | less -ISRM
==Process sort by mem usage.==
ps auxwww --sort -rss | head
==Processes sorted by time running.==
ps aux --sort -time
==Processes sorted by time started==
ps -auxwww --sort=start_time
==ps showing threads.==
ps -efL
==How long has process been running.==
echo -n $(( ($(date +%s) - $( stat -c%X /proc/$(pgrep -f [a]ctivemq.jar))) / 3600 ))
==ps long usernames==
ps axo user:20,pid,pcpu,pmem,vsz,rss,tty,stat,start,time,comm
==ps including nice==
ps -eo pid,user,ni,comm

=pstack=
print a stack trace of a running process

=pulseaudio=
# Is pulseaudio running?
ps uxawww| grep -E pulseaudi[o]
# stop pulseaudio
pulseaudio -k
# start pulseaudio as found by ps | grep pulseaudio
/usr/bin/pulseaudio --start --log-target=syslog

=putty=
Run putty from cli with login
"C:\Program Files\PuTTY\putty.exe" -l <username> -pw <password> <host_url>
Always setup stay alive.
connection -> keepalive -> 60
set up tunnel
putty -load blt.homeip.net -l bjorklun -pw password -L 19242:192.168.0.42:3389 blt.homeip.net
putty without taking tty.
plink -load www.halfface.se -l user_name -pw password -R *:3389:localhost:3389 -2 -4 -N
reverse tunnel. Connect remote host 3400 to machine running putty localhost:3389.
connection -> ssh -> tunnels -> "Source Port" = 3400 -> destination = localhost:3389 -> remote.
socks server.
connection -> ssh -> tunnels -> Source port: 3128 , Destination: localhost:3128, Dynamic:true -> add -> apply.
Change font size
echo Windows Registry Editor Version 5.00 > putty.reg && echo [HKEY_CURRENT_USER\Software\SimonTatham\PuTTY\Sessions\Default%20Settings] >> putty.reg && echo "Font"="Courier New" >> putty.reg && echo "FontHeight"="12" >> putty.reg && reg import putty.reg

=pv=
throughput in pipe. speed.
pv
pv -cN
make a dd and limit througput to 20MB/s.
dd if=${HOST}.qcow2 bs=4k conv=noerror,sync | pv -L 20M | dd of=${HOST}.dd_noerror.qcow2
=pwgen=
Create less complicated password.
pwgen -sy 15 -r \'\"\^\`\~\;\[\]\{\}\,

=qalculate=
qalc
> 40 euro to SEK
40 * euro = approx. SEK 417.36
=readpst=
output pst file in separate files in out directory
readpst -S -o out/ outlook.pst
=reboot=
Hard reboot mean that shutdown scripts will not run and machine reboot immediately without syncing hard disk drives.
This commands enable sysrq and after this call fast reboot.
echo 1 > /proc/sys/kernel/sysrq
echo b > /proc/sysrq-trigger
Force shutdown
echo 1 > /proc/sys/kernel/sysrq
echo o > /proc/sysrq-trigger
Kernel panic
echo c > /proc/sysrq-trigger
==List last reboots==
last --time-format iso reboot

=rename=
Recursive lowercase to uppercase
for i in $(find * -depth); do (mv $i $(echo $i | sed 's%[^/][^/]*$%%')$(echo $i | sed 's!.*/!!' | tr [:upper:] [:lower:])); done
Upper to lower case
for f in `find .`; do mv -v "$f" "`echo $f | tr '[A-Z]' '[a-z]'`"; done

=reposync=
reposync -n -c /etc/yum/yum.conf -p /repos/centos6 -d -r base -r updates -r extras -r centosplus -r contrib
createrepo -g /repos/centos6/base/repodata/comps.xml /repos/centos6/base
createrepo /repos/centos6/updates
createrepo /repos/centos6/extras
createrepo /repos/centos6/centosplus
halfface -> sync repo. -d delete what is not on remote, -n only newest version, -p store here, -r which repos to sync
reposync -d -n -p /install/system/linux/fedora/24/repo/ -r updates -r fedora -r rpmfusion-free -r rpmfusion-free-updates -r rpmfusion-nonfree -r rpmfusion-nonfree-updates
halfface -> create repository
REPODIR=/install/system/linux/fedora/24/repo ; for REPO in $(cd $REPODIR; ls) ; do echo $REPO ; createrepo_c ${REPODIR}/${REPO} ;done
=reptyr=
Reparent a running program to a new terminal. (move tty)

=rfcomm=
list usb devices
hcitool scan
What properties does the device have.
sdptool browse 00:0D:B5:30:07:79
connect bluetooth device virtual servial.
rfcomm bind /dev/rfcomm0 00:0D:B5:30:07:79 1
=rkhunter=
Run rkhunter full scan no keypresses needed
sudo rkhunter --checkall --skip-keypress -x
Update database
sudo rkhunter --propupd
Search for what triggered alarm.
sudo grep -E 'Warning|Suspicious' /var/log/rkhunter/rkhunter.log

=dnf update rkhunter. Update dnf after rkhunter scan=
tail -1 /etc/sysconfig/rkhunter
sleep 300 && ( dnf -e 0 -y update ; rkhunter --propupd ) >> /tmp/dnf_update_rkhunter--propupd.$(date +%F_%H-%M-%S).log 2>&1 &

=rotatelogs=
Write standard output to logfile. Rotate at 100M. Keep 3 files.
your_script.sh | rotatelogs -n3 /var/log/your.log 100M
=route=
The route to a network is behind 10.111.222.7
route add -net 10.111.223.0 netmask 255.255.255.0 gw 10.111.222.7
Add default route
route add default gw 192.168.122.1
Permanent route under redhat
/etc/sysconfig/static-routes
any net 198.18.129.0/24 gw 10.240.175.12
/etc/sysconfig/network-scripts/route-eth1
1.2.3.4/23 via 1.2.3.1
Drop packages to ip.
route add -host 192.168.1.51 reject
Remove reject rule.
route del -host 192.168.1.51 reject
Remove route
route -n
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
192.168.122.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0
169.254.0.0 0.0.0.0 255.255.0.0 U 1002 0 0 eth0
10.0.0.0 0.0.0.0 255.0.0.0 U 0 0 0 eth0
0.0.0.0 192.168.122.1 0.0.0.0 UG 0 0 0 eth0
route del -net 10.0.0.0 gw 0.0.0.0 netmask 255.0.0.0 dev eth0

=rpm=
==install src.rpm==
rpmbuild --rebuild alien-6.51-1.src.rpm
rpm -i /usr/src/redhat/RPMS/x86_64/alien-6.51-1.rpm
==List contents of rpm.==
rpm -qlp myfile.rpm
==Extract single file from rpm.==
rpm2cpio package.rpm | cpio -idv ./search_path_to_file_from_listing_above.txt
==List information about non installed rpm.==
rpm -qip foo.rpm
==Extract contents of rpm.==
rpm2cpio *.rpm | cpio -i --make-directories
==Which version of rpm is installed.==
/etc/rpm/macros ~/.rpmmacros
%_query_all_fmt %%{name}-%%{version}-%%{release}.%%{arch}
==list architecture==
rpm -qa --qf "%{n}-%{v}-%{r}.%{arch}\n"
==List only name of installed rpms.==
rpm -qa --qf "%{NAME}\n"
==Extract rpms in subdirectories.==
for RPM in $(ls *|sed 's_\.rpm$__g');do echo $RPM; mkdir $RPM; rpm2cpio $RPM.rpm | (cd $RPM && cpio -i --make-directories);done
==Verify content of rpm==
rpm -V package
# What does those cryptic letters mean from rpm -V:
S file Size differs
M Mode differs (includes permissions and file type)
5 MD5 sum differs
D Device major/minor number mismatch
L readlink(2) path mismatch
U User ownership differs
G Group ownership differs
T mTime differs
==Reinstall rpm==
rpm -iv --replacepkgs package.rpm
==Dependencies of rpm==
rpm -qpR ${rpm}
rpm -qR ${packagename}
rpm -qp mypackage.rpm --provides
rpm -qp mypackage.rpm --requires
==Rebuild rpm database.==
\rm /var/lib/rpm/__db*
rpm --rebuilddb

==Update minor release.==
yum --releasever=6.11 update sl-release
yum clean all
yum update
==Downgrade rpm.==
rpm -Uvh --oldpackage /tmp/app.x86_64.rpm
==Which rpm:s are required by rpm. Can be used to install rpm on machine without access to yum repo.==
PKG=openssh-server ; yum install --downloadonly --installroot=/tmp/$PKG-installroot --releasever=7 --downloaddir=/tmp/$PKG $PKG
==CVE:s fixed by rpm==
rpm -qi --changelog openssh-server | grep -i CVE

=rsync=
Syncronize folders. Delete non existing files on remote host. Compress.
rsync --delete -az -e ssh bjorklun@semco.homeip.net:/install/program/windows/
Syncronize files over ssh on port 2222. Show progress. Syncronize even empty directories.
rsync -Pae 'ssh -p 2222' localhost:/opt/techops/bin/ /opt/techops/bin/
rsync with total progress bar.
rsync -a --info=progress2 /dir1/ /dir2/
Run rsync in both ends but transfer data with normal user.
sudo rsync -aP /tmp/andreas/ andreasbj@localhost:/tmp/andreas2/ --rsync-path='sudo rsync'
rsync with limit of 8 MB/s.
rsync -aP --bwlimit=8000 /source/ /destination/
rsync excluding directory
rsync -r --exclude=.svn /source/ /destination/
rsync including selinux information. Preserve hard links.
rsync -aPXH /source /destination
rsync don't keep links. Copy files referenced.
rsync -rLP /source/ /destination
Record which files to sync.
rsync -r -ptgo --delete -P --size-only -n www.halfface.se:/mp3/ /mp3/ -n | tee /temp/mp3_$(date +%Y-%m-%d)_diff.txt
Rsync new files.
rsync -RDa0P --files-from=<(find /sourcedir -mtime -7 -print0) . /targetdir/
rsync ignore existing files.
rsync -P --ignore-existing /source/* /destination/ -n
rsync excluding directories matching pattern.
SOURCE=/apps/IP400 ; DESTINATION=/apps/IP400.$(date '+%Y-%m-%d_%H-%M-%S') ; rsync -aP "${SOURCE}"/ "${DESTINATION}"/ --exclude-from=<(cd "${SOURCE}" ; find -type d -name log | sed -e 's|./||')
Sync files partially.
rsync -avz --partial --inplace
which files differ between hosts.
rsync -nrlptDqv --delete --exclude napsjb/server/naps/tmp/ /opt/ongame/ 10.6.21.11:/opt/ongame | less
-n dry run.
-r recursive
-l copy symlinks av symlinks.
-p preserve permission
-t preserve tims.
-D --device --special. Keep special files.
-q quiet
-v verbose

=sar=
Old sar information.
sar -f /var/log/sa/sa25 -s 00:00:00 -e 23:59:00
load average.
sar -q -f /var/log/sa/sa25 -s 00:00:00 -e 23:59:00
All information.
sar -A -f /var/log/sa/sa25 -s 00:00:00 -e 23:59:00
View network statistics.
LANG=c sar -n DEV | grep eth0
realtime summary.
sar 4 5
=script=
Run command under shell even if it does not exist.
script -q -f -c "commands or scripts to run"
Run session under screen in script.
screen -dm bash -c 'script --timing=script1.tm script1.out'
Replay script recorded file
scriptreplay --timing script1.tm --typescript script1.out
=scp=
Limit to 1.2MB/s.
scp -l 10240 Rocky-8.5-x86_64-minimal.iso halfface.se:/temp/

=search&replace=
perl
grep -rsl '10.6.4.102' * | xargs perl -pi -e 's/10.6.4.102/10.6.4.103/'
sed
find . -type f -exec sed -i 's/string1/string2/g' {} \;
Grep for regexp starting with CN= and stop at first occurrence of ,. not greedy
grep -oE 'CN=[^,]*,'
=set=
Look at current settings. Expanded or simple view.
set -o
echo $-

=setfacl=
Add rwx permission for user_name recursivly from /directory
setfacl -Rm u:user_name:rwx /directory
Remove acl:s
setfacl -bn foobar
=setpriv=
Dump your privileges.
setpriv -d

=shred=
Recurse remove dir
find /tmp/secret -type f -exec shred {} \;

=shuf=
Pick random line in file.
shuf -n1 /file
Get random number
shuf -i 10-120 -n1

=sms=
Mail to sms gateway.
tele2
07XXXXXXXX@sms.tele2.se

Comviq
467xxxxxxxx@sms.comviq.se

Europolitan
4670xxxxxxx@europolitan.se

=snmptrap=
# send more than one string.
snmptrap -v 2c -Ci -u user -c community localhost "" .1.3.6.1.4.1.5089.1.0.1 1 s "This is the first string" 2 s "This is the second string"
snmptrap -v 2c -Ci -u user -c community localhost '' .1.3.6.1.4.1.5089.1.0.1 1 s "This is the first string" 2 s "This is the second string"
snmptrap -v 2c -c xxxxxxx localhost '' .1.3.6.1.4.1.5089.1.0.1 .1.3.6.1.4.1.5089.2.0.999 s "Hej Hej"
Simple trap
snmptrap -v 1 -c public localhost '' 0 0 ''

=snmptrapd=
# Enable logfile. /etc/sysconfig/snmptrapd
OPTIONS="-Lf /var/log/snmptrapd.log"
# Disable authorization and put in logfile. /etc/snmp/snmptrapd.conf
disableAuthorization yes
authCommunity log public

=snmpwalk=
Get information from an oid.
snmpwalk -v 1 -c public snmp.device.net .1.3.6.1.4.1.2021.84
Do tcpdump while running.
tcpdump -i eth0 -n -s0 -v host snmp.device.net and port snmp
=socat=
Create a tunnel between localhost 2222 to remote host 2222
socat TCP-LISTEN:2222,fork TCP:10.111.222.2:2222
socat TCP-LISTEN:22,fork,bind=127.0.0.1 TCP:192.168.0.15:5900
socat TCP-LISTEN:2222,fork TCP:10.8.110.20:22,bind=172.19.14.251
Listen on 10.120.50.12:9090 and forward to 127.0.0.1:9090
socat TCP-LISTEN:9090,bind=10.120.50.12,fork TCP:127.0.0.1:9090
Create tunnel via systemctl
Create file similar to this. /etc/systemd/system/socat_win.service
[Service]
ExecStart=/usr/bin/socat TCP-LISTEN:3389,fork TCP:192.168.122.204:3389
[Install]
WantedBy=multi-user.target
Enable new file.
systemctl daemon-reload
Start new daemon
systemctl start socat_win

=sort=
Sort ip address.
sort -t. +0n -1 +1n -2 +2n -3 +3n -4
sort -t . -k 1,1n -k 2,2n -k 3,3n -k 4,4n
sort on fift column
sort -t, -k5n,5 /tmp/gfp
Get a list of configured ip for a set of hosts. Sort on domain then hostname
pdsh ^/host_list 'ip route get 8.8.8.8 | awk "NR==1 {print \$NF}"' | sort -t . -k 2 -k 1
Sort on first column only.
sort -n -k 1,1

=spawn=
Encode wav to ogg in parallel.
# ls -1 *.wav | while read ; do echo "oggenc -q6 \"$REPLY\"" ; done | spawn -j4
=split=
Devide file into parts containing 100 lines.
split -l 100 create_updated_2013-10-29_sort_created_ci_id_name.txt --numeric-suffixes --suffix-length=3 Cleanup.
Devide file in 10 parts. Suffix length 4.
split -n 10 -a 3 bigfile.tar.gz

=sqlite=
Is db broken?
sqlite3 mydata.db "PRAGMA integrity_check"
recover db
sqlite3 mydata.db ".dump" | sqlite3 new.db
sqlite3 stellar.db .recover | sqlite3 stellar_2.db
Show databases
sqlite> .databases
main: /var/lib/tuptime/tuptime.db
List tables
sqlite> .tables
tuptime
Run sql command
sqlite> select * from tuptime;
1544984636|2387765.42|-1|0|0.0|Linux-4.19.8-200.fc28.x86_64-x86_64-with-fedora-28-Twenty_Eight
exit|quit
.quit
==vacuum==
/usr/local/openvpn_as/bin/sqlite3 /usr/local/openvpn_as/etc/db/log.db "VACUUM"
==count tables==
DB=files.db ; for TABLE in $( sqlite3 $DB ".tables") ; do echo -e $TABLE\\t$(sqlite3 $DB "SELECT COUNT(1) FROM $TABLE;") ; done | column_tab

=ss=
List all connections.
ss -an
List processes and which port they listen too. Grep process.
ss -tulpn | grep 5405

=ssh=
==ssh-keygen==
Create key pair without input.
<pre>
KEYNAME=cluster-info-reporting ; KEYNAME_PATH=/tmp/${KEYNAME}-$(date '+%Y-%m-%d_%H-%M-%S') ; ssh-keygen -q -t ed25519 -N '' -C $KEYNAME <<< $'\ny' >/dev/null 2>&1 -f "${KEYNAME_PATH}" ; echo Keys: $(ls "${KEYNAME_PATH}"*)
</pre>

==which private ssh keys are password protected==
ls ${HOME}/.ssh/* | grep -Ev 'pub$|authorized_keys|config|known_hosts|ssh-agent.sock' | while read i ; do SSH_PASSWORD=$(ssh-keygen -y -P "" -f "$i" 2>&1 | grep "incorrect passphrase supplied to decrypt private key") ; if [ -z "${SSH_PASSWORD}" ] ; then echo No password encrypted ssh private key: $i ; fi ; done

==Remove pass phrase==
ssh-keygen -p [-P old_passphrase] [-N new_passphrase] [-f keyfile]

==view fingerprint==
ssh-keygen -l -E md5 -f /tmp/ssh-keygen.pub

==change the name of private key==
ssh-keygen -c -C "first.lastname@example.com" -f ~/.ssh/id_ed25519

==Copy public key to authorized_keys==
ssh-copy-id user@host
List supported ciphers
ssh -Q cipher
List supported MACs
ssh -Q mac
List supported public key type
ssh -Q key
List supported key exchange algorithms
ssh -Q kex
List supported ciphers, macs and kexalgorithms.
sshd -T | grep "$ciphers\|macs\|kexalgorithms$"
Run command each time you login via ssh.
$HOME/.ssh/rc

==Tunnel==
sudo ssh -nNTx -R 2222:localhost:22 andreasbj@www.halfface.se
Reverse tunnel.
ssh -D \*:666 www.halfface.se
ssh -N ipmon10.ny1.ip-soft.net -L43389:ippc01.ongame.ip-soft.net:3389
-n Dont take console. Good for background.
-N Do not execute a remote command
-T Disable pseudo-tty allocation.
-x Disables X11 forwarding.
-R port:host:hostport
sudo ssh -N -L 2222:www.halfface.se:22 www.halfface.se
sudo ssh -nNTx -R 2222:www.halfface.se:22 www.halfface.se
sudo ssh -nNTx -R 443:satellite.ongame.com:443 root@10.0.254.30 # Tunnel 443 over ssh from remote host via local host.
Open tunnel on remote host. Start remote proxy server forwarding to internal network.
ssh remotehost -R remoteport:localhost:localport "ssh -D 9050 localhost:remoteport"
Multiple reverse tunnel controled by autossh. (-M)Control port,(-f)background, (-N) no remote command, reverse tunnel (-R)
autossh -M 41000 -f -N -R 0.0.0.0:8001:192.168.1.10:80 -R 0.0.0.0:8002:192.168.1.20:80 user@remotehost

==reverse tunnel bound to all interfaces==
The config has to allow to bind to * interface. /etc/ssh/sshd_config GatewayPorts yes
sudo ssh -i ${HOME}/.ssh/id_dsa -N -R \*:2222:localhost:22 ${USER}@www.halfface.se

==Create an ssh tunnel link==
https://help.ubuntu.com/community/SSH_VPN
echo 1 > /proc/sys/net/ipv4/ip_forward
vim /etc/ssh/sshd_config PermitTunnel=yes
sudo ssh -NTCf -w 0:0 1.2.3.4
sudo ssh -v -w any:any www.halfface.se
###
local:
ip link set tun0 up
ip addr add 169.254.0.1/32 peer 169.254.0.2 dev tun0
ip route add 192.168.0/24 via 169.254.0.2
remote:
ip link set tun1 up
ip addr add 169.254.0.2/32 peer 169.254.0.1 dev tun1
arp -sD 169.254.0.2 eth1 pub
### Change default gateway. In this case, 192.168.0.1 is Machine B's current default gateway; it is the gateway on Network B that provides internet connectivity
ip route add 1.2.3.4/32 via 192.168.0.1
ip route replace default via 10.0.0.1

==Limit ssh access with pam_access==
/etc/security/access.conf

==Proxycommand without nc==
Host server1
Hostname 10.0.1.1
ProxyCommand ssh -q -x jumphost -W %h:22

==ssh over ipv6 via 2 network interface.==
ssh -6 fe80::1ec1:deff:fecb:6ce%2

==ssh options==
None interactive. Dont ask for password.
-o BatchMode=yes
Accept all keys.
-o StrictHostKeyChecking=no

==ssh via proxy/squid==
ssh -o 'ProxyCommand nc --proxy proxy.inter.net:3128 --proxy-type http %h %p' host.inter.net hostname
ssh -o 'ProxyCommand nc -X connect -x proxy.inter.net:3128 %h %p' host.inter.net hostname

==brow.sh==
browser in terminal window.
ssh brow.sh

==jail==
/etc/sshd/sshd_config
Match group mychroot
ChrootDirectory /jail/
X11Forwarding no
AllowTcpForwarding no

==sshd debug==
Start deamon once in debug mode and put output to your console.
/etc/sysconfig/sshd
OPTIONS="-ddd"
Kill of sshd which is listening for new connections. Start sshd with the following command. Debug level can bee changed.
/usr/sbin/sshd -De -o LogLevel=DEBUG3

==ssh multiple jumps one cli==
Jump through host1.net to get to host2.net
ssh -t host1.net ssh -t host2
Jump through host1.net to host2.net and bring port 8080 with you.
ssh -t host1.net -L 8080:localhost:8080 ssh -t host2.net -L 8080:localhost:8080

==ssh force password login==
ssh -o StrictHostKeyChecking=no -o ControlPath=none -o ControlMaster=no -o PubkeyAuthentication=no user@host

==ssh via jumphost==
ssh -J core@1.1.1.1 core@2.2.2.2

==socks==
# Setup socks server exiting on remote host
ssh -D '*:3128' halfface.se
# Use socks setup above.
curl --socks5 localhost:3128 https://ifconfig.me

==Create public key from private==
ssh-keygen -y -f <private_key_with_return_at_end>

=sshfs mount filesystem over ssh=
sshfs name@server:/path/to/folder /path/to/mount/point
=sshpass=
ssh with password provided on the command line.
sshpass -p P@ssW0rd ssh -t -o ControlPath=none -o PreferredAuthentications=password -o PubkeyAuthentication=no -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o LogLevel=Error user@localhost hostname
=specify key=
ssh -o "IdentitiesOnly=yes" -i <private key>

=sshuttle=
create a network route over ssh.
sshuttle -D -r user@remotehost:2222 192.168.1.0/24

=stat=
View file permissions only.
stat -c "%a %n" /usr/bin/bash
Access - the last time the file was read
Modify - the last time the file was modified (content has been modified)
Change - the last time meta data of the file was changed (e.g. permissions)
Copy permissions from one location to another.
rpm -qlp package.rpm | while read FILE ; do echo chmod $(stat -c "%a" $FILE) \"$FILE\";done > /tmp/copy_permissions.sh

=strace=
==File open activity.==
strace -e open -f ls -la /temp/
==File open activity under directory.==
strace -e open -P /temp/ -f ls -la /temp/
==More file activity.==
strace -e trace=file -p 1234
strace -e trace=desc -p 1234
==Trace network activity.==
sudo strace -f -e trace=network -p 1476
# 1024 long strings.
sudo strace -s 1024 -f -e trace=network -p 1476
# strace follow process with matching regex.
strace -f -e poll,select,connect,recvfrom,sendto -p $(pgrep -f login-sync.xml)
# trace nework activity
strace -f -e trace=network -s 1000000 nc localhost 3333

==Memory usage==
sudo strace -f -e trace=memory -p $(pgrep -f firefox)
==What is taking time==
[root@util01 abjorklund]# strace -f -c -p 9657
% time seconds usecs/call calls errors syscall
------ ----------- ----------- --------- --------- ----------------
88.11 11.614155 1644 7065 1565 futex
9.94 1.310794 16183 81 73 restart_syscall
1.86 0.245018 86 2850 recvfrom
0.05 0.006784 30 228 poll
0.03 0.004006 2 1838 sendto
0.00 0.000271 1 253 sched_yield
0.00 0.000134 12 11 mmap
0.00 0.000107 0 5176 ioctl
0.00 0.000026 0 148 148 stat
0.00 0.000000 0 1 read
0.00 0.000000 0 254 write
0.00 0.000000 0 44 mprotect
0.00 0.000000 0 1 rt_sigreturn
------ ----------- ----------- --------- --------- ----------------
100.00 13.181295 17950 1786 total

==strace multiple processes==
strace -s 1024 -f -o /tmp/strace $(pidof Process_name | sed 's/$[0-9]*$/-p \1/g')
==strace to hex output. Convert to utf8.==
strace -xx -f -o/tmp/strace -s0 echo bajskorv
cat /tmp/strace | while read -r line; do printf "%b\n" "$line" ; done

=stty=
List settings
stty -a
speed 38400 baud; rows 50; columns 200; line = 0;
intr = ^C; quit = ^\; erase = ^?; kill = ^U; eof = ^D; eol = <undef>; eol2 = <undef>; swtch = <undef>; start = ^Q; stop = ^S; susp = ^Z; rprnt = ^R; werase = ^W; lnext = ^V; discard = ^O; min = 1; time = 0;
-parenb -parodd -cmspar cs8 -hupcl -cstopb cread -clocal -crtscts
-ignbrk -brkint -ignpar -parmrk -inpck -istrip -inlcr -igncr icrnl ixon -ixoff -iuclc -ixany -imaxbel -iutf8
opost -olcuc -ocrnl onlcr -onocr -onlret -ofill -ofdel nl0 cr0 tab0 bs0 vt0 ff0
isig icanon iexten echo echoe echok -echonl -noflsh -xcase -tostop -echoprt echoctl echoke -flusho -extproc
Set terminal properties.
stty rows 50 cols 200

=sudo=
Enable sudo logging
sed -i "$(( $(grep -n ^Defaults /etc/sudoers | tail -1 | awk -F: '{print $1}') + 1 ))iDefaults log_output\nDefaults log_input" /etc/sudoers
Command above adds the following to /etc/sudoers
Defaults log_output
Defaults log_input
List sudo-io logs.
sudoreplay -l
Search for string in logs.
zgrep search_string $(find /var/log/sudo-io/ -type f)
Replay session. Max wait 1s. 5 times the speed.
sudoreplay -m1 -s5 000002
Replay session including stdin
sudo sudoreplay -m1 -s5 -f stdin,stdout,stderr,ttyin,ttyout 000001
Which rules apply to user
sudo -l -U username
==Add user to sudoers.d so you do not need to add password for that user.==
SUDO_USER=<user> ; echo -e "# Adding $SUDO_USER user to sudo users.\n$SUDO_USER ALL=(ALL) NOPASSWD:ALL" > /etc/sudoers.d/90-${SUDO_USER//./_} ; chmod 440 /etc/sudoers.d/90-${SUDO_USER//./_}

=swapon/swapof=
Free swap
(swapoff -a; swapon -a) & watch free -m

=sysbench=
cpu test.
sysbench cpu --cpu-max-prime=20000 --threads=32 run | grep "events per second"
ram test
sysbench memory --threads=32 run | grep sec
disk test
RAM_TWO=$(( $(grep MemTotal /proc/meminfo | awk '{print $2}') * 2 ))kb
sysbench fileio --file-total-size=${RAM_TWO} prepare > /dev/null
sysbench fileio --file-total-size=${RAM_TWO} --file-test-mode=rndrw --time=300 --max-requests=0 run|grep -E ' read, | written, '
sysbench fileio --file-total-size=${RAM_TWO} cleanup > /dev/null

=sysctl=
Rename machine.
sysctl kernel.hostname=ipmonxx.${CLIENT}.ip-soft.net
Set tcp keepalive
$ sysctl -a | grep tcp_keepalive
net.ipv4.tcp_keepalive_time = 1800
net.ipv4.tcp_keepalive_probes = 9
net.ipv4.tcp_keepalive_intvl = 75
sudo sysctl -w net.ipv4.tcp_keepalive_time=60 net.ipv4.tcp_keepalive_probes=3 net.ipv4.tcp_keepalive_intvl=10
net.ipv4.tcp_keepalive_time = 60
net.ipv4.tcp_keepalive_probes = 3
net.ipv4.tcp_keepalive_intvl = 10
Reload config files
sysctl --system

=systemctl=
==init 3==
systemctl isolate runlevel3.target
systemctl isolate multi-user.target
systemctl set-default multi-user.target

==init 5==
systemctl isolate runlevel5.target
systemctl isolate graphical.target
systemctl set-default graphical.target

==When you have made changes to /etc/systemd/system/*.service==
systemctl daemon-reload

==List all units==
systemctl list-unit-files
==List units with problems==
systemctl list-units --failed
==create service==
cd /etc/systemd/system ; vim $service.service ; systemctl daemon-reload
[Unit]
Description=Set laptop brightness
After=multi-user.target

[Service]
Type=forking
ExecStart=/bin/sh -c 'echo 1000 > /sys/class/backlight/intel_backlight/brightness'
LimitNOFILE=65535
LimitNPROC=65535

[Install]
WantedBy=default.target

==Add groups to processes started by services script==
[Service]
SupplementaryGroups=33 518
==takes a long time to login==
systemctl daemon-reexec
systemctl restart systemd-logind

=strace process started by systemctl=
strace -f -o /tmp/strace.log -s 2048 -p 1 & systemctl restart httpd.service
=systemctl show puma=
Show variables of service
systemctl show puma

=systemd-analyze=
What takes time at startup.
systemd-analyze plot > /tmp/systemd-analyze-plot.svg ; chrome /tmp/systemd-analyze-plot.svg
=systemd-resolved=
resolvectl status
clear cache.
sudo systemd-resolve --flush-caches
Look at stats.
systemd-resolve --statistics
==restart daemon to apply settings==
systemctl daemon-reload
systemctl restart systemd-networkd
systemctl restart systemd-resolved
=systemctl show=
will show all available properties
systemctl show $service

=tail=
Tail from line number 21.
tail -n +21 /file
=talk=
Talks swedish.
espeak -v swedish -f /tmp/file

=tar=
Make a backup of a directory or disk.
server: tar -cpsf - $dir | pv -b | nc -l 3333
client: nc server 3333 | pv -b | tar -xpst -
Inline tar archive.
awk '/^__ARCHIVE_FOLLOWS__/ { print NR + 1; exit 0; }' $0
tail -n $0 > archive.tar # tail -n +347 Filename
Backup dir but exclude files within
tar zcf /tmp/backup_$(date '+%Y-%m-%d_%H-%M-%S').tar.gz /apps/app --exclude=/apps/app/var/* --exclude=/apps/app/logs/*
extract files remove 5 path element components.
tar xf archive.tar --strip-components 5
extract to other directory.
tar -xzf bar.tar.gz -C foo
extract files excluding path.
tar xf $file.tar.gz --transform='s/.*\///'

=tcpdump=
dump trafic information, -e Print the link-level header on each dump line, -vvv verbose.
tcpdump -e -vvv port 21
dump all trafic to and from machine. -w write to file, -s0 size of package, host to listen from.
time tcpdump -w ssl_dump -s0 host test.x30.webservices.itsfogo.com
dump all trafic into files of max 100MB. 270MB in reality.
tcpdump -w snoop -s0 -C 100000000
dump all trafic. compress logfiles. Create 10 files which are 10 MB big. Dont convert numbers to names. Dont truncate frames create logfile with this name.
tcpdump -z gzip -i wlan0 -C 10 -W 10 -n -s0 -w /tmp/tcpdump.log
Which machines send a syn packet.
sudo tcpdump -nn -i eth0 'tcp[13] = 2'
Show information about all traffic on interface.
tcpdump -s0 -i eth1 -vv
Show information about communication over port 514
tcpdump -Xni any port 514
listen on port 1023 for incoming trafic. disable local subnets.
sudo tcpdump -n -i eth0 tcp and dst host 172.17.17.6 and not src net 172.17.17.0/24 and not src net 158.0.0.0/8 and 'port 1023'
listen after torrent traffic.
sudo tcpdump -Xni any portrange 6882-6999
View content of http trafic
sudo tcpdump -i any -A -s 1500 dst 89.253.75.84 and port 80
View post in utf-8 format.
<pre>
sudo tcpdump -lnp -i any -A -s 1500 dst 89.253.75.84 and port 80 -w - | tr -t '[^[:print:]]' ''
</pre>
Get cookie
tcpdump -i lo -A -l dst port 8000 | grep "^Cookie: "
To create cookie for curl: https://xiix.wordpress.com/2006/03/23/mozillafirefox-cookie-format/
Look at traffic from specific ip
tcpdump -n -i any -n host 198.18.130.9
Eavesdrop password
tcpdump -i any -A -s0 port 8030 | grep Authorization:
==flags==
tcpdump -enni eth0 host 172.30.142.11 port 5432
F - FIN
S - SYN
R - RST
P - PSH
U - URG
E - ECN Echo
W - ECN Cwnd Reduced
. - ACK only
==get ftp username/password==
sudo tcpdump -n -vvv -i any -A -f "port 21" | grep -i "user\|pass"

=tcptraceroute=
tcptraceroute -n -q 1 192.168.0.1 -p 22
=teamdctl=
teamdctl team0 state view -v
=tee=
Feed tee with an unbuffered stream.
sar -n DEV 2 | stdbuf -oL grep wlp0s20f3 | tee /temp/sar_-n_wlp0s20f3.$(date)

=telnet=
Look at world map. a - z zoom.
telnet mapscii.me
=testssl=
test ssl certificate
testssl www.halfface.se

=tftp=
# Download test.file
tftp -v 172.17.17.6 -c get test.file
# Upload file.
tftp -v 172.17.17.6 -c put /tmp/test.put test.put
# Enable upload file in in.tftpd
/etc/xinetd.d/tftp
server_args = -c -s /var/lib/tftpboot
=tibco=
show permissions.
help permissions
Create user
create user surveillance "Surveillance user" password=surveillance
Grant user permission to view all
grant admin user=surveillance view-all
=tif=
cli image viewer.
tif $IMAGE.jpg

=time=
Time in a loop.
{ time sleep 2 >> ${LOG} ; } 2>> ${LOG}
How long did a command take
TIME=$( { /usr/bin/time -f "%e" sleep 1.5 ;} 2>&1 ) ; echo $TIME
Built in time command. 3 decimals in seconds.
TIMEFORMAT='%3R'; time ( sleep 61.22222 )
=timedatectl=
Show info how clock is synced.
timedatectl timesync-status
Which time zones exist
timedatectl list-timezones | cat -v | grep -i stockholm
Set timezone.
timedatectl set-timezone "Europe/Stockholm"
Show ntp servers
timedatectl show-timesync --all
Sync clock
timedatectl set-ntp true
Enable clock sync.
systemctl enable systemd-timesyncd --now

=timeout=
limit waiting for a period.
timeout 2s sleep 100
Run function under timeout
export -f my_function ; timeout 1 bash -c 'my_function options'
Run loop for some time then exit.
timeout 172800 bash -c -- 'while true ; do echo $(TZ=UTC date "+%Y-%m-%d %H:%M:%S %Z") $(ping -w1 -q -c1 -i10 192.168.10.120 | grep received) ; sleep 1 ; done| tee /tmp/ping_192.168.10.120.log'

=tnef=
List content of winmail.dat. Remove options to extract to current dir.
tnef -t -f winmail.dat
=toilet=
Generate graphics text similar to banner.
toilet -F gay -f mono12 "Some Funky Text"
=tor=
Select outgoing country. https://en.wikipedia.org/wiki/ISO_3166-1_alpha-2
Set country in:
torrc
One or several exit countries.
ExitNodes {us}
ExitNodes {kr},{ru},{sy},{cn}
test exit node
ifconfig.me
=toolbox=
toolbox create --distro rhel --release 9.5
==running rocky==
podman pull docker.io/rockylinux/rocky-toolbox:9
toolbox create --image docker.io/rockylinux/rocky-toolbox:9

=top(the command)=
Top batch mode run one iteration
top -bn1
Sort by memory usage
for i in {1..10};do date; top -c -b -o +%MEM | head -n 17|tail -11;sleep 5;done
Top used in openshift.
top -bcn1 -w512 | less -ISRM

=top derivates=
apachetop
dnstop
iftop
latencytop
glances

=touch=
touch -am 0910120003 Give a new access time on a file 0910120003MMDDhhmmyy
linux
touch -t 197102162324 *

=tput=
No line wraps
tput rmam
Line wraps
tput smam
invisible cursor
tput civis
visible cursor
tput cnorm
reset is a good command to reset shell
reset

=tr=
translate capital to lower letter.
tr '[:upper:]' '[:lower:]'
null character to new line
tr '\000' '\n' < /proc/3575/environ
Remove unprintable characters.
<pre>
tr -dc '[[:print:]]'
</pre>

=trickle=
Speed limit for download
rsync -ae "trickle -d 80 ssh" user@host:/src/ /dst/
Speed limit for upload.
rsync -ae "trickle -u 80 ssh" user@host:/src/ /dst/
Limit wget to 64kbit upload and download.
trickle -d 64 -u 64 wget "https://www.halfface.se/file.txt"
=ts=
timestamp
ls -la | ts '%F %H:%M:%S'

=tune2fs(tunefs)=
tune2fs -m 0 /dev/sdb1

=type=
What kind of command do we use. builtin or some file?
type ls

=udevadm=
Monitor udev events.
udevadm monitor
udevadm info --query=all --name=sda
look at values for disk. Can be used to locate san source.

=udr=
rsync over udp.
udr -a 57621 -b 57631 rsync -rP host.inter.net:/source/ /destination/
=ulimt=
Look at current limits for logged in user.
ulimit -a
Look at limits for process with pid 12345.
cat /proc/12345/limits
=unalias=
Unalias all aliases
unalias -a
=unhide=
Find hidden ports.
unhide -v proc

=unetbootin=
Boot iso image from usb memory.
=update-crypto-policies=
Change crypt policies so that I am able to start openvpn connection.
sudo update-crypto-policies --set DEFAULT:SHA1

=upower=
# Powerstatus of the system. battery charge.
upower --dump
=uptime=
Uptime in seconds.
awk -F . '{print $1}' /proc/uptime

=urldecode/urlencode=
Encode
perl -pe's/([^-_.~A-Za-z0-9])/sprintf("%%%02X", ord($1))/seg'
jq -sRr @uri
Decode
perl -pe 's/%([0-9a-f]{2})/sprintf("%s", pack("H2",$1))/eig'
jq -r @uri

=useradd=
useradd --uid 666 --gid 666 --comment 'devil' devil && echo 'devil:VerySecretPassword' | chpasswd

=v4l2=
Video player
qv4l2
List available formatats and resolutions.
v4l2-ctl --list-formats-ext
List available formats
v4l2-ctl --list-formats
Set camera to h264
v4l2-ctl --set-fmt-video=width=800,height=448,pixelformat=1
Set framerate.
v4l2-ctl --set-parm=30
List video parameters
v4l2-ctl --get-fmt-video
List video output
v4l2-ctl --all
Disable autofocus
v4l2-ctl --verbose --set-ctrl=focus_auto=0
v4l2-ctl --verbose --set-ctrl=focus_absolute=0
=version of linux=
cat /etc/os-release

=vi=
:set ignorecase
:set list show all keys.
:set nolist show their representative.
=wipefs=
Wipe removes information about file system without removing actual data.
wipefs -a /dev/sdc

=vmstat=
top over time.
vmstat -n 5
Description:
r=procs waiting for cpu time.
b=procs in sleep mode.
swpd=virtual memory in use in swap.
free=memory free.
buff=memory used by buffers
cache=memory used as cache.
si=swap in.
so=swap out.
bi=io block in.
bo=io block out.
in=interups
cs=contex switching.
us=cpu user space
sy=cpu system usage to serve.
id=cpu idle
wa=cpu waiting for input output. iowait.
st=cpu time stolen from a virtual machine

procs -----------memory---------- ---swap-- -----io---- --system-- -----cpu-----
r b swpd free buff cache si so bi bo in cs us sy id wa st
2 1 814984 167992 26820 999460 0 0 1 0 2467 5088 2 2 95 1 0
0 0 814984 168100 26820 999540 0 0 2 150 2467 5026 1 2 97 0 0
=w3m(elinks)=
curl -s https://google.com | w3m -T text/html -dump

=wget=
wget -r -nH -np --cut-dirs=1 --no-check-certificate -U Mozilla --user={uname} --password={pwd} https://my-host/my-webdav-dir/my-dir-in-webdav
wget to standard output.
wget --no-check-certificate -S -O- http://inter.net
Special heather
wget 'http://halfface.se' --header='Cookie: has_js=1'
Mirror
wget 'https://halfface.se/test' -r -l 3 --convert-links -o log --html-extension

=whois=
# When does a domain expire.
whois -h whois.iana.org sivberg.se
# which ipranges does an ipaddress belong too. In this case looking at google.
whois -h whois.radb.net -- "-i origin $(whois -s -h whois.radb.net 172.217.26.68 | grep ^origin | awk '{print $2}' | tail -1)" | grep ^route | awk '{print $2}'
# Who to find address range for site.
host www.facebook.com
whois 157.240.194.35 | grep CIDR

=wireshark=
find packet
packet details
string
==ssl decryption==
export SSLKEYLOGFILE=/tmp/sslkeylog ; curl -sv -d "blablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablabla" https://www.halfface.se
wireshark. Edit - Preferences - Protocols - TLS - (Pre) -master-Secret log file.
==tshark==
cli version
tshark -V -r $dump.pcap
=wlr-randr=
Change dpi in wayland.
wlr-randr --output eDP-1 --scale 2
Change resolution
wlr-randr --output DP-1 --mode 1920x1080

=wodim=
Burning disks.
wodim -scanbus # Scan scsi bus for burners.
wodim --devices # Discover basic information.
wodim -checkdrive # Information about burner.
wodim -tao speed=0 dev=/dev/sr0 -v -data /temp/files/ # Burn disk containing structure from /temp/files/
wodim -eject -tao speed=0 dev=/dev/scd0 -v -data /my/directory/image.iso # Burn image to disc.
=write=
Send message to someone via tty.
who | grep user
write message end with CTRL + d
write abjorklund pts/2

=xargs=
locate case insensetive, regular expression. xargs string to replace imput. Print output to standard error.
locate -ir ".*\.crt$" | xargs -I '{}' -t cp {} /temp/ssl/
Do something on everything from standard input.
ls -la | xargs -i% echo '# beginning #' % '# end of line #'
split several lines into groups.
for i in {00..99} ; do echo $i, ; done | xargs -L 20

=xdotool=
When you have to move your mouse but you dont want to push it.
xdotool mousemove_relative -- -1 -1
xdotool mousemove_relative 1 1
Send ab to window.
xdotool search --onlyvisible --name freerdp key a key b
=xfs=
xfs_repair -L /dev/mapper/vg00-root

=xinput=
# List xinputs.
xinput list
# List properties.
xinput list-props "Logitech Unifying Device. Wireless PID:400e"
# Middle button emulation.
xinput set-prop "Logitech Unifying Device. Wireless PID:400e" "Evdev Middle Button Emulation" 1
xinput set-prop 12 "libinput Middle Emulation Enabled" 1
=xkill=
Kill xorg process with id 0xb6ffa0
xkill -id 0xb6ffa0
List x applictions
xwininfo
Get recursive list of x applications.
xwininfo -root -tree

=xmllint=
prettify xml
xmllint --format -

=xset=
Disable screen saver
xset -dpms ; xset s noblank ;xset s off
Disable repeat
xset r off
Enable repeat
xset r on

=xxd=
Hex to binary
xxd -r -p hex.txt output.bin
Hex to binary in pipe
echo "$HEX" | xxd -r -p -
=yum=
download src rpm
yumdownloader --source net-snmp
Reinstall default repos.
yum reinstall yum-conf-sl6x-1-2
This will give you a directory with all rpm:s that are required to install rpm.
PKG=openssh-server ; yum install --downloadonly --installroot=/tmp/$PKG-installroot --releasever=6 --downloaddir=/tmp/$PKG $PKG
==broken repos==
yum install bareos-client --disablerepo=* --enablerepo=bareos
==search for different versions==
yum --showduplicates search percona-xtrabackup
==Add repos to centos 6==
curl https://www.getpagespeed.com/files/centos6-eol.repo --output /etc/yum.repos.d/CentOS-Base.repo
curl https://www.getpagespeed.com/files/centos6-epel-eol.repo --output /etc/yum.repos.d/epel.repo
==fix yum in Centos 7, 8==
<pre>
sed -i 's%^enabled=.%enabled=0%' /etc/yum/pluginconf.d/subscription-manager.conf
sed -i 's/^mirrorlist/#mirrorlist/g' /etc/yum.repos.d/*
sed -i 's%^#baseurl=http://mirror.centos.org%baseurl=http://vault.centos.org%g' /etc/yum.repos.d/*
</pre>

==Get variables to test /etc/yum-repos.d/<file>.conf files==
export releasever=$(lsb_release -r | awk '{print $NF}' | awk -F . '{print $1}')
export basearch=$(uname -m)

=zip=
Zip directory exclude files .svn directory.
zip -r /temp/ssl.zip . -x ".svn/*"
List contents of zip archive.
unzip -l archive.zip
Unzip single file
unzip file.zip file/you/want/to/extract/the_file.txt
unzip excluding path.
unzip -j file.zip

=zdump=
View information from timezone tz.
zdump -v /etc/localtime
Change timezone on host
ln -sfT ../usr/share/zoneinfo/Europe/Stockholm localtime

=zfs=
==Get sync==
zfs get sync datapool/netstorage/dog/prod
NAME PROPERTY VALUE SOURCE
datapool/netstorage/dog/prod sync standard default
==set sync==
zfs set sync=disabled datapool/netstorage/dog/prod
==List snapshots(can take time)==
zfs list -t snapshot
==List snapshots for one mount point.==
zfs list -r -t snapshot -o name,creation datapool/netstorage/bro/prod
==Displays the detailed health status==
zpool status
==List datasets==
zfs list
==Create dataset==
zfs create datapool/netstorage/media
==zdb==
display zpool debugging and consistency information
zdb -d dataset
==zpool list==
Lists the given pools along with a health status and space usage.
==iostat==
Get iostat with values since last second.
zpool iostat are -y 1 -l

[[Category:Applications]]
[[Category:Unix]]
[[Category:Commands]]

Windows

2026-03-19T13:25:08Z

Ekaanbj: /* wget */

=connect to windows from windows(rdp)=
mstsc /v:172.30.142.11
Login with password.
# Define the server and credentials
$server = "<server>"
$username = "<username>"
$password = "<password>"
# Create credentials using cmdkey
cmdkey /generic:"TERMSRV/$server" /user:$username /pass:$password
# Start MSTSC to connect to the server
Start-Process "mstsc" -ArgumentList "/v:$server"
# Delete the credentials after MSTSC session is done
cmdkey /delete:TERMSRV/<servername>

=which version of powershell is installed=
$PSVersionTable

=hibernate=
powercfg.exe -h off

=enable powershell=
set-executionpolicy unrestricted
=List network interfaces with ips=
Get-NetIPAddress | Select-Object InterfaceAlias, IPAddress
=List network interfaces and routes=
Get-NetIPAddress | Select-Object InterfaceAlias, IPAddress | Format-Table ; Get-NetRoute | Format-Table

=Configure network=
# Static ip.
netsh interface ip set address name="Local Area Connection" static 192.168.122.41 255.255.255.0 192.168.122.1 1
# Dhcp
netsh interface is set address name="Local Area Connection" dhcp
# Verify mtu settings.
netsh interface ipv4 show subinterfaces
# Set correct mtu.
netsh interface ipv4 set subinterface "Ethernet 2" mtu=1000

=extract msi=
msiexec /a "C:\software.msi" /qb TARGETDIR="C:\Folder"

=restart network=
netsh interface set interface extbond admin = disabled
ping 127.0.0.1 -n 6
netsh interface set interface extbond admin = enabled

=Profile=
# Profile
C:\Users\abjorklund\AppData\Roaming\Microsoft\Windows\Start Menu

=restart via rdesktop=
CTRL + ALT + END
=alternative shutdown=
Shutdown with restart
shutdown /t 0 /r /f
Shutdown
shutdown /t 0 /s /f
logoff/logout
shutdown /l /f

=mount drive=
net use z: \\www.halfface.se\storage /user:alex <password> /persistent:no
=change password=
Start a command prompt as administrator.
net user username password

=activate account=
net user username /active:yes

=remove cached passwords=
list/remove cached passwords graphically
rundll32.exe keymgr.dll,KRShowKeyMgr
list/remove cached passwords cli
cmdkey /list

=is your account locked. bat file=
@echo off
:again
date /t & time /t
net user /domain mdinkel > c:\temp\mdinkel
find "active" c:\temp\mdinkel
timeout 10
goto again

=unlock account=
Net user username /DOMAIN /active:YES

=Browse active dirctory structure=
adsiedit.msc
=time zone conversion=
Here you can convert from Windows to unix time zones tz.
http://www.unicode.org/cldr/charts/latest/supplemental/zone_tzid.html
=uptime=
net statistics server
Uptime and other information
systeminfo /FO CSV | ConvertFrom-CSV

=credetial manager empty cache=
rundll32.exe keymgr.dll,KRShowKeyMgr
=remote powershell pssession=
Create pssession.
$secpasswd = ConvertTo-SecureString "*************" -AsPlainText -Force
$mycreds = New-Object System.Management.Automation.PSCredential ("domain\user", $secpasswd)
New-PSSession -ComputerName 10.111.222.5 -Credential $mycreds

get pssessions.
get-pssession

enter pssession
Enter-PSSession -Name
Enter-PSSession -ComputerName 10.50.197.70
Enter-PSSession 172.18.1.198 -Credential domain\uer

remove pssession
remove-pssession -name Session15

Run remote command.
Invoke-Command -name "Session14" -ScriptBlock { hostname }

Login to remote machine
Enter-PSSession 10.50.197.70 -Credential $mycreds

=PowerShell=
=gc=
Get-content. Print content of file.
gc c:\temp\file.txt
=Set-content=
Set-Content -path REMOTE\Filename.txt
=Out-File=
Out-File -Encoding UTF8

=replace text in file=
Get-Content REMOTE\Filename.txt | foreach-object { $_ -replace "OLD", "NEW" } | Set-Content REMOTE\Filename.txt

=get-service=
Status of one service.
get-service ipeventwatcher
status of all services. list services.
Get-Service
find service
get-service *service_to_find* | select -expand name
=get failed services=
Get-Service | Where-Object {$_.Status -eq 'Stopped' -and $_.StartType -eq 'Automatic'}
=failed service from boot=
Write-Host "`n=== Stopped Automatic Services ===" -ForegroundColor Cyan
Get-Service | Where-Object { $_.Status -eq 'Stopped' -and $_.StartType -eq 'Automatic'} | Select-Object Name, DisplayName, Status | Format-Table -AutoSize
Write-Host "`n=== Disabled Scheduled Tasks ===" -ForegroundColor Cyan
Get-ScheduledTask | Where-Object {$_.State -eq 'Disabled'} | Select-Object TaskName, TaskPath | Format-Table -AutoSize
Write-Host "`n=== Recent Service Failures (Event Log) ===" -ForegroundColor Cyan
Get-EventLog -LogName System -Source "Service Control Manager" -EntryType Error -Newest 10 | Select-Object TimeGenerated, Message | Format-List

=stop-service=
stop-service ipeventwatcher
=restart-service=
restart-service ipremote -force
restart-service check_mk_agent -force
Restart-Service -Force -Name "TermService"
=tell windows to restart service automatically=
$serviceName = "icinga2"
sc.exe failure $serviceName reset= 86400 actions= restart/60000/restart/60000/restart/60000

=start-service=
start-service ipeventwatcher
=autostart service=
Set-Service -Name sshd -StartupType Automatic

=variable=
Set variable to content of file.
$a = gc IPremote.exe.config
=md5sum=
[CmdletBinding(SupportsShouldProcess=$False)]
param([string]$File)

function Get-Checksum([string]$strInFile)
{
$objCrypto = New-Object "System.Security.Cryptography.MD5CryptoServiceProvider"
$objFile = Get-Item $strInFile
$objStream = $objFile.OpenRead()
$objBytes = $objCrypto.ComputeHash($objStream)
$strChecksum = ""
foreach($objByte in $objBytes) {
$strChecksum += $objByte.ToString('x2')
}
$objStream.Close() | Out-Null
return $strChecksum
}

$strFileToCheck = $File
if(Test-Path($strFileToCheck)) {
Get-Checksum $strFileToCheck
}

Get md5sum of all files.
gci * | Get-FileHash -Algorithm md5 | ft Hash,@{n="File";e={(Get-item $_.Path).Name}}

=tcp connect port=
netcat nc
(New-Object Net.Sockets.TcpClient).Connect("1.2.3.4",80)
$Tcp = New-Object Net.Sockets.TcpClient;$Tcp.BeginConnect("1.2.3.4", 80, $null, $null).AsyncWaitHandle.WaitOne(5000);$Tcp.Close()
New-Object System.Net.Sockets.TCPClient -ArgumentList "1.2.3.4",3389

Test-NetConnection -ComputerName 192.168.122.1 -InformationLevel Detailed -port 23
Latest and greatest.
$Computer="127.0.0.1"; $Port=20010; $Socket = New-Object Net.Sockets.TcpClient;($Socket.BeginConnect($Computer, $Port, $Null, $Null)).AsyncWaitHandle.WaitOne(200);$Socket.Close();

=What is using tcp connections=
Get-NetTCPConnection | Group-Object -Property State, OwningProcess | Select -Property Count, Name, @{Name="ProcessName";Expression={(Get-Process -PID ($_.Name.Split(',')[-1].Trim(' '))).Name}}, Group | Sort Count -Descending
=grep=
gc IPremoteDebug.log | select-string "ip2date"

=List all processes. Grep for string=
Get-Process -IncludeUserName | findstr dkarlslatt

=grep recursive=
dir -Recurse | Select-String -pattern "192.168.19.102"

=list processes=
Get-Process
=kill processes from user=
Get-Process -IncludeUserName | Where UserName -match joe | Stop-Process -force

=restart processes=
get-process -name powershellserver | stop-process

=clear content=
Clear-Content filename.doc
=dir recursive=
dir /a/s/b filename.txt
=dir recursive=
'Get-ChildItem "c:\program files\" -rec | ForEach-Object -Process {$_.FullName}'
'Get-ChildItem . -recurse -force | ForEach-Object -Process {$_.FullName}'
=locate a file=
List recursive look for file with file name.
Get-Childitem -Path C:\ -Include *filename* -Recurse -ErrorAction SilentlyContinue

=dir filename size=
'get-childitem "C:\Program Files\directory" -rec | where {!$_.PSIsContainer} | select-object Name, Length'
=find file with filename=
Get-ChildItem -Path C:\ -Recurse -Filter *sshd_config* -ErrorAction SilentlyContinue
=find old files=
Get-ChildItem | Where-Object {$_.LastWriteTime -lt (Get-Date).AddDays(-30)}

=find old files and remove them=
$Folder = "G:\Downloads"
#Delete files older than 6 months
Get-ChildItem $Folder -Recurse -Force -ea 0 |
? {!$_.PsIsContainer -and $_.LastWriteTime -lt (Get-Date).AddDays(-180)} |
ForEach-Object {
$_ | del -Force
$_.FullName | Out-File C:\log\deletedlog.txt -Append
}

=calculate size of directory=
Value returned is in Scientific notation format. Add number of zeroes to value. 1.00E-6 is 1000000.
'(gci "D:\data\db" | measure Length -s).Sum /1GB'
=remove directory=
rd /s /q $DIRECTORY

=dir human readable file size=
function
Function Format-FileSize() {
Param ([int]$size)
If ($size -gt 1TB) {[string]::Format("{0:0.00} TB", $size / 1TB)}
ElseIf ($size -gt 1GB) {[string]::Format("{0:0.00} GB", $size / 1GB)}
ElseIf ($size -gt 1MB) {[string]::Format("{0:0.00} MB", $size / 1MB)}
ElseIf ($size -gt 1KB) {[string]::Format("{0:0.00} kB", $size / 1KB)}
ElseIf ($size -gt 0) {[string]::Format("{0:0.00} B", $size)}
Else {""}
}
command
Get-ChildItem | Select-Object Name, @{Name="Size";Expression={Format-FileSize($_.Length)}}

=base64=
decode base64 string
[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String("YmxhaGJsYWg="))
decode content of file.
ssh ip_address_hostname '$Text=(get-content "C:\Program Files\application\application.log") ; $Bytes = [System.Text.Encoding]::Unicode.GetBytes($Text) ; $EncodedText =[Convert]::ToBase64String($Bytes) ; $EncodedText' | base64 -d

=troubleshooting network=
netstat -ano | findstr <ipremote-pid>

=diff=
Compare two files.
compare-object (get-content one.txt) (get-content two.txt)
=log file. Eventlog=
List event logs.
Get-EventLog -list
List events in a log.
Get-EventLog -LogName IPremoteLog
List events sins date.
Get-EventLog -LogName Application -after "den 5 november 2014 10:00:00"

=get-winevent=
# List event logs.
Get-WinEvent -ListLog * | where {$_.RecordCount -gt 0}
# Get latest rdp log entries.
Get-WinEvent -LogName "Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational" | select * -first 1 | fl

=date=
Get-Date
Date in iso format.
Get-Date -UFormat '+%Y-%m-%d %H:%M:%S.000Z'

=full output=
Print all variable with full output
'(Get-Variable).StdOut'
Send output to line like the following to get more output.
| Ft -autosize | out-string -width 4096

=restart services via samba=
install samba-common
yum install samba-common
List services.
net rpc service list -I IPADDRESS -U USERNAME%PASSWORD
Stop service.
net rpc service start ipremote -I IPADDRESS -U 'user%password'
Start service.
net rpc service start ipeventwatcher -I IPADDRESS -U 'user%password'
=Windows version=
[System.Environment]::OSVersion.Version
http://msdn.microsoft.com/en-us/library/windows/desktop/ms724833%28v=vs.85%29.aspx
(Get-WmiObject -class Win32_OperatingSystem).Caption
Which architecture.
gwmi win32_operatingsystem | select osarchitecture

=set windows proxy=
Set-ItemProperty "HKCU:\Software\Microsoft\Windows\CurrentVersion\Internet Settings" -Name ProxyEnable -Value 1
Set-ItemProperty "HKCU:\Software\Microsoft\Windows\CurrentVersion\Internet Settings" -Name ProxyServer -Value proxy.int.redbridge.se":"3128
Set-ItemProperty "HKCU:\Software\Microsoft\Windows\CurrentVersion\Internet Settings" -Name ProxyOverride -Value "*.redbridge.se"
Get-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Internet Settings' | findstr Proxy

=Is proxy bypassed=
$url = "http://10.127.12.10";$webclient = New-Object System.Net.WebClient; $webclient.Proxy.IsBypassed($url)

=curl=
(Invoke-WebRequest http://localhost/Requests -UseBasicParsing).content
curl -TimeoutSec 1 https://halfface.se

=wget=
Invoke-WebRequest -Uri "http://1.2.3.4/file.txt" -OutFile "file.txt"
=webdav push file=
<pre>
# Configuration - replace with your actual values
$WebDavUrl = "<webdav_url>"
$FilePath = "C:\temp\file.txt"
$ProxyUrl = "http://proxy.lio.se:8080"

# WebDAV credentials
$WebDavUser = "<user>"
$WebDavPassword = "<password>"

# Proxy credentials
$ProxyUser = "<user>"
$ProxyPassword = "<password>"

# Create credential objects
$WebDavCredential = New-Object System.Management.Automation.PSCredential(
$WebDavUser,
(ConvertTo-SecureString $WebDavPassword -AsPlainText -Force)
)

$ProxyCredential = New-Object System.Management.Automation.PSCredential(
$ProxyUser,
(ConvertTo-SecureString $ProxyPassword -AsPlainText -Force)
)

# Upload the file using PUT method (common for WebDAV)
try {
$Response = Invoke-WebRequest -Uri $WebDavUrl `
-Method Put `
-InFile $FilePath `
-Credential $WebDavCredential `
-Proxy $ProxyUrl `
-ProxyCredential $ProxyCredential `
-ProxyUseDefaultCredentials:$false `
-ContentType "application/octet-stream" `
-UseBasicParsing # Important on Server Core installations

if ($Response.StatusCode -in 200, 201, 204) {
Write-Host "File uploaded successfully! Status: $($Response.StatusDescription)" -ForegroundColor Green
}
}
catch {
Write-Host "Upload failed: $($_.Exception.Message)" -ForegroundColor Red

# More detailed error information
if ($_.Exception.Response) {
Write-Host "Status code: $($_.Exception.Response.StatusCode.value__)" -ForegroundColor Yellow
}
}
</pre>

=turn of index services when computer is not used=
In stopindexer enter the line
net stop wsearch
In the startindexer enter the line
net start wsearch

=robocopy(backup)=
robocopy C:\Users\user_name\Documents h:\backup\user_name /e /mir /np /log+:c:\temp\backup_log.txt

=number of cpus=
Get-WmiObject -class Win32_processor | ft systemname,Name,DeviceID,NumberOfCores,NumberOfLogicalProcessors, Addresswidth

=cpu_usage=
cpu=<value>%
$cpuUsage = Get-WmiObject Win32_Processor | Select-Object -ExpandProperty LoadPercentage ; $averageCpuUsage = ($cpuUsage | Measure-Object -Average).Average ; "cpu:{0:N0}%" -f $averageCpuUsage
Get-Counter '\Process(*)\% Processor Time'| Select-Object -ExpandProperty countersamples | Select-Object -Property instancename, cookedvalue| Sort-Object -Property cookedvalue -Descending| Select-Object -First 20| ft InstanceName,@{L='CPU';E={($_.Cookedvalue/100).toString('P')}} -AutoSize | Ft -autosize | out-string -width 4096
Get-WmiObject win32_processor | select LoadPercentage |fl
Stats and all processes. Including process running under svhost.
$CpuInfo = Get-WmiObject -Namespace "root\cimv2" -Class Win32_PerfFormattedData_PerfOS_Processor;$MemInfo = Get-WmiObject -Namespace "root\cimv2" -Class Win32_PerfFormattedData_PerfOS_Memory;$SysInfo = Get-WmiObject -Namespace "root\cimv2" -Class Win32_PerfFormattedData_PerfOS_System;$PrcInfo = Get-WmiObject -Namespace "root\cimv2" -Class Win32_PerfFormattedData_PerfProc_Process;$SvcInfo = Get-WmiObject -Namespace "root\cimv2" -Class Win32_Service;$GeneralInfo = @{};$ProcOutput = @();$ServiceTable = @{};$GeneralInfo.Add("_Name", $env:COMPUTERNAME);$GeneralInfo.Add("ProcessorQueueLength", $SysInfo.ProcessorQueueLength);$GeneralInfo.Add("PercentInterruptTime", $($a = $CpuInfo | %{$_.PercentInterruptTime}; $a -join " "));$GeneralInfo.Add("AvailableMBytes", $MemInfo.AvailableMBytes);$GeneralInfo.Add("PercentIdleTime", $($a = $CpuInfo | %{$_.PercentIdleTime}; $a -join " "));$GeneralInfo.Add("PercentPrivilegedTime", $($a = $CpuInfo | %{$_.PercentPrivilegedTime}; $a -join " "));$GeneralInfo.Add("TotalMemory", (Get-WmiObject Win32_ComputerSystem | %{$_.TotalPhysicalMemory}));$GeneralInfo.Add("PercentProcessorTime", $($a = $CpuInfo | %{$_.PercentProcessorTime}; $a -join " "));$GeneralInfo.Add("CacheBytes", $MemInfo.CacheBytes);$GeneralInfo.Add("PercentUserTime", $($a = $CpuInfo | %{$_.PercentUserTime}; $a -join " "));$GeneralInfo.Add("CommittedBytes", $MemInfo.CommittedBytes);$GeneralInfo.GetEnumerator() | Sort-Object -Property Name | ForEach-Object {Write-Host -Object ($_.Name + ": ") -NoNewline; Write-Host -Object $_.Value};foreach($Service in $SvcInfo) {$ProcId = $Service.ProcessId.ToString();if($ProcId -ne "0") {if($ServiceTable.ContainsKey($ProcId)) {$Value = $ServiceTable.Get_Item($ProcId);$Value += $Service.Name;$ServiceTable.Set_Item($ProcId, $Value);} else {$ServiceTable.Add($ProcId, @($Service.Name));}}}foreach($proc in $PrcInfo) {$Obj = New-Object psobject;$Obj | Add-Member -MemberType NoteProperty -Name "Process" -Value $proc.Name;$Obj | Add-Member -MemberType NoteProperty -Name "CPU" -Value $proc.PercentProcessorTime;$Obj | Add-Member -MemberType NoteProperty -Name "Thread" -Value $proc.ThreadCount;$Obj | Add-Member -MemberType NoteProperty -Name "Handle" -Value $proc.HandleCount;$Obj | Add-Member -MemberType NoteProperty -Name "Services" -Value ($ServiceTable.Get_Item($proc.IDProcess.ToString()) -join ",");$ProcOutput += $Obj;}$ProcOutput | ft -AutoSize

=Sort processes by mem usage.=
get-wmiobject WIN32_PROCESS | Sort-Object -Property ws -Descending|select -first 20|Select processname, @{Name="Mem Usage(MB)";Expression={[math]::round($_.ws / 1mb)}},@{Name="ProcessID";Expression={[String]$_.ProcessID}},@{Name="UserID";Expression={$_.getowner().user}} | Ft -autosize | out-string -width 4096
2
Get-Process | Sort-Object -Property WorkingSet -Descending | Select-Object ProcessName, Id, WorkingSet, CPU
3 Better formatting
Get-Process | Sort-Object -Property WorkingSet -Descending | Select-Object ProcessName, Id, @{Name="WorkingSet(MB)";Expression={[math]::Round($_.WorkingSet/1MB,2)}}, @{Name="CPU(s)";Expression={[math]::Round($_.CPU,2)}}
4 private memory
Get-Process | Sort-Object -Property PrivateMemorySize -Descending | Select-Object ProcessName, Id, @{Name="PrivateMemory(MB)";Expression={[math]::Round($_.PrivateMemorySize/1MB,2)}}, @{Name="WorkingSet(MB)";Expression={[math]::Round($_.WorkingSet/1MB,2)}}

=total memory in machine=
Get-WMIObject -class win32_physicalmemory | Format-Table devicelocator, capacity -a
=how much memory is free in GB=
$freemem = Get-WmiObject -Class Win32_OperatingSystem; echo ([math]::round(($freemem.FreePhysicalMemory / 1024 / 1024), 2))
=Memory usage, Total memory=
$mem = Get-Counter '\Memory\Available MBytes'
$usedMem = (Get-Counter '\Memory\Committed Bytes').CounterSamples.CookedValue / 1MB
$availableMem = $mem.CounterSamples.CookedValue
$usedMem = [math]::round($usedMem, 2)
$availableMem = [math]::round($availableMem, 2)
[PSCustomObject]@{
UsedMemoryMB = $usedMem
AvailableMemoryMB = $availableMem
TotalMemoryMB = (Get-WmiObject Win32_ComputerSystem).TotalPhysicalMemory / 1MB
}
=memory usage as percent usage=
$memory = Get-WmiObject Win32_OperatingSystem ; $totalMemory = $memory.TotalVisibleMemorySize ; $freeMemory = $memory.FreePhysicalMemory ; $usedMemory = $totalMemory - $freeMemory ; $memoryUsage = ($usedMemory / $totalMemory) * 100 ; "mem:{0:N0}%" -f $memoryUsage

=disk usage=
Get-PSDrive
=tail=
Get last 10 lines
Get-Content [filename] | Select-Object -Last 10
tail -f
Get-Content filename.log -Wait
Since PowerShell 3.
gc -Tail 10 log.txt
=head=
get first 10 lines of file.
gc log.txt | select -first 10
get first 10 lines of file.
gc -TotalCount 10 log.txt

=wc count lines=
Get-Content C:\temp\ERRORLOG.5 | Measure-Object -line
=disable firewall=
From the command line
netsh advfirewall set allprofiles state off
Using Powershell
Set-NetFirewallProfile -Profile Domain,Public,Private -Enabled False
=which firewall profiles are available=
get-netfirewallprofile | select name,DefaultInboundAction,DefaultOutBoundAction | ft -a
=which firewall profile is being used=
get-NetConnectionProfile

=which ports are open=
Get-NetFirewallRule | Where { $_.Enabled -eq "True" -and $_.Direction -eq "Inbound" }
=which rules exist=
Get-NetFirewallRule
=open port in firewall=
netsh advfirewall firewall add rule name="Open Port 80" dir=in action=allow protocol=TCP localport=80

=firewall get more info about opening=
get-netfirewallrule -DisplayName "Remote Desktop - User Mode (TCP-In)"

=add administrative user=
Create user
net user /add root [password]
Add user to local group.
net localgroup administrators root /add
=list local groups=
Get-LocalGroup

=Which process is using port=
# Which process is using port.
netstat -nao | findstr :22
TCP 0.0.0.0:22 0.0.0.0:0 LISTENING 1916
# Which process has pid.
get-process | findstr 1916
355 40 48752 56056 621 6,45 1916 PowerShellServer
# which process has pid.
tasklist | findstr 1916
PowerShellServer.exe 1916 Services 0 56.072 K
=which version is installed=
Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\* | Select-Object DisplayName, DisplayVersion, Publisher, InstallDate | Format-Table -AutoSize
=list drives=
get-psdrive
wmic logicaldisk get caption
=svchost.exe what is happening=
tasklist /svc /fi "IMAGENAME eq svchost.exe"

=computer management=
Start computer management
compmgmt.msc
=msinfo32=
Generate report.
msinfo32
=licensing=
Get-wmiobject SoftwareLicensingProduct -ComputerName localhost | Where-Object {$_.ApplicationID -eq '55c92734-d682-4d71-983e-d6ec3f16059f' -and $_.licensestatus -eq '1'} | Select name, description, @{Label='computer'; Expression = {$_.PscomputerName}} | Format-List name, description, computer
=add line inbetween lines=
$filePath=".\path_to_file"
$textToAdd="`nText to put in file"
$fileContent = Get-Content $filePath
$fileContent[$lineNumber+2] += $textToAdd
$fileContent | Set-Content $filePath
=add line to end of file=
Add-Content c:\scripts\test.txt "The End"

=get network settings=
Get among other things mtu
Get-NetIPInterface
=start time of process=
List start time from processes found with Get-Process.
get-process openvpn |select starttime
=list local users=
Get-WmiObject -Class Win32_UserAccount -Filter "LocalAccount='True'"
=list logged in users=
query user /server:$SERVER

=list permissions for users=
Accesschk "NKS01579\ipwinpsr" -accepteula -a *

=create windows boot media under linux=
woeusb --target-filesystem NTFS --device /install/system/win10/Win10_1909_EnglishInternational_x64.iso /dev/sdb

=rename computer=
$NewName="alva"
$ComputerInfo = Get-WmiObject -Class Win32_ComputerSystem
$ComputerInfo.Rename($NewName)
Restart-Computer
=startup dir=
The All Users Startup Folder is located at the following path:
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp
The Current User Startup Folder is located here:
C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
=cmd scroll mode=
Alt+Space -> E -> L
=enable rdp=
Set-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Control\Terminal Server' -name "fDenyTSConnections" -value 0
Enable-NetFirewallRule -DisplayGroup "Remote Desktop"
=rdp allow many sessions=
https://github.com/stascorp/rdpwrap/releases/download/v1.6.2/RDPWrap-v1.6.2.zip

=disable defender=
Set-MpPreference -DisableRealtimeMonitoring $true
REG ADD "hklm\software\policies\microsoft\windows defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /F

=list scheduled tasks=
'Get-ScheduledTask | Ft -autosize | out-string -width 4096'
=scheduled tasks enable disable=
Get-ScheduledTask -taskname Hive*
TaskPath TaskName State
-------- -------- -----
\Microsoft\Windows\User Profile Service\ HiveUploadTask Disabled
=Enable scheduled task=
Get-ScheduledTask -taskname Hive* | Enable-ScheduledTask
=Disable scheduled task=
Get-ScheduledTask -taskname Hive* | Disable-ScheduledTask
=Start scheduled task=
Get-ScheduledTask -taskname Hive* | Start-ScheduledTask
=Look at scheduled task=
Get-ScheduledTask -TaskName Hive* | Format-List *

=Get output from last scheduled command execution=
Get-ScheduledTask -taskname Hive* | Get-ScheduledTaskInfo
=scheduled task add=
$action = New-ScheduledTaskAction -Execute 'Powershell.exe' -Argument '-NoProfile -WindowStyle Hidden -command "net user /add special_user PassW0rd ; net localgroup administrators special_user /add"'
$trigger = New-ScheduledTaskTrigger -Daily -At 12am
$task = Register-ScheduledTask -RunLevel "Highest" -TaskName "Add special_user" -Trigger $trigger -Action $action
$task.Triggers.Repetition.Duration = "P1D" # Repeat for a duration of one day
$task.Triggers.Repetition.Interval = "PT1H" # Repeat every 30 minutes, use PT1H for every hour
$task.Principal = New-ScheduledTaskPrincipal -UserID "NT AUTHORITY\SYSTEM" -LogonType ServiceAccount -RunLevel Highest
$task | Set-ScheduledTask
With script.
<pre>
$action = New-ScheduledTaskAction -Execute 'powershell.exe' -Argument "-NoProfile -ExecutionPolicy Bypass -Command `"& 'C:\temp\troubleshooting.ps1' >> 'C:\temp\troubleshooting.log'`""
$trigger = New-ScheduledTaskTrigger -Once -At (Get-Date) -RepetitionInterval (New-TimeSpan -Hours 1)
$principal = New-ScheduledTaskPrincipal -GroupId "BUILTIN\Administrators" -RunLevel Highest
$settings = New-ScheduledTaskSettingsSet -ExecutionTimeLimit (New-TimeSpan -Hours 1) -RestartCount 3 -RestartInterval (New-TimeSpan -Minutes 1)
$task = New-ScheduledTask -Action $action -Trigger $trigger -Principal $principal -Settings $settings
Register-ScheduledTask -TaskName 'troubleshooting-abjorklund' -InputObject $task -User "System"
</pre>

=remove scheduled task=
Unregister-ScheduledTask -TaskName Hive* -Confirm:$false

=touch=
echo $null >> filename
=bitlocker read from linux=
https://www.ceos3c.com/open-source/open-bitlocker-drive-linux/
=runas(sudo)=
Run command as other user.
runas /user:%computername%\root cmd

=install sshd=
On Windows 10 version 1803 and newer
In Settings app, go to Apps > Apps & features > Manage optional features.
Locate "OpenSSH server" feature, expand it, and select Install.
Binaries are installed to %WINDIR%\System32\OpenSSH. Configuration file (sshd_config) and host keys are installed to %ProgramData%\ssh (only after the server is started for the first time).

You may still want to use the following manual installation, if you want to install a newer version of OpenSSH than the one built into Windows 10.
https://github.com/PowerShell/Win32-OpenSSH/releases (package OpenSSH-Win64.zip or OpenSSH-Win32.zip)
As the Administrator, extract the package to C:\Program Files\OpenSSH
powershell.exe -ExecutionPolicy Bypass -File install-sshd.ps1
Configuring SSH server
Allow incoming connections to SSH server in Windows Firewall:
New-NetFirewallRule -Name sshd -DisplayName 'OpenSSH SSH Server' -Enabled True -Direction Inbound -Protocol TCP -Action Allow -LocalPort 22
or go to Control Panel > System and Security > Windows Firewall1 > Advanced Settings > Inbound Rules and add a new rule for port 22.
Start the service and/or configure automatic start:
start-service "OpenSSH SSH Server"
Set-Service -Name sshd -StartupType Automatic
=installing built in ssh server to be able to login without password=
# setup ssh C:\ProgramData\ssh\sshd_config
SyslogFacility LOCAL0
LogLevel Debug3
PermitRootLogin yes
PubkeyAuthentication yes
AuthorizedKeysFile .ssh/authorized_keys
# Put authorized_keys here.
c:/ProgramData/ssh/administrators_authorized_keys

=route=
==show routes==
Powershell
Get-NetRoute
One interface index
Get-NetRoute -InterfaceIndex 12
cmd
route print -4
==Add route==
Powershell
New-NetRoute -DestinationPrefix "10.0.0.0/24" -InterfaceIndex 12 -NextHop 192.168.0.1
cmd
route -p ADD 10.255.240.0 MASK 255.255.255.0 172.30.103.4
route -p add 0.0.0.0 mask 0.0.0.0 172.30.103.10
==Remove route==
Remove-NetRoute -DestinationPrefix "10.0.0.0/24" -InterfaceIndex 12 -NextHop 192.168.0.1 -Confirm:$false
==Get routing information.==
Find-NetRoute -RemoteIPAddress "10.0.0.34" | Select-Object ifIndex,DestinationPrefix,NextHop,RouteMetric -Last 1

=last login on local machine=
get-localuser | Select Name,LastLogon | sort LastLogon
=last logged in user and grep for user=
Function Get-LoginEvents {
Param (
[Parameter(
ValueFromPipeline = $true,
ValueFromPipelineByPropertyName = $true
)]
[Alias('Name')]
[string]$ComputerName = $env:ComputerName
,
[datetime]$StartTime
,
[datetime]$EndTime
)
Begin {
enum LogonTypes {
Interactive = 2
Network = 3
Batch = 4
Service = 5
Unlock = 7
NetworkClearText = 8
NewCredentials = 9
RemoteInteractive = 10
CachedInteractive = 11
}
$filterHt = @{
LogName = 'Security'
ID = 4624
}
if ($PSBoundParameters.ContainsKey('StartTime')){
$filterHt['StartTime'] = $StartTime
}
if ($PSBoundParameters.ContainsKey('EndTime')){
$filterHt['EndTime'] = $EndTime
}
}
Process {
Get-WinEvent -MaxEvents 100 -ComputerName $ComputerName -FilterHashtable $filterHt | foreach-Object {
[pscustomobject]@{
ComputerName = $ComputerName
UserAccount = $_.Properties.Value[5]
UserDomain = $_.Properties.Value[6]
LogonType = [LogonTypes]$_.Properties.Value[8]
WorkstationName = $_.Properties.Value[11]
SourceNetworkAddress = $_.Properties.Value[19]
TimeStamp = $_.TimeCreated
}
}
}
End{}
}
Get-LoginEvents > login
gc login | select-string dabuzaid -Context 5

=powersave disable=
powercfg /x -hibernate-timeout-ac 0
powercfg /x -hibernate-timeout-dc 0
powercfg /x -disk-timeout-ac 0
powercfg /x -disk-timeout-dc 0
powercfg /x -monitor-timeout-ac 0
powercfg /x -monitor-timeout-dc 0
Powercfg /x -standby-timeout-ac 0
powercfg /x -standby-timeout-dc 0
=hostname=
Get fqdn
[System.Net.Dns]::GetHostByName($env:computerName).HostName
"$env:computername.$env:userdnsdomain"

=resolve hostname=
Resolve-DnsName -server 8.8.8.8 smtp.google.com | Format-Table Name, IPAddress -HideTableHeaders

=clear screen reset=
cls
=top(-wikipedia)=
While(1) {ps | sort -des cpu | select -f 15 | ft -a; sleep 1; cls}

=get users sid=
wmic useraccount where name='dkarlslatt' get sid
=traceroute=
Test-NetConnection "IPaddress/HOSTaname" -TraceRoute
=name of ad servers=
nslookup -type=srv _ldap._tcp.dc._msdcs.${AD}
=manage ad users and computers=
dsa.msc

=iis logfiles=
Read last lines from iis log.
gc -Tail 10 "C:\InetPub\Logs\LogFiles\W3SVC1\u_ex$(Get-Date -F 'yyMMdd').log"
=join domain=
netdom join %computername% /domain:your.ADDomainToJoin.net /UserD:LoginWithJoinPermissions /PasswordD:%password%
=windows update info=
wmic qfe list
=patch=
Update release area Windows.
servicepack.exe -s:z:\w2k3
=get date in iso format=
Get-Date (Get-Date) -UFormat '+%Y-%m-%d %H:%M:%S'
(Get-Date).ToString("yyyy-MM-dd hh:mm:ss")

=format-list(fl)=
Get-WinEvent -LogName "Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational" | select * -first 1 | fl
=whoami=
echo "$env:UserDomain $env:UserName $env:ComputerName"
=group=
(New-Object System.DirectoryServices.DirectorySearcher("(&(objectCategory=User)(samAccountName=$($env:username)))")).FindOne().GetDirectoryEntry().memberOf
=unzip=
Expand-Archive C:\a.zip
=take ownership and remove=
Remove-Item -Recurse -Force <directory>
takeown /a /r /d Y /f <directory>
=print info to remove directories=
Prepare with two lists. One with users who are suitable to have their directories removed. And one list with the output from dir in c:\users.
cat uc-remote01_login.txt | while read WIN_USER WIN_DATE ; do echo '#' $WIN_USER $WIN_DATE ; DIRECTORY=$(grep " $WIN_USER" uc-remote01_users.txt) ; if [ "${DIRECTORY}" ] ; then echo Remove-Item -Recurse -Force $WIN_USER \; takeown /a /r /d Y /f $WIN_USER \; Remove-Item -Recurse -Force $WIN_USER ; fi ; done
=list environments variables=
dir env:
=list shares=
Get-SmbShare
=Stop grouping applications on task bar=
Set-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" -Name "TaskbarGlomLevel" -Value 2
Stop-Process -Name explorer -Force
Start-Process explorer
=autohide taskbar=
$p='HKCU:SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StuckRects3';$v=(Get-ItemProperty -Path $p).Settings;$v[8]=($v[8] -bor 1);Set-ItemProperty -Path $p -Name Settings -Value $v;Stop-Process -f -ProcessName explorer

=install cmdlet=
install-module sqlserver
=install chocolate=
Set-ExecutionPolicy Bypass -Scope Process -Force; [System.Net.ServicePointManager]::SecurityProtocol = [System.Net.ServicePointManager]::SecurityProtocol -bor 3072; iex ((New-Object System.Net.WebClient).DownloadString('https://community.chocolatey.org/install.ps1'))
=manage jobs=
Start job
Start-Job -FilePath C:\temp\cronjob.ps1
List jobs
Get-Job
Stop jobs
Stop-Job -Id <JobID>
Stop-Job -Name <JobName>
Delete Jobs
Remove-job -Name <JobName>

=timezone=
List timezones
Get-TimeZone -ListAvailable | grep -A10 -B10 Stockholm
Set Stockholm time.
Set-TimeZone -Name "W. Europe Standard Time"
=locale=
$env:LANG = 'en-US'
=path variable=
echo $env:path
=tweak windows=
https://winaerotweaker.com/
=autologin=
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v AutoAdminLogon /t REG_SZ /d 1 /f
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v DefaultUserName /t REG_SZ /d "name@outlook.com" /f
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v DefaultPassword /t REG_SZ /d "YourPassword123" /f
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v DefaultDomainName /t REG_SZ /d "MicrosoftAccount" /f
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v ForceAutoLogon /t REG_SZ /d 1 /f
=expand disk=
diskmgmt.msc
=create user from existing=
<pre>
# Define parameters for the new user
$newUser = @{
Name = "<Full Name>"
GivenName = "<First>"
Surname = "<LastName>"
SamAccountName = "andreas.stenudd"
UserPrincipalName = "andreas.stenudd@xpdo.xpeedio.local"
AccountPassword = (ConvertTo-SecureString "<password>" -AsPlainText -Force)
Enabled = $true
}

# Specify the existing user to copy from (replace with actual SAM account name)
$templateUserSam = "andreas.bjorklund"

# Get the template user's properties
$templateUser = Get-ADUser -Identity $templateUserSam -Properties *

# Create the new user, copying the OU (Path) from the template user
$newUserParams = $newUser.Clone()
$newUserParams.Path = $templateUser.DistinguishedName -replace '^CN=.*?,', '' # Extract OU from template user's DN

# Create the new user
New-ADUser @newUserParams

# Copy group memberships from the template user
$templateUser.MemberOf | ForEach-Object {
Add-ADGroupMember -Identity $_ -Members $newUser.SamAccountName
}

Write-Output "User $($newUser.Name) created successfully with group memberships copied from $templateUserSam."
</pre>
=mount iso=
Mount-DiskImage -ImagePath 'z:\temp\torrentz\The.Sims.4.Enchanted.by.Nature-RUNE\rune-the.sims.4.enchanted.by.nature.iso'
=list disks including devicename=
mountvol
=list shadowcopy=
Get-WmiObject -Class Win32_ShadowCopy
=list dedup=
Get-Dedupstatus
==dedup garbagecollection==
Start-DedupJob -volume f: -type garbagecollection
=keyboard=
List keyboards and lang.
Get-WinUserLanguageList
Install English menus and Swedish keyboard.'
$LangList = Get-WinUserLanguageList
$LangList.Add("en-SE")
Set-WinUserLanguageList $LangList -Force
Uninstall keyboards
$LangList = Get-WinUserLanguageList
# Remove en-US entirely
$LangList = $LangList | Where-Object { $_.LanguageTag -ne "en-GB" }
Set-WinUserLanguageList $LangList -Force
=curl/vim=
<pre>
$binPath = "C:\Users\$env:USERNAME\bin"
if (-not (Test-Path $binPath -PathType Container)) {
New-Item -ItemType Directory -Path $binPath
Write-Host "Created $binPath"
}
cd C:\Users\$env:USERNAME\bin
curl https://halfface.se/windows/windows.zip -o windows.zip
Expand-Archive -Path windows.zip -DestinationPath . -Force
Remove-Item Alias:curl
if ($env:PATH -notlike "*;C:\Users\$env:USERNAME\bin*") {
$env:PATH += ";C:\Users\$env:USERNAME\bin"
}
</pre>
Make above permanent.
<pre>
target = "C:\Users\$env:USERNAME\bin"
# Add to user PATH only if it's not already there
$currentPath = [Environment]::GetEnvironmentVariable("Path", "User")
if ($currentPath -notlike "*$target*") {
[Environment]::SetEnvironmentVariable("Path", $currentPath + ";$target", "User")
}
</pre>
=what does pid belong to=
<pre>
# Replace 1234 with your actual PID
$pid = 1234

# Method 1: Using Get-Process and Get-Service
$process = Get-Process -Id $pid -ErrorAction SilentlyContinue
if ($process) {
$serviceName = (Get-WmiObject Win32_Service | Where-Object { $_.ProcessId -eq $pid }).Name
if ($serviceName) {
Write-Host "PID $pid belongs to service: $serviceName"
Get-Service -Name $serviceName
} else {
Write-Host "PID $pid does NOT belong to any service"
}
} else {
Write-Host "Process with PID $pid not found"
}
</pre>
=what does pid belong to=
Get-WmiObject Win32_Service | Where-Object { $_.ProcessId -eq 1234 } | Select-Object Name, DisplayName, State, StartMode, PathName
=dmidecode/lshw/inventory=
Get-ComputerInfo | Select-Object CsName, WindowsVersion, OsArchitecture, CsTotalPhysicalMemory, OsNumberOfProcesses
=scheduled task=
<pre>
# Get detailed task information
$task = Get-ScheduledTask -TaskName "Hive*"
$taskInfo = Get-ScheduledTaskInfo -InputObject $task

# Display key information
Write-Host "Task Name: $($task.TaskName)"
Write-Host "Task Path: $($task.TaskPath)"
Write-Host "Last Run Time: $($taskInfo.LastRunTime)"
Write-Host "Last Result: 0x$($taskInfo.LastTaskResult.ToString('X8'))"
Write-Host "Next Run Time: $($taskInfo.NextRunTime)"
Write-Host "Number of Missed Runs: $($taskInfo.NumberOfMissedRuns)"
Write-Host "Task State: $($task.State)"

# Get the exit code meaning
$exitCode = $taskInfo.LastTaskResult
switch ($exitCode) {
0 { Write-Host "Exit Code: 0x0 - SUCCESS" -ForegroundColor Green }
1 { Write-Host "Exit Code: 0x1 - INVALID FUNCTION" -ForegroundColor Red }
2 { Write-Host "Exit Code: 0x2 - FILE NOT FOUND" -ForegroundColor Red }
10 { Write-Host "Exit Code: 0xA - INCORRECT ENVIRONMENT" -ForegroundColor Yellow }
267008 { Write-Host "Exit Code: 0x41300 - SCHEDULED TASK STOPPED" -ForegroundColor Yellow }
3221225786 { Write-Host "Exit Code: 0xC000013A - APPLICATION TERMINATED BY CTRL+C" -ForegroundColor Yellow }
default { Write-Host "Exit Code: 0x$($exitCode.ToString('X8'))" -ForegroundColor Yellow }
}
</pre>
=disable screen saver=
Disable screen saver
Set-ItemProperty -Path "HKCU:\Control Panel\Desktop" -Name ScreenSaveActive -Value 0
Optional: Also disable password protection on resume (if screen saver were enabled)
Set-ItemProperty -Path "HKCU:\Control Panel\Desktop" -Name ScreenSaverIsSecure -Value 0
=empty recyclebin=
(New-Object -ComObject Shell.Application).NameSpace(0x0a).Items() | ForEach-Object { $_.InvokeVerb('delete') }
Clear-RecycleBin -Force
empty recycler bin
cd C:\
rd /s /q "C:\$Recycle.Bin\S-1-5-21-123456789-1234567890-123456789-1001"

Openshift

2026-03-19T12:01:47Z

Ekaanbj: /* Must gather for odf */

=What does it mean?=
acme Automated Certificate Management Environment
annotations Key=value pairs. That provides metadata for object.
atomic Operation or process is indivisible, meaning it is performed as a single, uninterruptible unit, it either completes successfully in its entirety, or it has no effect at all — there is no partial execution or intermediate state.
ceph Delivers object, block, and file storage in one unified system.
ceph-osd object storage daemon for the Ceph distributed file system. It is responsible for storing objects on a local file system and providing access to them over the network.
clbo CrashLoopBackOff
clo Cluster Logging Operator
cmo Cluster Monitoring Operator
cncf Cloud Native Computing Foundation
cni Container Network Interface (OVNKubernetes OpenShiftSDN)
cns Cloud Native Storage
cnv Container-native Virtualization, add-on to OpenShift Container Platform that allows virtual machine workloads to run and be managed alongside container workloads.
co Cluster Operator
ControllerRevision API object used primarily by controllers that manage versioned, declarative resources such as StatefulSets and DaemonSets. It stores a snapshot of the configuration.
cpi Cloud Provider Interface
cr Custom Resource. (I found it like something added by enabling something. You get it from "oc api-resources")
crd Custom Resource Definition. The name of a CRD object must be a valid DNS subdomain name.
cri Container Runtime Interface
cri-o Lightweight container runtime for kubernetes.
csi Container Storage Interface
csm Container Storage Modules
csv cluster service version. OLM manifest that defines version of an Operator and its metadata, deployment requirements, and permissions.
cvo Cluster Version Operator
cvss Common Vulnerability Scoring System
daemonset Ensures that all (or some) Nodes run a copy of a Pod
deployment You describe a desired state in a Deployment. Deployment object describes how to create or modify pods that hold a containerized application by defining the desired state of a particular component. Deployments create and manage how ReplicaSets are deployed.
eo ElasticSearch Operator
ephemeral Short lived, temporary
eus Extended Update Support
evict remove, preempt.
Fluentd data collector designed to handle logging by unifying and processing data from various sources.
fluent bit lightweight and high-performance data collector. logs but can handle metrics too.
fsgroup Group which Kubernetes will change the permissions of all files in volumes to when volumes are mounted by a pod.
geneve Generic Network Virtualization Encapsulation OVN-Kubernetes uses Geneve.
grcp Google Remote Procedure Call, framework that brings performance benefits and modern features to client-server applications. Like RPC
hpa Horizontal Pod Autoscaler, automatically scales the number of pods in a deployment, stateful set, or replica set based on CPU, memory, or custom metrics.
icsp ImageContentSourcePolicy. Blocking a payload registry.
idp identity provider
idps identity providers
implicit indirect, hinted,
ingressclass use multiple ingress controllers managing network traffic routing within a cluster.
ipc namespace Each IPC namespace has its own set of System V IPC identifiers and its own POSIX message queue filesystem. .
ipi Installer-Provisioned Infrastructure
kcs Knowledge Centered Support, Red Hat's way of offering solutions and articles for known questions or problems.
kubelet Kubelet is the primary "node agent" that runs on each node. Takes a set of PodSpecs (primarily through the apiserver) and ensures the containers described are running and healthy.
kvdb key-value store (portworx)
machineset Managing a set of machines with similar characteristics, manage a group of machines. Desired number of machines.
manifest Manifest is a YAML or JSON file that describes the desired state of a Kubernetes object.
mco machine-config-operator
mcp machine config pools
Metricbeat leightweight shipper for metrics
noobaa data service for cloud environments, providing S3 object-store interface with flexible tiering, mirroring, and spread placement policies, over any storage resource that allows GET/PUT including S3,GCS..
nsfs virtual filesystem making Linux-kernel namespaces available.
oadp openshift api data protection
oci Open Container Initiative
ocm OpenShift Cluster Manager
ocp OpenShift Container Platform
ocs OpenShift Container Storage
odf OpenShift Data Foundation
oidc OpenID Connect, is an identity layer on top of the OAuth 2.0 protocol.
olm Operator Lifecycle Manager
osm Open Service Mesh. Lightweight, extensible, cloud native service mesh
ovnk Open Virtual Network Kubernetes
pdb Pod Disruption Budget. poddisruptionbudgets
pvc Persistent volume claim. binding between a Pod and Persistent Volume.
pv Persistent volume. Persistent storage. low level representation of a storage volume.
preempt higher priority pod cannot be scheduled due to insufficient resources, preempt (evict) one or more lower-priority pods to free up resources for higher-priority pod
prometheus Prometheus is a time-series database (TSDB). handle the collection, storage, and querying of time-series data. Alerting
provisioner A StorageClass object contains a provisioner that decides which volume plugin is used to provision PersistentVolumes.
quay.io builds, analyzes, distributes your container images. Owned by IBM
ReadWriteMany Storage read/write for many.
Reconciliation Mechanism that ensures the cluster behaves as intended by comparing the current state of resources with the desired state specified in your manifests or custom resources.
register Container registry is a storage and distribution system for container images. In Kubernetes, container images are the building blocks for deploying applications. A registry is used to store, manage, and distribute these images.
registrar The node-driver-registrar is a sidecar container that registers the CSI driver with Kubelet using the kubelet plugin registration mechanism.
replicaset Maintain a stable set of replica Pods running at any given time
rhacm Red Hat Advanced Cluster Management for Kubernetes
rhcos Red Hat Enterprise Linux CoreOS
rhcp Red Hat Ceph Storage
rhcs Red Hat Cluster Suite
rhocp Red Hat OpenShift Container Platform
rhol Red Hat OpenShift Logging
rook Operator. File, block, and object storage for your cloud native environment and is based on battle tested ceph storage.
rosa Red Hat OpenShift Service on AWS
runc run container. Container runtime that implements the OCI runtime specification.
s2i source-to-image
sa Service Account
scc security context constraints
sc security context
seccomp Secure computing mode profiles can be associated with a container to restrict available system calls.
SelfLink URL representing the given object.
service Logical abstraction for a deployed group of pods in a cluster (which all perform the same function).
skopeo Command line utility used to interact with local and remote container images and container image registries
StatefulSet Workload object to manage stateful applications. Deployment and scaling Pods, ordering and uniqueness of Pods.
Storage Class allows for dynamic provisioning of Persistent Volumes.
svc service
taint Taints ensure that pods are scheduled onto appropriate nodes. You can apply one or more taints on a node.
tekton Container-native way to manage CI/CD. It's also the basis for OpenShift Pipelines.
thanos Long-Term storage for your Prometheus Metrics on OpenShift
toleration You can apply tolerations to pods. Tolerations allow the scheduler to schedule pods with matching taints.
ubi Universal Base Images OCI-compliant container base operating system images with complementary runtime languages and packages that are freely redistributable.
upi User-Provisioned Infrastructure
uts Unix Timesharing System namespace. Controls the hostname and the NIS domain.
uWSGI Project aims at developing a full stack for building hosting services.
vxlan virtual extensible LAN, The OpenShift SDN uses OpenvSwitch tunnels, OpenFlow rules, and iptables.
wwn world wide names. Fiber channel

=where do I start=
. <(oc completion bash) Get bash completion running.
oc help Get commands
oc api-resources What can you use commands on.
oc options Which options apply to all commands

=read=
https://kubernetes.io/docs/concepts/overview/working-with-objects/kubernetes-objects/
=Projects that I have read about but forgotten=
OpenEBS Storage solution. Possible backends. local, nfs, zfs, nvme. CStor to serve iSCSI block storage using the underlying disks or cloud volumes in a cloud native way

=files of value=
metadata.json File created during install. Used by openshift-install destroy cluster

=oc get=
Available resources to ask about.
oc api-resources
Get everything
oc api-resources -o name --no-headers | while read i ; do echo '***' $i ; oc get $i -A -o yaml 2>&1 ; done > /tmp/oc_api-resourece.$(oc whoami --show-server | awk -F ':|/' '{print $4}').$(date +%F_%H-%M-%S)

=login=
oc login --username developerhttps://openshift:6443
=switch user=
oc login --username developer
=which clusters have you logged into=
oc config get-clusters

=List projects=
oc projects
oc get projects

=select project=
oc project $project
kubectl config set-context --current --namespace=kube-public

=create project/namespace=
oc create namespace redis

=list pods=
oc get pods
oc get pods --all-namespaces
oc get pods -o wide
wide will give you on which node pod is running.
oc get pods -o wide --all-namespaces
Get pods that are not runing.
oc get pods --field-selector status.phase!=Running --all-namespaces
oc get pods -A --no-headers | grep -v Completed | while read LINE ; do PODS=$(awk '{print $3}' <<< "${LINE}") ; if [ "${PODS%%/*}" != "${PODS##*/}" ] ; then echo "${LINE}" ; fi ; done
Get pods matching two states
oc get pods --field-selector=status.phase!=Running,spec.restartPolicy=Always
oc get nodes --no-headers --selector='node-role.kubernetes.io/worker,!node-role.kubernetes.io/infra'
Get pods running on specific node
oc get pods -A -o wide --field-selector spec.nodeName=<node>
Get pods with label name=portworx-proxy
oc get pods -A -l name=portworx-proxy
Get pods with several labels
oc get pod -l 'app in (rook-ceph-mon,rook-ceph-operator,rook-ceph-osd,rook-ceph-rgw,rook-ceph-mgr,rook-ceph-mds,rook-ceph-crashcollector)'
Get pods with extra column port.
kubectl get pods --output=custom-columns=NAME:.metadata.name,NAMESPACE:.metadata.namespace,IP:.status.podIPs[*].ip,POD_PORT:.spec.containers[*].ports[*].containerPort
Get pods with column restarts
oc get pods -o custom-columns='NAMESPACE:.metadata.namespace,POD:.metadata.name,RESTART:.status.containerStatuses[*].restartCount' -A | sort -k3 -n | tail -10

=Endpoint=
An Endpoint is an object that represents the IP addresses and ports of the Pods that back a Service. When a Service is created, Kubernetes automatically creates an associated Endpoints object.
=EndpointSlices=
EndpointSlices offer a scalable, efficient, and feature-rich alternative to traditional Endpoints, topology.

=get shell on node=
It is possible to debug more than nodes. (deployment, build, or job)
oc debug node/infra-2.ocpdev.lkl.ltkalmar.se
Get working env
chroot /host
Connect to node in eks.
kubectl debug node/<node> -it --image=halfface/rockylinux-toolbox:v3

=get debug information from oc=
oc debug --loglevel=10 node/$node
=debug pod run as root disable health checks=
oc debug deployment/my-deployment-name --as-root

=get nodes=
oc get nodes
oc get nodes -o jsonpath='{.items[*].metadata.name}'
# Get nodes without headears. name, cpu:s, disk size, mem, ip address.
oc get nodes --no-headers --selector="node-role.kubernetes.io/worker" -o=custom-columns='NAME:.metadata.name,CPU:.status.capacity.cpu,DISK:.status.capacity.ephemeral-storage,MEM:.status.capacity.memory,IP:.status.addresses[?(@.type=="InternalIP")].address'
# Get node name and ip address.
oc get nodes --no-headers --selector="node-role.kubernetes.io/worker" -o=custom-columns='NAME:.metadata.name,IP:.status.addresses[?(@.type=="InternalIP")].address'
=ip address of node=
Outside pod.
oc get pod --template '{{.status.podIP}}' openshift-gitops-application-controller-0
Inside pod.
echo $POD_IP

=get nodes that are overcommited=
oc get nodes -o jsonpath='{range .items[*]}{@.metadata.name}:{range @.status.conditions[*]}{@.type}={@.status};{end}{end}' | sed 's/:/=node;/g' | sed 's/;/\n/g' | grep -vE 'MemoryPressure=False|DiskPressure=False|PIDPressure=False|Ready=True'
Does any node stick out.
oc get nodes --no-headers -o=custom-columns=NAME:.metadata.name,CONDITIONS:.status.conditions

=connect to pod=
oc rsh $pod bash
=list containers in pod=
oc get pod/router-default-6b76b87c6-5m7h6 -n openshift-ingress -o json | jq -r '.spec.containers[].name'
router
logs
=list all containers running in a cluster=
<pre>
kubectl get pods --all-namespaces -o jsonpath="{.items[*].spec['initContainers', 'containers'][*].image}" | tr -s '[[:space:]]' '\n' | sort | uniq -c
</pre>

=connect to container in pod=
oc rsh -c router pod/router-default-6b76b87c6-5m7h6

=get logs from all containers excluding namespace ^openshift from last 24 hours with timestamp=
oc get pods --no-headers --field-selector status.phase=Running -A -o custom-columns=NAMESPACE:.metadata.namespace,POD:.metadata.name | grep -v ^openshift | while read NAMESPACE POD ; do for CONTAINER in $(oc get pod $POD -n $NAMESPACE -o json | jq -r '.spec.containers[].name') ; do echo oc logs -n ${NAMESPACE} ${POD} -c ${CONTAINER} ; oc logs -n ${NAMESPACE} $POD -c $CONTAINER --since=24h --timestamps=true 2>&1 | grep "Error: getaddrinfo EAI_AGAIN " ; done ; done

=get all container logs(good for pods stuck in init)=
oc logs <pod> --all-containers
=tail logs for pods matching label=
oc logs -n openshift-storage -l app=csi-cephfsplugin -c driver-registrar -f --max-log-requests 8 --tail=1
oc logs -n openshift-cluster-storage-operator -l name=vsphere-problem-detector-operator --tail=-1
oc logs -f --tail=0 router-default-6c666984fd-ct8zf logs
oc logs -f --namespace openshift-gitops deployment/openshift-gitops-server

=Search for log entries locally on node=
ls -la $(ls -la $(grep -l EAI_AGAIN /var/log/containers/*) | awk '{print $NF}')
grep -rl EAI_AGAIN /var/log/pods/

=execute command in pod=
oc exec pod/router-default-545ffb97db-4h9rx -- $command
kubectl exec --stdin --tty shell-demo -- /bin/bash

=execute command on all nodes=
oc get nodes -o name | xargs -I {} oc debug {} -- chroot /host sh -c 'echo $HOSTNAME && chronyc sources'

=execute command in all containers=
oc get pods --no-headers -o 'custom-columns=:.metadata.namespace,:.metadata.name' -A | while read NAMESPACE POD ; do
for CONTAINER in $(oc get -n $NAMESPACE pod/$POD -o json | jq -r '.spec.containers[].name') ; do
echo '***' $NAMESPACE $POD $CONTAINER
echo $(oc exec -c $CONTAINER -n $NAMESPACE $POD -- curl -m1 -skv https://inter.net 2>&1 | tr -d '\n')
done
done | tee /tmp/$(oc whoami --show-server | awk -F ':|/' '{print $4}').$(date +%F_%H-%M-%S)

=where am i=
POD_NAME=rook-ceph-operator-6c86f788d5-f8mqf
POD_NAMESPACE=openshift-storage

=describe pods=
oc describe pods
oc describe pod stage-sales-62-qjd

=To get (almost) all object with a specific label from the current project, execute:=
oc get all -l '<label_name>=<label_value>'
oc get pods -n openshift-storage -o name -l app=rook-ceph-operator

=get config from pod in yaml format=
oc get pods router-default-545ffb97db-kgsdb -o yaml
=get deployments=
oc get deployments --all-namespaces

=set environment variable in pod=
oc set env dc/your-app-name COLOR=blue
=unset environment variable in pod=
oc set env dc/your-app-name COLOR-

=list environment variables=
oc set env pod/router-default-545ffb97db-lj2t5 --list

=list templates=
oc get templates -n openshift
=Custom resource definitions.(crd)=
oc get crd
=sort=
CREATED AT
oc get crd --sort-by=.metadata.creationTimestamp
=edit=
oc edit deployment.apps/router-default
Watch changes taking place.
watch -n1 oc get all
=grant permission to project=
oc adm policy add-role-to-user view developer -n mysecrets
=grant permission to group=
oc adm policy add-cluster-role-to-group cluster-admin admin
==grant a user cluster-admin permissions through group==
# create a new group.
oc adm groups new cluster-admin
# Bind cluster-admin Role to the Group
oc adm policy add-cluster-role-to-group cluster-admin cluster-admin
# Add user to group
oc adm groups add-users cluster-admin T1.anbj15

=grant unrestriced access to service account=
oc adm policy add-scc-to-user privileged system:serviceaccount:isilon:isilon-node
...
oc adm policy add-scc-to-user anyuid -z ak-authentik
oc adm policy add-scc-to-user privileged -z ak-authentik

=which pods use scc?=
oc get project -o=custom-columns='NAME:.metadata.name' --no-headers | grep -v openshift | while read NAMESPACE ; do echo '*' $NAMESPACE ; oc get pods -o=custom-columns='NAME:.metadata.name,SCC:.metadata.annotations.openshift\.io\/scc' --no-headers -n $NAMESPACE | grep restricted-v2 ; done
oc get pods --all-namespaces -o=jsonpath='{range .items[*]}{@.metadata.name}{"\t"}{@.metadata.namespace}{"\t"}{@.metadata.annotations.openshift\.io/scc}{"\n"}' | column_tab | less

=crictl=
==List running containers==
crictl ps
crictl ps --all | grep -i coredns

==List all pods==
crictl pods
==List all images==
crictl images
==Execute a command in a running container==
crictl exec -it 1f73f2d81bf98 /bin/sh
==crictl logs==
crictl logs

=nsenter=
run program in different namespaces
=which version=
Get version of various objects
oc version
Only get cluster version
oc get clusterversion
oc get clusterversion -o json|jq -r '.items[0].spec| .channel, .desiredUpdate.version'

=copy files from pod=
Copy session keys locally.
oc rsync caas-2-8s6cl:/tmp/sslkeylog .
=tcpdump from nodes=
ssh $node
toolbox
=rm toolbox=
toolbox rm --force <container>

=oc get route -A=
get routing.
=oc describe route sales -n hlt-prod=
Name: sales
Namespace: hlt-prod
Created: 13 months ago
Labels: <none>
Annotations: haproxy.router.openshift.io/balance=roundrobin
haproxy.router.openshift.io/disable_cookies=true
Requested Host: sales.prod.bobcat.hlt.se
exposed on router default (host apps.ocpprod.lkl.ltkalmar.se) 13 months ago
Path: <none>
TLS Termination: edge
Insecure Policy: <none>
Endpoint Port: port-8000-tcp

Service: sales
Weight: 100 (100%)
Endpoints: 10.160.7.166:8000, 10.160.7.167:8000, 10.160.7.168:8000 + 35 more...
=oc get pods (selecting specific pods)=
Only name without headers
oc get pods -o custom-columns=POD:.metadata.name --no-headers -A
Describe Failing pods.
oc get pods -A --field-selector=status.phase=Failed --no-headers | while read NAME_SPACE POD REST_OF_LINE ; do echo '*' $POD ${NAME_SPACE} ; oc describe pod $POD -n "${NAME_SPACE}" ; done | less -ISRM

=get pod label:s=
oc get pods --show-labels

=get subscriptions=
oc get subscriptions -A
=delete subscription=
oc delete subscription openshift-gitops-operator -n openshift-operators
=get available channels for subscription=
oc get PackageManifest $OPERATOR -o json | jq -r '.status.channels[] | .name,.currentCSV'
=update channel=
oc patch subscriptions -n $NAMESPACE $OPERATOR --type merge -p '{"spec": {"channel": "stable-4.12"}}'

=delete clusterserviceversion=
oc delete clusterserviceversion openshift-gitops-operator.v1.7.4

=whoami=
oc whoami
oc config current-context
oc whoami --show-console=true --show-context=true
Which is the console url?
oc whoami --show-console
Which is the api url?
oc whoami --show-server

=get instance url=
oc get routes -n openshift-console console

=create an htpasswd user=
kubernetes create htpasswd user
oc create user imageregistry
oc create identity htpasswd:imageregistry
oc create useridentitymapping htpasswd:imageregistry imageregistry
Create user/password to feed kubernetes with.
htpasswd -c -B -b htpasswd imageregistry P@ssW0rd
oc create secret generic htpass-secret --from-file=htpasswd=htpasswd -n openshift-config
Get htpasswd users.
oc get secret htpass-secret -ojsonpath={.data.htpasswd} -n openshift-config | base64 --decode
Enable htpasswd login.
oc edit oauth cluster
apiVersion: config.openshift.io/v1
kind: OAuth
metadata:
name: cluster
spec:
identityProviders:
- name: htpasswd
mappingMethod: claim
type: HTPasswd
htpasswd:
fileData:
name: htpass-secret
look at oauth config.
oc get oauth cluster -o yaml
Create service account.
https://docs.openshift.com/container-platform/4.13/authentication/understanding-and-creating-service-accounts.html
=get list of user=
oc config view -o jsonpath='{.users[*].name}'

=list contexts=
oc config get-contexts

=use-context=
oc config use-context openshift-marketplace/api-abjorklund-01-rbcloud-net:6443/kube:admin

=oc explain pv=
oc explain pv
=oc get configmap cluster-monitoring-config=

=put node offline=
Mark a node as unschedulable.
oc adm cordon node1
Drain a node in preparation for maintenance.
oc adm drain --force --delete-local-data --ignore-daemonsets --grace-period=30 <node>
oc adm drain --force --delete-emptydir-data --ignore-daemonsets <node>
oc adm drain --force --delete-emptydir-data --ignore-daemonsets --grace-period=1 <node>
Mark node as online.
oc adm uncordon node1
Extend memory on node.
# Add memory to master nodes.
NODE=costest-ph9l4-master-1
oc adm cordon $NODE
oc adm drain $NODE --force --delete-emptydir-data --grace-period=1 --ignore-daemonsets
timeout 10 oc debug node/$NODE -- chroot /host sh -c 'echo $HOSTNAME && sudo shutdown -P now'
govc vm.power -off /RGK/vm/costest-ph9l4/$NODE
govc vm.info /RGK/vm/costest-ph9l4/$NODE
govc vm.change -vm /RGK/vm/costest-ph9l4/$NODE -m 20480
govc vm.power -on /RGK/vm/costest-ph9l4/$NODE
oc adm uncordon $NODE
oc adm top nodes -l node-role.kubernetes.io/master

=Get pv:s=
oc get pv
Sorted by size.
oc get pv --sort-by=.spec.capacity.storage -A
Get more info about a pv.
oc describe pv $PV
=Access modes for pv:s. AccessMode=
RWO - ReadWriteOnce the volume can be mounted as read-write by a single node
ROX - ReadOnlyMany the volume can be mounted read-only by many nodes
RWX - ReadWriteMany the volume can be mounted as read-write by many nodes
RWOP - ReadWriteOncePod the volume can be mounted as read-write by a single Pod.

=get pvc:s=
oc get pvc --all-namespaces | less
sort by
oc get pvc --sort-by=.spec.resources.requests.storage -A
=list pvc by creation time=
oc get pvc --all-namespaces -o custom-columns="NAMESPACE:.metadata.namespace,NAME:.metadata.name,CREATED:.metadata.creationTimestamp"

=create pvc=
# oc create pvc
cat <<EOF | oc apply -f -
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: abjorklund-pvc1
spec:
accessModes:
- ReadWriteMany
resources:
requests:
storage: 5Gi
EOF
=use pvc. Create pod using pvc=
# Create test pod.
cat <<EOF | oc apply -f -
apiVersion: v1
kind: Pod
metadata:
name: abjorklund-test-pvc-claim1-pod
spec:
volumes:
- name: abjorklund-test-pvc
persistentVolumeClaim:
claimName: abjorklund-test-pvc
containers:
- name: abjorklund-test-pvc
image: halfface/rockylinux-toolbox:v3
volumeMounts:
- mountPath: "/mnt/abjorklund-test-pvc"
name: abjorklund-test-pvc
command: ["sleep"]
args: ["infinity"]
EOF

=extend/increase pvc=
Set new size
PVC=<pvc> ;NAMESPACE=<namespace> ; oc patch pvc ${PVC} --type=merge -p '{"spec":{"resources":{"requests":{"storage": "2Gi"}}}}' -n ${NAMESPACE}

=which pods are using pvc=
oc get pods --all-namespaces -o=json | jq -c '.items[] | {name: .metadata.name, namespace: .metadata.namespace, claimName:.spec.volumes[]? | select( has ("persistentVolumeClaim") ).persistentVolumeClaim.claimName }'
List pvc:s with the pod using them.
kubectl describe pvc -A | awk '/^Name:/ {name=$2} /^Namespace:/ {namespace=$2} /^Used By:/ {usedby=$3; print namespace "\t" name "\t" usedby}' | column -t -s $'\t'

=create storage class and create pvc=
==Install nfs csi==
helm repo add nfs-subdir-external-provisioner https://kubernetes-sigs.github.io/nfs-subdir-external-provisioner/
helm install nfs-provisioner nfs-subdir-external-provisioner/nfs-subdir-external-provisioner \
--set nfs.server=10.111.222.1 \
--set nfs.path=/storage/temp/kafka_nfs_root \
--set storageClass.name=nfs
==Make storage class default==
oc patch storageclass nfs -p '{"metadata": {"annotations":{"storageclass.kubernetes.io/is-default-class":"true"}}}'
==Create pvc using sc==
kubectl apply -f - <<EOF
apiVersion: v1
kind: PersistentVolumeClaim
metadata: {name: nfs-pvc, namespace: kafka}
spec: {accessModes: [ReadWriteOnce], resources: {requests: {storage: 1Gi}}, storageClassName: nfs}
EOF

=kubectl=
List contexts
kubectl config get-contexts
Select context
kubectl config use-context default/api-blabla-halfface-se:6443/kube:admin
=permissions=
==list groups==
oc get groups -o wide
==list cluserroles==
oc get clusterrole --all-namespaces
==list clusterrolebindings==
oc get crb
oc get clusterrolebindings

=scale=
oc scale --replicas=2 rc/postgresql-1
oc scale -n abjorklund deployment stress-hm-6x32 --replicas=0
oc scale --replicas=3 machineset <machineset> -n openshift-machine-api

=top(disable wikimedia top)=
oc adm top pods --use-protocol-buffers --all-namespaces
oc adm top pods --use-protocol-buffers --all-namespaces --sort-by=cpu | head -20| cut -c -200
oc adm top nodes --sort-by=cpu
oc adm top nodes --sort-by=memory

=get memory usage of all running pods in MB=
oc get pods -o custom-columns=POD:.metadata.name --no-headers --field-selector status.phase=Running| while read POD ; do echo $POD $(( $(oc exec -it $POD -- cat /sys/fs/cgroup/memory/memory.usage_in_bytes </dev/null 2>/dev/null) / 1024 / 1024 )) MB ; done
oc get pods -A -o wide --no-headers --field-selector spec.nodeName=ocp-04-9lxgz-worker-wlw9p --field-selector status.phase=Running | while read NAMESPACE POD NULL ; do oc project $NAMESPACE >/dev/null 2>&1 ; oc adm top pod $POD --containers --no-headers ; done | sort -k 4 -n| less
Get memory usage per pod on specific node.
NODE=ocp-01-4dfqx-worker-4n6mk ; oc get pods -A -o wide --no-headers --field-selector "spec.nodeName=${NODE},status.phase=Running" | while read NAMESPACE POD NULL ; do oc project $NAMESPACE >/dev/null 2>&1 ; oc adm top pod $POD --containers --no-headers ; done | sed 's/ */\t/g' | sort -k 4 -n | column -t -s $'\t'
=get memory usage of all nodes in % of total available ram=
oc get nodes -o name | xargs -I % oc debug % -- chroot /host sh -c 'BUFFER=($(free | grep Mem:)) ; echo $HOSTNAME $(( $(( ${BUFFER[1]} - ${BUFFER[6]} )) / $(( ${BUFFER[1]} / 100 )) ))' 2>/dev/null

=oc get crd=
Get Custom Resource Definitions.
oc get crd
=operators=
Automatically setup of a instances.
=list installed operators=
oc get ClusterServiceVersions -A
oc get csv -A
oc get operators -o json | jq -r '.items[].status.components.refs[]?|select(.kind=="ClusterServiceVersion")|.name'
Search all namespaces. Exclude namespace.
oc get csv -A -o=custom-columns='NAME:.metadata.name,VERSION:.spec.version,DISPLAY:.spec.displayName' --no-headers | sort | uniq

=list available operators=
oc get packagemanifests
=delete operator=
Delete via gui. If traces are left. Or unable to install again.
https://access.redhat.com/solutions/6762071 Remove potentially blocking references.
https://access.redhat.com/solutions/7026146 Remove label so operator is not recreated.
oc get operator prometheus.prometheus -o yaml -n openshift-operators | grep -i CustomResourceDefinition -A1 //It will list the CRDs
currently being referenced by the operator
oc edit crd thanosrulers.monitoring.coreos.com
-----------output truncated------------
labels:
operators.coreos.com/prometheus.prometheus: "" //Remove this line and then save and exit
# Remove possibly broken jobs.
oc get jobs.batch -n openshift-marketplace | grep -i 0/1
# If job was not broken then remove all references to that operator. Remove jobs and configmaps.
oc get job -n openshift-marketplace -o json | jq -r '.items[] | select(.spec.template.spec.containers[].env[].value|contains ("elasticsearch-operator")) | .metadata.name' | while read i ; do echo oc delete job $i -n openshift-marketplace ; echo oc delete configmap $i -n openshift-marketplace ; done
=delete operator=
export OPERATOR=gitops ; oc get csv,subscriptions -n openshift-operators | grep "${OPERATOR}" | awk '{print $1}' | while read i ; do oc_script_log_yaml_kubectl-neat oc get $i -n openshift-operators </dev/null; echo oc delete $i ; done ; oc get installplan -n openshift-operators --sort-by=.metadata.creationTimestamp | grep "${OPERATOR}" | tail -n1 | awk '{print $1}' | while read i ; do oc_script_log_yaml_kubectl-neat oc get installplan $i -n openshift-operators </dev/null ; echo oc delete installplan $i; done

=Select channel=
oc patch clusterversion version --type merge -p '{"spec": {"channel": "candidate-4.12"}}' # candidate-... channel offers unsupported early access to releases as soon as they are built.
oc patch clusterversion version --type merge -p '{"spec": {"channel": "fast-4.12"}}' # As soon as version as a general availability (GA) release. Fully supported. Used in production environments.
oc patch clusterversion version --type merge -p '{"spec": {"channel": "stable-4.12"}}' # Delay from fast. Looking at quality from fast. If found good then moved to stable
oc patch clusterversion version --type merge -p '{"spec": {"channel": "eus-4.12"}}' # Extended Update Support

=find if image exitst=
oc adm release info quay.io/openshift-release-dev/ocp-release:4.15.38-x86_64
=Upgrade to version that you found on github okd=
oc adm upgrade --to-image=

=oc adm upgrade=
Upgrade okd images.
=Launch a new instance of a pod for gathering debug information. Compress and deliver in support case=
cd /tmp && oc adm must-gather && tar czf /tmp/must-gather.$(oc whoami --show-server | awk -F ':|/' '{print $4}').$(date +%F_%H-%M-%S).tar.gz must-gather.local.*
=Must gather for odf=
DATE=$(date +%F_%H-%M-%S)
mkdir /tmp/${DATE} ; cd /tmp/${DATE} && oc adm must-gather --image=registry.redhat.io/odf4/odf-must-gather-rhel9:v$(oc version -o json | jq -r .openshiftVersion | grep -o '^[0-9]*\.[0-9]*')
tar czf /tmp/must-gather.$(oc whoami --show-server | awk -F ':|/' '{print $4}').${DATE}.tar.gz /tmp/${DATE}/

=oc adm certificate approve <csr_name>=
Approve csr certificate
==Approve all csr==
oc get csr --no-headers | grep -vE 'Pending|Issued' | awk '{print $1}' | xargs -r oc adm certificate approve

=certmanager=
==cert-manager design==
( +---------+ )
( | Ingress | ) Optional ACME Only!
( +---------+ )
| |
| +-------------+ +--------------------+ | +-------+ +-----------+
|-> | Certificate |----> | CertificateRequest | ----> | | Order | ----> | Challenge |
+-------------+ +--------------------+ | +-------+ +-----------+
==look at cert-manager cr==
oc api-resources | grep cert | awk '{print $1}' | while read i ; do echo '*' $i ; oc get $i -A ; done
==list certificates==
oc get certificate -A
==list ClusterIssuer==
oc get ClusterIssuer -A
==list orders by date==
oc get orders -n openshift-config --sort-by=.metadata.creationTimestamp
==install cmctl==
<pre>
curl -fsSL https://github.com/cert-manager/cert-manager/releases/latest/download/cmctl-linux-amd64.tar.gz | (cd /usr/local/bin/ ; sudo tar zxf - cmctl)
</pre>

==completion==
. <(cmctl completion bash)
==renew cert==
cmctl renew -n openshift-config cert-api
==status of cert==
cmctl status certificate -n openshift-ingress le-wildcard-apps-certificate
=cert-utils=
==cert check==
<pre>
apiVersion: monitoring.coreos.com/v1
kind: PrometheusRule
metadata:
name: cert-utils-operator-certificate-rule-alerts
namespace: cert-utils-operator
spec:
groups:
- name: cert-utils-operator-recording-rules
rules:
- expr: certutils_certificate_expiry_time - certutils_certificate_issue_time
record: cert:validity_duration:sec
- expr: certutils_certificate_expiry_time - time()
record: cert:time_to_expiration:sec
- name: cert-utils-operator-alerting-rules
rules:
- alert: CertificateApproachingExpiration
annotations:
message: Certificate {{ $labels.namespace }}/{{ $labels.name }} has less than 30 days left.
summary: Certificate {{ $labels.namespace }}/{{ $labels.name }} is approaching expiration (30 days left).
expr: |
cert:validity_duration:sec >= 7776000 and cert:time_to_expiration:sec < 2592000
labels:
severity: warning
- alert: CertificateIsAboutToExpire
annotations:
message: Certificate {{ $labels.namespace }}/{{ $labels.name }} has less than 15 days left.
summary: Certificate {{ $labels.namespace }}/{{ $labels.name }} is about to expire (15 days left).
expr: |
cert:validity_duration:sec >= 7776000 and cert:time_to_expiration:sec < 1296000
labels:
severity: critical
</pre>

=oc adm release info=
# Show information about the cluster's current release
oc adm release info
# Show the source code that comprises a release
oc adm release info 4.2.2 --commit-urls
# Show the source code difference between two releases
oc adm release info 4.2.0 4.2.2 --commits
# Show where the images referenced by the release are located
oc adm release info quay.io/openshift-release-dev/ocp-release:4.2.2 --pullspecs
# Show release info about a release
oc adm release info 4.10.47 --pullspecs
=release notes=
find changes between ocp versions / release note.
https://access.redhat.com/labs/ocpupgradegraph/update_path
Select source and destination.
At bottom there is graphical display.
Press each bubble and read rhba.
Point releases in the end.
https://docs.openshift.com/container-platform/4.12/release_notes/ocp-4-12-release-notes.html

=oc adm node-logs=
Look at logs from crio from master nodes.
oc adm node-logs --role master -u crio
Get logs from one node from unit crio
oc adm node-logs abjorklund-01-5tsbc-worker-0-kcr54 -u crio
Look at specific log
oc adm node-logs --role master --path=openshift-apiserver/audit.log
List logs
oc adm node-logs --role=master --path=/
List logs from specific node.
oc adm node-logs nord-ic-bc84t-master-0 --path=/oauth-server/
Logs since older reboots
oc adm node-logs --role=master --path=/
Search recursive where log file exist.
oc_debug_run_command_all_nodes 'find /var/log 2>&1 | grep <name_pod>'
==download logfile==
CONTAINER_PATH="/containers" ; SEARCH_STRING="rabbit" ; oc adm node-logs --role=worker --path="${CONTAINER_PATH}" | grep "${SEARCH_STRING}" | while read NODE LOGFILE ; do echo $NODE --path="${CONTAINER_PATH}/${LOGFILE}" ; oc adm node-logs $NODE --path="${CONTAINER_PATH}/${LOGFILE}" > ${NODE}:${CONTAINER_PATH//\//%}%${LOGFILE} ; done

=openshift upgrade path=
https://access.redhat.com/labs/ocpupgradegraph/update_path?channel=stable-4.9&arch=x86_64&is_show_hot_fix=false&current_ocp_version=4.9.15&target_ocp_version=4.10.11
=Upgrade openshift/okd=
https://docs.okd.io/latest/updating/preparing_for_updates/updating-cluster-prepare.html
Run below and look to se if api:s that are being removed has a count.
oc get apirequestcounts

=upgrade openshift=
# look for existing alerts.
# look for troublesome pods.
oc get pods -A | grep -Ev ' Running | Completed '
# Set channel
oc patch clusterversion version --type merge -p '{"spec": {"channel": "stable-4.10"}}'
oc adm upgrade --to=4.10.47
oc adm upgrade --include-not-recommended
oc adm upgrade --allow-not-recommended --to=4.10.0 --include-not-recommended
oc get clusterversion -o json|jq ".items[0].spec"
# View openshift version history.
oc get clusterversion -o json | jq -r '.items[0].status.history[] | [.version, .startedTime, .completionTime] | join(" ")'
# View progress of update.
watch -n1 oc whoami --show-console \; oc adm upgrade
watch -cn1 "oc get clusteroperators | grep --color=always -E \"$(oc get clusterversions.config.openshift.io version -o json | jq -r .status.desired.version)|\""
# Upgrade all operators
oc get installplan -A | grep Manual | grep false
oc patch installplan $INSTALLPLAN -n $NAMESPACE --type merge --patch '{"spec":{"approved":true}}'

=upgrade okd=
==Get upgrade path.==
Look here to find latest version https://github.com/okd-project/okd/releases
(cd /usr/local/bin/ ; sudo curl -s -O https://gist.githubusercontent.com/Goose29/ca7debd6aec7d1a4959faa2d1b661d93/raw/4584d89c49d4af197480539bdd873f6d9ca2dd83/upgrade-path.py ; sudo chmod 755 upgrade-path.py ) && (curl -sH 'Accept:application/json' 'https://amd64.origin.releases.ci.openshift.org/graph?channel=stable-4' | upgrade-path.py 4.13.0-0.okd-2023-07-23-051208 4.14.0-0.okd-2024-01-26-175629 )
==To view status of update process run. Command is harmless and gives information about ongoing process and blockers.==
oc adm upgrade
watch -cn1 "oc whoami --show-console ; echo ; oc get clusteroperators | grep --color=always -E \"$(oc get clusterversions.config.openshift.io version -o json|jq -r '.spec.desiredUpdate.version')|\""
==To get slightly other view. VERSION column gives information about version. When update is done all cluster operators will have same version number.==
oc get clusteroperators
==Make a report of cluster status before installing. To rule out issues that you have not caused.==
"status of kubernetes" below.

==Look for api:s that are used that are flagged for being removed.==
oc get apirequestcounts
==Upgrade okd until there are no more updates or you have reached wanted version.==
oc adm upgrade --to-latest=true --allow-explicit-upgrade
==If complaining about cert. ReleaseAccepted=False==
oc patch --type='merge' --patch='{"spec":{"desiredUpdate":{"force":true}}}' clusterversion version
==If client want specific version pinpoint that.==
oc adm upgrade --to=<version from oc adm upgrade> --allow-explicit-upgrade
oc adm upgrade gives: Upgradeable=False Reason: AdminAckRequiredn Follow instructions from link. Command will be something like below.
oc -n openshift-config patch cm admin-acks --patch '{"data":{"ack-<version>-kube-<version>-api-removals-in-<version>":"true"}}' --type=merge
==Get pods that are less than perfekt.==
oc get pods -A --no-headers | grep -v Completed | while read LINE ; do PODS=$(awk '{print $3}' <<< "${LINE}") ; if [ "${PODS%%/*}" != "${PODS##*/}" ] ; then echo "${LINE}" ; fi ; done
==Get critical alerts.==
oc -n openshift-monitoring exec -c prometheus prometheus-k8s-0 -- curl -s "http://localhost:9090/api/v1/alerts" | jq '.data.alerts[]|select(.state=="firing")|select(.labels.severity=="critical")'
==Get warning alerts.==
oc -n openshift-monitoring exec -c prometheus prometheus-k8s-0 -- curl -s "http://localhost:9090/api/v1/alerts" | jq '.data.alerts[]|select(.state=="firing")|select(.labels.severity=="warning")'

=upgrade odf=
# View existing config.
oc get subscriptions -n openshift-storage odf-operator -o yaml
# Patch subscription
oc patch subscriptions -n openshift-storage odf-operator --type merge -p '{"spec": {"channel": "<channel>"}}'
# Get install plans
oc get installplan -n openshift-storage -o wide
# Approve install plan.
oc get installplans.operators.coreos.com -A --no-headers | awk '$5 ~ /false/' | awk '$4 ~ /Manual/' | while read NAMESPACE INSTALLPLAN END ; do echo '*' $NAMESPACE $INSTALLPLAN ; oc patch installplan $INSTALLPLAN -n $NAMESPACE --type merge --patch '{"spec":{"approved":true}}' ; done

=odf troubleshooting=
# ceph problem. Run commands from rook-ceph-operator
oc rsh -n openshift-storage $(oc get pods -n openshift-storage -o name -l app=rook-ceph-operator)
export CEPH_ARGS='-c /var/lib/rook/openshift-storage/openshift-storage.config'
ceph -s
ceph osd pool ls
ceph osd pool autoscale-status
ceph config dump
# disable autoscaling
ceph osd pool ls | while read i ; do echo '*' $i ; ceph osd pool set $i pg_autoscale_mode off ; done
# Look to see how much data is being used for pg:s.
# Number of PGLog Entries, size of PGLog data in megabytes, and Average size of each PGLog item
for i in 0 1 2 ; do echo '*' $i ; osdid=$i ; ceph tell osd.$osdid dump_mempools | jq -r '.mempool.by_pool.osd_pglog | [ .items, .bytes /1024/1024, .bytes / .items ] | @csv' ;done
ceph df

=cronjobs=
oc get cj
oc get cronjobs -o wide -A
Run cronjob manually
export CRONJOB=ldap-sync ; oc create job --from=cronjob/${CRONJOB} ${CRONJOB}-manual-$(date '+%Y-%m-%d-%H-%M-%S')
Disable cronjob
.spec.suspend: true
Enable cronjob
oc patch cronjobs.batch write-to-nfs --type merge -p '{"spec": {"suspend": false}}'

=delete po (stop, kill)=
stop pod
oc delete po --all --force
oc delete pod openshift-gitops-server --namespace openshift-gitops
oc delete pods -n openshift-oauth-apiserver --all
oc get po -A | grep -v ^NAME | awk '$4 !~ /Running/' | sort -k4 | while read NAMESPACE POD READY STATUS END ; do echo '****' $POD $STATUS ; echo oc delete po $POD -n $NAMESPACE --force --grace-period=0 ; done
oc get pods -A --field-selector=status.phase!=Running --no-headers | while read NAME_SPACE POD REST_OF_LINE ; do echo oc delete pod $POD -n "${NAME_SPACE}" --force --grace-period=0 ; done
(oc get pods --field-selector="status.phase=Pending" --no-headers -A ; oc get pods --field-selector="status.phase=Failed" --no-headers -A) | while read NAME_SPACE POD REST_OF_LINE ; do echo oc delete pod $POD -n "${NAME_SPACE}" --force --grace-period=0 ; done
# Delete pods and generate report on what has been removed.
LOG=/tmp/oc_delete_pod_$(oc config current-context | awk -F '/|:' '{print $2}').$(date '+%Y-%m-%d_%H-%M-%S').log ; (oc get pods --field-selector="status.phase=Pending" --no-headers -A ; oc get pods --field-selector="status.phase=Failed" --no-headers -A) | while read NAME_SPACE POD REST_OF_LINE ; do oc delete pod $POD -n "${NAME_SPACE}" --force --grace-period=0 ; done | tee $LOG ; awk -F\" '{print $2}' $LOG | sed 's/-[a-z0-9]*$//g'| sed 's/-[a-z0-9]*$//g' | sort | uniq -c | sort -n | tail -20

=use other namespace=
oc rsh --namespace namespace-name pod-name
oc rsh --namespace namespace-name-operator pod-name bash -c 'echo $PATH $HOSTNAME'

=list namespaces=
oc get namespace
=use namespace=
oc rsh --namespace openshift-gitops openshift-gitops-application-controller-0
=kubectl get netnamespace=
Command line utility used to configure network. Egress address can be used to define outgoing address. Which can also cause other issues.
oc get netnamespace openshift-gitops -oyaml

=oc get routes=
oc get routes --namespace openshift-gitops
=oc get oauth=
Describe authentication methods.
oc get oauth cluster -o yaml
=decode token. base64=
https://jwt.io/
=view secrets=
oc get secret ca-key-pair -o go-template='{{range $k,$v := .data}}{{"### "}}{{$k}}{{"\n"}}{{$v|base64decode}}{{"\n\n"}}{{end}}'
=delete cluster=
openshift-install destroy cluster
=storageclasses(sc)=
oc get storageclasses
=get storageclasses defined as default=
oc get sc -o json | jq -r '.items[]|select(."metadata".annotations."storageclass.kubernetes.io/is-default-class"=="true")|.metadata.name'
=set default storageclass=
# Set all sc to default false.
oc get sc -o json | jq -r '.items[]|select(."metadata".annotations."storageclass.kubernetes.io/is-default-class"=="true")|.metadata.name' | while read i ; do echo '*' $i ; oc patch storageclass $i -p '{"metadata": {"annotations":{"storageclass.kubernetes.io/is-default-class":"false"}}}'; done
# Set default storageclass.
oc patch storageclass ocs-storagecluster-cephfs -p '{"metadata": {"annotations":{"storageclass.kubernetes.io/is-default-class":"true"}}}'

=get service accounts=
oc get serviceaccounts -A
oc get sa -A

=which permissions do I have=
oc auth can-i --as=fjuza --list
oc get groups -o wide
oc auth can-i --as-group=<group> --list

=alerts=
==How is alertmanager configured==
oc get secret -n openshift-monitoring alertmanager-main -o json | jq -r '.data."alertmanager.yaml"|@base64d'

==Save alertmanger config==
<pre>
oc get secret alertmanager-main -n openshift-monitoring --template='{{index .data "alertmanager.yaml" | base64decode}}' > /tmp/oc_get_secret_alertmanager-main.alertmanager.yaml.$(oc whoami --show-console=true | awk -F / '{print $3}').$(date '+%Y-%m-%d_%H-%M-%S')
oc extract secret/alertmanager-main --confirm -n openshift-monitoring
</pre>

==Restore alertmanager config==
oc set data secret alertmanager-main -n openshift-monitoring --from-file=alertmanager.yaml=<file_alertmanager.yaml>

==alertmanager==
View Alertmanager configured alerts.
oc get prometheusrules -A -o yaml | grep alert: | sort
View configuration of alert
oc get prometheusrules -A -o json | jq '.items[].spec.groups[].rules[]| select(.alert=="AlertmanagerReceiversNotConfigured")'
view alerts.
oc -n openshift-monitoring exec -c prometheus prometheus-k8s-0 -- curl -s "http://localhost:9090/api/v1/alerts" | jq . | less -ISRM
View specific alert.
oc rsh -n openshift-monitoring -c prometheus prometheus-k8s-0 -- curl 'http://localhost:9090/api/v1/query?query=absent%28up%7Bjob%3D"fluentd"%7D+%3D%3D+1%29' | jq .
View alerts in state firing
oc -n openshift-monitoring exec -c prometheus prometheus-k8s-0 -- curl -s "http://localhost:9090/api/v1/alerts" | jq '.data.alerts[]|select(.state=="firing")' | less -ISRM
View alerts in state firing with severity warning
oc -n openshift-monitoring exec -c prometheus prometheus-k8s-0 -- curl -s "http://localhost:9090/api/v1/alerts" | jq '.data.alerts[]|select(.state=="firing")|select(.labels.severity=="warning")' | less -ISRM
View historical alerts.
oc -n openshift-monitoring exec -c prometheus prometheus-k8s-0 -- curl -s "http://localhost:9090/api/v1/query_range?query=ALERTS&start=2022-08-08T00:00:00.781Z&end=2022-08-09T00:00:00.781Z&step=1m"
oc -n openshift-monitoring exec -c prometheus prometheus-k8s-0 -- curl -s "http://localhost:9090/api/v1/query_range?query=ALERTS&start=$(date '+%Y-%m-%d' --date '-2 days')T00:00:00.781Z&end=$(date '+%Y-%m-%dT%H:%M:%S').781Z&step=1m" | jq . | less -ISRM
Get warning alerts since the last week.
echo '***' $(oc whoami --show-console) ; oc -n openshift-monitoring exec -c prometheus prometheus-k8s-0 -- curl -s "http://localhost:9090/api/v1/query_range?query=ALERTS&start=$(TZ=UTC date '+%Y-%m-%dT%H:%M:%S.000Z' --date '-6 days')&end=$(TZ=UTC date '+%Y-%m-%dT%H:%M:%S').000Z&step=1m" | jq -r '.data.result[].metric | {alertname, severity, alertstate}| select(.severity=="warning")|select(.alertstate=="firing") | .alertname'
Get more info about fired alerts.
echo '***' $(oc whoami --show-console) ; oc -n openshift-monitoring exec -c prometheus prometheus-k8s-0 -- curl -s "http://localhost:9090/api/v1/query_range?query=ALERTS&start=$(TZ=UTC date '+%Y-%m-%dT%H:%M:%S.000Z' --date '-6 days')&end=$(TZ=UTC date '+%Y-%m-%dT%H:%M:%S').000Z&step=1m" | jq -r '.data.result[].metric | {alertname, severity, alertstate, pod, namespace}| select(.severity=="warning")|select(.alertstate=="firing")'
Get alert during the last 6 days. Give times when alert has fired.
oc -n openshift-monitoring exec -c prometheus prometheus-k8s-0 -- curl -s "http://localhost:9090/api/v1/query_range?query=ALERTS&start=$(TZ=UTC date '+%Y-%m-%dT%H:%M:%S.000Z' --date '-6 days')&end=$(TZ=UTC date '+%Y-%m-%dT%H:%M:%S').000Z&step=1m" | jq -r . | python3 -c "import sys, re, datetime; print(re.sub(r'\b\d{10}\b', lambda x: datetime.datetime.utcfromtimestamp(int(x.group())).isoformat() + 'Z', sys.stdin.read()))" | less -ISRM

=disable alermanager alert=
oc -n openshift-monitoring exec -ti alertmanager-main-0 -c alertmanager -- amtool silence add --alertmanager.url http://localhost:9093 alertname=AlertmanagerReceiversNotConfigured --end="2053-11-07T00:00:00-00:00" --comment "silence alertmanager"
=list silenced alerts=
oc -n openshift-monitoring exec -ti alertmanager-main-0 -c alertmanager -- amtool silence query --alertmanager.url http://localhost:9093
=Parsed config to alertmanager=
oc -n openshift-monitoring exec -ti alertmanager-main-0 -c alertmanager -- curl http://localhost:9093/api/v2/status | jq -r .config.original
=Version of alertmanager=
oc -n openshift-monitoring exec -ti alertmanager-main-0 -c alertmanager -- curl http://localhost:9093/api/v2/status | jq -r .versionInfo.version | strings

=Silence alertmanager not configured alert=
oc set data secret alertmanager-main -n openshift-monitoring --from-file=alertmanager.yaml=<(cat <<'EOF'
"global":
"resolve_timeout": "5m"
"inhibit_rules":
- "equal":
- "namespace"
- "alertname"
"source_match":
"severity": "critical"
"target_match_re":
"severity": "warning|info"
- "equal":
- "namespace"
- "alertname"
"source_match":
"severity": "warning"
"target_match_re":
"severity": "info"
"receivers":
- "name": "Default"
- "name": "Watchdog"
- "name": "Critical"
- "name": "testrec" # Dummy receiver with webhook config
"webhook_configs":
- "url": "http://xxxxdumyxxx.com"
"route":
"group_by":
- "namespace"
"group_interval": "5m"
"group_wait": "30s"
"receiver": "Default"
"repeat_interval": "12h"
"routes":
- "match":
"alertname": "dummyalert" # Dummy alert being routed to dummy receiver
"receiver": "testrec"
EOF
)

=prometheus=
Url to web interface.
https://prometheus-k8s-openshift-monitoring.apps.<url>
echo https://prometheus-k8s-openshift-monitoring.$(oc whoami --show-console | awk -F 'console-openshift-console.' '{print $2}')
echo https://$(oc get route -n openshift-monitoring prometheus-k8s -o jsonpath="{.spec.host}")
Get disk usage from odf
oc -n openshift-monitoring exec -c prometheus prometheus-k8s-0 -- curl -s "http://localhost:9090/api/v1/query?query=odf_system_raw_capacity_used_bytes" | jq -r .
Get disk usage from odf over time.(metrics)
oc -n openshift-monitoring exec -c prometheus prometheus-k8s-0 -- curl -s "http://localhost:9090/api/v1/query_range?query=odf_system_raw_capacity_used_bytes&start=$(date '+%Y-%m-%d' --date '-20 days')T00:00:00.781Z&end=$(date '+%Y-%m-%dT%H:%M:%S').781Z&step=1h" | jq . | less -ISRM
Search tips
https://prometheus.io/docs/prometheus/latest/querying/basics/
Disk usage per project. Taken from RH ticket.
oc -n openshift-monitoring exec prometheus-k8s-0 -c prometheus -- curl -s -g 'http://localhost:9090/api/v1/query?' --data-urlencode 'query=(sort_desc(topk(25,(sum(kubelet_volume_stats_used_bytes * on (namespace,persistentvolumeclaim) group_left(storageclass, provisioner) (kube_persistentvolumeclaim_info * on (storageclass) group_left(provisioner) kube_storageclass_info {provisioner=~"(.*cephfs.csi.ceph.com)"})) by (namespace)))))'

=openshift-user-workload-monitoring=
"annotations": {
"description": "Prometheus operator in openshift-user-workload-monitoring namespace rejected 2 prometheus/ServiceMonitor resources.",
"summary": "Resources rejected by Prometheus operator"
},...
# Look at what is causing.
oc logs -l app.kubernetes.io/name=prometheus-operator -n openshift-user-workload-monitoring
# After tweaking with monitoring settings kill pod and view log.
oc delete pod -l app.kubernetes.io/name=prometheus-operator -n openshift-user-workload-monitoring
oc logs -l app.kubernetes.io/name=prometheus-operator -n openshift-user-workload-monitoring | less
# Stop monitoring.
oc label namespace openshift-local-storage openshift.io/cluster-monitoring-
oc label namespace openshift-local-storage openshift.io/user-monitoring=false
# Allow monitoring.
oc label namespace openshift-operators openshift.io/cluster-monitoring=true

=Talk to api with Bearer.=
HOST=$(oc -n openshift-monitoring get route alertmanager-main -ojsonpath={.spec.host})
TOKEN=$(oc whoami -t)
curl -skH "Authorization: Bearer $TOKEN" "https://$HOST/api/v2/alerts" | jq .
=token=
token=`oc sa get-token prometheus-k8s -n openshift-monitoring` ## --- In OCP client 4.10 or lower ---
OR
token=`oc create token prometheus-k8s -n openshift-monitoring` ## --- In OCP client 4.11 or higher ---
curl using token
curl -k -H "Authorization: Bearer $token" 'https://alertmanager-main-openshift-monitoring.apps.domain/api/v1/alerts' | jq '.data[].labels'
=ServiceMonitor=
Prometheus Operator:
When using Prometheus Operator, custom resources like ServiceMonitor and PodMonitor might include metricsConfig settings to customize how Prometheus should scrape metrics from various services or pods.

=bash completion=
. <(oc completion bash)

=machineconfig=
view settings
oc describe machineconfigpool
==set ntp servers==
echo 'variant: openshift
version: 4.9.0
metadata:
name: 99-master-chrony
labels:
machineconfiguration.openshift.io/role: master
storage:
files:
- path: /etc/chrony.conf
mode: 0644
overwrite: true
contents:
inline: |
server ntp.lio.se iburst
driftfile /var/lib/chrony/drift
makestep 1.0 3
rtcsync
logdir /var/log/chrony' | butane | oc apply -f -
==get machineconfig value==
oc get mc 00-master -o json | jq -r '.spec.config.storage.files[]|select(.path=="/var/lib/kubelet/config.json")|.contents.source' | perl -pe 's/%([0-9a-f]{2})/sprintf("%s", pack("H2",$1))/eig' | sed 's/^data:,//g' | jq .

==List machineconfigs by creation time==
oc get mc --sort-by=.metadata.creationTimestamp

=get users=
oc get users
=give me kubeadmin ecrypted password=
oc get secret kubeadmin -n kube-system -o json -o=jsonpath='{.data.kubeadmin}' | base64 -d
=Give kubeadmin a new password=
==generate password hash==
htpasswd -bnBC 10 "" '<password>' | tr -d ':\n' | base64 -w0

==patch password hash==
oc patch secret/kubeadmin -n kube-system -p '{"data": {"kubeadmin": "UGFzc3dvcmQK=="}}'

=work with oc without login=
export KUBECONFIG=/var/lib/kubelet/kubeconfig
if on bootstrap node.
export KUBECONFIG=/etc/kubernetes/kubeconfig

=Add the following if cert is not trusted.ssl/tls/ignore/expired=
- cluster:
insecure-skip-tls-verify: true
server: https://127.0.0.1:443
name: my-cluster

=run oc when on node=
oc get pod -n openshift-monitoring --kubeconfig=/var/lib/kubelet/kubeconfig

=etcdctl=
oc rsh -c etcdctl -n openshift-etcd $(oc get pod -l app=etcd -oname -n openshift-etcd | awk -F"/" 'NR==1{ print $2 }')
[root@ocp-03-lm8km-master-1 /]# etcdctl --write-out=table endpoint status
+---------------------------+------------------+---------+---------+-----------+------------+-----------+------------+--------------------+--------+
| ENDPOINT | ID | VERSION | DB SIZE | IS LEADER | IS LEARNER | RAFT TERM | RAFT INDEX | RAFT APPLIED INDEX | ERRORS |
+---------------------------+------------------+---------+---------+-----------+------------+-----------+------------+--------------------+--------+
| htt://172.19.14.36:2379 | c4f7b42b92713818 | 3.5.0 | 105 MB | false | false | 6 | 2632074 | 2632074 | |
| htt://172.19.14.37:2379 | 5dea668b432969fc | 3.5.0 | 105 MB | false | false | 6 | 2632074 | 2632074 | |
| htt://172.19.14.41:2379 | 51cecd971b657ee5 | 3.5.0 | 105 MB | true | false | 6 | 2632074 | 2632074 | |
+---------------------------+------------------+---------+---------+-----------+------------+-----------+------------+--------------------+--------+
Verifying etcd while openshift is less than perfekt
# List etcd containers
crictl ps --label io.kubernetes.pod.namespace=openshift-etcd
# Execute command to verify health of etcd using crictl
crictl exec -it <container-id> etcdctl endpoint status --write-out=table

=create troubleshooting/debug/test pod=
oc run abjorklund-redhat-ubi8 --image=redhat/ubi8 -i --tty -- sh
oc run abjorklund-curlimage-curl --image=curlimages/curl -i --tty -- sh
oc run -it busybox --image=busybox --restart=Never -- ash
oc run abjorklund-rocky-rocky --image=rockylinux/rockylinux -i --tty -- bash
oc run ${USER}-rocky-rocky --image=rockylinux/rockylinux -i --tty -- bash # dnf -y install procps-ng iproute
oc run ${USER}-rocky-rocky --image=rockylinux/rockylinux --restart=Never --command sleep infinity
==install packages to get running==
yum install -y lsof procps-ng bind-utils

=proxy settings=
oc get proxy cluster -o yaml
Change ca
oc patch proxy/cluster --type=merge --patch='{"spec":{"trustedCA":{"name":"custom-ca"}}}'
=oc proxy=
Run a proxy to the Kubernetes API server
=port forward to pod=
oc port-forward <my-pod-name> <local-port>:<remote-port>
=alertmanager=
oc port-forward -n monitoring svc/kube-prometheus-stack-alertmanager 9093:9093 # http://localhost:9093/
=grafana access=
oc port-forward -n monitoring svc/kube-prometheus-stack-grafana 3000:80 # http://localhost:3000 admin prom-operator
=prometheus access=
oc port-forward -n monitoring svc/kube-prometheus-stack-prometheus 9090:9090 # http://localhost:9090
=akhq=
<pre>
kubectl port-forward service/akhq 8080:80
http://localhost:8080
</pre>

=thanos-queries=
oc port-forward -n openshift-monitoring svc/thanos-querier 9091:9091 # access via: curl -sk -H "Authorization: Bearer $(oc whoami -t)" https://localhost:9091/api/v1/status/buildinfo | jq . (via browser use requestly)

==proxy via pod==
# Create tunnel pod. Please remove when done.
oc apply -f - << 'EOF'
apiVersion: v1
kind: Pod
metadata:
name: proxy-pod
namespace: default
spec:
containers:
- name: socat-proxy
image: alpine/socat:latest
command: ["/bin/sh", "-c"]
args:
- |
apk add --no-cache socat && # Install socat if not in image
socat TCP-LISTEN:443,fork,reuseaddr TCP:scm.devops.cambio.se:443
ports:
- containerPort: 443
restartPolicy: Never
EOF
# Tunnel on localhost reaching destination.
sudo oc --kubeconfig=$KUBECONFIG port-forward pod/proxy-pod -n default 443:443
# Add hosts entry to use browser as "usual".
grep scm.devops.cambio.se /etc/hosts
127.0.0.1 localhost scm.devops.cambio.se

=Install additional ca certificate=
apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
metadata:
labels:
machineconfiguration.openshift.io/role: worker
name: 50-company-ca-cert
spec:
config:
ignition:
version: 3.1.0
storage:
files:
- contents:
source: data:text/plain;charset=utf-8;base64,LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURrVENDQW5tZ0F3SUJBZ0lFSC93Skh6QU5CZ2txaGtpRzl3MEJBUXNGQURBM01SVXdFd1lEVlFRS0RBeFMKUlVSQ1VrbEVSMFV1VTBVeEhqQWNCZ05WQkFNTUZVTmxjblJwWm1sallYUmxJRUYxZEdodmNtbDBlVEFlRncweQpNVEF5TWpNd056RTVOVFphRncwME1UQXlNak13TnpFNU5UWmFNRGN4RlRBVEJnTlZCQW9NREZKRlJFSlNTVVJIClJTNVRSVEVlTUJ3R0ExVUVBd3dWUTJWeWRHbG1hV05oZEdVZ1FYVjBhRzl5YVhSNU1JSUJJakFOQmdrcWhraUcKOXcwQkFRRUZBQU9DQVE4QU1JSUJDZ0tDQVFFQW5mY1F3YURwcEdzNWJxaUc5ajE5aFJVaG1sMzhjb2JGT2tzRQpsZFo3Y3RkV1d6VHJqSTFCRGxZSEd5SXBYMEo4ZU1PaDhvbUZqbVR6VTEzTkpWSnJrWm5RaDRhTzA1UGtKRlJRCkg1ZVA2N3R0S2pEb0txOFZVWXRZUldxRlFaalNxY2lQMzJobXZSNG42QVZDWDdCaUVBZjd2Y05ZVys0a1k5OUsKbTluV1BNbEpGU056M1puRnlWc1BtR1ZWeVN2RmFVL0dBTmt1Z25uSGdUM1VUUTNsc2NidU5keUpBcVEya3dHSwpKbkdZKzBSajVrUWpvdXptUjBDZ3pJN0hWSmhwK2Z6R1lyenRYQXA1Zkt0Z3ZTZFRtTndVVXZJR3pLTmU4WklGCmY0WVVUUDFPdU9jUmNIRDJQclVodDgzWlRLYzNwOUhLYk5CazIzWFFtYU85QVBqeEl3SURBUUFCbzRHa01JR2gKTUI4R0ExVWRJd1FZTUJhQUZMbWFrNHdDamtuakZvWkd6M1daRGErY2N4RGxNQjBHQTFVZERnUVdCQlM1bXBPTQpBbzVKNHhhR1JzOTFtUTJ2bkhNUTVUQVBCZ05WSFJNQkFmOEVCVEFEQVFIL01BNEdBMVVkRHdFQi93UUVBd0lCCnhqQStCZ2dyQmdFRkJRY0JBUVF5TURBd0xnWUlLd1lCQlFVSE1BR0dJbWgwZEhBNkx5OXBjR0V0WTJFdWNtVmsKWW5KcFpHZGxMbk5sTDJOaEwyOWpjM0F3RFFZSktvWklodmNOQVFFTEJRQURnZ0VCQURabURvUytJY1ZMcERBRwpiSXM0SWRJKzcxY0xINk90NjNkYWhBT25QRDJnMUhvVUFIZFdUcGdobER3TkFQWjg3UXQybFc4Q1B4eDhCQVZOCnlrZWlEN2paeVA5dmVCcDRxNjBiSTVYSENndWV5U2lGdjBBKzloKzMzekMrYy9WbStJVHJNTkZ0dlZMNE1kRWQKaVE4UVBhaFJEWW1qVkJVb1VIZWErMDdkWEY3TzQxY2t2YzZRb0lad2F5Y1Zhc0gvd05lVGNrdzl1TlNiajNTQwoyNHdpOUthQnpxdDZsWlF3TG5uUjVnNjNWUDZNZUprR2FXMTBxdExiQVM4NGZwQ1NWTUx3U051MGZqeFU2d2lPCkRjaWlKKzNZOG5ldjM5NGJHRkwxcG5ZVmM4YmpoL0xaaHM1dTRQUnhlNFBLRER2Y09NZUhpUkN1M1YySWRRTTgKbDl3enBQZz0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQoK
mode: 0644
overwrite: true
path: /etc/pki/ca-trust/source/anchors/company-ca.crt

=get raw api data=
oc get --raw "/api/v1/nodes/[node]/proxy/stats/summary"
Via proxy.
oc proxy &
Starting to serve on 127.0.0.1:8001
curl -s http://localhost:8001/api/v1/nodes/crc-lgph7-master-0/proxy/stats/summary
curl -s http://localhost:8001/api/v1/nodes/crc-lgph7-master-0/proxy/metrics/resource
=explain=
Get documentation for a resource. Get available attributes for an resource.
oc explain deployment

=events=
Get events.
oc get events -A --sort-by=.metadata.creationTimestamp
=jsonpath=
Get names of MachineConfigs one value per line.
oc get mc -o jsonpath='{range .items[*]}{.metadata.name}{"\n"}{end}' --no-headers
=ImageStreamTag=
ImageStreamTag represents an Image that is retrieved by tag name from an ImageStream.
=imagestream=
apiVersion: image.openshift.io/v1
kind: ImageStream
metadata:
name: myapp
==Tagging Images: When you tag an image, it is added to the ImageStream with a specified tag.==
oc tag myregistry/myapp:latest myapp:latest
==Using ImageStreams in Deployment Configurations: Deployment configurations can reference ImageStreams instead of direct image URLs.==
apiVersion: apps.openshift.io/v1
kind: DeploymentConfig
metadata:
name: myapp
spec:
template:
spec:
containers:
- name: myapp
image: image-registry.openshift-image-registry.svc:5000/myproject/myapp:latest

=BuildConfig=
Build configurations define a build process for new container images.
=download okd openshift-install=
# Show latest.
curl -skL https://github.com/okd-project/okd/releases | elinks --dump | sed 's/^ *//g' | grep " Latest"
# Download and install in /usr/local/bin. Keep old versions.
export OKD_VERSION=4.15.0-0.okd-2024-03-10-010116 ; (cd /temp/ ; oc adm release extract --tools quay.io/openshift/okd:${OKD_VERSION} ; cd /usr/local/bin/ ; sudo tar xf /temp/openshift-install-linux-${OKD_VERSION}.tar.gz openshift-install ; sudo mv openshift-install openshift-install.${OKD_VERSION})

=setup openshift cluster=
Download binary
<pre>
cd /tmp/ ; curl -L -O https://mirror.openshift.com/pub/openshift-v4/x86_64/clients/ocp/4.10.47/openshift-install-linux.tar.gz && sudo tar xf openshift-install-linux.tar.gz -C /usr/local/bin/
</pre>
Add vmware certs if using that backend.
(cd /tmp/ ; curl -sk https://${vspherer_server}/certs/download.zip -O) ; cd /etc/pki/ca-trust/source/anchors ; sudo unzip -oj /tmp/download.zip certs/lin/\* ; sudo update-ca-trust
Create config file
install-config.yaml
Then fire off install
openshift-install create cluster
Another example
ln -s install-config.yaml.2023-03-23 install-config.yaml
./openshift-install-4.12.0-0.okd-2023-04-16-041331 create cluster

=Edit install config after setup=
Save config
<pre>
oc get cm cluster-config-v1 -n kube-system --template='{{index .data "install-config" }}' > /tmp/cm_cluster-config-v1_-n_kube-system.$(oc whoami --show-console=true | awk -F / '{print $3}').$(date '+%Y-%m-%d_%H-%M-%S')
</pre>
Edit downloaded file and apply edited file.
oc set data cm cluster-config-v1 -n kube-system --from-file=install-config=/tmp/cm_cluster-config-v1_-n_kube-system.<suitable_name>

=look at install settings=
oc get -n kube-system cm/cluster-config-v1 -o yaml

=argocd login=
argocd login openshift-gitops-server-openshift-gitops.apps.costest.ltkronoberg.se --username kubeadmin --password asdfasfasdfas --sso --insecure
argocd login $(oc get routes -n openshift-gitops openshift-gitops-server -o json | jq -r .spec.host) --username $USER --password $COMPANY_PASSWORD --sso --insecure

=git sync heal=
argocd app list | grep -v NAME | awk '{print $1}' | while read i ; do echo '*' $i ; argocd app set $i --self-heal ; done

=metrics=
==Get available values==
Thanos monitoring points
curl -sk -H "Authorization: Bearer $(oc whoami -t)" https://$(oc get routes -n openshift-monitoring thanos-querier -o jsonpath='{.status.ingress[0].host}')/api/v1/metadata | jq .
node-exporter
oc --request-timeout=3 -n openshift-monitoring exec -c node-exporter $(oc get pod -n openshift-monitoring -l app.kubernetes.io/name=node-exporter -o=custom-columns='NAME:.metadata.name' --no-headers | head -1) -- curl -s 'http://localhost:9100/metrics' | grep -vE "^#|^$"
==Cpu usage per node.==
100 - (avg by (instance) (irate(node_cpu_seconds_total{mode="idle"}[30m])) * 100)
instance:node_cpu_utilisation:rate1m{job="node-exporter", cluster=""} != 0
instance:node_cpu_utilisation:rate1m{job="node-exporter"} != 0
==cpu usage per pod on node==
sum(node_namespace_pod_container:container_cpu_usage_seconds_total:sum_irate{cluster="", node=~"<node>"}) by (pod)
==iowait==
avg by (instance) (irate(node_cpu_seconds_total{mode="iowait"}[30m]))
==namespace==
cpu usage per namespace.
sum(node_namespace_pod_container:container_cpu_usage_seconds_total:sum_irate{cluster=""}) by (namespace)
==load==
Load 1 graph
instance:node_load1_per_cpu:ratio{job="node-exporter", cluster=""} != 0
==usage for pvc==
kubelet_volume_stats_used_bytes
kubelet_volume_stats_available_bytes
kubelet_volume_stats_used_bytes{persistentvolumeclaim="prometheus-prometheus-k8s-1"}
With % usage of all pvc
( kubelet_volume_stats_used_bytes / kubelet_volume_stats_capacity_bytes ) * 100

==Memory usage==
Memory usage of node.
instance:node_memory_utilisation:ratio
node_memory_MemAvailable_bytes
100 * (1 - (node_memory_MemAvailable_bytes / node_memory_MemTotal_bytes))
==Memory usage per pod on a node==
sum(container_memory_usage_bytes{node="<node_name>"}) by (pod, namespace)
==OOMKilled==
sum by (namespace, pod) (kube_pod_container_status_restarts_total) * on(namespace, pod) group_left(reason) kube_pod_container_status_last_terminated_reason{reason="OOMKilled"}
oc -n openshift-monitoring exec -c prometheus prometheus-k8s-0 -- curl -s "http://localhost:9090/api/v1/query_range?query=sum%20by%20(namespace,%20pod)%20(kube_pod_container_status_restarts_total)%20*%20on(namespace,%20pod)%20group_left(reason)%20kube_pod_container_status_last_terminated_reason%7Breason%3D%22OOMKilled%22%7D&start=$(date '+%Y-%m-%d' --date '-20 days')T00:00:00.781Z&end=$(date '+%Y-%m-%dT%H:%M:%S').781Z&step=1h" | jq .
==uptime==
oc exec -n openshift-monitoring -c prometheus prometheus-k8s-0 -- curl -s 'http://localhost:9090/api/v1/query?query=time%28%29%20-%20node_boot_time_seconds%7Bjob%3D%22node-exporter%22%7D%0A' | jq -r '.data.result[]|.metric.instance +"\t"+ (.value[1] | tonumber | floor | tostring)' | column_tab
==disk usage==
(1 - (node_filesystem_avail_bytes{mountpoint="/"} / node_filesystem_size_bytes{mountpoint="/"})) * 100
==disk inode usage==
(1 - (node_filesystem_files_free{mountpoint="/"} / node_filesystem_files{mountpoint="/"})) * 100
==disk utalization==
100 * (rate(node_disk_io_time_seconds_total[5m]) / 300)

==steal==
sum by (instance) (rate(node_cpu_seconds_total{mode="steal"}[1m])) * 100
==request memory==
sum by (node) ( kube_pod_container_resource_requests{resource="memory"} * on (namespace, pod) group_left kube_pod_status_phase{phase="Running"} ) / 1024 / 1024

=install oc and kubectl=
curl -fsSL https://mirror.openshift.com/pub/openshift-v4/x86_64/clients/ocp/latest/openshift-client-linux.tar.gz | (cd /usr/local/bin/ ; sudo tar zxf - oc kubectl )

=time and timezone in first pod(date)=
oc get pods --no-headers -o 'custom-columns=:.metadata.namespace,:.metadata.name' -A | grep -v cert-manager | head -1 | while read NAMESPACE POD ; do oc rsh -n $NAMESPACE $POD bash -c 'date "+%Y-%m-%d %H:%M:%S %Z"' 2>/dev/null ; done

=oc get installplan=
InstallPlan defines the installation of a set of operators.
oc get installplan install-bk8hw -n openshift-operators -o yaml
Approve all manual updates.
oc get installplans.operators.coreos.com -A --no-headers | awk '$5 ~ /false/' | awk '$4 ~ /Manual/' | while read NAMESPACE INSTALLPLAN END ; do echo '*' $NAMESPACE $INSTALLPLAN ; oc patch installplan $INSTALLPLAN -n $NAMESPACE --type merge --patch '{"spec":{"approved":true}}' ; done
Get selected info from all installplans
oc get installplans.operators.coreos.com -A --no-headers -o=custom-columns='DATE:.metadata.creationTimestamp,NAME:.metadata.name,PHASE:.status.phase,CSV:.spec.clusterServiceVersionNames,NAMESPACE:.metadata.namespace' --sort-by=.metadata.creationTimestamp

=oc extract=
Extract secrets or config maps to disk
# Extract only the key "nginx.conf" from config map "nginx" to the /tmp directory
oc extract configmap/nginx --to=/tmp --keys=nginx.conf
=dependencies,owner=
Search in output from
oc describe ...
Search for this.
Controlled By: ReplicaSet/rook-ceph-osd-0-6dcdc7fb48
=metadata.ownerReferences=
Define object that owns object

=nodeAffinity=
Pin pod to node with label (kubectl label nodes <your-node-name> disktype=ssd)
spec:
affinity:
nodeAffinity:
requiredDuringSchedulingIgnoredDuringExecution:
nodeSelectorTerms:
- matchExpressions:
- key: disktype
operator: In
values:
- ssd

=Add user to group=
oc adm groups add-users openshift-admins rb_janitor
=api-int=
api-int.<fqdn>
for i in api-int:6443 api:6443 test.apps:443 ; do ping -c1 -W1 ${i%%:*} 2>&1 | xargs ; curl -skI https://${i%%:*}:${i##*:} 2>&1 | xargs ; done | cut -c -150
for i in api-int:6443 api:6443 test.apps:443 ; do ping -c1 -W1 ${i%%:*} 2>&1 | xargs ; set -x ; curl -skv https://${i%%:*}:${i##*:} -o /dev/null 2>&1 | grep "Server certificate:" -A5 ; set +x ; done | cut -c -150
=test talk to api-int=
CACERT=/tmp/%var%lib%kubelet%kubeconfig%certificate-authority-data ; grep certificate-authority-data: /var/lib/kubelet/kubeconfig | awk '{print $2}' | base64 -d > /$CACERT ; curl -s --key /var/lib/kubelet/pki/kubelet-client-current.pem --cert /var/lib/kubelet/pki/kubelet-client-current.pem --cacert $CACERT -XGET "$(grep server /etc/kubernetes/kubeconfig | awk '{print $2}')/api/v1/namespaces/default/pods?limit=500"
=api urls=
kubernetes generic: reference to the Kubernetes API server.
kubernetes.default: reference to the Kubernetes API server within the "default" namespace.
kubernetes.default.svc: refers to the Kubernetes service within the "default" namespace.
kubernetes.default.svc.cluster.local: This is the fully-qualified domain name (FQDN) for the Kubernetes service within the "default" namespace.
openshift: Similar to "kubernetes," this is a generic reference to the OpenShift API server.
openshift.default: reference to the OpenShift API server within the "default" namespace.
openshift.default.svc: refers to the OpenShift service within the "default" namespace.
openshift.default.svc.cluster.local: fully-qualified domain name (FQDN) for the OpenShift service within the "default" namespace.

=okd setup fix=
# On bootstrap node. Could work on all clusters. First a test to se if it work already.
DOMAIN=$(grep " baseDomain: " /etc/mcc/bootstrap/cluster-dns-02-config.yml | awk '{print $2}')
for i in api-int api ; do ping -c1 -W1 $i.${DOMAIN} 2>&1 | xargs; done | cut -c -150
echo "10.1.0.5 api-int.${DOMAIN} api.${DOMAIN}" >> /etc/hosts

=oc annotate=
Update the annotations on one or more resources.
oc annotate pods foo description='my frontend'
=setuid setgid=
securityContext:
runAsUser: 10004000
runAsGroup: 10004000
=patch examples=
==Look at oc get ... -o json and copy line after line.==
oc patch redis redis-standalone --type merge --patch '{"spec": {"securityContext": {"runAsGroup": 1000400000}}}'
==Enable disable clusterlogging # Unmanaged/Managed==
oc patch clusterlogging -n openshift-logging instance --type merge -p '{"spec": {"managementState": "Unmanaged"}}'
==Enable disable elasticsearch(Unmanaged/Managed)==
oc patch elasticsearch -n openshift-logging elasticsearch --type merge -p '{"spec": {"managementState": "Unmanaged"}}' #
==Remove finalizers from pod.==
oc patch pod <pod> -n <namespace> -p '{"metadata":{"finalizers":null}}'
==remove value==
Remove .spec.kafka.version
oc patch kafka kafka-cluster --type='json' -p='[{"op": "remove", "path": "/spec/kafka/version"}]'

==Add finalizer==
oc patch pod <pod> -n <namespace> -p '{"metadata":{"finalizers":["kubernetes.io/pvc-protection"]}}'
==Replace finalizers value with this.==
oc patch pod <pod> -n <namespace> --type merge -p '{"metadata":{"finalizers":["kubernetes.io/pvc-protection","kubernetes"]}}'
==patch replicas deployment==
oc patch deployment <deployment-name> --patch '{"spec": {"replicas": 0}}'
==patch list entries do not wipe existing list entries==
oc patch deployment -n openshift-kube-apiserver-operator kube-apiserver-operator --type json -p '[{"op": "replace", "path": "/spec/template/spec/containers/0/image", "value": "quay.io/okd/scos-content@sha256:37d6b6c13d864deb7ea925acf2b2cb34305333f92ce64e7906d3f973a8071642"}]'
oc get deployment kube-apiserver-operator -n openshift-kube-apiserver-operator -o json | jq '.spec.template.spec.containers[0].env |= map(if .name == "IMAGE" then .value = "quay.io/okd/scos-content@sha256:5c9128668752a9b891a24a9ec36e0724d975d6d49e6e4e2d516b5ba80ae2fb23" else . end)' | oc apply -f -
oc get deployment kube-apiserver-operator -n openshift-kube-apiserver-operator -o json | jq '.spec.template.spec.containers[0].env |= map(if .name == "OPERATOR_IMAGE" then .value = "quay.io/okd/scos-content@sha256:37d6b6c13d864deb7ea925acf2b2cb34305333f92ce64e7906d3f973a8071642" else . end)' | oc apply -f -
oc get deployment kube-apiserver-operator -n openshift-kube-apiserver-operator -o json | jq '.spec.template.spec.containers[0].env |= map(if .name == "OPERAND_IMAGE_VERSION" then .value = "1.29.6" else . end)' | oc apply -f -
==patch service monitor==
kubectl patch servicemonitor cert-utils-operator-controller-manager-metrics-monitor -n openshift-operators -p='[{"op": "replace", "path": "/spec/endpoints/0/tlsConfig/serverName", "value": "cert-utils-operator-controller-manager-metrics-service.openshift-operators.svc"}]' --type='json'
==edit text/cert entry==
#!/bin/bash
SSL_URL=halfface.se
SSL_PORT=443
DATE_FILE=$(date +%F_%H-%M-%S)
openssl s_client -connect ${SSL_URL}:${SSL_PORT} -servername ${SSL_URL} -verify 5 -showcerts -certform pem </dev/null 2>/dev/null | sed -n '/^----/,/^----/p' > chain.${SSL_URL}.${SSL_PORT}.${DATE_FILE}.pem
ln chain.${SSL_URL}.${SSL_PORT}.${DATE_FILE}.pem ${SSL_URL}
oc create cm argocd-tls-certs-cm -n argocd --from-file ${SSL_URL} --dry-run=client -o yaml >> /tmp/chain.${SSL_URL}.${SSL_PORT}.${DATE_FILE}.pem.patch
oc patch configmap argocd-tls-certs-cm -n argocd --patch-file /tmp/chain.${SSL_URL}.${SSL_PORT}.${DATE_FILE}.pem.patch

=limits=
When your need to increase your cpu and memory resources.
cpu limit is either written as a number. 0.5 for half a cpu. Or rather a definition in milli. 500m for half a cpu.
spec:
containers:
...
resources:
limits:
cpu: "2"
memory: 5Gi
requests:
cpu: "2"
memory: 5Gi

=quotas on cpu memory pvc... per project=
oc get ResourceQuota
=tolerations|node selectors|...=
oc describe pod
Node-Selectors: node-role.kubernetes.io/app=
Tolerations: node.kubernetes.io/memory-pressure:NoSchedule op=Exists
node.kubernetes.io/not-ready:NoExecute op=Exists for 300s
node.kubernetes.io/unreachable:NoExecute op=Exists for 5s
node.ocs.openshift.io/storage=true:NoSchedule
=tolerate any taint=
tolerations:
- operator: Exists

=enable monitoring=
cat <<EOF | oc apply -f -
apiVersion: v1
kind: ConfigMap
metadata:
name: cluster-monitoring-config
namespace: openshift-monitoring
data:
config.yaml: |
prometheusK8s:
retention: 2d
EOF

=retention elasticsearch=
Edit the ClusterLogging CR to add or modify the retentionPolicy parameter:
apiVersion: "logging.openshift.io/v1"
kind: "ClusterLogging"
...
spec:
managementState: "Managed"
logStore:
type: "elasticsearch"
retentionPolicy:
application:
maxAge: 1d
infra:
maxAge: 7d
audit:
maxAge: 7d
elasticsearch:
nodeCount: 3
...

=retention prometheus=
Prometheus retention. https://docs.openshift.com/container-platform/4.10/monitoring/configuring-the-monitoring-stack.html#modifying-retention-time-for-prometheus-metrics-data_configuring-the-monitoring-stack
oc edit configmap cluster-monitoring-config -n openshift-monitoring
# Enable prometheus.
cat <<EOF | oc apply -f -
apiVersion: v1
kind: ConfigMap
metadata:
name: cluster-monitoring-config
namespace: openshift-monitoring
data:
config.yaml: |
prometheusK8s:
retention: 2d
EOF
=retention prometheus default=
oc get Prometheus k8s -n openshift-monitoring -o json | jq -r .spec.retention
oc -n openshift-monitoring exec -c prometheus prometheus-k8s-0 -- curl -s "http://localhost:9090/api/v1/status/runtimeinfo" | jq -r '.data.storageRetention'

=EFK(elk)=
ElasticSearch
# Fluentd
processing pipeline
# Kibana.
https://kibana-openshift-logging.apps.<url>

=grafana=
# grafana
https://grafana-openshift-monitoring.apps.<url>
=pull secret=
Get pull secret
<pre>
oc get secret/pull-secret -n openshift-config -o jsonpath='{.data.\.dockerconfigjson}' | base64 -d | jq .
oc get secret/pull-secret -n openshift-config --template='Template:Index .data ".dockerconfigjson"' -o json | jq .
oc get secret/pull-secret -n openshift-config --template='{{index .data ".dockerconfigjson" | base64decode}}' -o json | jq .
</pre>
Just the keys.
oc get secret/pull-secret -n openshift-config --template='Template:Index .data ".dockerconfigjson"' -o json | jq -r '.data.".dockerconfigjson"' | base64 -d | jq .
Name of each key and email.
oc get secret/pull-secret -n openshift-config --template='Template:Index .data ".dockerconfigjson"' -o json | jq -r '.data.".dockerconfigjson"' | base64 -d | jq -r '.auths | with_entries(.value = .value.email)' | sed 's/{//g;s/}//g;s/"//g' | grep -v '^$' | sed 's/ *//g' | sort
Download pull secret.
<pre>
oc get secret/pull-secret -n openshift-config --template='{{index .data ".dockerconfigjson" | base64decode}}' > /tmp/pull_secret.$(oc whoami --show-console=true | awk -F / '{print $3}').$(date '+%Y-%m-%d_%H-%M-%S')
</pre>
Set pull secret.
oc set data secret/pull-secret -n openshift-config --from-file=.dockerconfigjson=/tmp/pull_secret_<file_name>
==has pull secret been update==
<pre>
echo '#' pull-secret ; oc get secret/pull-secret -n openshift-config --template='{{index .data ".dockerconfigjson" | base64decode}}' | jq -r '.auths[].email'
echo '#' apiserver ; oc exec deployment/apiserver -n openshift-apiserver -c openshift-apiserver -- cat /var/lib/kubelet/config.json | jq
echo '#' nodes ; oc get nodes -o name | xargs -I {} oc debug {} -- chroot /host sh -c 'cat /var/lib/kubelet/config.json | jq'
</pre>

==Does pull secret work==
jq . /tmp/pull_secret.2024-01-10_12-00-01.registry.redhat.io
{
"auths": {
"registry.redhat.io": {
"auth": "YmxhYmxh"
}
}
}
podman pull --authfile /tmp/pull_secret.2024-01-10_12-00-01.registry.redhat.io registry.redhat.io/ubi8/ubi:latest
==Which pull secret does machineconfig contain==
oc get mc 00-master -o json | jq -r '.spec.config.storage.files[]|select(.path=="/var/lib/kubelet/config.json")|.contents.source' | perl -pe 's/%([0-9a-f]{2})/sprintf("%s", pack("H2",$1))/eig' | sed 's/^data:,//g' | jq .
==Is pull secret correct in machineconfigpool. Rendered config==
oc get mc rendered-master-3626460c7752fc1605e94c19b7a9aba7 -o json | jq -r '.spec.config.storage.files[]|select(.path=="/var/lib/kubelet/config.json")|.contents.source' | sed 's/^data:,//g' | perl -pe 's/%([0-9a-f]{2})/sprintf("%s", pack("H2",$1))/eig'| jq .

=change number of nodes=
oc get machineset -n openshift-machine-api
oc edit machineset -n openshift-machine-api <MachineSet>
=Elasticsearch status=
oc exec -n openshift-logging -c elasticsearch $(oc get pods -n openshift-logging -l component=elasticsearch -o custom-columns=:.metadata.name --no-headers | head -1) -- es_util --query=_cat/health?v
oc exec -n openshift-logging -c elasticsearch $(oc get pods -n openshift-logging -l component=elasticsearch -o custom-columns=:.metadata.name --no-headers | head -1) -- es_util --query=_cluster/health?pretty

=talk to elasticsearch=
oc rsh elasticsearch-cdm-q8apadpa-1-65f99d99b4-8b9wg
curl -s --key /etc/elasticsearch/secret/admin-key --cert /etc/elasticsearch/secret/admin-cert --cacert /etc/elasticsearch/secret/admin-ca https://localhost:9200
Oneliner
oc exec -n openshift-logging -c elasticsearch $(oc get pods -l component=elasticsearch -o custom-columns=:.metadata.name --no-headers -n openshift-logging | head -1) -- curl -s --key /etc/elasticsearch/secret/admin-key --cert /etc/elasticsearch/secret/admin-cert --cacert /etc/elasticsearch/secret/admin-ca https://localhost:9200
=Free disk space/reclaim=
oc exec -n openshift-logging -c elasticsearch $(oc get pods -l component=elasticsearch -o custom-columns=:.metadata.name --no-headers -n openshift-logging | head -1) -- curl -s --key /etc/elasticsearch/secret/admin-key --cert /etc/elasticsearch/secret/admin-cert --cacert /etc/elasticsearch/secret/admin-ca "https://localhost:9200/_forcemerge?only_expunge_deletes=true" -X POST

=which version of elasticsearch operator is installed=
oc get csv -n openshift-operators-redhat -l operators.coreos.com/elasticsearch-operator.openshift-operators-redhat="" -o=custom-columns='VERSION:.spec.version' --no-headers
==list nodes==
oc exec -c elasticsearch $(oc get pods -l component=elasticsearch -o custom-columns=:.metadata.name --no-headers | tail -1) -- es_util --query="_cat/nodes?v"
==Who is master node==
oc exec -c elasticsearch $(oc get pods -l component=elasticsearch -o custom-columns=:.metadata.name --no-headers | tail -1) -- es_util --query="_cat/master?v"
==Is cluster recovering==
oc exec -c elasticsearch $(oc get pods -l component=elasticsearch -o custom-columns=:.metadata.name --no-headers | tail -1) -- es_util --query="_cat/recovery?active_only=true"
==Look at all indices==
oc exec -n openshift-logging -c elasticsearch $(oc get pods -n openshift-logging -l component=elasticsearch -o custom-columns=:.metadata.name --no-headers | tail -1) -- es_util --query=_cat/indices?v

export INDICE=<indice> ; oc exec -n openshift-logging -c elasticsearch $(oc get pods -n openshift-logging -l component=elasticsearch -o custom-columns=:.metadata.name --no-headers | tail -1) -- es_util --query=$INDICE -XDELETE

=look at chards=
oc exec -c elasticsearch $(oc get pods -l component=elasticsearch -o custom-columns=:.metadata.name --no-headers | tail -1) -- es_util --query=_cat/indices?v
=Create audit index=
oc exec -n openshift-logging -c elasticsearch $(oc get pods -n openshift-logging -l component=elasticsearch -o custom-columns=:.metadata.name --no-headers | head -1) -- es_util --query=audit-000001 -XPUT
==Remove all red indices.==
oc exec -c elasticsearch $(oc get pods -l component=elasticsearch -o custom-columns=:.metadata.name --no-headers | tail -1) -- es_util --query=_cat/indices?v | grep ^red | awk '{print $3}' | while read i ; do echo '*' $i ; oc exec -c elasticsearch $(oc get pods -l component=elasticsearch -o custom-columns=:.metadata.name --no-headers | tail -1) -- es_util --query=${i} -X DELETE ; done
==recreate elasticsearch pvc:s==
# scale down elasticsearch to 0 pods to be able to remove pvc:s
oc get deployment -l component=elasticsearch -o custom-columns=NAME:.metadata.name --no-headers -n openshift-logging | while read DEPLOYMENT ; do echo '*' $DEPLOYMENT ; oc scale deployment $DEPLOYMENT --replicas 0 ; done
# Remove pvc:s.
oc delete pvc -l logging-cluster=elasticsearch -n openshift-logging
# scale up elasticsearch to 0 pods to be able to remove pvc:s
oc get deployment -l component=elasticsearch -o custom-columns=NAME:.metadata.name --no-headers -n openshift-logging | while read DEPLOYMENT ; do echo '*' $DEPLOYMENT ; oc scale deployment $DEPLOYMENT --replicas 1 ; done

=vsphere creds=
oc get -n kube-system cm/cluster-config-v1 -o yaml
=does vsphere account have expected permissions=
oc logs -n openshift-cluster-storage-operator -l name=vsphere-problem-detector-operator --timestamps --tail=100 | less

=Enable openshift/okd logging=
==Enable redhat-operators==
oc patch OperatorHub cluster --type json -p '[{"op": "add", "path": "/spec/disableAllDefaultSources", "value": false}]'
Or edit individual operator.
oc edit operatorhubs
Spec:
Disable All Default Sources: true
Sources:
Disabled: false
Name: community-operators
Disabled: false
Name: redhat-operators
Or patch OperatorHub for individual operators
oc patch operatorhub cluster --type='json' -p='[{"op": "add", "path": "/spec/sources/-", "value":{"name":"redhat-operators","disabled":false}}]'

==Create namespace==
cat <<EOF | oc apply -f -
apiVersion: v1
kind: Namespace
metadata:
name: openshift-operators-redhat
annotations:
openshift.io/node-selector: ""
labels:
openshift.io/cluster-monitoring: "true"
EOF
==Create namespace==
cat <<EOF | oc apply -f -
apiVersion: v1
kind: Namespace
metadata:
name: openshift-logging
annotations:
openshift.io/node-selector: ""
labels:
openshift.io/cluster-monitoring: "true"
EOF
==Create operatorgroup==
cat <<EOF | oc apply -f -
apiVersion: operators.coreos.com/v1
kind: OperatorGroup
metadata:
name: openshift-operators-redhat
namespace: openshift-operators-redhat
spec: {}
EOF
==Subscribe to OpenShift Elasticsearch Operator==
cat <<EOF | oc apply -f -
apiVersion: operators.coreos.com/v1alpha1
kind: Subscription
metadata:
name: "elasticsearch-operator"
namespace: "openshift-operators-redhat"
spec:
channel: "stable"
installPlanApproval: "Automatic"
source: "redhat-operators"
sourceNamespace: "openshift-marketplace"
name: "elasticsearch-operator"
EOF
==Install the openshift logging operator.==
cat <<EOF | oc apply -f -
apiVersion: operators.coreos.com/v1
kind: OperatorGroup
metadata:
name: cluster-logging
namespace: openshift-logging
spec:
targetNamespaces:
- openshift-logging
EOF
==Create a subscription object yaml file.==
cat <<EOF | oc apply -f -
apiVersion: operators.coreos.com/v1alpha1
kind: Subscription
metadata:
name: cluster-logging
namespace: openshift-logging
spec:
channel: "stable"
name: cluster-logging
source: redhat-operators
sourceNamespace: openshift-marketplace
EOF
==Create OpenShift Logging instance.==
cat <<EOF | oc apply -f -
apiVersion: "logging.openshift.io/v1"
kind: "ClusterLogging"
metadata:
name: "instance"
namespace: "openshift-logging"
spec:
managementState: "Managed"
logStore:
type: "elasticsearch"
retentionPolicy:
application:
maxAge: 1d
infra:
maxAge: 7d
audit:
maxAge: 7d
elasticsearch:
nodeCount: 3
storage:
storageClassName: "standard-csi"
size: 200G
resources:
limits:
memory: "16Gi"
requests:
memory: "16Gi"
proxy:
resources:
limits:
memory: 256Mi
requests:
memory: 256Mi
redundancyPolicy: "SingleRedundancy"
visualization:
type: "kibana"
kibana:
replicas: 1
collection:
logs:
type: "fluentd"
fluentd: {}
EOF

=telemetry=
Restart telemetry.
oc delete pod -n openshift-monitoring -l app.kubernetes.io/component=telemetry-metrics-collector
=Update vsphere/openstack creds=
oc edit cm cloud-provider-config -n openshift-config
default-datastore = "cl07-2-fc-loc-001"

=Get datastore=
oc get cm cloud-provider-config -n openshift-config -o json | jq -r .data.config | sed -nr "/^\[Workspace\]/ { :l /^default-datastore[ ]*=/ { s/[^=]*=[ ]*//; p; q;}; n; b l;}"

=Manage labels.=
Add a label to a node or pod:
oc label node node001.krenger.ch mylabel=myvalue
oc label pod mypod-34-g0f7k mylabel=myvalue
Remove a label (in the example “mylabel”) from a node or pod:
oc label node node001.krenger.ch mylabel-
oc label pod mypod-34-g0f7k mylabel-
Permanently label a node
oc edit machineset ocp-qz7hf-worker-us-west-1b -n openshift-machine-api
=rollout=
Restart pod in an deployment
oc rollout restart deployment -n openshift-storage csi-rbdplugin-provisioner
=api.<URL>=
openssl_x509_multi_line <(oc get secrets external-loadbalancer-serving-certkey -n openshift-kube-apiserver -o json | jq -r '.data."tls.crt"|@base64d')
=ssl certificates replace=
How to replace api.<url> and star.apps.<url> certs.
# api. Create full chain cert. Public - intermediate - root ca.
api.<url>.crt
api.<url>.key
# create secret
oc delete secret api-cert -n openshift-config
oc create secret tls api-cert --cert=api.<url>.crt --key=api.<url>.key -n openshift-config
# patch apiserver
oc patch apiserver cluster --type=merge -p '{"spec":{"servingCerts": {"namedCertificates": [{"names": ["api.<url>"], "servingCertificate": {"name": "api-cert"}}]}}}'
...
# star.apps. Create full chain cert. Public - intermediate - root ca.
star.apps.<url>.crt
star.apps.<url>.key
# create secret
oc delete secret custom-certs-default -n openshift-ingress
oc create secret tls custom-certs-default --cert=star.apps.<url>.crt --key=star.apps.<url>.key -n openshift-ingress
# patch ingress controller
oc patch --type=merge --namespace openshift-ingress-operator ingresscontrollers/default --patch '{"spec":{"defaultCertificate":{"name":"custom-certs-default"}}}'
==edit serving certs==
look at api cert
oc get secret -n openshift-config $(oc get apiservers cluster -o json | jq -r '.spec.servingCerts.namedCertificates[].servingCertificate.name') -o json | jq -r '.data."tls.crt"' | base64 -d
Patch secret api cert
oc patch secret -n openshift-config $(oc get apiservers cluster -o json | jq -r '.spec.servingCerts.namedCertificates[].servingCertificate.name') -p '{"data":{"tls.crt": "<new-base64-encoded-certificate>"}}'
Look at ingress cert. wildcard.apps.<url>
oc get secret -n openshift-ingress $(oc get -n openshift-ingress-operator ingresscontrollers default -o json | jq -r .spec.defaultCertificate.name) -o json | jq -r '.data."tls.crt"' | base64 -d
Patch secret ingress wildcard.apps.<url>
oc patch secret -n openshift-ingress $(oc get -n openshift-ingress-operator ingresscontrollers default -o json | jq -r .spec.defaultCertificate.name) -p '{"data":{"tls.crt": "<new-base64-encoded-certificate>"}}'

=After you update above certificates then the following config map is updated to reflect that=
openssl_x509_multi_line <(oc get cm kube-root-ca.crt -o json | jq -r '.data."ca.crt"')
=get cluster-id=
oc get clusterversion/version -o jsonpath="{.spec.clusterID}"

=api=
Process running api server. They scale horizontally. They all serve requests.
openshift-kube-apiserver
kube-apiserver
=kube-proxy=
kube-proxy is a network proxy that runs on each node in your cluster, implementing part of the Kubernetes Service concept.
kube-proxy maintains network rules on nodes. These network rules allow network communication to your Pods from network sessions inside or outside of your cluster.
kube-proxy uses the operating system packet filtering layer if there is one and it's available. Otherwise, kube-proxy forwards the traffic itself.
=Resource Allocation=
OS and Kubernetes overhead. You can see the reserved OS & Kubernetes overhead by comparing the Allocatable (what the Kubernetes Scheduler can allocate to Pods) and the Capacity.
Capacity:
->cpu: 4
ephemeral-storage: 125293548Ki
hugepages-1Gi: 0
hugepages-2Mi: 0
->memory: 16409360Ki
pods: 250
Allocatable:
->cpu: 3500m
ephemeral-storage: 114396791822
hugepages-1Gi: 0
hugepages-2Mi: 0
->memory: 15258384Ki
pods: 250
==requests/limits==
User pod allocation is calculated by looking at the “Requests” resource columns from the kubectl get nodes output.
The relevant columns here are the “Requests, not Limits.
Requests impact how the pod is scheduled, and what resources are allocated to it,
whereas limits are used to enable pods to burst beyond their allocation.
==look at current Allocated resources==
oc get nodes --no-headers --selector="node-role.kubernetes.io/worker" -o=custom-columns='NAME:.metadata.name' | while read NODE ; do oc describe node $NODE | grep "Allocated resources:" -A10 | grep -E ' cpu | memory ' | while read RESOURCE ; do echo $NODE $RESOURCE ; done ; done

==empty space==
Allocatable - Allocated resources = empty
Allocatable:
cpu: 3500m
ephemeral-storage: 114396791822
hugepages-1Gi: 0
hugepages-2Mi: 0
memory: 15258384Ki
pods: 250
...
Allocated resources:
(Total limits may be over 100 percent, i.e., overcommitted.)
Resource Requests Limits
-------- -------- ------
cpu 834m (23%) 0 (0%)
memory 2474Mi (16%) 736Mi (4%)
ephemeral-storage 0 (0%) 0 (0%)
hugepages-1Gi 0 (0%) 0 (0%)
hugepages-2Mi 0 (0%) 0 (0%)
=status of namespace=
Show an overview of the current project
oc status
=age of cluster=
Looking at age of machines.
oc get nodes -o json | jq -r '.items[].metadata.creationTimestamp' | sort -n | sed 's/T/ /g;s/Z//g'
=oc adm inspect=
oc adm inspect namespace/isilon
tar cf /tmp/inspect.isilon.$(date_file ) inspect.local.*
=Operations Lifecycle manager(olm)=
oc logs -l app=olm-operator -n openshift-operator-lifecycle-manager --tail=-1
=Reinstall operator that is no longer available with current openshift version=
# Force install odf which is not possible to install because openshift has moved more than 1 version.
# Save subscription
for i in operators.coreos.com/mcg-operator.openshift-storage= operators.coreos.com/ocs-operator.openshift-storage= operators.coreos.com/odf-csi-addons-operator.openshift-storage= operators.coreos.com/odf-operator.openshift-storage= ; do
oc get subscription -o yaml -l $i > oc_get_subscription_${i//\//_}.yaml ; done
...
# Save operators
for i in operators.coreos.com/odf-operator.openshift-storage= operators.coreos.com/ocs-operator.openshift-storage= operators.coreos.com/mcg-operator.openshift-storage= operators.coreos.com/odf-csi-addons-operator.openshift-storage= ; do
oc get csv -l $i -o yaml > oc_get_csv_-l_${i//\//_}.yaml ; done
...
# Confirm backup files contain usable yaml. Have we forgotten any operators or csv:s. Remove resources clearly not related to odf.
...
# delete the existing ODF related subscriptions and the ClusterServiceVersions related:
for i in operators.coreos.com/mcg-operator.openshift-storage= operators.coreos.com/ocs-operator.openshift-storage= operators.coreos.com/odf-csi-addons-operator.openshift-storage= operators.coreos.com/odf-operator.openshift-storage= ; do
oc delete subscription -l $i; done
for i in operators.coreos.com/odf-operator.openshift-storage= operators.coreos.com/ocs-operator.openshift-storage= operators.coreos.com/mcg-operator.openshift-storage= operators.coreos.com/odf-csi-addons-operator.openshift-storage= ; do
oc delete csv -l $i ; done
...
# Make sure you wait for the CSVs to be deleted before creating a subscription again.
...
# create only the the Subscription again:
# (optional: edit the subscription before recreate, changing the channel version to the goal version)
...
# Recreate subscription
oc create -f 'oc_get_subscription_operators.coreos.com_odf-operator.openshift-storage=.yaml'
# wait watching the events:
oc get events -w

=increase disk on node=
Update worker machineset.
oc patch machinesets -n openshift-machine-api $(oc get machinesets -n openshift-machine-api -o json | jq -r '.items[] | select(.spec.template.metadata.labels."machine.openshift.io/cluster-api-machine-role" == "worker")| .metadata.name') --type merge -p '{"spec": {"template": {"spec": {"providerSpec": {"value": {"rootVolume": {"diskSize" : 50}}}}}}}'
==View results from above==
oc get machinesets -n openshift-machine-api $(oc get machinesets -n openshift-machine-api -o json | jq -r '.items[] | select(.spec.template.metadata.labels."machine.openshift.io/cluster-api-machine-role" == "worker")| .metadata.name') -o yaml | tee /tmp/$(oc get DNS cluster -o=jsonpath='{.spec.baseDomain}').$(date +%F_%H-%M-%S).yaml

==Update on node only==
VOLUME=abjorklund-01-h4sxm-worker-0-rkk87-root
os volume set --size 40 $VOLUME --os-volume-api-version 3.42
dnf install cloud-utils-growpart xfsprogs
ssh core@worker
growpart /dev/sda 4
xfs_growfs /

=increase ram on worker nodes=
oc patch machinesets -n openshift-machine-api $(oc get machinesets -n openshift-machine-api -o json | jq -r '.items[] | select(.spec.template.metadata.labels."machine.openshift.io/cluster-api-machine-role" == "worker")| .metadata.name') --type merge -p '{"spec": {"template": {"spec": {"providerSpec": {"value": {"memoryMiB" : 24576}}}}}}'
=Change flavor of worker node=
oc patch machinesets -n openshift-machine-api $(oc get machinesets -n openshift-machine-api -o json | jq -r '.items[] | select(.spec.template.metadata.labels."machine.openshift.io/cluster-api-machine-role" == "worker")| .metadata.name') --type merge -p '{"spec": {"template": {"spec": {"providerSpec": {"value": {"flavor" : "hm.4x16"}}}}}}'

=set number of worker nodes=
oc patch machinesets -n openshift-machine-api $(oc get machinesets -n openshift-machine-api -o json | jq -r '.items[] | select(.spec.template.metadata.labels."machine.openshift.io/cluster-api-machine-role" == "worker")| .metadata.name') --type merge -p '{"spec": {"replicas" : 2}}'

=clusteroperator=
ClusterOperator is the Custom Resource object which holds the current state of an operator. Clusteroperator is resposible for core, systemwide functions like dns and so on.
oc get clusteroperators
oc get co
oc get clusteroperators -o custom-columns=NAME:.metadata.name,ANNOTATIONS:.metadata.annotations

=ignition=
Retrieve rendered ignition data.
curl https://api-int.$(grep ^search /etc/resolv.conf | awk '{print $NF}'):22623/config/master
curl -v https://api-int.$(grep ^search /etc/resolv.conf | awk '{print $2}'):22623/config/worker

=rockylinux container names=
ubi ("Standard"): OpenSSL, microdnf, and utilities like gzip and vi
ubi-minimal ("Minimal"): Minimized binaries and minimal yum stack.
ubi-init ("Multi-service"): Less than standard but more than minimal, plus systemd.
ubi-micro ("Micro"): Most minimal image without even a package manager.
=create a job/pod/script=

==Create config map of script==
Notice that I have to escape $. Since I give date in a here document. Where $ is being expanded.
cat <<EOF | oc apply -f -
apiVersion: v1
kind: ConfigMap
metadata:
name: dns-lookup.sh
data:
dns-lookup.sh: |
#!/bin/bash
# Verify if dns resolution works and how fast.
while true ; do
for DNS in \$(awk '/^nameserver / {print \$2}' /etc/resolv.conf) 10.2.0.10 ; do
echo \$(date '+%F %H:%M:%S %Z') \$DNS \$(host -v -t A ibm.se 2>&1 | tail -3 )
done
sleep 5
done
EOF

==create job==
cat <<EOF | oc apply -f -
apiVersion: batch/v1
kind: Job
metadata:
name: dns-lookup
spec:
template:
spec:
containers:
- name: dns-lookup
# image: rockylinux/rockylinux:9
image: halfface/rockylinux-toolbox:v2
command: ["/script/dns-lookup.sh"]
volumeMounts:
- name: script
mountPath: "/script"
# securityContext:
# runAsUser: 0
# privileged: true
volumes:
- name: script
configMap:
name: dns-lookup.sh
defaultMode: 0755
restartPolicy: Never
activeDeadlineSeconds: 1209600
EOF

=terminal fix=
No line wraps
tput rmam
=list operatorhub/catalogsources=
oc get catalogsources -n openshift-marketplace
oc get catalogsources -n openshift-marketplace -o custom-columns=NAME:.metadata.name,DISPLAY:.spec.displayName,STATE:.status.connectionState.lastObservedState,TYPE:.spec.sourceType,PUBLISHER:.spec.publisher,IMAGE:.spec.image

=remove catalogsources=
oc get catalogsources.operators.coreos.com -n openshift-marketplace -l company=cambio --no-headers -o custom-columns=:.metadata.name | while read i ; do echo oc get catalogsources $i -n openshift-marketplace -o yaml \>oc_get_catalogsources.$(oc_api_url).$i.$(date_file).yaml ; echo oc delete catalogsource -n openshift-marketplace $i ; done

=which changes will occure=
. /etc/node-sizing-enabled.env ; NODE_SIZES_ENV=/tmp/node-sizing.env /usr/local/sbin/dynamic-system-reserved-calc.sh true ${SYSTEM_RESERVED_MEMORY} ${SYSTEM_RESERVED_CPU} ${SYSTEM_RESERVED_ES} ; sdiff /etc/node-sizing.env /tmp/node-sizing.env
=SYSTEM_RESERVED=
cat <<EOF | oc apply -f -
apiVersion: machineconfiguration.openshift.io/v1
kind: KubeletConfig
metadata:
name: dynamic-node
spec:
autoSizingReserved: true
machineConfigPoolSelector:
matchLabels:
pools.operator.machineconfiguration.openshift.io/worker: ""
EOF

Which changes will occur.
oc get nodes -o name | xargs -I {} oc debug {} -- chroot /host sh -c 'hostname ; . /etc/node-sizing-enabled.env ; NODE_SIZES_ENV=/tmp/node-sizing.env /usr/local/sbin/dynamic-system-reserved-calc.sh true ${SYSTEM_RESERVED_MEMORY} ${SYSTEM_RESERVED_CPU} ${SYSTEM_RESERVED_ES} ; sdiff /etc/node-sizing.env /tmp/node-sizing.env' 2>/dev/null
==which processes is it complaining about==
systemd-cgls /system.slice | grep -o '[^─]*\.service' | cat -v | sed 's/^\^\[\[0m//g' | while read i ; do echo -e "$(systemctl show -p MemoryCurrent $i | awk -F = '{print $2}')\t$i" ; done | column -t -s $'\t' | sort -n

=CNI=
oc get networks cluster -o 'custom-columns=NETWORKTYPE:.spec.networkType'
Cni from install
echo -e "$(oc --request-timeout=5 get -n kube-system cm/cluster-config-v1 -o json | jq -r '."data"."install-config"')" | python -c 'import sys, yaml, json; json.dump(yaml.safe_load(sys.stdin), sys.stdout, indent=4)' | jq -r .networking.networkType
=autoscale.=
https://docs.openshift.com/container-platform/4.12/machine_management/applying-autoscaling.html
==ClusterAutoscaler==
# The two below has to be configured.
apiVersion: autoscaling.openshift.io/v1
kind: ClusterAutoscaler
metadata:
name: default
spec:
logVerbosity: 4
podPriorityThreshold: -10
resourceLimits:
cores:
max: 128
min: 0
maxNodesTotal: 24
memory:
max: 256
min: 0
scaleDown:
delayAfterAdd: 10m
delayAfterDelete: 5m
delayAfterFailure: 30s
enabled: true
unneededTime: 5m
utilizationThreshold: "0.4"
==MachineAutoscaler==
apiVersion: autoscaling.openshift.io/v1beta1
kind: MachineAutoscaler
metadata:
name: abjorklund-01-4rp8x-worker-1
namespace: openshift-machine-api
spec:
maxReplicas: 12
minReplicas: 0
scaleTargetRef:
apiVersion: machine.openshift.io/v1beta1
kind: MachineSet
name: abjorklund-01-4rp8x-worker-1
==Machineset example where machine is labeled and tainted.==
apiVersion: machine.openshift.io/v1beta1
kind: MachineSet
metadata:
annotations:
autoscaling.openshift.io/machineautoscaler: openshift-machine-api/abjorklund-01-4rp8x-worker-1
capacity.cluster-autoscaler.kubernetes.io/cpu: "4"
capacity.cluster-autoscaler.kubernetes.io/memory: "17179869184"
machine.openshift.io/cluster-api-autoscaler-node-group-max-size: "12"
machine.openshift.io/cluster-api-autoscaler-node-group-min-size: "0"
machine.openshift.io/memoryMb: "16384"
machine.openshift.io/vCPU: "4"
labels:
machine.openshift.io/cluster-api-cluster: abjorklund-01-4rp8x
machine.openshift.io/cluster-api-machine-role: worker
machine.openshift.io/cluster-api-machine-type: worker
name: abjorklund-01-4rp8x-worker-1
namespace: openshift-machine-api
spec:
replicas: 0
selector:
matchLabels:
machine.openshift.io/cluster-api-cluster: abjorklund-01-4rp8x
machine.openshift.io/cluster-api-machineset: abjorklund-01-4rp8x-worker-1
template:
metadata:
labels:
machine.openshift.io/cluster-api-cluster: abjorklund-01-4rp8x
machine.openshift.io/cluster-api-machine-role: worker
machine.openshift.io/cluster-api-machine-type: worker
machine.openshift.io/cluster-api-machineset: abjorklund-01-4rp8x-worker-1
spec:
metadata:
labels:
stress: stress
providerSpec:
value:
apiVersion: machine.openshift.io/v1alpha1
cloudName: openstack
cloudsSecret:
name: openstack-cloud-credentials
namespace: openshift-machine-api
flavor: hm.4x16
image: ""
kind: OpenstackProviderSpec
metadata:
creationTimestamp: null
networks:
- subnets:
- filter:
name: abjorklund-01-4rp8x-nodes
tags: openshiftClusterID=abjorklund-01-4rp8x
rootVolume:
diskSize: 64
sourceUUID: abjorklund-01-4rp8x-rhcos
volumeType: ssd
securityGroups:
- name: abjorklund-01-4rp8x-worker
- uuid: 1de812c6-ed8b-4212-a486-ca283dbe1444
serverGroupName: abjorklund-01-4rp8x-worker-1
serverMetadata:
Name: abjorklund-01-4rp8x-worker
openshiftClusterID: abjorklund-01-4rp8x
tags:
- openshiftClusterID=abjorklund-01-4rp8x
userDataSecret:
name: worker-user-data
taints:
- effect: NoExecute
key: stress
value: stress

==autoscaler does not scale down==
oc logs -l cluster-autoscaler=default -n openshift-machine-api --tail=-1 --timestamps=true
==Add dynamic load to cluster. deployment==
apiVersion: apps/v1
kind: Deployment
metadata:
annotations:
deployment.kubernetes.io/revision: "7"
labels:
app: stress
name: stress
namespace: stress
spec:
progressDeadlineSeconds: 600
replicas: 0
revisionHistoryLimit: 10
selector:
matchLabels:
app: stress
strategy:
rollingUpdate:
maxSurge: 25%
maxUnavailable: 25%
type: RollingUpdate
template:
metadata:
annotations:
kubectl.kubernetes.io/restartedAt: "2025-01-24T09:52:22+01:00"
creationTimestamp: null
labels:
app: stress
spec:
containers:
- command:
- /mnt/bin/stress.sh
image: halfface/rockylinux-toolbox:v3
imagePullPolicy: IfNotPresent
livenessProbe:
exec:
command:
- bash
- -c
- ps uxawww | grep -q [s]tress && echo 0 || echo 1
failureThreshold: 3
periodSeconds: 10
successThreshold: 1
timeoutSeconds: 1
name: stress
resources:
requests:
cpu: 700m
memory: 300Mi
terminationMessagePath: /dev/termination-log
terminationMessagePolicy: File
volumeMounts:
- mountPath: /mnt/bin/
name: stress
dnsPolicy: ClusterFirst
nodeSelector:
stress: stress
restartPolicy: Always
schedulerName: default-scheduler
terminationGracePeriodSeconds: 30
tolerations:
- effect: NoExecute
key: stress
value: stress
volumes:
- configMap:
defaultMode: 493
name: stress.sh
name: stress
==configmap==
apiVersion: v1
data:
stress.sh: |
#!/bin/bash
# stress pod.
while true ; do
echo $(date '+%F %H:%M:%S %Z') $( stress -m 1 --vm-bytes 1000M --vm-keep -t 300s )
sleep 5
done
kind: ConfigMap
metadata:
name: stress.sh
namespace: stress

=change dns server for domain=
oc edit dns.operator/default
apiVersion: operator.openshift.io/v1
kind: DNS
metadata:
name: default
spec:
servers:
- name: halffce-server
zones:
- halfface.se
forwardPlugin:
policy: Random
upstreams: 10.111.222.2
# View config.
oc get configmap/dns-default -n openshift-dns -o yaml

=coredns=
# tail logs.
oc get events -A --sort-by=.metadata.creationTimestamp
# Change debug level.
oc patch dnses.operator.openshift.io/default -p '{"spec":{"logLevel":"Debug"}}' --type=merge
Sets
log . {
class denial error
}
oc patch dnses.operator.openshift.io/default -p '{"spec":{"logLevel":"Trace"}}' --type=merge
Sets
log . {
class all
}
oc patch dnses.operator.openshift.io/default -p '{"spec":{"logLevel":"Normal"}}' --type=merge
Sets
log . {
class error
}
==Get log files for analyze==
oc get pods -l dns.operator.openshift.io/daemonset-dns=default -o custom-columns=POD:.metadata.name,NODE:.spec.nodeName --no-headers -n openshift-dns | while read i j ; do oc logs $i --tail=-1 -c dns --timestamps=true -n openshift-dns > /tmp/oc_logs_$j.$i.$(oc get DNS cluster -o=jsonpath='{.spec.baseDomain}').$(date +%F_%H-%M-%S) ; done

=get instance dns name=
oc get DNS cluster -o=jsonpath='{.spec.baseDomain}'
=Read values provided by coredns /metrics=
oc exec -it -n openshift-dns $(oc get pods -l dns.operator.openshift.io/daemonset-dns=default --no-headers -n openshift-dns| head -1) -- curl -s http://localhost:9153/metrics
=coredns default logformat=
# Default format
{remote}:{port} - {>id} "{type} {class} {name} {proto} {size} {>do} {>bufsize}" {rcode} {>rflags} {rsize} {duration}
# Values explained
{port}: client’s port
{remote}: client’s IP address, for IPv6 addresses these are enclosed in brackets: [::1]
{>id}: query ID
{type}: qtype of the request
{class}: qclass of the request
{name}: qname of the request
{proto}: protocol used (tcp or udp)
{size}: request size in bytes
{>do}: is the EDNS0 DO (DNSSEC OK) bit set in the query
{>bufsize}: the EDNS0 buffer size advertised in the query
{rcode}: response RCODE
{>rflags}: response flags, each set flag will be displayed, e.g. “aa, tc”. This includes the qr bit as well
{rsize}: raw (uncompressed), response size (a client may receive a smaller response)
{duration}: response duration
=Confirm that coredns hosts are possible to resolve=
<pre>
grep match /etc/coredns/Corefile | uniq | sed 's/\[//g;s/\]//g;s/^ *match //g;s/\.\*/test/g;s/^\^//g' | while read i ; do echo $(dig +short ${i}.) ${i}. ; done
</pre>

=Create lets encrypt certificates on dns domain in route53 which is managed by certmanager.=
#Create a domain in route 53.
#Create a user with a token for "Application running outside AWS"
==Fill in below values to be able to update config below.==
Hosted_Zone_id: <Hosted_Zone_id>
Access_key: <Access_key>
Secret_access_key: <Secret_access_key>
DNS_Domain: <DNS_Domain>
DNS_shortname: <DNS_shortname>
==Attach the following policy to your newly created user.==
(Populate all <Values> below.)
{
"Version": "2023-11-22",
"Statement": [
{
"Effect": "Allow",
"Action": "route53:GetChange",
"Resource": "arn:aws:route53:::change/*"
},
{
"Effect": "Allow",
"Action": "route53:ChangeResourceRecordSets",
"Resource": "arn:aws:route53:::hostedzone/<Hosted_Zone_id>"
},
{
"Effect": "Allow",
"Action": "route53:ListHostedZonesByName",
"Resource": "*"
}
]
}
==Create namespace==
oc create namespace cert-manager
==Install cert-manager community version via graphical fluff.==
==Create secret that includes <Secret_access_key>.==
oc create secret generic route53-secret --from-literal=secret-access-key="<Secret_access_key>" -n cert-manager
==Create ClusterIssuer for letsencrypt which uses route53 to show that you own dns.==
cat <<EOF | oc apply -f -
apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
name: letsencrypt-prod-dns
namespace: cert-manager
spec:
acme:
server: https://acme-v02.api.letsencrypt.org/directory
email: support@company.se
# Name of a secret used to store the ACME account private key
privateKeySecretRef:
name: <DNS_shortname>-issuer-account-key
solvers:
- selector:
dnsZones:
- "<DNS_Domain>"
dns01:
route53:
accessKeyID: <Access_key>
secretAccessKeySecretRef:
name: route53-secret
key: secret-access-key
hostedZoneID: <Hosted_Zone_id>
region: 'us-east-1'
EOF

==Create api certificate.==
cat <<EOF | oc apply -f -
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
name: cert-api
namespace: openshift-config
spec:
issuerRef:
name: letsencrypt-prod-dns
kind: ClusterIssuer
dnsNames:
- "api.<DNS_Domain>"
secretName: le-api-cert
commonName: "api.<DNS_Domain>"
EOF
==Start to use api certificate.==
oc patch apiserver cluster --type=merge -p '{"spec":{"servingCerts": {"namedCertificates": [{"names": ["api.<DNS_Domain>"], "servingCertificate": {"name": "le-api-cert"}}]}}}'

==Create ingress certificate==
cat <<EOF | oc apply -f -
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
name: le-wildcard-apps-certificate
namespace: openshift-ingress
spec:
issuerRef:
name: letsencrypt-prod-dns
kind: ClusterIssuer
dnsNames:
- "*.apps.<DNS_Domain>"
secretName: le-wildcard-apps-certificate
commonName: "*.apps.<DNS_Domain>"
EOF
==Start to use ingress certificate.==
oc patch --type=merge --namespace openshift-ingress-operator ingresscontrollers/default --patch '{"spec":{"defaultCertificate":{"name":"le-wildcard-apps-certificate"}}}'
=resolv.conf=
ndots 5. This means that the DNS client will automatically consider a domain name to be fully qualified (which will allow it to skip the search path iteration) if it has five or more dots.
=bind to external login sources ldap ad=
oc get authentications.operator.openshift.io cluster -o yaml
=get machine name and creation time=
oc get machines -o=custom-columns='NAME:.metadata.name,CREATIONTIMESTAMP:.metadata.creationTimestamp,TYPE:.spec.providerSpec.value.flavor,STATUS:.status.phase' -n openshift-machine-api

=setup nfs server=
nfs export shared between pods.
==Create server==
openstack server create --flavor gp.1x2 --availability-zone europe-se-1a --image rocky-8-x86_64 --boot-from-volume 30 --network abjorklund-01-bmc7w-openshift --security-group ssh_allow --key-name abjorklund_ed25519 abjorklund_$(date_file)
openstack volume create --size 50 --type ssd --description "nfs storage block device 0" nfs_storage_abjorklund-01
openstack server add volume e93d2db1-6d95-4364-a236-0bd1b9255e90 28adbdb9-c88d-4397-9a79-b13c505016a8 --device /dev/vdb
==install nfs dependencis==
dnf -y install cloud-utils-growpart nfs-utils iptables-utils epel-release vim-enhanced
==How to grow filesystem.==
partx growpart
os volume set --size 60 nfs_storage_abjorklund-01 --os-volume-api-version 3.42
==Create partion and disk.==
gdisk /dev/sdb
mkfs.ext4 /dev/sdb1
find /dev/ -ls | grep sdb | grep by-uuid
==Mount drive. /etc/fstab==
UUID=66998126-9f18-44ce-a462-827c870a57bd /netstorage ext4 defaults 0 0
mkdir /netstorage
mount /netstorage/
mkdir /netstorage/abjorklund-01
chmod 777 /netstorage/abjorklund-01
==export drive==
systemctl enable nfs-server.service --now
/etc/exports
/netstorage/abjorklund-01 10.1.0.0/16(rw,root_squash)
exportfs -rav

==setup deployment==
# deployment.yaml
cat <<EOF | oc apply -f -
apiVersion: apps/v1
kind: Deployment
metadata:
name: nfs-client-provisioner
labels:
app: nfs-client-provisioner
# replace with namespace where provisioner is deployed
namespace: default
spec:
replicas: 1
strategy:
type: Recreate
selector:
matchLabels:
app: nfs-client-provisioner
template:
metadata:
labels:
app: nfs-client-provisioner
spec:
affinity:
nodeAffinity:
requiredDuringSchedulingIgnoredDuringExecution:
nodeSelectorTerms:
- matchExpressions:
- key: node-role.kubernetes.io/worker
operator: Exists
serviceAccountName: nfs-client-provisioner
securityContext:
supplementalGroups:
- 65534
- 1261150637
containers:
- name: nfs-client-provisioner
image: gcr.io/k8s-staging-sig-storage/nfs-subdir-external-provisioner:v4.0.0
volumeMounts:
- name: nfs-client-root
mountPath: /persistentvolumes
env:
- name: PROVISIONER_NAME
value: auto-nfs-storage
- name: NFS_SERVER
value: 10.1.0.48
- name: NFS_PATH
value: "/netstorage/abjorklund-01"
volumes:
- name: nfs-client-root
nfs:
server: 10.1.0.48
path: /netstorage/abjorklund-01
EOF
# nfs-clusterrolebinding.yaml
cat <<EOF | oc apply -f -
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: run-nfs-client-provisioner
subjects:
- kind: ServiceAccount
name: nfs-client-provisioner
# replace with namespace where provisioner is deployed
namespace: default
roleRef:
kind: ClusterRole
name: nfs-client-provisioner-runner
apiGroup: rbac.authorization.k8s.io
EOF
# nfs-clusterrole.yaml
cat <<EOF | oc apply -f -
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: nfs-client-provisioner-runner
rules:
- apiGroups: [""]
resources: ["persistentvolumes"]
verbs: ["get", "list", "watch", "create", "delete"]
- apiGroups: [""]
resources: ["persistentvolumeclaims"]
verbs: ["get", "list", "watch", "update"]
- apiGroups: ["storage.k8s.io"]
resources: ["storageclasses"]
verbs: ["get", "list", "watch"]
- apiGroups: [""]
resources: ["events"]
verbs: ["create", "update", "patch"]
EOF
# nfs-rolebinding.yaml
cat <<EOF | oc apply -f -
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: leader-locking-nfs-client-provisioner
# replace with namespace where provisioner is deployed
namespace: default
subjects:
- kind: ServiceAccount
name: nfs-client-provisioner
# replace with namespace where provisioner is deployed
namespace: default
roleRef:
kind: Role
name: leader-locking-nfs-client-provisioner
apiGroup: rbac.authorization.k8s.io
EOF
# nfs-role.yaml
cat <<EOF | oc apply -f -
kind: Role
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: leader-locking-nfs-client-provisioner
# replace with namespace where provisioner is deployed
namespace: default
rules:
- apiGroups: [""]
resources: ["endpoints"]
verbs: ["get", "list", "watch", "create", "update", "patch"]
EOF
# nfs-sa.yaml
cat <<EOF | oc apply -f -
apiVersion: v1
kind: ServiceAccount
metadata:
name: nfs-client-provisioner
# replace with namespace where provisioner is deployed
namespace: default
EOF
# storageclass.yaml
cat <<EOF | oc apply -f -
apiVersion: storage.k8s.io/v1
kind: StorageClass
metadata:
name: managed-nfs-storage
provisioner: auto-nfs-storage # or choose another name, must match deployment's env PROVISIONER_NAME'
parameters:
onDelete: delete
EOF
# test-claim.yaml
cat <<EOF | oc apply -f -
kind: PersistentVolumeClaim
apiVersion: v1
metadata:
name: test-claim
namespace: default
spec:
storageClassName: managed-nfs-storage
accessModes:
- ReadWriteMany
resources:
requests:
storage: 1Mi
EOF
=set nfs csi driver=
https://github.com/kubernetes-csi/csi-driver-nfs

=dns=
https://access.redhat.com/solutions/3804501
==confirm upstream dns works==
for UPSTREAM_DNS_IP in 10.46.201.1 10.46.201.2 10.46.201.3 ; do UPSTREAM_DNS_PORT=53 ; echo -e "\nTCP\n"; for dnspod in `oc get pods -n openshift-dns -o name --no-headers -l dns.operator.openshift.io/daemonset-dns=default`; do echo "Pod $dnspod"; oc exec -n openshift-dns -c dns $dnspod -- dig @${UPSTREAM_DNS_IP} redhat.com -p ${UPSTREAM_DNS_PORT} +tcp +short; echo; done ; done
for UPSTREAM_DNS_IP in 10.46.201.1 10.46.201.2 10.46.201.3 ; do UPSTREAM_DNS_PORT=53 ; echo -e "\nUDP\n"; for dnspod in `oc get pods -n openshift-dns -o name --no-headers -l dns.operator.openshift.io/daemonset-dns=default`; do echo "Pod $dnspod"; oc exec -n openshift-dns -c dns $dnspod -- dig @${UPSTREAM_DNS_IP} redhat.com -p ${UPSTREAM_DNS_PORT} +notcp +short; echo; done ; done

=image=
Which images are ok.
oc get image.config.openshift.io cluster -o yaml
=enable sso with keycloak=
apiVersion: config.openshift.io/v1
kind: OAuth
metadata:
annotations: {}
labels:
app.kubernetes.io/instance: sso
name: cluster
spec:
identityProviders:
- mappingMethod: add
name: SSO
openID:
claims:
email:
- email
groups:
- groups
name:
- name
preferredUsername:
- preferred_username
clientID: <Client name in keycloak>
clientSecret:
name: keycloak-client-secret
extraScopes: []
issuer: <URL to issuer>
type: OpenID
---
apiVersion: v1
data:
clientSecret: <base64 secret>
kind: Secret
metadata:
labels:
app.kubernetes.io/instance: sso
name: keycloak-client-secret
namespace: openshift-config

=keepalive/api/ingress=
On nodes where nodes server the same ip for api or ingress.
oc get nodes -o name | xargs -I {} oc debug {} -- chroot /host sh -c 'echo "# unicast_peer" > /etc/keepalived/keepalived.conf'
Get info about where ingress is running.
oc get nodes -o name | xargs -I {} oc debug {} -- chroot /host sh -c 'ip a' 2>&1 | tee /tmp/tmp ; grep $(host $(oc whoami --show-server | awk -F ':|/' '{print $4}') | awk '{print $NF}') /tmp/tmp

=diff rendered mc=
export OLD_RENDERED=rendered-infra-6c7e5fc796264dd32341950aea971807 ; export NEW_RENDERED=rendered-infra-bac1dd431374a5c4c21742e547739c7c ; diff -NrU 5 <(oc get mc ${OLD_RENDERED} -o json) <(oc get mc ${NEW_RENDERED} -o json)
=secret management=
List secrets of they type tls.
get secrets --field-selector type=kubernetes.io/tls
=ocm=
==ocm install==
(cd /usr/local/bin/ ; sudo curl -vLsk https://github.com/openshift-online/ocm-cli/releases/download/v0.1.72/ocm-linux-amd64 -o ocm ; sudo chmod 755 ocm)
==ocm search examples==
ocm list clusters --parameter search="name like 'da0d9ade-d649-4948-8bc6-744a1fcb0960'"
ocm get /api/clusters_mgmt/v1/clusters --parameter search="name like '0047ccf6-134b-4bff-99e0-5f2d6532a3ea'"
ocm get /api/accounts_mgmt/v1/subscriptions/ --parameter size=1000 | jq -r '.items[]| .display_name +"\t"+ .status +"\t"+ .cluster_id +"\t"+ .created_at' | grep -v Archived | column_tab
Search for two states.
ocm get /api/accounts_mgmt/v1/subscriptions/ --parameter search="status like 'Active' or status like 'Stale'" --parameter size=1000

=PodDisruptionBudget=
API object that specifies the minimum number of replicas that must be up at a time.
=pod placement=
Does it look sane which pods run on worker nodes. Search for pods on worker nodes and look for the same pods on all nodes.
oc get nodes --no-headers --selector='node-role.kubernetes.io/worker,!node-role.kubernetes.io/infra' -o=custom-columns='NAME:.metadata.name' | while read NODE ; do oc get pods -A -o wide --no-headers --field-selector "spec.nodeName=$NODE" | while read NAMESPACE POD REST ; do echo '#' $NAMESPACE ${POD%-*} ; oc get pods -n $NAMESPACE -o wide | grep ${POD%-*} ; done ; done | less -ISRM
Are any user pods running outside worker nodes?
oc get project --no-headers -o=custom-columns='NAME:.metadata.name' | grep -v ^openshift- | while read NAMESPACE ; do echo '*' $NAMESPACE ; oc get pods -o wide -n $NAMESPACE ; done
=wait=
Wait for kafka getting ready.
kubectl wait kafka/my-cluster --for=condition=Ready --timeout=300s -n kafka
=list configured ssh public keys=
oc get machineconfig --no-headers -o custom-columns=":metadata.name" | grep -E '^99-.*-ssh$' | while read MACHINECONFIG ; do echo '*' "${MACHINECONFIG}" ; oc get machineconfig "${MACHINECONFIG}" -o json | jq -r '.spec.config.passwd.users[].sshAuthorizedKeys[]'; done
=Add key for ssh login=
oc get machineconfig --no-headers -o custom-columns=":metadata.name" | grep -E '^99-.*-ssh$' | while read MACHINE_CONFIG_SSH ; do echo '*' $MACHINE_CONFIG_SSH ; oc patch machineconfig $MACHINE_CONFIG_SSH --type=json --patch="[{\"op\":\"add\", \"path\":\"/spec/config/passwd/users/0/sshAuthorizedKeys/-\", \"value\":\"$(cat $HOME/.ssh/id_ed25519.pub)\"}]" ; done
With a save.
oc get machineconfig --no-headers -o custom-columns=":metadata.name" | grep -E '^99-.*-ssh$' | while read MACHINE_CONFIG_SSH ; do echo '*' $MACHINE_CONFIG_SSH ; oc_script_log oc get machineconfig $MACHINE_CONFIG_SSH -o yaml </dev/null ; oc patch machineconfig $MACHINE_CONFIG_SSH --type=json --patch="[{\"op\":\"add\", \"path\":\"/spec/config/passwd/users/0/sshAuthorizedKeys/-\", \"value\":\"$(cat $HOME/.ssh/id_ed25519.pub)\"}]" ; done

=readable output from df.=
df -lh | grep -Ev '^overlay|^tmpfs|^shm|^nsfs|^cgroup|^devtmpfs'
=give me openstack credentials=
oc get secret -n kube-system openstack-credentials -o json | jq -r '.data."clouds.yaml" | @base64d'
=extract content of container=
CONT_ID=$(docker create nginx:latest)
docker export ${CONT_ID} -o nginx.tar.gz

=shut down openshift=
Stolen with pride: https://docs.openshift.com/container-platform/4.12/backup_and_restore/graceful-cluster-shutdown.html
# Etcd bacup.
# Do we use proxy.
oc get proxy cluster -o yaml
# Make an etcd backup.
oc debug --as-root node/$(oc get nodes --no-headers --selector='node-role.kubernetes.io/master' -o=custom-columns='NAME:.metadata.name' | head -1) -- chroot /host sh -c '/usr/local/bin/cluster-backup.sh /home/core/assets/backup'
# Copy files locally.
MASTER=node/$(oc get nodes --no-headers --selector='node-role.kubernetes.io/master' -o=custom-columns='NAME:.metadata.name' | head -1) ; oc debug $MASTER -- chroot /host sh -c 'ls /home/core/assets/backup/*' 2>/dev/null | while read ETCD_BACKUP ; do echo '*' Copying ${ETCD_BACKUP##*/} ; oc debug $MASTER -- chroot /host sh -c "cat $ETCD_BACKUP | gzip -9" | zcat > ${ETCD_BACKUP##*/} ; done
# Confirm files are ok.
MASTER=node/$(oc get nodes --no-headers --selector='node-role.kubernetes.io/master' -o=custom-columns='NAME:.metadata.name' | head -1) ; oc debug $MASTER -- chroot /host sh -c 'ls /home/core/assets/backup/*' 2>/dev/null | while read ETCD_BACKUP ; do echo '*' md5sum ${ETCD_BACKUP##*/} ; oc debug $MASTER -- chroot /host sh -c "md5sum $ETCD_BACKUP" 2>/dev/null ; md5sum ${ETCD_BACKUP##*/} ; done
# When does certificate run out.
oc -n openshift-kube-apiserver-operator get secret kube-apiserver-to-kubelet-signer -o jsonpath='{.metadata.annotations.auth\.openshift\.io/certificate-not-after}{"\n"}'
# kubelet client/server certificate expiration.
oc get nodes -o name | xargs -I {} oc debug {} -- chroot /host sh -c 'openssl x509 -in /var/lib/kubelet/pki/kubelet-client-current.pem -noout -enddate; openssl x509 -in /var/lib/kubelet/pki/kubelet-server-current.pem -noout -enddate'
# If certs expire while being shut down. Then we manually have to approve csr:s when cluster comes up.
# oc get csr -o name | xargs oc adm certificate approve
# Shutdown all nodes.
oc get nodes -o name | xargs -I {} oc debug {} -- chroot /host sh -c 'shutdown -h 1'
# Now nodes can stay dead until reviving.
# To start up use command similar to this which is from openstack.
openstack server list -f value | grep SHUTOFF | awk '{print $2}' | xargs openstack server start

=statefulset=
StatefulSet is a Kubernetes controller designed to manage stateful applications that require stable network identities and persistent storage. It handles the deployment, scaling, and management of pods in an ordered and predictable manner, making it ideal for databases, distributed systems, and other applications where state preservation is critical.
=oc diff=
Se which changes would be made
kubectl diff -f <manifest>.yaml
=taint=
Remove taint from node.
kubectl taint node control-plane0.novalocal control-plane1.novalocal control-plane2.novalocal node.cloudprovider.kubernetes.io/uninitialized-
=list nodes with taints=
oc get nodes -o custom-columns=NAME:.metadata.name,TAINTS:.spec.taints

=Sealed secrets=
==create sealed secret==
kubeseal --controller-namespace=kube-system --format yaml --namespace openshift-config <ldap-secret.yaml > ldap-secret-sealed.yaml
==get secret that you want to unencrypt==
oc get sealedsecrets -n openshift-config ldap-secret -o yaml > sealedsecrets_-n_openshift-config_ldap-secret
==Unencrypt sealed secrets==
kubeseal --recovery-private-key <private_key_file> --recovery-unseal < sealedsecrets_-n_openshift-config_ldap-secret > sealedsecrets_-n_openshift-config_ldap-secret.unsealed
==Get private keys from from Sealed secrets==
oc get secret -n kube-system -l sealedsecrets.bitnami.com/sealed-secrets-key -o json | jq -r '.items[].data."tls.key"' | while read LINE ; do echo $LINE | base64 -d > $(echo "${LINE}" | cut -c -100) ; done

=imagetag=
ImageTag represents a single tag within an image stream and includes the spec, the status history, and the currently referenced image (if any) of the provided tag
"alertname": "SamplesImagestreamImportFailing",
"namespace": "openshift-cluster-samples-operator",
# Remove import fail
oc -n openshift get imagetag | grep "ImportFailed" | awk -e '{ print $1 }' | xargs -r oc -n openshift tag -d
oc delete pod -l name=cluster-samples-operator -n openshift-cluster-samples-operator

=custom-column examples=
oc get machine -n openshift-machine-api -o custom-columns=MACHINE:.metadata.name,SERVERGROUPNAME:.spec.providerSpec.value.serverGroupName,CREATIONTIME:.metadata.creationTimestamp --no-headers
=/etc/hosts=
BASE_URL=$(oc get DNS cluster -o=jsonpath='{.spec.baseDomain}')
cat << EOF
$( host api.${BASE_URL} | awk '{print $NF}') api.${BASE_URL}
$( host oauth-openshift.apps.${BASE_URL} | awk '{print $NF}') oauth-openshift.apps.${BASE_URL}
EOF
=--field-selector: examples=
List pods on node.
kubectl get pods --all-namespaces -o wide --field-selector spec.nodeName=<node-name>
List running pods
oc get pods --field-selector status.phase==Running
List not running pods
oc get pods --field-selector status.phase!=Running
=node is not ready. What could cause it=
oc logs -n openshift-machine-config-operator -l k8s-app=machine-config-controller
=Copy file from pod to your machine=
kubectl cp -n kafka $(oc get kafka -n kafka --no-headers -o custom-columns=:.metadata.name)-kafka-0:/opt/kafka/libs/kafka-tools-3.9.0.jar /temp/kafka-tools-3.9.0.jar
=category=
oc get crd -o jsonpath='{range .items[?(@.spec.names.categories)]}{.metadata.name}{"\t"}{.spec.names.categories}{"\n"}{end}' | awk -F '"' '{print $2}' | sort | uniq | while read i ; do echo '*' $i oc get $i -A ; done
* cluster-api oc get cluster-api -A
* coreoperators oc get coreoperators -A
* olm oc get olm -A
* prometheus-operator oc get prometheus-operator -A
=noobaa=
==recreate noobaa==
# Recreate noobaa. https://access.redhat.com/solutions/5948631
oc patch -n openshift-storage noobaa noobaa --type='merge' -p '{"spec":{"cleanupPolicy":{"allowNoobaaDeletion":true}}}'
oc delete -n openshift-storage noobaas.noobaa.io --all
# possibly run this command if hanging.
oc patch -n openshift-storage noobaas/noobaa --type=merge -p '{"metadata": {"finalizers":null}}'
# confirm working.
oc get pv,deployment,pods,sts -n openshift-storage|grep noobaa

=hdd to ssd convertion=
ceph osd crush rm-device-class osd.<id>
ceph osd crush set-device-class ssd osd.<id>
ROTA 1 means spinning platter
oc get nodes -l cluster.ocs.openshift.io/openshift-storage="" --no-headers -o custom-columns=:.metadata.name | xargs -I % oc debug node/% -- chroot /host sh -c "lsblk -d -o NAME,ROTA,MODEL" 2>/dev/null | grep -Ev '^loop|^sr0|^nbd|^rbd' ; oc exec -n openshift-storage $(oc get pods -n openshift-storage -o name -l app=rook-ceph-operator) -it -- bash -c "export CEPH_ARGS='-c /var/lib/rook/openshift-storage/openshift-storage.config'; exec ceph osd tree"

=lease=
I way of distributing resouces. In the case of nodes report back within time defined.
oc get leases -o custom-columns=NAMESPACE:.metadata.name,NAME:.metadata.name,HOLDER:.spec.holderIdentity,LEASEDURATION:.spec.leaseDurationSeconds,RENEWTIME:.spec.renewTime -A
=download oc for windows=
https://mirror.openshift.com/pub/openshift-v4/clients/oc/latest/
==missing commands==
ps_ls(){
echo "PID STATE COMMAND"
for pid in /proc/[0-9]*; do
[ -d "$pid" ] || continue
pid_num=$(basename "$pid")
cmd=$(cat "$pid/cmdline" 2>/dev/null | tr '\0' ' ')
state=$(cat "$pid/stat" 2>/dev/null | cut -d' ' -f3)
[ -n "$cmd" ] && printf "%-8s %-5s %s\n" "$pid_num" "$state" "$cmd"
done
}
=Create pod for testing read and write to pvc=
<pre>
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: odf-simple-test-pvc
namespace: default
spec:
accessModes:
- ReadWriteMany
resources:
requests:
storage: 1Gi
storageClassName: ocs-storagecluster-cephfs
---
apiVersion: v1
kind: Pod
metadata:
name: odf-simple-test-pod
namespace: default
spec:
containers:
- name: test-container
image: registry.redhat.io/ubi8/ubi:latest
command: ["/bin/bash"]
args:
- -c
- |
echo "Starting simple ODF PVC test..."
TEST_FILE="/mnt/test/simple-test.txt"

while true ; do
DATE=$(TZ=Europe/Stockholm date '+%F %H:%M:%S %Z')
# Write test
echo "${DATE}" > $TEST_FILE
# Read test
READ_RESULT=$(timeout 1 cat $TEST_FILE 2>/dev/null)
if [ "$READ_RESULT" = "${DATE}" ]; then
echo "${DATE} PVC Read/Write test PASSED"
else
echo "${DATE} PVC Read/Write test FAILED"
exit 1
fi
sleep 1
done
volumeMounts:
- name: test-volume
mountPath: /mnt/test
readinessProbe:
exec:
command: ["true"]
initialDelaySeconds: 5
periodSeconds: 5
livenessProbe:
exec:
command: ["true"]
initialDelaySeconds: 10
periodSeconds: 10
volumes:
- name: test-volume
persistentVolumeClaim:
claimName: odf-simple-test-pvc
restartPolicy: Never
</pre>
=PrometheusDuplicateTimestamps=
https://access.redhat.com/solutions/7101689
# Save yaml that you want to edit.
oc get configmap cluster-monitoring-config -n openshift-monitoring -o json | jq -r '.data."config.yaml"' | yq -e '.prometheusK8s.logLevel = "debug"' > config.yaml
# Upload the same
oc create configmap cluster-monitoring-config -n openshift-monitoring --from-file=config.yaml --dry-run=client -o yaml | kubectl apply -f -
# If above fails it may be caused by argocd managing the manifest. Disable sync
oc label application <argo-app> -n openshift-gitops owner-
# Command above should do the same as below command.
argocd app set openshift-gitops/<argo-app> --sync-policy=none
# Find trouble
oc logs -n openshift-monitoring prometheus-k8s-1 --tail=-1 | grep "Duplicate sample for timestam" | awk -F ' msg="Duplicate sample for timestamp"' '{print $2}' | sort | uniq -c
49 series="kube_persistentvolumeclaim_access_mode{namespace=\"rjh-mh-test\",persistentvolumeclaim=\"postgres-1\",access_mode=\"ReadWriteOnce\"}"
# Enable sync
oc label application <argo-app> -n openshift-gitops owner=rjh
# If above does not start sync.
argocd app set <argo-app> --sync-policy=automated --auto-prune --self-heal
=serverGroupName/server_groups=
<pre>
# Look at machinegroup on machineset and machine
oc get machinesets -n openshift-machine-api -o custom-columns=NAME:.metadata.name,SERVERGROUP:.spec.template.spec.providerSpec.value.serverGroupName
oc get machine -n openshift-machine-api -o custom-columns=NAME:.metadata.name,SERVERGROUPNAME:.spec.providerSpec.value.serverGroupName,CREATIONTIME:.metadata.creationTimestamp
# Patch machineset to suitable machinegroup
oc patch --namespace openshift-machine-api machineset <machineset> --type=merge --patch '{"spec":{"template":{"spec":{"providerSpec":{"value":{"serverGroupName":"<server-group>"}}}}}}'
# List servergroups.
openstack server group list
# Create servergroup with soft-affinity
openstack server group create --policy soft-anti-affinity <server_group_name>
# look at openstack what server group is.
openstack server list -f value -c ID | while read ID ; do openstack server show $ID -f json | jq -r '.|[.name,.server_groups[]]|@tsv' ; done
</pre>

Azure

2026-03-17T06:43:44Z

Ekaanbj: /* Show info about current session */

=Show info about current session=
az account show
=show info about access token=
az account get-access-token

Azure

2026-03-17T06:36:35Z

Ekaanbj: Created page with "=Show info about current session= az account show"

=Show info about current session=
az account show

Icinga2

2026-03-13T09:48:35Z

Ekaanbj: /* list checks on remote windows machine */

Icinga2

2026-03-13T08:05:24Z

Ekaanbj: /* List most */

Icinga2

2026-03-13T07:49:32Z

Ekaanbj: /* List services */

Aws

2026-03-12T15:00:36Z

Ekaanbj: /* what does it mean? */

=what does it mean?=
alb Application Load Balancer
acm AWS Certificate Manager
asg Auto Scaling Group
CloudFormation Iac Infrastructure as code
cloudfront cdn Content Delivery Network
cloudwatch monitoring and management service that provides data and actionable insights.
cwagent cloud watch agent.
DynamoDB NoSQL database
ebs elastic block storage
ecr Elastic Container Registry
ecs Elastic Container Service.
efs Elastic File System
eks Elastic Kubernetes Service
elb Elastic Load Balancing
eni Elastic Network Interface, is a virtual nic that can be attached to an EC2 instance within a vpc.
fargate Fargate is a serverless compute service that can run containers on ECS or EKS.
iam Identity and Access Management
imds Instance Metadata Service.
irsa IAM Roles for Service Accounts
kenesis analyzing real-time streaming data
kms key management Service
lambda is an event-driven, serverless computing platform provided
lbc Load Balancer Controller
nlb Network Load Balancer
peering connection Networking connection established between two VPC.
sg Security group
sid "statement ID" as an optional identifier for the policy statement. Must be uniq in the json statement.
sns Simple Notification Service. message bus.
sqs Simple Queue Service
ssm "Amazon Simple Systems Manager" "Amazon EC2 Systems Manager" Now known as AWS Systems Manager
ssm agent Systems Manager Agent runs on EC2 makes it possible for Systems Manager to manage,resources.
sts Security Token Service
transit gateway service that simplifies and centralises the management of connectivity between multiple VPCs, VPN connections, and on-premises networks.
waf web application firewall
vpc Virtual Private Cloud
vgw Virtual Private Gateway. VPN endpoint on the AWS side of a Site-to-Site VPN connection.

=documentation=
https://awscli.amazonaws.com/v2/documentation/api/latest/reference/index.html
=aws completion=
complete -C '/usr/bin/aws_completer' aws

=version=
aws --version
=configure aws=
aws help config-vars

=whoami=
aws sts get-caller-identity
=which groups do I belong to=
aws iam list-groups
=list databases=
aws rds describe-db-instances
=List databases short version=
aws rds describe-db-instances --region=eu-west-1 --query 'DBInstances[*].[DBInstanceArn,Engine,DBInstanceIdentifier]'
aws rds describe-db-instances | jq -r '.DBInstances[]| [.DBInstanceIdentifier, .DBInstanceClass, .Engine, (.Endpoint|.Address, .Port)]|@tsv' | column -t -s $'\t'

=List databases in all regions=
aws account list-regions | jq -r '.Regions[]| select(."RegionOptStatus" == "ENABLED_BY_DEFAULT")|.RegionName' | while read REGION ; do echo '*' ${REGION} ; aws rds describe-db-instances --region=${REGION} | jq -r '.DBInstances[]| .DBInstanceIdentifier +"\t"+ .DBInstanceClass +"\t"+ .Engine +"\t"+ .DBName' | column -t -s $'\t' ; done

=list events=
export DB=<database> ; aws rds describe-events --duration 10080 --region=eu-west-1 --source-identifier ${DB} --source-type db-instance

=list logfiles=
aws rds describe-db-log-files --region=eu-west-1 --db-instance-identifier admin
=view logfiles=
aws rds download-db-log-file-portion --region=eu-west-1 --db-instance-identifier admin --log-file-name error/mysql-error-running.log.2022-05-05.14 --output text
=List files in s3=
aws s3 ls
=Create bucket=
aws --endpoint-url http://localhost:9000 s3 mb s3://minsio
make_bucket: minsio
=Push files to bucket.=
aws --endpoint-url http://localhost:9000 s3 sync . s3://minsio
=remove files from s3 bucket=
aws s3 rm s3://<bucket> --recursive --exclude '*' --include '<path>-*.gz'
=Do files expire=
aws s3api get-bucket-lifecycle-configuration --bucket <bucket>
=undelete revision controlled files=
Possible file that you are searching for
aws s3 ls s3://$(awk '/bucket/ {print $3}' tf-state-backend.tf | sed 's/"//g')/$(awk '/key/ {print $3}' tf-state-backend.tf | sed 's/"//g')
Recover expired file
export BUCKET=$(awk '/bucket/ {print $3}' tf-state-backend.tf | sed 's/"//g')
export PREFIX=$(awk '/key/ {print $3}' tf-state-backend.tf | sed 's/"//g')
aws s3api list-object-versions --bucket "${BUCKET}" --prefix "${PREFIX}" --output json --query 'DeleteMarkers[?IsLatest==`true`].VersionId' | jq '.[]' -r | xargs echo aws s3api delete-object --bucket "${BUCKET}" --key "${PREFIX}" --version-id

=save policy of s3 bucket=
aws s3api get-bucket-policy --bucket <bucket> | jq '.Policy | fromjson'
=Copy s3 files to local path=
aws s3 cp s3://abjorklund-kafka-external-bootstrap-lb-logs/AWSLogs/203144576027/vpcflowlogs/eu-north-1/2025/09/02/17/203144576027_vpcflowlogs_eu-north-1_fl-0d84f7269ca36d677_20250902T1700Z_d63c36ab.log.gz /temp/
=delete s3 bucket=
aws s3 rb s3://abjorklund-kafka-external-bootstrap-lb-logs --force

=eks=
==eksctl install==
curl --silent --location "https://github.com/weaveworks/eksctl/releases/latest/download/eksctl_$(uname -s)_amd64.tar.gz" | sudo tar xz -C /usr/local/bin

==configure for kubectl==
aws eks update-kubeconfig --name "${AWS_EKS_CLUSTER}"
aws eks update-kubeconfig --name "${AWS_EKS_CLUSTER}" --role-arn arn:aws:iam::<arn>:<arn>

==list eks clusters==
eksctl get clusters
aws eks list-clusters
==Version of eks==
aws eks describe-cluster --name "${AWS_EKS_CLUSTER}" --query "cluster.version" --output text

==Update eks==
eksctl upgrade cluster --name "${AWS_EKS_CLUSTER}" --version <new-version> --approve
aws eks update-cluster-version --name "${AWS_EKS_CLUSTER}" --kubernetes-version <new-version>
Follow upgrade
aws eks describe-update --name "${AWS_EKS_CLUSTER}" --update-id <update-id>
==View update status==
aws eks describe-cluster --name "${AWS_EKS_CLUSTER}"
kubectl get events -n kube-system --sort-by='.metadata.creationTimestamp'

==Update eks nodegroup==
Confirm that there is only one nodegroup.
eksctl get nodegroup --cluster "${AWS_EKS_CLUSTER}"
If there is only one nodegroup then you can set:
AWS_EKS_NODEGROUP=$(aws eks list-nodegroups --cluster-name "${AWS_EKS_CLUSTER}" --query 'nodegroups[0]' --output text)
eksctl upgrade nodegroup --name="${AWS_EKS_NODEGROUP}" --cluster "${AWS_EKS_CLUSTER}"

==View status==
aws eks describe-nodegroup --cluster-name "${AWS_EKS_CLUSTER}" --nodegroup-name "${AWS_EKS_NODEGROUP}"

==list addons and version number==
aws eks list-addons --cluster-name "${AWS_EKS_CLUSTER}" | jq -r '.addons[]' | while read AWS_EKS_ADDON ; do echo "${AWS_EKS_ADDON}" $(aws eks describe-addon --cluster-name "${AWS_EKS_CLUSTER}" --addon-name "${AWS_EKS_ADDON}" --query 'addon.addonVersion' | jq -r .) ; done
==List addons==
aws eks list-addons --cluster-name "${AWS_EKS_CLUSTER}"

==Look for versions of addons==
aws eks describe-addon-versions --addon-name kube-proxy
==Update eks add-on==
aws eks update-addon --cluster-name "${AWS_EKS_CLUSTER}" --addon-name <addon-name> --addon-version <version> --resolve-conflicts OVERWRITE
==list available supported add-on==
export AWS_EKS_CLUSTER=$(aws eks list-clusters --query 'clusters[0]' --output text)
export AWS_EKS_VERSION=$(aws eks describe-cluster --name "${AWS_EKS_CLUSTER}" --query "cluster.version" --output text)
aws eks list-addons --cluster-name "${AWS_EKS_CLUSTER}" | jq -r '.addons[]' | while read AWS_EKS_ADDON ; do echo '*' "${AWS_EKS_ADDON}" ; aws eks describe-addon-versions --addon-name "${AWS_EKS_ADDON}" --kubernetes-version "${AWS_EKS_VERSION}" | jq -r '.addons[].addonVersions[]|[.addonVersion, .compatibilities[].defaultVersion]|@tsv' ; done

==aws eks access can work i two modes. configmap or api==
aws eks describe-cluster --name $AWS_EKS_CLUSTER --query 'cluster.accessConfig'
"authenticationMode": "API_AND_CONFIG_MAP"
==list users in all eks clusters==
aws eks list-clusters | jq -r '.clusters[]' | while read EKS ; do echo '*' Eks cluster $EKS ; eksctl get iamidentitymapping --cluster $EKS ; done

==grant access to eks cluster(configmap)==
eksctl create iamidentitymapping --cluster "${AWS_EKS_CLUSTER}" --arn arn:aws:iam::442031788965:role/Administrator --group system:masters --username eks-admin

==who has access to cluster configmap==
oc get configmap aws-auth -n kube-system -o yaml
==Grant access to above==
Using eksctl
eksctl create iamidentitymapping --cluster "${AWS_EKS_CLUSTER}" --arn arn:aws:iam::442031788965:role/<role> --group system:masters --username eks-admin
Using kubectl
oc edit configmap aws-auth -n kube-system -o yaml

==Who has access api mode==
aws eks list-access-entries --cluster-name "${AWS_EKS_CLUSTER}"
===Add permissions to cluster from above===
aws eks create-access-entry --cluster-name $AWS_EKS_CLUSTER --principal-arn arn:aws:iam::442031788965:role/Administrator
===Add principal arn===
aws eks associate-access-policy --cluster-name $AWS_EKS_CLUSTER --principal-arn arn:aws:iam::442031788965:role/<role> --policy-arn arn:aws:eks::aws:cluster-access-policy/AmazonEKSClusterAdminPolicy --access-scope type=cluster

==access policies==
aws eks list-associated-access-policies --cluster-name $AWS_EKS_CLUSTER --principal-arn arn:aws:iam::442031788965:role/<role>

==list logs of aws-load-balancer-controller(loadbalancer)==
oc logs --tail=-1 -n kube-system $(oc get leases -n kube-system aws-load-balancer-controller-leader -o custom-columns=HOLDER:.spec.holderIdentity --no-headers | awk -F_ '{print $1}')
List corresponding pods
oc get pods -n kube-system -l app.kubernetes.io/name=aws-load-balancer-controller

==Manifest for creating an deployment that creates an nginx server and creating a service that provides a loadbalancer==
<pre>
oc apply -f - << 'EOF'
apiVersion: v1
kind: Namespace
metadata:
name: nginx
---
apiVersion: apps/v1
kind: Deployment
metadata:
name: nginx-deployment
namespace: nginx
labels:
app: nginx
spec:
replicas: 2
selector:
matchLabels:
app: nginx
template:
metadata:
labels:
app: nginx
spec:
containers:
- name: nginx
image: nginx:latest
ports:
- containerPort: 80
volumeMounts:
- name: nginx-html
mountPath: /usr/share/nginx/html
volumes:
- name: nginx-html
configMap:
name: nginx-html
items:
- key: index.html
path: index.html
---
apiVersion: v1
kind: ConfigMap
metadata:
name: nginx-html
namespace: nginx
data:
index.html: |
<!DOCTYPE html>
<body>
<h1>Hello, World!</h1>
</body>
---
apiVersion: v1
kind: Service
metadata:
name: nginx-service
namespace: nginx
annotations:
service.beta.kubernetes.io/aws-load-balancer-backend-protocol: http
service.beta.kubernetes.io/aws-load-balancer-internal: "true"
service.beta.kubernetes.io/aws-load-balancer-ip-address-type: ipv4
service.beta.kubernetes.io/aws-load-balancer-nlb-target-type: ip
service.beta.kubernetes.io/aws-load-balancer-scheme: internal
service.beta.kubernetes.io/aws-load-balancer-type: external
spec:
selector:
app: nginx
ports:
- name: http
port: 80
targetPort: 80
protocol: TCP
type: LoadBalancer
loadBalancerClass: service.k8s.aws/nlb
externalTrafficPolicy: Cluster
ipFamilyPolicy: SingleStack
ipFamilies:
- IPv4
EOF
</pre>

=list roles=
aws iam list-roles | jq -r '.Roles[].RoleName'
=List roles with specific attribute=
aws iam list-roles --query "Roles[?RoleName=='Administrator']"

=assume role=
aws sts assume-role --role-arn arn:aws:iam::288898264342:role/eks-cluster-role-kafka-prod-cluster --role-session-name eks-cluster-role-kafka-prod-cluster
=save assume role policy=
aws iam list-roles --query "Roles[?RoleName=='Administrator']" | jq '.[].AssumeRolePolicyDocument' > /temp/aws_iam_list-roles.$(date_file).json
=grant access to assume role=
aws iam update-assume-role-policy --role-name Administrator --policy-document file:///<full_path_to_file>.json
{
"Version": "2012-10-17",
"Statement": {
"Effect": "Allow",
"Principal": {"AWS": [
"arn:aws:iam::442031788965:root",
"arn:aws:sts::203144576027:assumed-role/rb-sso/abjorklund"
]},
"Action": "sts:AssumeRole"
}
}

=list users=
aws iam list-users | jq -r '.Users[].UserName'
=list all users and their accesstokens=
for user in $(aws iam list-users --query 'Users[*].UserName' --output text); do
echo "User: $user"
aws iam list-access-keys --user-name "$user" --query 'AccessKeyMetadata[*].AccessKeyId' --output text
done

=get info about certain user=
aws iam get-user --user-name abjorklund
=list ec2 instances=
aws ec2 describe-instances | jq -r '.Reservations[].Instances[] | [.PrivateIpAddress, .InstanceType, .KeyName, .PublicIpAddress, (.Tags[] | .Key, .Value)] | join("\t")' | column_tab | less
Filter running instances.
aws ec2 describe-instances --filters "Name=instance-state-name,Values=running"

=list vpcs=
aws ec2 describe-vpcs $@ | jq -r '.Vpcs[] | [.CidrBlock, .VpcId, (.Tags[]?|join(":"))] | @tsv'
=vpc peering=
List connections between vpc:s
aws ec2 describe-vpc-peering-connections | jq -r '.VpcPeeringConnections[] | .AccepterVpcInfo.CidrBlock +" "+ .AccepterVpcInfo.VpcId +" "+ .AccepterVpcInfo.Region +" "+ .RequesterVpcInfo.CidrBlock +" "+ .RequesterVpcInfo.VpcId +" "+ (.Tags[] | select(.Key=="Name").Value)'

=list securitygroups=
aws ec2 describe-security-groups | jq -r .SecurityGroups[].GroupName
aws ec2 describe-security-groups | jq -r '.SecurityGroups[]|{GroupName: .GroupName,VpcId: .VpcId, Description: .Description, IpPermissions:.IpPermissions[],IpPermissionsEgress:.IpPermissionsEgress[]}, (.Tags[]?|join(":"))'
=Show info about securitygroup=
aws ec2 describe-security-groups --group-ids sg-03b884a9f0fbc58c1 --query 'SecurityGroups[0].{ID:GroupId,Rules:IpPermissions,RulesOut:IpPermissionsEgress}' --output yaml

=list accounts=
aws organizations list-accounts --query 'Accounts[*].[Name, Id]' --output table
List info about Account.
aws organizations list-accounts | jq '.Accounts[]|select(.Id=="974752708905")'
=vip/irule=
cloudfront -> distribution -> behaviour
=origin=
Where to shoot request.
=list load balancers=
aws elbv2 describe-load-balancers | jq -r '.LoadBalancers[].LoadBalancerName'
=try to access listeners=
aws elbv2 describe-load-balancers | jq -r '.LoadBalancers[] | .DNSName +" "+ .VpcId +" "+ .LoadBalancerArn' | while read DNSName VpcId LoadBalancerArn ; do PORTS=$(aws elbv2 describe-listeners --load-balancer-arn $LoadBalancerArn | jq -r '.Listeners[]?|.Port') ; for Port in $PORTS ; do echo $DNSName $VpcId $(nc -w1 -zv $DNSName $Port 2>&1 ) ; done ; done

=route53=
==List names of hosted zones.==
aws route53 list-hosted-zones-by-name | jq -r '.HostedZones[]|.Id +"\t"+ .Name| sub("/hostedzone/"; "")' | column_tab

==List info about record==
aws route53 list-resource-record-sets --hosted-zone-id <hostedzone>

==Update cname==
aws route53 change-resource-record-sets --hosted-zone-id <hostedzone> \
--change-batch '{"Changes":[{"Action":"UPSERT","ResourceRecordSet":{"Name":"akhq.inter.net.","Type":"CNAME","TTL":300,"ResourceRecords":[{"Value":"internal-k8s-kafka-akhq-30d3a6b6ec-1805732719.eu-north-1.elb.amazonaws.com."}]}}]}'
==Create a zone==
aws route53 create-hosted-zone --name inter.net --caller-reference $(date_file) --comment <comment>
==Add record to zone==
aws route53 change-resource-record-sets --hosted-zone-id <hostedzone> --change-batch '{"Changes":[{"Action":"CREATE","ResourceRecordSet":{"Name":"in.ter.net.","Type":"A","TTL":300,"ResourceRecords":[{"Value":"1.1.1.1"}]}}]}'

=subnets=
List subnets
aws ec2 describe-subnets | jq -r '.Subnets[] | [.SubnetId, .CidrBlock, .VpcId, (.Tags[]?|join(":"))] | @tsv' | column -t -s $'\t' | less -ISRM
=direct connect=
List direct connect links
aws directconnect describe-connections

=ipsec vpn=
aws ec2 describe-vpn-connections | jq -r '.VpnConnections[] | .VpnConnectionId +" "+ (.Tags[] | select(.Key=="Name").Value)'
=list vpc endpoints interface/gateway=
aws ec2 describe-vpc-endpoints | jq -r '.VpcEndpoints[] | .VpcEndpointId +" "+ .VpcEndpointType +" "+ .VpcId +" "+ (.Tags[]? | select(.Key=="Name").Value)'
=imds=
Instance Metadata Service
TOKEN=`curl -s -X PUT "http://169.254.169.254/latest/api/token" -H "X-aws-ec2-metadata-token-ttl-seconds: 21600"` && curl -s -H "X-aws-ec2-metadata-token: $TOKEN" http://169.254.169.254/latest/meta-data/
=List ecs services=
# List cms services. Count the tasks.
aws ecs list-clusters
aws ecs describe-clusters --clusters <cluster>
aws ecs list-services --cluster <cluster>
aws ecs describe-services --cluster <cluster> --services <service> | jq '.services[].desiredCount'
=cloud trail=
aws cloudtrail describe-trails
=cloudwatch=
# View metrics on aws in namespace.
aws cloudwatch list-metrics --namespace=ContainerInsights/Prometheus
# List alarms
aws cloudwatch describe-alarms
aws cloudwatch describe-alarms | jq -r '.MetricAlarms[]| [.AlarmName, .MetricName, .Namespace, .AlarmDescription]|@tsv' |column_tab | less
aws cloudwatch describe-alarms | jq -r '.MetricAlarms[]| [.AlarmName, .MetricName, .EvaluationPeriods, .DatapointsToAlarm, .AlarmDescription]|@tsv' | column -t -s $'\t' | less
# Get alarm history
aws cloudwatch describe-alarm-history --alarm-name <ALARM_NAME>

=ssm/parameters=
Get parameter
aws ssm get-parameters --with-decryption --region eu-west-1 --name /<name>
Get parameters recursive
aws ssm get-parameters-by-path --recursive --region eu-west-1 --path /
Get latest Amazon Linux 2023
aws ssm get-parameters --names /aws/service/ami-amazon-linux-latest/al2023-ami-kernel-default-x86_64 --query 'Parameters[0].Value' --output text

=list ecr repositories=
aws ecr describe-repositories
aws ecr describe-repositories | jq -r .repositories[].repositoryName
=list content of ecr repository=
aws ecr list-images --repository-name <repository>

=create ecr=
aws ecr create-repository --repository-name quay.io_strimzi_kafka_0.46.0-kafka-4.0.0_debezium_3.1.1
=list volumes=
aws ec2 describe-volumes | jq -r '.Volumes[]|(.Size|tostring) +"\t"+ (.VolumeId|tostring) +"\t"+ (.VolumeId|tostring)' | column_tab | sort -n
=delete volumes=
aws ec2 delete-volume --volume-id <volume-id>
=get console output from ec2=
aws ec2 get-console-output --instance-id i-013cc270ad69f885f --query Output --output text
=list saml providers=
aws iam list-saml-providers
=get info about saml provider=
aws iam get-saml-provider --saml-provider-arn <arn>
=ssh=
==Upload public ssh key==
aws ec2 import-key-pair --key-name <name> --public-key-material fileb://~/.ssh/id_ed25519.pub
==list keypairs==
aws ec2 describe-key-pairs
==delete public key==
aws ec2 delete-key-pair --key-name <name>
=organisations=
==list organizations==
aws organizations list-accounts | jq -r '.Accounts[] | "\(.Name) \t \(.Email) \t \(.Id) \t \(.Status)"' | column_tab | sort
=Which permissions does user have=
==aws sts get-caller-identity==
{
"UserId": "AROAWN2ZF2OSSO6EHQX42:andreas.bjorklund",
"Account": "442031788965",
"Arn": "arn:aws:sts::442031788965:assumed-role/aws-binero/andreas.bjorklund"
}
==aws iam list-role-policies --role-name aws-binero==
{
"PolicyNames": []
}
==aws iam list-attached-role-policies --role-name aws-binero==
{
"AttachedPolicies": [
{
"PolicyName": "AdministratorAccess",
"PolicyArn": "arn:aws:iam::aws:policy/AdministratorAccess"
}
]
}
==aws iam get-policy-version --policy-arn arn:aws:iam::aws:policy/AdministratorAccess --version-id v1==
{
"PolicyVersion": {
"Document": {
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": "*",
"Resource": "*"
}
]
},
"VersionId": "v1",
"IsDefaultVersion": true,
"CreateDate": "2015-02-06T18:39:46+00:00"
}
}

Commands

2026-03-11T13:22:59Z

Ekaanbj: /* dnsmasq */

=7za=
decompress file
7za e myfiles.7z
=ab=
apache benchmarking
ab -n 50 https://www.halfface.se/photos/
ab -n 1000 -c 10 https://www.halfface.se/wiki/index.php/Halfface

=abcde=
Rip cd.
abcde
=adb android=
# install adb
dnf install android-tools
# enable debug. On phone. Settings. about phone. build version. Click until prompted. Enable debug via selector.
# Connect phone via usb.
# List phones.
adb devices
# Get shell on phone.
adb shell
# list installed packages.
pm list packages -f
adb shell pm list packages -f | grep game
# Uninstall
adb shell pm uninstall -k --user 0 com.samsung.android.game.gos
adb shell pm uninstall -k --user 0 com.samsung.android.game.gametools
adb shell pm disable-user --user 0 com.sec.android.app.samsungapps

=agrep=
Aproximate grep. 3 differences from andreas
agrep -3 andreas /var/log/messages
=alacritty(Terminal emulator hw accellerated)=
Terminal copy mode.
CTRL + SHIFT + SPACE
=alsactl=
Reload alsa drivers
systemctl restart alsa-state
sudo alsactl restore

=alternatives=
alternatives --set mta /usr/sbin/sendmail.postfix
sudo alternatives --config java

=antiword=
antiword bad.doc > pure.txt

=arecord=
List soundcards.
arecord -l
Chose source.
alsamixer
Create mp3 from source.
arecord -f cd -d 5 -t raw | lame -x -r - out.mp3
=arp-scan=
Scan ip addresses on local subnet
arp-scan --localnet | sort -n -k4 -t. | grep ^[0-9]

=at=
Run command at specific time. Look at queue.
echo '/usr/bin/espeak -s120 "I will say this only once."' | at -t $(date +%Y%m%d%H%M --date="+2 min")
atq
List at jobs.
atq ; atq | awk '{print $1}' | while read i ; do echo '***' $i ; at -c $i 2>&1 | tail -3 | head -1 ; done
2 Sun May 17 04:00:00 2020 a root
*** 2
/usr/bin/systemctl restart springboot_uc_supportrouter.service

=authselect=
Redhat command to manage connection to underlying services and features.
# To change content of nsswitch.conf do to your used profile.
vim /usr/share/authselect/default/local/nsswitch.conf
authselect select local --force

=base64=
base64 -d /tmp/html | elinks --dump | less -ISRM
No wrapping
base64 --wrap=0
base64 -w 0
=bash=
curl
exec 3<>/dev/tcp/localhost/8080 ; echo -e "GET /health HTTP/1.1\r\nHost: localhost\r\nConnection: close\r\n\r\n" >&3 ; cat <&3

=bbk_cli_...=
Bredbandskollen via cli.
bbk_cli_linux_amd64-1.0

=bc=
Simplify using bercerly calculator
calc(){ echo -e "scale=8\n${@}\nquit\n" | bc ; }
To the power of(upphöjt i)
2^10 = 1024
scientific (aka exponential) notation
echo 1.6945991213315015e+09 | sed -E 's/([+-]?[0-9.]+)[eE]\+?(-?)([0-9]+)/(\1*10^\2\3)/g' | bc
=bitwarden=
# Install bw.
curl -L -o /tmp/bw.zip 'https://vault.bitwarden.com/download/?app=cli&platform=linux' ; (cd /usr/local/bin ; sudo unzip -o /tmp/bw.zip)
# Remove bitwarden config.
unset BW_CLIENTID BW_CLIENTSECRET BW_SESSION
\rm -r /home/abjorklund/.config/Bitwarden*
# Set bitwarden server.
bw config server https://halfface.se/vaultwarden/
# api login
bw login --apikey
# sso login. When web server opens write "Binero SSO"
bw login
# Unlock
bw unlock
# Sync from server.
bw sync
# List items.
bw list items | jq -r '.[].name'
# get totp
bw_halfface get totp ginatricot_user
# get login info.
bw get item bareos-webui | jq .login
# which version
curl https://halfface.se/vaultwarden/api/version
podman image inspect docker.io/vaultwarden/server | jq -r '.[].Config.Labels."org.opencontainers.image.version"'

=bluetoothctl=
Enable bluetooth
sudo systemctl enable bluetooth --now
Scan
bluetoothctl scan on
Pair
bluetoothctl pair <MAC address>
Connect
bluetoothctl connect <MAC address>
Trust
bluetoothctl trust <MAC address>
Remove
bluetoothctl remove <MAC address>
List paired devices
bluetoothctl devices
Get info about paired device
bluetoothctl info 00:00:00:00:3E:E2

=blkid=
Get uuid of disk.
blkid /dev/sdb1
/dev/sdb1: UUID="64cd54f7-5330-425d-81e5-a0e473a5f5e7" TYPE="ext4" PARTLABEL="primary" PARTUUID="21f38e48-af2d-4fdd-854a-5910f392a6e0"

=bonnie++=
Report performance on disk. benchmark
bonnie++ -u 0:0
On machine running out of disk
sudo bonnie++ -d ./ -s 400 -r 200 -u root
Example command.
bonnie++ -d /storage/temp/ -s 32G -n 0 -m TEST -f -b -u abjorklund

=boot=
Booting singe user mode.
kernel ... single

=bootchart=
Analyze startup times.

=bootgraph=
How to use.
Kernel later than 2.6.28
kernel option initcall_debug
dmesg | /usr/src/linux-headers-2.6.28-11-generic/scripts/bootgraph.pl > /tmp/bootgraph.svg
=bpftrace=
run code at each system call
#!/usr/bin/bpftrace

interval:s:5
{
exit();
}

kprobe:do_sys_open
{
printf("%s %s\n", comm, str(arg1));
}
=busctl=
busctl may be used to introspect and monitor the D-Bus bus.

=bzip2=
Extract keep original
bzip2 -dk /compressed_file.bz2 and extract standard out via tar.
Extract bunzip2 file and extract via tar from standard out.
bzip2 -c /compressed_file.bz2 | tar -xivf -

=cdrecord=
Blank cd/dvd rw
cdrecord -v gracetime=2 dev=/dev/cdrom -eject blank=all -force
=certutil=
Test password. Password should be part of file called by -f
certutil -K -d /etc/dirsrv/slapd-halfface -f /tmp/pin.txt
Remove cert if it already exist.
certutil -D -n "Self-Signed-CA" -d /etc/dirsrv/slapd-halfface/ -f /tmp/pin.txt
Create new certificate.
certutil -S -n Self-Signed-CA -s CN=ssca.389ds.halfface,O=halfface,L=389ds,ST=Stockholm,C=SE -x -t "CT,," -v 480 -d /etc/dirsrv/slapd-halfface/ -k rsa -g 2048 -f /tmp/pin.txt
List certificates
certutil -L -d /etc/dirsrv/slapd-halfface/
Look at a specific certificate
certutil -L -d /etc/dirsrv/slapd-halfface/ -n "Self-Signed-CA"
Remove orphan key
certutil -F -d /etc/dirsrv/slapd-halfface/ -f /tmp/pin.txt -k 27e0fcb7a201cf0f0c3674eae03c8d94b47b4de0
Generate a new csr
certutil -R -s "CN=www.halfface.se,O=halfface,L=389ds,ST=Stockholm,C=SE" -o server.csr -d /etc/dirsrv/slapd-halfface/ -k rsa -g 2048 -f /tmp/pin.txt --extSAN "dns:www.halfface.se,dns:ldap.halfface.se" -v 240
sign certificate
certutil -C -i server.csr -o server-cert.crt -c "Self-Signed-CA" -d /etc/dirsrv/slapd-halfface/ -f /tmp/pin.txt
Import signed cert
certutil -A -n "Server-Cert" -t "u,u,u" -i server-cert.crt -d /etc/dirsrv/slapd-halfface/ -f /tmp/pin.txt
==Add certs to chrome==
for i in $(ls) ; do echo '*' $i ; certutil -d sql:${HOME}/.pki/nssdb -A -t "C,," -n "vSphere Root CA $i" -i $i ; done

=cfdisk=
Disk partitioning via ncurses interface. like fdisk.
=chage=
List password properties of user
chage -l abjorklund
Unlimited login
chage -I -1 -m 0 -M 99999 -E -1 sftponly

=chattr/lsattr=
Set extendet attributes of files.
# Lock file for most activities.
chattr +i file
# Unlock file
chattr -i file
# recursive lsattr looking for imutable.
lsattr -aR -- .//. 2>/dev/null | sed -rn '/i.+\.\/\/\./s/\.\/\///p'

=chmod=
Sticky bit on directory. Only owners of files are able to delete.
chmod 1755 /file.
-rwxr-xr-t
GUID on file. binaries started will have the group set to the defined group.
chmod 2755 /file
-rwxr-sr-x
SUID on file.
chmod 4755 /file
-rwsr-xr-x
Remover permissions for others
chmod o-rwx

=chntpw=
# Change windows passwords offline
mkdir /mnt/disk ; mount /dev/sd1 /mnt/disk; cd /mnt/disk/Windows/System32/config
# List local users.
chntpw -l SAM
# clear password on user.
chntpw -u Administrator SAM
=chrony=
# setup time sync via ntp.
/etc/chrony.conf
# look at status
chronyc tracking
# List ntp sources.
chronyc sources
.-- Source mode '^' = server, '=' = peer, '#' = local clock.
/ .- Source state '*' = current synced, '+' = combined , '-' = not combined,
| / '?' = unreachable, 'x' = time may be in error, '~' = time too variable.
|| .- xxxx [ yyyy ] +/- zzzz
|| Reachability register (octal) -. | xxxx = adjusted offset,
|| Log2(Polling interval) --. | | yyyy = measured offset,
|| \ | | zzzz = estimated error.
|| | | \
MS Name/IP address Stratum Poll Reach LastRx Last sample
===============================================================================
#? PHC0 0 3 0 19d +41ns[ +349ns] +/- 104ns
Force syncronize
sudo chronyc -a 'burst 4/4'
Make a big step. Did not work for me.
chronyc -a makestep
Verify clock
chronyd -q 'server pool.ntp.org iburst'

=chvt=
From a script change to a virtual interface and connect script to that terminal.
chvt 3 exec < /dev/tty3 > /dev/tty3

=cacafire=
View some fire in ascii.

=clean=
Clean file from comments and blank lines.
sed '/ *#/d; /^ *$/d'

=codepage=
Change codepage of file.
convmv -f cp850 -t iso-8859-1 --notest *
convmv -f utf8 -t iso8859-1 -r --notest *
convmv -f iso8859-1 -t en_US.UTF-8 -r --notest .
Change codepage of file.
iconv --from-code=ISO-8859-15 --to-code=UTF-8 document.csv > document_iconv.csv
View nfo files
iconv -f CP437 -t UTF-8 KaOs.nfo

=column=
Create nice column. Use tab as delimiter.
column -t -s $'\t' /file.tsv
=compgen=
List all commands
compgen -A function -abck

=convert=
Convert Image to 8 bit grey with threshold for white.
for tif in *.tif; do convert -depth 8 -white-threshold 70% ${tif} ${tif%%.*}.png;done
Resize image
convert -resize 25% -gamma 1.5 2011-08-03_11-09-43.jpg 2011-08-03_11-09-43_new.jpg
Multipage pdf.
convert -adjoin -page A4 -compress jpeg Infineon1.tif Infineon2.tif Infineon.pdf
pdfunite RegionUppsala01.pdf RegionUppsala02.pdf RegionUppsala03.pdf RegionUppsala04.pdf RegionUppsala.pdf
Prepare photos for printing.
convert -rotate 90 -gamma 1.5 -resize 25% -compress jpeg -quality 80 -adjoin -page A4 * print.pdf
Resize change aspect.
convert Slide1.PNG -resize 1920x1080\! slide01.png
animated gif
convert -delay 100 -loop 0 *.jpg animation.gif
Create multipage pdf of photos.
convert -resize 25% -adjoin -page A4 -rotate 90 -compress jpeg *.jpg test.pdf ; pdfjam test.pdf --no-landscape --frame true --nup 2x2 --suffix 4up --outfile /temp/photos/Alva/test_2x2.pdf
For vertical stacking (top to bottom):
convert -append 1.jpg 2.jpg out.jpg
For horizontal stacking (left to right):
convert +append 1.jpg 2.jpg out.jpg
Remove transparancy
convert image.png -background white -flatten image.jpg

=cpio=
Copy wanted partitions.
#!/bin/bash
ssh root@192.168.2.148 "(cd /boot/ ; find ./ -xdev -depth -print0 | cpio -o -0Hnewc )" | (cd /mnt/sysimage/boot ; cpio -idvuma )
ssh root@192.168.2.148 "(cd / ; find ./ -xdev -depth -print0 | cpio -o -0Hnewc)" | (cd /mnt/sysimage ; cpio -idvuma )
# -o copy out mode.
# -0 terminated by null character.
# -Hnewc som storing format.
# -i extract copy in mode.
# -d make directories.
# -v verbose.
# -V print dot.
# -u replace all files.
# -m preserve modification time.
# -a preserve access time.
=cpulimit=
Limit application cpu usage to 25% cpu utilization. Inherit limit to spawned processes.
cpulimit -i -l 25 /apps

=crash=
Troubleshoot hung Redhat vm.
Dump vm.
virsh dump <vm> --memory-only --verbose /tmp/<vm>.core
Login to machine you dump:ed and rebooted. Verify kernel version. uname -r
Setup vm similar to the one you dumped.
Install rpm:s to be able to debug.
export UNAME_R=5.14.0-554.el9.x86_64
dnf install --enablerepo=* crash kernel-modules-${UNAME_R} kernel-core-${UNAME_R} kernel-${UNAME_R} kernel-modules-core-${UNAME_R} kernel-debuginfo-common-x86_64-${UNAME_R} kernel-debuginfo-${UNAME_R}
Tips to find rpm:s.
<pre>
https://kojihub.stream.centos.org/koji/builds -> Dropdown: builds -> Search: kernel-5.14.0-554.el9
https://kojihub.stream.centos.org/kojifiles/packages/kernel/ -> find your way down the tree.
</pre>
Start crash. Write help to give advice. LLMS are quite useful for troubleshooting advice.
crash /usr/lib/debug/lib/modules/${UNAME_R}/vmlinux /tmp/<vm>.core
Scripting with crash
cd /temp/ ;cat commands.txt ; for i in $(ls instance-0002da2b_osc-compute27-sto1-prod.cloud.binero.net_okd01-ppj65-master-0_2025-04-15_15-03-04*) ; do crash -i commands.txt /usr/lib/debug/lib/modules/5.14.0-554.el9.x86_64/vmlinux /temp/instance-0002da2b_osc-compute27-sto1-prod.cloud.binero.net_okd01-ppj65-master-0_2025-04-15_15-03-04.core > $i.log </dev/null ; done
ps
runq

=cronie=
Start cronie in foreground. Write what it is doing.
/usr/sbin/crond -n -x sch

=crontab/cron=
crontab.
* * * * * command to be executed
- - - - -
| | | | |
| | | | +----- day of week (0 - 6) (Sunday=0)
| | | +------- month (1 - 12)
| | +--------- day of month (1 - 31)
| +----------- hour (0 - 23)
+------------- min (0 - 59)
0 Sunday
1 Monday
2 Tuesday
3 Wednesday
4 Thursday
5 Friday
6 Saturday
@reboot "run command at reboot"
If you need % in crontab escape it. \%

Run command every 10 minutes.
*/10 * * * * command

Run command at 12:00 and 24:00 hours.
00 0,12 * * * command

Run command between 8-17 every 2 hours.
0 8-17/2 * * * /path/command
0 8,10,12,14,16 * * * /path/command

Start program under crontab.
#!/bin/bash
COMMAND="screen -L -d -m ping www.dn.se"
if [ "$(ps -ef | grep -i ping | grep -v grep)" ]
then
echo "\"${COMMAND}\" already running."
else
echo "Starting \"${COMMAND}\"."
cd /tmp
${COMMAND}
fi

=crudini=
Edit ini files och cli.
crudini --set /lib/systemd/system/icinga2.service Service Nice -10 ; systemctl daemon-reload ; systemctl restart icinga2.service

=cryptsetup=
luks. Process to unlock disk. Mount it and unmount and encrypt.
cryptsetup luksOpen /dev/nvme0n1p3 secure
mount /dev/mapper/secure /mnt
umount /mnt
cryptsetup luksClose secure
==create luks encrypted disk==
# Add block device and add gpt label. Create partition.
cfdisk /dev/sde
# Encypt partition
sudo cryptsetup luksFormat /dev/vdb1
# open encrypted disk
sudo cryptsetup open /dev/vdb1 encrypted-disk
# Format disk
sudo mkfs.ext4 /dev/mapper/encrypted-disk
# Info about partition
sudo blkid /dev/vdb1
/dev/vdb1: UUID="cb2e7238-8245-41cb-9811-6804f602e5e8" TYPE="crypto_LUKS" PARTUUID="56b829b6-8295-4963-9562-29e8937819a8"
# Setup crypttab if you want to decrypt at boot splash
echo 'encrypted-disk UUID=cb2e7238-8245-41cb-9811-6804f602e5e8 none luks' | sudo tee -a /etc/crypttab
# Manually unlock luks partition
sudo cryptsetup luksOpen UUID=cb2e7238-8245-41cb-9811-6804f602e5e8 encrypted-disk
# Manuall lock luks partition
sudo cryptsetup luksClose encrypted-disk
# Add disk to fstab
echo '/dev/mapper/encrypted-disk /mnt/encrypted-disk ext4 noauto 0 2' | sudo tee -a /etc/fstab
# Create mount point
sudo mkdir /mnt/encrypted-disk ; sudo chmod 777 /mnt/encrypted-disk
# mount disk
sudo umount /mnt/encrypted-disk
# Change password of luks partition
sudo cryptsetup luksAddKey UUID=cb2e7238-8245-41cb-9811-6804f602e5e8
sudo cryptsetup --test-passphrase -v open UUID=cb2e7238-8245-41cb-9811-6804f602e5e8
sudo cryptsetup luksRemoveKey UUID=cb2e7238-8245-4

=cups=
Install cups
dnf install cups
enable cups
systemctl enable cups.service --now
Configure printer in cups.
http://localhost:631/

=cut=
Cuf everything from field 5.
cut -f5- -d ' '

=curl=
==Get http return code.==
curl --connect-timeout 3 --max-time 9 -ksL -w '%{http_code}\n' 'http://www.dn.se' -o /dev/null
==get external ip. what is my ip==
curl ifconfig.me
==get external ip and all related browser information.==
curl ifconfig.me/all
==Alternative address for domain.==
<pre>
curl -sk --resolve www.halfface.se:80:127.0.0.1 http://www.halfface.se
curl http://127.0.0.1/ -H "Host: halfface.se" -H "X-Forwarded-Proto: https" -I
</pre>

==Get header / mime type==
curl -I http://url.se
==post file==
curl -X POST -d @myfilename http://user:pass@myhost/hudson/job/_jobName_/postBuildResult
==post file via ftp using proxy==
curl -p --proxy http://proxy.example.se:3128 -v -T backup.tar ftp://user:password@ftp.example.se/directory/

==cookie format. tab delimited.==
domain - The domain that created AND that can read the variable. .halfface.se
flag - A TRUE/FALSE value indicating if all machines within a given domain can access the variable. This value is set automatically by the browser, depending on the value you set for domain.
path - The path within the domain that the variable is valid for.
secure - A TRUE/FALSE value indicating if a secure connection with the domain is needed to access the variable.
expiration - The UNIX time that the variable will expire on. UNIX time is defined as the number of seconds since Jan 1, 1970 0:00:00 GMT.
name - The name of the variable.
value - The value of the variable.

==add certificate authority to openssl==
Redhat based os:es this file gets updated. /etc/pki/ca-trust/extracted/openssl/ca-bundle.trust.crt
cp /tmp/ca.crt /etc/pki/ca-trust/source/anchors/
update-ca-trust
Debian based
cp /tmp/ca.crt /usr/share/ca-certificates/extra
update-ca-certificates
Debian 2
cp foo.crt /usr/local/share/ca-certificates/foo.crt
update-ca-certificates

==curl ipv6==
curl -6 -g "http://[::1]:80/"
curl -g "http://[2001:9b1:402d:0:ffff:f038:ec3e:b5d4]/"
==proxy==
curl --proxy http://proxy.se:3128 -sk "http://mirrorlist.centos.org"
===no_proxy===
export https_proxy=http://proxy.se:3128 ; export http_proxy=$https_proxy ; export HTTPS_PROXY=$https_proxy ; export HTTP_PROXY=$https_proxy ; export no_proxy=localhost,127.0.0.1,.inter.net,$(echo 10.217.{4..5}.{1..254}, 10.217.5.255) ; export NO_PROXY=$no_proxy
===time spent===
-w "time_namelookup: %{time_namelookup}, time_connect: %{time_connect}, time_appconnect: %{time_appconnect}, time_pretransfer: %{time_pretransfer}, time_redirect: %{time_redirect}, time_starttransfer: %{time_starttransfer}, time_total: %{time_total}\n"
=Is it a free day?=
<pre>
curl -sk https://sholiday.faboul.se/dagar/v2.1/2023 | jq -r '.dagar[] |select(."arbetsfri dag"=="Ja")|.datum'
</pre>

=qr code=
encode
qrencode "Andreas" -o /tmp/qr_Andreas.png
decode
zbarimg /tmp/qr_Andreas.png

=date=
Get date in requested format.
date '+%Y-%m-%d %H:%M'
date +%Y-%m-%d-%H%M
date "+%F_%T" # 2017-01-16_19:41:41

date 033121422003.55
Mon Mar 31 21:42:55 PST 2003
date MMDDhhmmCCYY.ss

Whats the date in 1000 years. Or any other increment.
date --date="+1000 years" +%C%y-%m-%d
date --date="-2 hour" +%C%y-%m-%d\ %H:%M
TZ=CEST date --date="-2 hour" +%C%y-%m-%d\ %H:%M

What is the time in other timezone given in unixtime/epoch.
TZ=GMT date -d '@1345064585'
Wed Aug 15 21:03:05 GMT 2012

Unix time.
date +%s
Unix to normal
date -d @1234567890

scew clock by a second.
DATE_OFF=$(date --date="-5 second" +%C%y-%m-%d\ %H:%M:%S\ %Z) ; date --set="${DATE_OFF}"
Set clock
date '+%Y-%m-%d %T %Z' -s "2008-11-28 08:08:08 UTC"
=datefudge=
Fake date for command.
datefudge "2020-04-01 10:23" date

=dateseq=
Create date sequense.
dateseq 2017-04-01 2017-04-05

=db2=
Empty catalog remove node
for DB2 in $(db2 list node directory | grep "Node name" | awk '{print $4}') ; do db2 uncatalog node $DB2;done
Empty catalog remove db
for DB2 in $(db2 list db directory | grep "Database name" | awk '{print $4}') ; do db2 uncatalog db $DB2;done
# Load db2 environment.
. /home/db2/sqllib/db2profile

# Connect to database.
db2 connect to ${database_name} user ${user} using ${password}

# Test query.
SELECT service_level, fixpack_num, bld_level FROM TABLE (sysproc.env_get_inst_info()) as A;

# System Database Directory
db2 list db directory

# Node Directory
db2 list node directory

# setup directory
db2 "catalog tcpip node db2datan remote 1.2.3.4 server 5000"
db2 "catalog db db2datadb as db2datadb at node db2datan"

# Drop connection.
db2 terminate

=dbus-monitor=
dbus-monitor # Monitor activity on the dbus to see what system and sessions are doing.

=dd=
output your microphone to a remote computer's speaker
dd if=/dev/dsp | ssh -c arcfour -C username@host dd of=/dev/dsp
Add 2GB to disk image.
dd if=/dev/zero of=/system_image.img bs=1M oflag=append conv=notrunc count=2000
dd with progress bar.
dd if=kali.iso of=/dev/sdc status=progress
pv -ptre /install/backup/machine/raspberry/ipcenter_view.img | sudo dd of=/dev/mmcblk0 bs=1M
dd to position on disk
dd of=/dev/disk1 if=/dev/urandom obs=500000 seek=1 bs=1MB count=1 conv=notrunc
==consume 100GB ram==
mount -o remount,size=300G /dev/shm
dd if=/dev/zero of=/dev/shm/$(date '+%Y-%m-%d_%H-%M-%S') bs=1073741824 count=100 status=progress

=debugfs=
ctime: Shows file change time.
atime: Shows file access time.
mtime: Shows file modification time.
crtime: Shows file creation time. Birth.
Example
debugfs -R 'stat /etc/exports.bkp-2021-11-17_10-07-46' /dev/mapper/vg_rbnetstorage0-lv_root
debugfs 1.41.12 (17-May-2010)
Inode: 924905 Type: regular Mode: 0644 Flags: 0x80000
Generation: 2068409071 Version: 0x00000000:00000001
User: 0 Group: 0 Size: 4775
File ACL: 0 Directory ACL: 0
Links: 1 Blockcount: 16
Fragment: Address: 0 Number: 0 Size: 0
ctime: 0x6194c662:deae4368 -- Wed Nov 17 10:07:46 2021
atime: 0x6193bd7f:c4faf658 -- Tue Nov 16 15:17:35 2021
mtime: 0x61925419:34c06f18 -- Mon Nov 15 13:35:37 2021
crtime: 0x6194c662:deae4368 -- Wed Nov 17 10:07:46 2021
Size of extra inode fields: 28
Extended attributes stored in inode body:
selinux = "unconfined_u:object_r:etc_t:s0\000" (31)
EXTENTS:
(0-1): 3718194-3718195
=ddclient=
Debug
ddclient -daemon=0 -debug -verbose -noquiet

=df=
df output one per line. Without header.
df -Plk / /apps | tail -n+2

=dhclient=
[root@wall sysconfig]# cat /etc/dhclient.conf
interface "eth0" {
prepend domain-name-servers 127.0.0.1;
supersede domain-name "bltprojektering.se";
}

=dialog=
Create dialog in terminal. Example a progressbar.
for i in {0..100} ; do echo $i | dialog --gauge "Please wait" 7 70 1 ; sleep .1 ; done
=diff=
sdiff <(echo -e 'hej\nda\nvi\nses\ni\nmorgon') <(echo -e 'hej\ndå\nvi\nSES\ni\nmorgon')
Only show files that differ.
-q --brief
Only show change between files.
diff -u file1.txt file2.txt | grep -vE '^(---|\+\+\+|@@|\+|-)'

=dig=
==Get all dns information about host.==
dig any www.halfface.se
==Trace dns lookups from root dns. Use 8.8.8.8 for lookups.==
dig +trace @8.8.8.8 www.halfface.se
==Recursive lookup.==
dig -tAXFR halfface.se
==backward resolve==
dig -x 89.253.75.84
==get ttl==
dig +nocmd +multiline +noall +answer any halfface.se
==Get external ip.==
dig +short myip.opendns.com @resolver1.opendns.com
==Get txt record.==
dig google.com txt
==You can find the authoritative servers by asking for the NS records for a domain==
dig example.com NS
==dig using alternative port==
dig +short -p 5353 halfface.se @10.130.0.35

=digitemp=
digitemp_DS9097 -c /etc/.digitemprc -t0

=disk=
disk usage
baobab
foremost
recover deleted files.
=disown=
Disconnect process(pid) so that is survives a logout.
disown %2

=display=
Change resolution
xrandr --output LVDS --mode 1280x800
xrandr --output default --mode 1280x1024
Query graphics card capabilities.
xrandr -q
Change dpi
xrandr --dpi 138/eDP1
=du=
du -amx / | sort -n | tail -5
=duplicity=
Encrypted backups over rsync

=dmesg=
dmesg with iso time format
dmesg --ctime --time-format iso
Write to dmesg
echo "$USER $(date '+%Y-%m-%d %H:%M:%S %Z')" | sudo tee /dev/kmsg

=dmidecode=
List memory banks
sudo dmidecode -t 17

=dnf=
install skip if not exist
sudo dnf install --setopt=strict=0 $(sort -u /temp/other_machine_rpm)
==update system==
dnf -y upgrade --refresh
reboot
dnf -y install dnf-plugin-system-upgrade
dnf -y system-upgrade download --refresh --allowerasing --releasever=43
# Before 42:
dnf -y system-upgrade reboot
# From 42 and onward
dnf5 offline reboot
# broken deps.
dnf repoquery --unsatisfied
# look for duplicates
dnf repoquery --duplicated
# which rpms do not exit in repo.
dnf list extras
# remove no longer used.
dnf autoremove
dnf remove $(rpm -qa| grep \.fc23)
# reinstall rpm
dnf reinstall sssd-common

==auto update==
# Install auto updates.
dnf install dnf-automatic
# Enable auto update.
sed -i "s/apply_updates = no/apply_updates = yes/g;s/email_from = root@example.com/email_from = root@${HOSTNAME}/g;s/email_to = root/email_to = anden@halfface.se/g" /etc/dnf/automatic.conf
# Enable timer.
systemctl enable dnf-automatic.timer && systemctl start dnf-automatic.timer
# Trigger timer.
systemctl start dnf-automatic.timer
# Check status of dnf-automatic:
systemctl list-timers *dnf-*
==build environment==
dnf group install "C Development Tools and Libraries"
==update to specific version==
View available version.
dnf --showduplicates list gitlab-ee
Update to specific version
dnf install gitlab-ee-13.12.15-ee.0.el8

=Setup dnsmasq on ubuntu=
<pre>
# Install dnsmasq
apt install dnsmasq
systemctl enable dnsmasq --now
# Disable systemd-resolved.
sudo systemctl disable --now systemd-resolved
# Make NetworkManager ignore dns.
sudo tee /etc/NetworkManager/conf.d/no-dns.conf <<'EOF'
[main]
dns=none
EOF
systemctl restart NetworkManager
# Fix /etc/resolv.conf
sudo \rm /etc/resolv.conf
sudo tee /etc/resolv.conf <<'EOF'
nameserver 127.0.0.1
search int.redbridge.se halfface.se cloud.binero.net
options timeout:1 attempts:1
EOF
# Create config
sudo tee /etc/dnsmasq.d/custom.conf <<'EOF'
listen-address=127.0.0.1
bind-interfaces
server=/redbridge.se/185.53.164.25
#server=/halfface.se/10.111.222.2
server=8.8.8.8
EOF
# Restart dnsmasq
systemctl restart dnsmasq
</pre>

=dovecot=
# List files with doveadm
MAIL=mbox:/var/vmail/fordonskontroll.app doveadm mailbox list
# Remove mails with doveadm
MAIL=mbox:/var/vmail/fordonskontroll.app doveadm expunge -u n

=dovecot=
# List files with doveadm
MAIL=mbox:/var/vmail/fordonskontroll.app doveadm mailbox list
# Remove mails with doveadm
MAIL=mbox:/var/vmail/fordonskontroll.app doveadm expunge -u n

=dracut=
Dracut is a tool used to create an initial RAM filesystem (initramfs) for Linux systems.

=dvgrab=
Capture dv material
dvgrab -f dv2 -i -showstatus -s 0 -timestamp California-2

=e2fsck=
Scan for bad blocks.
e2fsck -ycv /dev/VolGroup00/LogVol00

=edid/ddc=
startx -- -logverbose 5.
The EDID information turns up in /var/log/Xorg.0.log.
=enca=
detect and convert encoding of text files. (codepage utf)
enca -L none /temp/locale2
=esmtp=
# Install dependency
dnf install procmail
# Put the following config in either /etc/esmtprc or more specific ~/.esmtprc. chmod 644.
SMTP_SERVER=halfface.se
cat << EOF > ~/.esmtprc
hostname = $SMTP_SERVER:25
# Set the Mail Delivery Agent (MDA)
mda = "/usr/bin/procmail -d %T"
EOF
chmod 0710 ~/.esmtprc

=etckeeper=
Keep your /etc/ directory under git revision control.
What has happened.
git log -p /etc/resolv.conf
Wipe /etc/.git
etckeeper uninit
etckeeper init

=ethtool=
show-features
ethtool -k <device>
generic-segmentation-offload = gso
tcp-segmentation-offload = tso
...
Enable wake on lan magic package.
ethtool --change <interface> wol g
Permanently add wol
find /sys/class/net -type l -not -lname '*virtual*' -printf '%f\n' | while read i ; do INTERFACE_INFO=$(ip address show $i) ; MAC=$(grep link/ether <<< "${INTERFACE_INFO}" | awk '{print $2}') ; echo "# /etc/systemd/network/50-wired.link
[Match]
MACAddress=$MAC

[Link]
NamePolicy=kernel database onboard slot path
MACAddressPolicy=persistent
WakeOnLan=magic" ; done

=exiftool=
Change meta data for files, exif, jpg, mp3...
Get info from file.
exiftool $file.mp4
gps format
41°24'12.2"N 2°10'26.5"E
gps format known to maps.google.com
exiftool -c "%.6f" 2022-03-06_10-39-40.mp4 | grep -i gps

=exportfs=
Install server
dnf install nfs-utils
Start nfs server
systemctl enable nfs-server --now
Reexport everything.
exportfs -avr
Example export.
*(rw,no_root_squash,async,insecure)
rw rewritable
no_root_squash Allow root on remote machine same permissions as local root
async
insecure NFS version 2 and 3 servers only provide (insecure) host-based authentication: Hosts are allowed/denied based on hostnames and/or IP addresses. Authorization of users is controlled on the clients using the permissions of the files based on user/group IDs. allows clients with NFS implementations that don't use a reserved port for NFS

=fdupes=
Find duplicate files.
fdupes -r /home
=feh=
Image viewer

=ffmpeg=
ffmpeg
ffmpeg -y -deinterlace -aspect 16:9 -author "Andreas Bjorklund" -title "Tanzania" -year 2007 -i Tanzania.m2t -acodec mp3 -vcodec mpeg4 -b 3000k -s 720x540 test.avi
Create swf/flv from mpeg2 stream
ffmpeg -deinterlace -i VTS_01_1.VOB -ab 56 -ar 22050 -b 500000 -r 15 -s 360x288 sisyfos.swf
Create horse movie.
ffmpeg -deinterlace -i /temp/VTS_01_1.VOB -ab 100 -ar 22050 -b 1200000 -r 25 -s 360x288 3horses.swf
Cut video from command prompt.
ffmpeg -i video.avi -vcodec copy -acodec copy -ss 00:00:00 -t 00:00:04 trimmed_video.avi
Record desktop.
ffmpeg -f alsa -ac 2 -i pulse -f x11grab -r 5 -s 1920x1080 -i :0.0 -acodec pcm_s16le -vcodec libx264 -threads 0 -y output.mkv
ffmpeg -f x11grab -s $(xrandr | grep \*+|awk '{print $1}') -r 25 -i :0.0 -sameq /tmp/out.mpg
Change container.
ffmpeg -i film.mov -vcodec copy -acodec copy film.mp4
Transcode to h264 aac
ffmpeg -i original.avi -vcodec libx264 -acodec aac -strict experimental new_file.mp4
Transcode mp3 to ogg vorbis
for file in *.mp3; do ffmpeg -i "${file}" -acodec libvorbis "${file/%mp3/ogg}";done
Take one photo from video stream.
ffmpeg -ss 00:00:01 -i <video input> -frames:v 1 -q:v 2 <photo created>
Take photo
ffmpeg -f video4linux2 -s 1280x720 -i /dev/video0 -f image2 snapshot.jpg
ls /dev/video* | while read i ; do echo $i ; ffmpeg -f video4linux2 -i $i -vframes 1 -q:v 2 /tmp/${i//\//%}.$(date +%F_%H-%M-%S).jpg ; done ; ls -la /tmp/%*
Take a photo from a video steam every 10 seconds.
ffmpeg -i video.mp4 -r 0.1 -f image2 %03dandreas.jpg
Take a photo every 1 put it in a file.
ffmpeg -y -i http://balcony.halfface.se:8080 -r 1 -f image2 -update 1 stream_image.jpg -probesize 5e+07
Rotate 180 degrees.
ffmpeg -i input.mp4 -filter:v "transpose=1,transpose=1" output.mp4
Change rotation without transcoding.
ffmpeg -i IMG_0703.MOV -metadata:s:v rotate="" -codec copy rotate_IMG_0703.MOV
Concaternate videos.
ffmpeg -f concat -safe 0 -i mylist.txt -c copy output

=find=
==Find exluding directory==
find . -wholename '/var/' -prune -o -ls
==Find text file in directoy execpt directory. Grep for text in that file and show it with colours in less==
find /opt/ongame/ -wholename '/opt/ongame/napsjb/server/naps/tmp' -prune -o -type f -exec grep --color=always -r '/fraud' /dev/null {} \; | less -SR
==Find excluding several directories==
find / -type d $ -path /proc -o -path /dev -o -path /net $ -prune -o -gid 1002 -exec chgrp -h 1001 {} \;
==Find excluding svn==
find . -path '*/.svn' -prune -o -type f -print
==Searches for files modified up to 4 days ago==
find ./ -type f -mtime -4
==Searches for files modified between certain dates. Here for files older than 30 days but younger than 60 (penultimate month)==
find ./ -type f -mtime -60 ! -mtime -30
sudo find . -newermt "2014-10-19 09:30" ! -newermt "2014-10-19 09:35"
==Find which dir is consuming inodes==
find /var -xdev -printf '%h\n' | sort | uniq -c | sort -k 1 -n
for i in $(ls) ; do echo $(find $i | wc -l) $i ; done | sort -n
==How much data is consumed by pattern==
export NFS_DIR=/netstorage/cam/ocp-01 ; find ${NFS_DIR} -maxdepth 1 | grep ^${NFS_DIR}/archived- | while read NFS_DIR_REMOVE ; do du -sk "${NFS_DIR_REMOVE}" ; done | awk '{ SUM += $1} END { print SUM "KiB" }' | numfmt --from=auto --to=iec-i --suffix=B
==find search small files==
find . -type f -size -1M -exec grep -H 'your_search_pattern' {} +
=find physical network interfaces=
find /sys/class/net -type l -not -lname '*virtual*' -printf '%f\n'

=findmnt=
view the mount tree
findmnt

=flash=
When firefox is complaining about outdated flash plugin
rm pluginreg.dat
=flatpak=
=Install flatpak=
sudo apt install -y flatpak gnome-software-plugin-flatpak
sudo flatpak remote-add --if-not-exists flathub https://dl.flathub.org/repo/flathub.flatpakrepo
=Install flatpak application and replace system binary=
sudo flatpak install -y flathub com.freerdp.FreeRDP
cat <<'EOF' | sudo tee /usr/local/bin/xfreerdp
#!/bin/bash
flatpak run com.freerdp.FreeRDP "$@"
EOF
sudo chmod 755 /usr/local/bin/xfreerdp
hash -r
=Run other binary from flatpack=
flatpak run --command=xfreerdp com.freerdp.FreeRDP

=List installed applications.=
flatpak list --app

=flock=
used to use cript that only used 1 time concurrently.
flock

=fmt=
Join lines
ifconfig -a | fmt -w 300

=fold=
Fold long lines. Break at 80 and blank spaces.
fold -w 80 -s text.txt
=forward traffic=
service x11
{
disable = no
socket_type = stream
protocol = tcp
wait = no
user = root
server = /usr/bin/nc
server_args = 172.28.37.152 6000
}
=fping=
fping --timeout=10 --elapsed --netdata <fqdn>
Example of testing connectivity.
for i in $(grep -E 'ocp-[0-9]{2}-' /etc/hosts | awk '{print $2}') ; do echo -e "$(fping --timeout=10 --elapsed $i)\t$(nc -v -w1 $i 22 </dev/null 2>&1 | strings | xargs)" ; done | column -t -s $'\t'

=free=
You have 15956MB physical ram. 9033MB is used by applications. 6922MB is free.
free -m
total used free shared buffers cached
Mem: 15956 15755 200 0 300 6421
-/+ buffers/cache: 9033 6922
Swap: 19998 2405 17593

=free new=
Total memory 8076624k and 5169152 free.
total used free shared buff/cache available
Mem: 8076624 2536328 1069132 284152 4471164 5169152
Swap: 7815164 2809244 5005920

Free memory usage from /proc/zoneinfo and /proc/meminfo
awk -v low=$(grep low /proc/zoneinfo | awk '{k+=$2}END{print k}') '{a[$1]=$2} END{print a["MemFree:"]+a["Active(file):"]+a["Inactive(file):"]+a["SReclaimable:"]-(12*low);}' /proc/meminfo
5168456
==physical memory==
Show physical memory in machine. Consider points below.
grep MemTotal /proc/meminfo
meminfo:
Provides information about distribution and utilisation of memory. This varies by architecture and compile options...
MemTotal:
Total usable ram (i.e. physical ram minus a few reserved bits and the kernel binary code)
Gives more information not really sure how.
dmesg|grep Memory:
==List memory modules==
dmidecode -t memory
lshw -class memory

=fstab=
Use ram for some logfiles.
none /var/log/ tmpfs defauls,noatime,size=10% 0 0
none /tmp/ tmpfs defauls,noatime,size=10% 0 0
none /var/tmp/ tmpfs defauls,noatime,size=10% 0 0
none /var/spool/ tmpfs defauls,noatime,size=10% 0 0

=fswebcam=
Capture photo.
fswebcam -r 1920x1080 --jpeg 85 -D 1 --quiet --no-banner shot.jpg
fswebcam -d /dev/video0 -i 0 -r 2592x1944 -p YUYV /net/10.111.222.1/storage/temp/logitech.jpg
=fwupdmgr=
fwupdmgr get-devices --show-all-devices
fwupdmgr get-upgrades
fwupdmgr update $device_id

=genisoimage=
genisoimage -o nuc.iso nuc
=gnome-font-viewer=
view fonts
gnome-font-viewer /file.woff2
=gnome-monitor-config=
Set one monitor. Disable all others.
gnome-monitor-config set -LpM HDMI-2
Get monitor settings
WINDOWS + p

=gpg=
Password encryption decryption with gnupg.
gpg -c --force-mdc /temp/shadow
echo "$(gpg -qd /temp/shadow.gpg)"
==create keys==
gpg --full-generate-key
==list secret keys==
gpg --list-secret-keys --keyid-format LONG
==delete secret keys==
gpg --delete-secret-key liza

==list public keys==
gpg --list-public-keys --keyid-format LONG

==export public key==
gpg --armor --export 3AA5C34371567BD2
==export private key==
gpg --armor --export-secret-keys 3AA5C34371567BD2
==export secret subkey==
gpg --armor --export-secret-subkeys 3AA5C34371567BD2
==import keys==
gpg --import pub.key
gpg --import sec.key
gpg --import sub.key
==add trust to private key==
gpg --edit-key 6252FC9A029A2669 trust quit # 5 y

==edit gpg key==
gpg --edit-key 6252FC9A029A2669
==send gpg key==
gpg --send-key 6252FC9A029A2669
==delete public key==
gpg --delete-key "User Name"
==change trust level on all keys==
gpg --list-keys --fingerprint |grep pub -A 1|egrep -Ev "pub|--"|tr -d ' ' | awk 'BEGIN { FS = "\n" } ; { print $1":6:" } ' | gpg --import-ownertrust
==get info about gpg encrypted file==
gpg --list-packets crypto-text.pgp
==list keys in gpg file==
gpg --list-packets crypto-text.pgp # | grep keyid
==get public key from command above==
gpg --recv-keys 754817487F42735A
==encrypt file==
gpg --encrypt --recipient user1@inter.net --recipient user2@inter.net --recipient user3@inter.net file.txt

==decrypt gpg file==
gpg --decrypt vpn-0ea602e33ab9c49fd.txt.gpg

==who has encrypted file==
gpg --pinentry-mode cancel --list-packets file.gpg
==remove expired public keys==
for i in $(gpg --list-public-keys --keyid-format LONG 2>&1 | grep -A1 -B1 expired | grep -Ev '^$|^pub|^uid') ; do gpg --delete-key $i ; done

=pgpdump=
pgpdump <(curl -sS https://download.spotify.com/debian/pubkey_C85668DF69375001.gpg)
=gphoto2=
Capture photo from the command line linux.
gphoto2 --camera='Canon EOS 40D (PTP mode)' --port=usb: --capture-image-and-download

=graphviz=
Create graph.
dot -Tps /flow -o /tmp/flow.ps

=grep=
Colorize grep output.
grep --color=always -r '10\.7\.' /opt/ongame/
Show non comment lines ending with a blank.
find . -name '*.properties' -exec grep --color=always -E '^[^#].*\ $' {} \; | less -SR
grep ipaddress from message file.
sudo grep DHCP /var/log/messages | grep -oir --color=always '192\.168\.[0-9]*\.[0-9]*' | sort -u
grep -E '([0-9]|[1-9][0-9]|1([0-9][0-9])|2([0-4][0-9]|5[0-5]))\.([0-9]|[1-9][0-9]|1([0-9][0-9])|2([0-4][0-9]|5[0-5]))\.([0-9]|[1-9][0-9]|1([0-9][0-9])|2([0-4][0-9]|5[0-5]))\.([0-9]|[1-9][0-9]|1([0-9][0-9])|2([0-4][0-9]|5[0-5]))'
grep ipaddress from file
grep -E '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}'
grep for tab
grep 10.199.2.1$'\t' /etc/hosts
grep from word containing regex space separated.
grep -oE '\S*regex\S*' /file
When grep start to complain about file being binary run the following command to define where.
grep -Pa '\x00' /temp/file_name
Remove binary part of file.
sed -i 's/\x00//g' /temp/file_name
Grep email addresses.
grep -E -o "\b[a-zA-Z0-9.-]+@[a-zA-Z0-9.-]+\.[a-zA-Z0-9.-]+\b" filename.txt
Grep for exact string like \
grep -F \\ blabla.json
=grepcidr=
grepcidr -v 10.0.0.0/8,172.16.0.0/12,192.168.0.0/16

=growpart=
growpart /dev/vda 5
btrfs filesystem resize max /

=gsettings=
Emulate 3 button mouse
gsettings set org.gnome.settings-daemon.peripherals.mouse middle-button-enabled true
Blinking cursor disable
gsettings set org.gnome.Terminal.Legacy.Profile:/org/gnome/terminal/legacy/profiles:/:$(gsettings get org.gnome.Terminal.ProfilesList default|tr -d \')/ cursor-blink-mode off
List settings
gsettings list-recursively

=gsync=
Install gsync
git clone https://github.com/iwonbigbro/gsync.git
cd gsync/
sudo python setup.py install
Download data.
gsync -u -r -t -v --progress --delete -l -s drive://motion/ /temp/motion2/

=gzip=
Compress a stream.
find . | gzip -9 > /tmp/file_list.gz

=gscan2pdf=
Scan and ocr pdf dokuments

=Handbrake=
Compress dvd
#Rip dvd.
sudo vobcopy -o /storage/temp/ -v -x -l
#compress video.
HandBrakeCLI -e x264 -Z Normal -i source.vob -o destination.mkv -a 2 -r 25 -E faac -f mkv -d -S 600 --crop 0:0:0:0
#Create film for android.
HandBrakeCLI -i 01.Alla.Vi.Barn.I.Bullerbyn.1986.SWEDiSH.vob -o 01.Alla.Vi.Barn.I.Bullerbyn.1986.SWEDiSH.mp4 -x level=30:bframes=0:cabac=0:ref=1:vbv-maxrate=1500:vbv-bufsize=2000:analyse=all:me=umh:no-fast-pskip=1 -e x264 --vb 300 -E faac --ab 128 --maxWidth 320 -2 -T -d
# Compress.
SOURCE=/ssd/temp ; DESTINATION=/temp ; for FILM in $(cd ${SOURCE}; ls *.mov | sed 's/\.mov$//g'); do HandBrakeCLI -e x264 -q 20 -B 160 -i ${SOURCE}/${FILM}.mov -o ${DESTINATION}/${FILM}.mp4 ;done
# High profile
HandBrakeCLI -i DVD -o ~/Movies/movie.mp4 -e x264 -q 20.0 -a 1 -E faac -B 160 -6 dpl2 -R Auto -D 0.0 -f mp4 --strict-anamorphic -m -x ref=2:bframes=2:subme=6:mixed-refs=0:weightb=0:8x8dct=0:trellis=0
=hashid=
Identify hash strings.
hashid

=heif-convert=
heif-convert image.HEIC new-image.jpg
=hostnamectl=
hostnamectl set-hostname rocky_8_1

=htmldoc=
Convert html document to pdf
htmldoc --webpage -f php_html_doc.pdf /home/andreasbj/php_manual_en.html 2>/tmp/htmldoc
=htpasswd=
Add user to htpasswd file.
htpasswd -b /etc/httpd/conf/htpasswd <username> <password>

=hunspell=
hunspell -d sv_SE swedish.txt
=hydra=
Password checking.
hydra -l root -P /etc/passwdknown -t 5 192.168.29.62 ssh2

=ifconfig=
Configure network.
ifconfig eth0 192.168.0.1 netmask 255.255.255.0 up
ip address alias
ifconfig eth0:0 192.168.1.2 netmask 255.255.255.0
Network configuration Full config.
echo -e "options timeout:1 attempts:1
domain halfface.se
nameserver 84.246.88.10
nameserver 84.246.88.20" > /etc/resolv.conf
ifconfig eth0 89.253.75.84 netmask 255.255.255.224 up
route add default gw 89.253.75.65 eth0
Vip on loopback /etc/sysconfig/network-scripts/ifcfg-lo:ipdbm
DEVICE=lo:ipdbm
IPADDR=192.168.122.2
NETMASK=255.255.255.255
NETWORK=192.168.122.0
ONBOOT=yes
Setting up multiple addresses. ifcfg-eth0-range0
TYPE=Ethernet
IPADDR_START=192.168.122.3
IPADDR_END=192.168.122.15
ifcfg-eth0
DEVICE=eth0
BOOTPROTO=static
ONBOOT=yes
TYPE=Ethernet
IPADDR=10.111.222.2
NETMASK=255.255.255.0
GATEWAY=10.111.222.1
DNS1=10.111.222.253
DNS2=10.111.222.254
DOMAIN="halfface.se subdomain.halfface.se"

=imv=
Image viewer for wayland
imv . -f -s full

=ilo=
log in to ilo
env -u LANG ssh -v Ongame@10.1.1.94
restart ilo
reset map1
start system
start system1

=install=
Crete directory
install -d --mode=755 --owner=user --group=group /apps/IP/IPim/var/log
Create empty file
install -o 0664 -o user -g group /dev/null ${ALFRESCO_DIR}/logs/catalina.out
=inotifywathc=
Se what access /dev/random
inotifywatch -v -t 60 /dev/random

=inxi=
inventory report.
inxi -Frmxx
=iostat=
iostat -xtc 5
-x extended statistics.
-t print time for each report.
-c display the cpu utalization report.
-y Omit first report with statistics since the system boot
==iostat -xty 5 1 dm-3==
Linux 2.6.32-573.7.1.el6.x86_64 (machine.se) 12/30/2021 _x86_64_ (12 CPU)
12/30/2021 11:47:42 AM
avg-cpu: %user %nice %system %iowait %steal %idle
0.12 0.00 2.01 4.23 0.00 93.65
Device: rrqm/s wrqm/s r/s w/s rsec/s wsec/s avgrq-sz avgqu-sz await svctm %util
dm-3 0.00 0.00 5806.20 0.00 1485056.00 0.00 255.77 1.54 0.27 0.17 97.44

# Explained.
rrqm/s The number of read requests merged per second that were queued to the device.
wrqm/s The number of write requests merged per second that were queued to the device.
r/s The number of read requests that were issued to the device per second.
w/s The number of write requests that were issued to the device per second.
rsec/s The number of sectors read from the device per second.
wsec/s The number of sectors written to the device per second.
avgrq-sz The average size (in sectors) of the requests that were issued to the device.
avgqu-sz The average queue length of the requests that were issued to the device.
await The average time (in milliseconds) for I/O requests issued to the device to be served. This includes the time spent by the requests in queue and the time spent servicing them.
svctm The average service time (in milliseconds) for I/O requests that were issued to the device. Warning! Do not trust this field any more. This field will be removed in a future sysstat version.
%util Percentage of elapsed time during which I/O requests were issued to the device (bandwidth utilization for the device). Device saturation occurs when this value is close to 100%.

=iotop=
iotop with dates for output to logfile.
DATE=$(date '+%Y-%m-%d %H:%M:%S %Z') ; sudo iotop -kbon1 | head -2 | while read i ; do echo $DATE $i ; done

=ip=
==Add vlan 23==
ip link add link eno1 name eno1.23 type vlan id 23
==View vlan protocol==
ip -d link show eno1.23
==Configure vlan==
ip addr add 10.151.23.101/24 brd 10.151.23.255 dev eno1.23
ip link set dev eno1.23 up
==create default route==
ip route add default via 192.168.1.254
==show routing==
ip route show
more info
ip route show table all
==Add static route==
ip route add 10.10.20.0/24 via 192.168.50.100 dev eth0
==Remove static route.==
ip route del 10.10.20.0/24
==which outgoing interfaces are available.==
ip r l| awk '/src/{print $9}'
==Which route is used for ip.==
ip route get 192.168.122.252
==route subnet over interface.==
sudo ip route add 145.251.242.0/24 dev tun0
==Show ipaddress on interface tun0==
ip address show tun0
==vlan tag interface.==
ip link add link eth0 name eth0.8 type vlan id 8
==set ip on interface.==
ip addr add 192.168.50.5 dev eth1
ip addr add 192.168.50.5/24 dev eth1
==set secondary ip on interface==
ip addr add 192.168.1.2/24 dev eth0
==remove ip address.==
ip addr del 192.168.50.5/24 dev eth1
==enable interface==
ip link set eth1 up
==disable interface==
ip link set eth1 down
==list arp entries.==
ip neigh show
==local routing table==
ip route list table local
==rule base routing. List rules==
ip rule show
==show multicast networks==
ip maddr show
==Disable traffic to an ipaddress.==
ip route add blackhole 10.151.19.151
==dynamic/random mac wifi disable==
MAC=$(ip link show | grep link/ | grep -v 00:00:00:00:00:00 | awk '{print $2}') ; nmcli -f TYPE,NAME connection show | grep ^wifi | sed 's/^wifi *//g' | while read i ; do echo '*' $i ; nmcli connection modify "${i}" 802-11-wireless.cloned-mac-address $MAC ; done
==change mtu==
sudo ip link set dev ens3 mtu 1400
==network namespaces==
ip netns list

=ip2location=
ip2location -d /usr/share/IP2Location/IP2LOCATION-LITE-DB5.BIN -p $IP -e country_name,city_name,ip --format TAB
sed 's/ \+/\t/g' haproxy.log | cut -f 9 | sort -u | while read IP ; do ip2location -d /usr/share/IP2Location/IP2LOCATION-LITE-DB5.BIN -p $IP -e country_name,city_name,ip --format TAB | tail -n1 ; done | column_tab | sort
=ipcalc=
ipcalc -n 192.121.85.96/27 -m

=iperf=
start server on client A.
iperf -s
start measure from the other host. Limit bandwidth to 10k.
iperf -c 10.20.30.40 --bandwidth 10K
==Multicast test.==
On the listener side:
iperf -s -u -B 224.1.1.1 -i 1
On sender
iperf -c 224.1.1.1 -u -T 32 -t 3 -i 1

=ipmitool=
What is the power consumtion of dell server.
ipmitool -I lanplus -H 127.0.0.1 -U root -P calvin delloem powermonitor
ipmitool lan print
ipmitool sdr list

=iptables=
==Show iptables OUTPUT, PREROUTING and POSTROUTING==
iptables --table nat --list --exact --verbose --numeric --line-number
==Show config==
iptables -L -t nat -n
==Dnat to localhost.==
iptables -t nat -I PREROUTING --source 131.115.115.53 -p tcp --dport 22 -j REDIRECT --to-ports 222
iptables -t nat -I OUTPUT --source 131.115.115.53 --destination 127.0.0.1 -p tcp --dport 22 -j REDIRECT --to-ports 222
==Flush all rules.==

iptables -F
iptables -X
iptables -t nat -F
iptables -t nat -X
iptables -t mangle -F
iptables -t mangle -X
iptables -P INPUT ACCEPT
iptables -P FORWARD ACCEPT
iptables -P OUTPUT ACCEPT

==Block==
iptables -A OUTPUT -p tcp -d 131.115.248.82 --dport 8080 -j DROP
iptables -A OUTPUT -p tcp -d 131.115.248.82 --dport 8080 -j REJECT

==Block outgoing mail==
iptables -A OUTPUT -p tcp --dport 25 -o $INTERFACE -j REJECT

==Block all traffic except ssh in/out log to syslog.==
iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -P FORWARD DROP
iptables -A INPUT -m tcp -p tcp --dport 22 -j ACCEPT
iptables -A INPUT -m tcp -p tcp --sport 22 -j ACCEPT
iptables -A INPUT -m state --state NEW -m tcp -p tcp -j LOG --log-level info --log-prefix "dropped-in"
iptables -A OUTPUT -m tcp -p tcp --dport 22 -j ACCEPT
iptables -A OUTPUT -m tcp -p tcp --sport 22 -j ACCEPT
iptables -A OUTPUT -m state --state NEW -m tcp -p tcp -j LOG --log-level info --log-prefix "dropped-out"

==Block traffic on certain port.==
iptables -A INPUT -p tcp --dport 7009 -j REJECT
==Fake source==
iptables -t nat -A POSTROUTING -d "${DST}" -p udp --dport 162 -j SNAT --to "${SRC}" &>/dev/null
# Remove the current rules
iptables -t nat -D POSTROUTING -d "${DST}" -p udp --dport 162 -j SNAT --to "${SRC}"
==redirect ip==
Send traffic destined for one ip and port to another ip and port.
iptables -t nat -A OUTPUT -p tcp -d 146.213.6.7 --dport 1023 -j DNAT --to-destination 10.199.150.111:1023
iptables -t nat -A OUTPUT -p icmp -d 146.213.6.7 -j DNAT --to-destination 10.199.150.111
==allow trafic from subnet==
iptables -A INPUT -s 172.16.27.0/24 -j ACCEPT
==allow ssh from all==
iptables -A INPUT -p tcp -dport 22 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p tcp -dport 22 -m conntrack --ctstate ESTABLISHED -j ACCEPT
or
-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 22 -j ACCEPT
==find which rule is blocking by removing one at a time. Better way is to enable logging==
iptables -L -n --line-numbers
iptables -D <line-number>
==List rules from OUTPUT chain with line number==
iptables -t filter -L OUTPUT --line-numbers -n

==Add rule to specific row number==
iptables -I OUTPUT $ROW_NUMBER -d 54.72.175.186/32 -p tcp -m tcp --dport 443 -j ACCEPT

=irc=
Close private messages
/window close
Close public messages
/window close
Close a query
/q
=jmtpfs=
Mount disk
jmtpfs /mnt/mtp
Umount disk
fusermount -u /mnt/mtp

=john=
Test performance
john -test
Recover passwords with password list.
john -wordlist:password.lst passfile.txt
=journalctl=
==View log from last day.==
journalctl --since yesterday
==List all units.==
systemctl list-unit-files
==Current disk usage.==
journalctl --disk-usage
==Show only certain error level. (err crit)==
journalctl -p err
==List boots==
journalctl --list-boots
==Show events between two time stamps.==
journalctl --since "2017-01-23 05:56:42" --until "2017-01-23 07:56:42"
==show entries for one unit.==
journalctl -u openvpn-server@server
journalctl -u sshd -f
==iptables logs==
journalctl -k -f | grep -i iptables
==wipe logs==
journalctl --vacuum-time=1h
==compare two different boots==
journalctl --since "$(date '+%F %H:%M:%S' --date '-10 hour')" -u NetworkManager -b -1 -o cat | sed 's/\[[0-9.]*\]//g'

==persistent logging==
Enable persistent logging in systemd-journald. grep journal /usr/lib/tmpfiles.d/systemd.conf. Install syslog instead.
mkdir /var/log/journal
chmod 2755 /var/log/journal
chown root:systemd-journal /var/log/journal
killall -USR1 systemd-journald

=jpegtran=
# to lossless cut a file.
jpegtran -crop 700x400+2150+1500 2012-05-19_20-39-35.jpg > /photos/Sweden/2012/2012-05-19/2012-05-19_20-39-35.jpg
# Rotate counter clockwise.
jpegtran -copy all -rotate 270 2012-08-18_15-06-43.jpg > 2012-08-18_15-06-43_270.jpg
=kdump=
Change action to dump memory.
/etc/kdump.conf
core_collector true
Reload config.
systemctl restart kdump
=keepass=
Create database
printf '%s\n' 'P@55Word'{,} | keepassxc-cli db-create -p -q keepassxc_abjorklund.kdbx
Add entry to database.
keepassxc-cli add keepassxc_abjorklund.kdbx abjorklund
Copy password from password entry
keepassxc-cli clip keepassxc_abjorklund.kdbx abjorklund

=keyboard=
keymaps
dumpkeys
loadkeys sv-latin1
loadkeys us
setxkbmap en
setxkbmap -layout se -variant nodeadkeys
reset corrupt keyboard after using vmware.
setxkbmap

=kill=
suspend/resume a jobb.
# kill -STOP PID
# kill -CONT PID
=kpartx=
# Create device files from disk image.
sudo kpartx -av disk_image.raw
# Remove device files.
sudo kpartx -d disk_image.raw

=lastb=
Show failed ssh logins.
lastb
=less=
Toggle line wrap
- -> S
tail with less. CTRL + c = scroll around. SHIFT + f = to tail again.
less +F -B /tmp/tmp
=lftp=
lftp -u <user>,<password> <ftp_server>
With proxy.
lftp -e "set ftp:proxy http://<url>:3128 ; set ssl:verify-certificate no; open -u user,password ftp://ftp.example.se/"
Workaround.
lftp -e 'set ftp:use-feat false; set ftp:ssl-allow false' -u user,passwor ftp.example.se
Run commands from cli.
lftp -u '<user>,<password>' -e 'set ssl:verify-certificate no ; ls -la ; quit' <ftp_server>

=ln=
Create link even if it exists.
ln -sfT /destination link

=locale=
To show 24 hour format.
LC_ALL=C
=localectl=
Change keyboard.
localectl list-keymaps
localectl set-keymap se-nodeadkeys
localectl set-x11-keymap se-nodeadkeys

=lock=
locking keyboard under linux.
lock-keyboard-for-baby
=logging=
bash create log.
#!/bin/bash
exec > /logfile
alternative
exec 2>/tmp/log
Read logs on system.
tail -f $(lsof | grep log$ |awk '{ print $NF }' | sort -u |xargs)
=logrotate=
Test dry run logrotate file. -d=debug -f=force
logrotate -d -f /etc/logrotate.conf
Force logrotate in verbose mode.
logrotate -v -f /etc/logrotate.conf
Create logrotate config entry.
# Configure log rotation.
cat << EOF > /etc/logrotate.d/ipmonperfj_cleanupdaemon
/directory/logs/cleanupdaemon.log {
copytruncate
size 100M
rotate 60
compress
missingok
olddir old
}
EOF
Disable logrotate. Look for file extension to ignore.
man logrotate.conf, you can read find tabooext
Ex. mv /etc/logrotate.d/mysql{,.rpmsave}

=losetup=
Create loopback devices for partitions in image. Force the kernel to scan the partition table on a newly created loop device
losetup -P /dev/loop2 harddrive.img
Set up next available device read only.
losetup -f -r /temp/rb-slog05/sda6
Show all
losetup -a
detatach
losetup -d /dev/loop2

=ls=
ls -la --time-style="+%Y-%m-%d %H:%M:%S" *.3gp
List processes in epoch date
( cd /proc; ls -rtd --full-time --time-style=+%s [0123456789]*; )
=lsblk=
lsblk -d -o NAME,ROTA,MODEL
=lshw=
==List memory modules==
lshw -C memory

==Is cpu 32 or 64bit.==
lshw -class processor

=lsof=
List recurivly all process that have a path open.
lsof +D /apps/
which ports has a process opened?
lsof -Pan -p 13354 -i
=lspci=
List devices without drivers.
lspci -nnk

=which process listen to port=
lsof -i :443

=mail=
command line mail with changed from
echo message$(date +%F_%H-%M-%S) | mail -s Subject$(date +%F_%H-%M-%S) -r from@inter.net reciever@inter.net
command line mail with changed from with attachment
echo message | mail -s Subject -r from@inter.net -a /attach.ment reciever@inter.net
Change default sender.
# ~/.mailrc
# From address for mailx.
set from="root degn.redbridge.se <abjorklund@redbridge.se>"
set replyto="root degn.redbridge.se <abjorklund@redbridge.se>"

=man=
man correct caracters.
LANG=C man passwd

man clean for output to file.
man [manual] | col -b > file.txt
Read from section 5
man man.5

=mbr=
backup mbr.
# dd if=/dev/sdX of=/temp/sdx-mbr bs=512 count=1

restore mbr
# dd if=/temp/sdx-mbr of=/dev/sdX bs=446 count=1
=mdadm=
Add disk that was lost
mdadm /dev/md125 -a /dev/vda1

=minimodem=
Transmit file via audio.
minimodem -t 200
Recieve file via audio
minimodem -r 200

=mkfs=
Create fat32 file system.
dd if=/dev/zero of=/tmp/sdb bs=32M status=progress conv=fdatasync count=10
fdisk /tmp/sdb
n
<accept all defaults>
t
b
p
w
mkfs.vfat -F 32 -n MYDRIVE /tmp/sdb1
==mkfs.ext4==
Create ext4 filesystem. Overwrite. Label and root reserved to 0.
mkfs.ext4 -F -L looted_storage -m 0 /dev/sda1

=mkpasswd=
Create a password hash
echo password | mkpasswd -m sha-512 -s

=mogrify=
Resize, crop... a file. Removes original.
mogrify -resize 800 *.jpg
=mokutil(secure boot/secureboot=
mokutil --sb-state

=mount=
Mount a temporary ram partition
mount -t tmpfs tmpfs /mnt -o size=1024
Mount a cifs filesystem and change owner on mountpoint.
mount.cifs -o credentials=/home/user/cifs.credentials,gid=1004,uid=1004 //server/c$ /mnt/cifs
Disallow normal user to ps. If not belonging to gid 1001.
*/etc/fstab
proc /proc proc defaults,hidepid=2,gid=1001 0 0

=movgrab=
List available formats
movgrab -T http://youtu.be/ucivXRBrP_0
Get version listed.
movgrab -f mp4:1920x1080 http://www.youtube.com/v/ucivXRBrP_0

=mplayer=
mplayer in ascii mode.
mplayer -monitoraspect 4:3 -vo aa LinaFreestyler.avi
mplayer -vo aa -monitorpixelaspect 0.5 *.mp4
mplayer on second soundcard.
mplayer -ao oss:/dev/dsp *.mp3
mplayer -ao alsa:device=hw=0.0 *.mp3
Or, to specify a non-default (secondary) device either of the following commands can be used.
mplayer -ao oss:/dev/dsp1 *.mp3
mplayer -ao alsa:device=hw=1.0 *.mp3
play from v4l
mplayer -tv device=/dev/video:driver=v4l:input=1:width=640:height=480:norm=ntsc:adevice=/dev/dsp tv://1 -zoom -aspect 4:3
mplayer -fps 15 tv:// -tv driver=v4l2:width=640:height=480:device=/dev/video0play hdv material.
mplayer -monitoraspect 16:9 -vf pp=lb
play dvd image.
mplayer dvd://1 -dvd-device DVD.iso
play h264 webcam
mplayer -fps 24 tv:// -tv driver=v4l2:width=1920:height=1080:device=/dev/video0:outfmt=0x34363248 -aspect 16:10 -fs
play mjpeg webcam
mplayer -fps 24 tv:// -tv driver=v4l2:outfmt=mjpeg:width=1920:height=1080:device=/dev/video0 -aspect 16:10 -fs
play mp3 in different speed keep pitch.
mplayer -speed 1.5 -af scaletempo /mp3/music.mp3
# list chapters.
mplayer dvd://1 -dvd-device /dev/sr0 -identify -novideo -nosound
# dump chapters.
mplayer -dvd-device /dev/sr0 dvd://3 -dumpstream -dumpfile 3.vob

=MP4Box=
Combine mp4 files
MP4Box -add file1.mp4 -add file2.mp4 output.mp4
=mpv=
Video player. Enable hardware accelleration.
# Install packages.
dnf install intel-media-driver libva libva-utils gstreamer1-vaapi ffmpeg intel-gpu-tools mesa-dri-drivers mpv
# Top for intel gpu
sudo intel_gpu_top
# Enable hardware accelleration for mpv.
CONFIG_FILE=~/.config/mpv/mpv.conf ; if ! grep -q ^hwdec=auto ${CONFIG_FILE} ; then echo hwdec=auto ${CONFIG_FILE} ; fi
# Create new initramfs
sudo dracut --force
# Look at browser.
chrome://gpu/

=mpstat=
top like output of system usage
mpstat 5 5

=mtr=
ping and traceroute combined.
mtr -rc 10 8.8.8.8

=mutt=
Put the followin in .muttrc to change From.
set realname="Joe User"
set from="user@host"
set use_from=yes
command line mail with attachment
mutt -s subject -a syslogs.tar.gz admin@domain.org < /dev/null
Change sender from command line.
export EMAIL=address@inter.net && mutt -s "Subject Test" anden@halfface.se < /dev/null
echo "Test message" | mutt -s "Subject test" -e "set realname=\"Real Name\"" -e "set from=\"anden@halfface.se\"" -e "set use_from=yes" anden@halfface.se
Change envolope from
export REPLYTO=email@inter.net
export EMAIL=email@inter.net
echo "email@inter.net testing" | mutt -e "set envelope_from=yes" email@inter.net -a /tmp/attachment
oneliner
export EMAIL=email@inter.net;export REPLYTO="${EMAIL}";echo "email@inter.net testing" | mutt -e "set envelope_from=yes" email@inter.net -a /tmp/attachment
export EMAIL=email@inter.net;export REPLYTO="${EMAIL}";echo "${EMAIL} testing on ${HOSTNAME}" | mutt -e "set envelope_from=yes" -s "${EMAIL} testing on ${HOSTNAME}" "${EMAIL}"
Dont trigger out of Out Of Office reply.
echo "email@inter.net testing" | mutt -e "unignore list-id" email@inter.net
=multilog=
split standard output to logfiles. In this case keep specific size. t means to prepend a TAI timestamp on each line. 10000B. 5 logfiles. tai64nlocal program simply reads stdin and replaces TAI timestamps with human-readable ones. http://blog.teksol.info/pages/daemontools/best-practices. Compress rotated logfiles.
mkdir /tmp/myapp ; ./myapp | multilog t s10000 n5 '!tai64nlocal' '!gzip' /tmp/myapp 2>&1

=nc (netcat)=
==Check communication.==
listen on port 3333.
nc -kl 3333
talk to port 3333.
nc 192.168.0.1 3333

==Transfer data==
Cat file, calculate size listen on port 3333.
cat backup.iso | pv -b | nc -l 3333
Receive file.
nc 192.168.0.1 3333 | pv -b > backup.iso

==Setup telnet server==
nc -L -l -p1234 -d -e cmd.exe

==Test connection.==
nc -w2 -znv 10.1.22.31 7222

==tunnel==
On the server, we open a listener on the TCP port 6667 which will forward data to UDP port 53 of a specified IP. If you want to do DNS forwarding like me, you can take the first nameserver's IP you will find in /etc/resolv.conf - in this example, this is 192.168.1.1. But first, we need to create a fifo. The fifo is necessary to have two-way communication between the two channels. A simple shell pipe would only communicate left process' standard output to right process' standard input.

mkfifo /tmp/fifo
nc -l -p 6667 < /tmp/fifo | nc -u 192.168.1.1 53 > /tmp/fifo

==Dont eat up standard output.==
nc -v --send-only --recv-only localhost 22

==Talk to pop3 server over ssl.==
nc --ssl mail.tele2.se 995
==Talk to pop server==
nc -C mail.tele2.se 25

==Talk to web server==
URL_SSL=halfface.se ; echo -e "HEAD / HTTP/1.1\nHost: ${URL_SSL}\n\n" | nc --ssl ${URL_SSL} 443
echo -e 'GET /users/password/new HTTP/1.1\r\nHost: localhost\r\nConnection: Close\r\n\r\n' | nc localhost 80 | head
To overcome problems with nc closing connection too fast.
(echo -en 'GET / HTTP/1.1\r\nHost: 172.30.156.15\r\nConnection: close\r\n\r\n'; sleep .1) | nc 172.30.156.15 80 | head -30
nc --no-shutdown -v 172.30.156.15 80 <<<$(echo -en 'GET / HTTP/1.1\r\nHost: 172.30.156.15\r\nConnection: close\r\n\r\n')

=ncdu=
disk usage. Stay in one filesystem.
ncdu -x /
=net=
Start service via samba.
net rpc service start ipremote -I 172.17.255.99 -U 'domain/user%password'

=netstat=
Look at network connections. tcp/ip4.
netstat -4anpt
Look at multicast groups
netstat -g
What does it mean?=
ESTABLISHED
The socket has an established connection.
SYN_SENT
The socket is actively attempting to establish a connection.
SYN_RECV
A connection request has been received from the network.
FIN_WAIT1
The socket is closed, and the connection is shutting down.
FIN_WAIT2
Connection is closed, and the socket is waiting for a shutdown
from the remote end.
TIME_WAIT
The socket is waiting after close to handle packets still in the
network.
CLOSE The socket is not being used.
CLOSE_WAIT
The remote end has shut down, waiting for the socket to close.
LAST_ACK
The remote end has shut down, and the socket is closed. Waiting
for acknowledgement.
LISTEN The socket is listening for incoming connections. Such sockets
are not included in the output unless you specify the
--listening (-l) or --all (-a) option.
CLOSING
Both sockets are shut down but we still don't have all our data
sent.
UNKNOWN
The state of the socket is unknown.
==statistics==
netstat -s
netstat -s | retransmit

=nft=
nftables list config
nft -j list ruleset | jq .
=nmap=
Scan for open ssh ports.
nmap -p 22 --open -sV 10.0.0.*
nmap -p 22 -sV --open -oG - $(ip -4 a s $(ip route show default | awk '{print $5}') | grep inet | awk '{print $2}') | awk '/\/open\// {print $2,$3}'
Syn scan.
nmap -P0 -sS -p1023 www.halfface.se
Ping scan. Do not resolve.
nmap -sn -n 10.127.254.1-254
Which ciphers are allowed.
nmap --script ssl-enum-ciphers -p 465 www.halfface.se
arp scan.
nmap -PR 192.168.0.0/24
which kex_algorithms server_host_key_algorithms encryption_algorithms compression_algorithms
nmap --script ssh2-enum-algos -sV -p 22 ssh.server.inter.net
Which manufacturer.
nmap -sn 10.111.222.0/24

=nmcli=
==List connections==
nmcli con
==rename connection==
nmcli connection modify <old_name> con-name <new_name>

==manage network from cli==
http://fedoraproject.org/wiki/Networking/CLI
==Connect to a configured connection by name==
nmcli connection up WireLess
==Disconnection by name==
nmcli connection down Wireless
==Connect to remembered network.==
nmcli con up '[-_-] halfface 5'
==List available wireless networks.==
nmcli device wifi list
==Generate list of available wireless networks.==
nmcli device wifi rescan
sudo nmcli device wifi list --rescan yes

==Create connection for wireless network.==
nmcli device wifi connect Bredband password P4ssM0rd
==Connect to specific bssid==
nmcli connection modify MyWifiConnection 802-11-wireless.bssid 00:11:22:33:44:55

==List networks on specific interface.==
nmcli device wifi list ifname wlp0s18f2u4
==Disconnect network interface.==
nmcli device disconnect wlp0s18f2u4
==Manually setup interface.==
nmcli con add con-name "static-ens32" ifname ens32 type ethernet ip4 xxx.xxx.120.44/24 gw4 xxx.xxx.120.1
nmcli con mod "static-ens32" ipv4.dns "xxx.xxx.120.1,8.8.8.8"
nmcli con up "static-ens32" iface ens32
==list devices.==
nmcli device status
==list connections.==
nmcli connection show
==delete connection==
nmcli con delete "Wired connection 1"
==add connection with static ip.==
nmcli con add con-name ens224 ifname ens224 type ethernet ip4 172.30.109.16/24
==show properties for connection==
nmcli dev show ens224
==set dns server==
nmcli connection modify enp1s0 ipv4.dns "10.111.222.2,8.8.8.8"
==edit==
nmcli con edit $connection
print all
==autostart==
nmcli connection modify IFNAME connection.autoconnect yes|no
==dhcp option==
ip -4 addr show | grep -Ev "127.0.0.1|LOOPBACK" | awk '/^[0-9]+:/ {sub(/:/,"",$2); print $2}' | sort -u | while read NIC ; do echo '*' $NIC ; nmcli -f DHCP4 device show $NIC ; done

==Make network a bridge interface==
sudo nmcli con add ifname br0 type bridge con-name br0
sudo nmcli con add type bridge-slave ifname <network_card> master br0
sudo nmcli con modify br0 bridge.stp no
sudo nmcli con down "Wired connection 1"
sudo nmcli con up br0
==modify(change) vlan id==
nmcli connection modify <connection_name> vlan.id <new_id>

=nohup=
Start binary under nohup and tail log.
nohup ./run.sh & sleep 1 ; tail -1000f nohup.out
Start process and log to specified file.
nohup daemon > /path/daemon.log &

=nping=
nping -c 1 --tcp -p 80 www.halfface.se

=nth=
Name That Hash
nth --text '$y$j9T$jogs61gwDHB6L1oEwHeR00$L4cfYqkxKzS8dtkC5hPXFRMOIcEl6q5VKIkngrRGFM0'
=ntfs-3g=
mount ntfs filesystem. read and write.
yum install fuse fuse-libs ntfs-3g
mount /dev/sda1 /media/c_drive -t ntfs-3g -r -o umask=0222,locale=en_US
mount /dev/sda1 /media/c_drive -t ntfs-3g -rw -o umask=0000,locale=en_US
fstab read and write.
/dev/sda3 /media/e_drive ntfs-3g ro,defaults,umask=0222 0 0
/dev/sda1 /media/c_drive ntfs-3g rw,defaults,umask=0000 0 0
Create ntfs partition.
fdisk 7/gdisk 0700
mkfs.ntfs /dev/sdx1 -Q

=numbers=
series of numbers
bash:
echo {1..10}
=numfmt=
iec=accept optional single letter suffix. No output suffix. Remove B from input. change format of output, mb ,gb and so on.
numfmt --from=iec --to=none --suffix=B 8.7KB

=nwipe (dban)=
Wipe your disk
nwipe --nogui --nowait --autonuke /dev/sdb

=omping=
multicast ping
omping -c10 10.111.222.118 10.111.222.121
=openvpn3=
==Install openvpn fedora 38+ /etc/yum.repos.d/_copr\:copr.fedorainfracloud.org\:dsommers\:openvpn3-devsnapshots.repo==
[copr:copr.fedorainfracloud.org:dsommers:openvpn3-devsnapshots]
name=Copr repo for openvpn3-devsnapshots owned by dsommers
baseurl=https://download.copr.fedorainfracloud.org/results/dsommers/openvpn3-devsnapshots/fedora-$releasever-$basearch/
type=rpm-md
skip_if_unavailable=True
gpgcheck=1
gpgkey=https://download.copr.fedorainfracloud.org/results/dsommers/openvpn3-devsnapshots/pubkey.gpg
repo_gpgcheck=0
enabled=1
enabled_metadata=1
==Install package from above.==
dnf install openvpn3-client
==Add configuration==
OPENVPN_CONFIG=<name> ; openvpn3 config-import --name "$OPENVPN_CONFIG" --persistent --config "$OPENVPN_CONFIG".ovpn
==List configs==
openvpn3 configs-list
openvpn3 configs-list --verbose

==Remove config==
openvpn3 config-remove --config <config-name>
==show full config==
openvpn3 config-dump --config <config-name>

==Connect==
openvpn3 session-start --config <config-name>
==Disconnect==
openvpn3 session-manage --config <config-name> --disconnect
==Connect to the log with debug enabled. This can be run in a different terminal window after the connection has been started.==
openvpn3 log --config <config-name> --log-level 6
==Show active sessions==
openvpn3 sessions-list
==Show statistics for an active session==
openvpn3 session-stats --config <config-name>
==Show configuration settings==
openvpn3 config-manage --config <config-name> --show
==sessions disconnect==
openvpn3 sessions-list | grep Path | awk '{print $2}' | while read OPENVPN_PATH ; do echo $OPENVPN_PATH ; openvpn3 session-manage --session-path $OPENVPN_PATH --disconnect ; done
==View config files==
sudo find /var/lib/openvpn3/configs/ -type f

=openssl=
==Grab the public key.==
openssl s_client -connect www.halfface.se:443 </dev/null 2>/dev/null | sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p'
==What does the ssl cert look like.==
HOST=www.halfface.se ; PORT=443 ; echo | openssl s_client -connect ${HOST}:${PORT} -servername ${HOST}| openssl x509 -ext subjectAltName -noout -startdate -enddate -subject -issuer -nameopt RFC2253,sep_comma_plus_space

==What does crl look like. (Certificate Revocation List)==
openssl crl -inform PEM -text -noout -in crl.pem

==Connect to ssl server==
echo hello | openssl s_client -connect www.halfface.se:8140
==Connect to ssl server -cipher NULL,LOW==
echo hello | openssl s_client -connect www.halfface.se:8140
==Connect with openssl v3==
openssl s_client -ssl3 -connect ipmon01.dupont:443
==Connect with low security cipher==
echo X | openssl s_client -cipher NULL,LOW -connect www.halfface.se:8140
==PEM convert to DER==
openssl x509 -inform PEM -in /file.pem -outform DER file.der
==p12 to cer==
openssl pkcs12 -in infile.p12 -out outfile.cer -nodes
Export public
openssl pkcs12 -in path.p12 -out newfile.crt.pem -clcerts -nokeys -passin pass:<password>
export CERT=<cert>.p12 ; export PASS=<pass> ; openssl pkcs12 -in $CERT -out ${CERT}.pem -clcerts -nokeys -passin pass:${PASS}
Export private
openssl pkcs12 -in path.p12 -out newfile.key.pem -nocerts -nodes -passin pass:<password>
export CERT=<cert>.p12 ; export PASS=<pass> ; openssl pkcs12 -in $CERT -out ${CERT}.key -clcerts -nodes -passin pass:${PASS}
==p7b to pem==
openssl pkcs7 -print_certs -in <certificate>.p7b -out certificate.pem
==pem to p12==
Using file containing private, public and chain.
openssl pkcs12 -export -in sulzer.pem -out sulzer.p12 -passout pass:

==pfx to pem==
env FILE="<file>" PASSWORD="<password>" bash -c 'openssl pkcs12 -in "$FILE" -out "${FILE//\//_}.pem" -nodes -password pass:"$PASSWORD"'
Complete file.
openssl pkcs12 -in filename.pfx -out cert.pem -nodes
Get private cert. Then remove password. Decrypt
openssl pkcs12 -in filename.pfx -nocerts -out key.pem
openssl rsa -in key.pem -out server.key
Get public cert.
openssl pkcs12 -in filename.pfx -clcerts -nokeys -out cert.pem

==Extract p12 password protected keys in==
openssl pkcs12 -in /file.p12 -passin file:/password -nokey -nodes -out /file.nokeys
openssl pkcs12 -info -in </path/to/file.pfx> -passin pass:<pfx's password>

==Encrypt file==
openssl aes-256-cbc -a -salt -in file -out file,encoded -passin file:passfile
==Decrypte file==
openssl aes-256-cbc -d -a -salt -in file -out file,encoded -passin file:passfile
==Install new root ca==
# Change to the directory:
cd /etc/pki/tls/certs
# Next download the College root certificate:
wget https://icca2.ic.ac.uk/certenroll/ic-root.crt
# Convert the certificate to PEM format:
openssl x509 -inform der -in ic-root.crt -out ic-root.pem
# Create a link with the certificate hash:
ln -s ic-root.pem `openssl x509 -hash -noout -in ic-root.pem`.0
# Create sha256 base64 encoded hash
openssl dgst -binary -sha256 | openssl base64
# Verify root ca.
openssl verify -CApath /etc/pki/tls/certs ic-inter-root.pem
icrootca.cer: OK
The server certificate is the first certificate returned, and will be PEM formatted. The CA certificate is the final certificate returned, and is also PEM formatted.
openssl': echo | openssl s_client -connect www.sslsite.com:443 -showcerts
Check ca store files.
find . -name '*.pem' | while read PEM ; do echo '###' ${PEM} '###';ls -la "${PEM}" ; set -x ; curl --cacert "${PEM}" https://site.test.net/index.htm.
==Verify pop3 connectivity.==
openssl s_client -crlf -connect mail.tele2.se:110 -starttls pop3
USER yiming
PASS foobar
LIST – lists the messages available in the user’s account, returning a status message and list with each row containing a message number and the size of that message in bytes
STAT – returns a status message, the number of messages in the mailbox, and the size of the mailbox in bytes
RETR [message_num] – returns the message identified by the message number, which is the same as the message number shown in the LIST command output
TOP [message_num] [n] – returns the top n lines of the message denoted by message number.
QUIT command will end the session.
==Create wildcard self signed certificate.==
openssl req -x509 -nodes -days 3650 -newkey rsa:2048 -keyout wildcard.test.internal.zone.key -out wildcard.test.internal.zone.crt
Common Name (eg, your name or your server's hostname) []:*.test.internal.zone
==Verify certificate chain==
openssl verify -CAfile Thawte_Primary_Root_CA.pem -untrusted thawte_SSL_CA_G2.cer www.halfface.se.pem
Look at certificate chain.
openssl s_client -connect www.halfface.se:443
CONNECTED(00000003)
depth=2 O = Digital Signature Trust Co., CN = DST Root CA X3
verify return:1
depth=1 C = US, O = Let's Encrypt, CN = Let's Encrypt Authority X3
verify return:1
depth=0 CN = www.halfface.se
verify return:1
---
Certificate chain
0 s:CN = www.halfface.se
i:C = US, O = Let's Encrypt, CN = Let's Encrypt Authority X3
1 s:C = US, O = Let's Encrypt, CN = Let's Encrypt Authority X3
i:O = Digital Signature Trust Co., CN = DST Root CA X3
---
Verify chain.
openssl s_client -showcerts -verify 5 -connect www.halfface.se:443 < /dev/null 2>&1

==Connect to smtp server via ssl.==
openssl s_client -crlf -ign_eof -connect www.halfface.se:25 -starttls smtp -quiet
EHLO halfface.se
AUTH LOGIN
$(echo -n "username" | base64)
$(echo -n "password" | base64)
MAIL FROM:anden@halfface.se
RCPT TO:<anden@halfface.se>
DATA
Subject: Test from cli.

This is a test email.
.
QUIT

==Connect to imap==
openssl s_client -crlf -connect www.halfface.se:993
openssl s_client -showcerts -connect www.halfface.se:143 -starttls imap
Login
tag login abjorklund ${PASSWORD}
List mailboxes
tag LIST "" "*"
Log out
tag LOGOUT

==compare two certifactes==
Compare the use case for the certificate.
sdiff <(openssl x509 -in server.crt -noout -issuer -subject -enddate -purpose) <(openssl x509 -in uc_activemq.crt -noout -issuer -subject -enddate -purpose)| less
==create a csr==
openssl req -new -sha256 -nodes -out www.halfface.se.csr -newkey rsa:2048 -keyout www.halfface.se.key -config <(
cat <<-EOF
[req]
default_bits = 2048
prompt = no
default_md = sha256
req_extensions = req_ext
distinguished_name = dn
[ dn ]
O=Organisation: halfface
C=SE
ST=Stockholm
L=Stockholm
CN = www.halfface.se
[ req_ext ]
subjectAltName = @alt_names
[ alt_names ]
DNS.1 = halfface.se
DNS.2 = ldap.halfface.se
DNS.3 = mqtt.halfface.se
EOF
)

==csr information==
openssl req -noout -text -in file.csr | grep -vE ' [0-9A-Fa-f]{2}:[0-9A-Fa-f]{2}:'

==look at content of private key==
openssl rsa -text -noout -in key.pem

==confirm that public private and csr match==
# For your SSL certificate:
CERT_PUBLIC=$(ls *.crt)
echo $(openssl x509 -noout -modulus -in "${CERT_PUBLIC}" | openssl md5 | awk '{print $2}'),"${CERT_PUBLIC}",public cert.
# For your RSA private key:
CERT_PRIVATE=$(ls *.key)
echo $(openssl rsa -noout -modulus -in "${CERT_PRIVATE}" | openssl md5 | awk '{print $2}'),"${CERT_PRIVATE}",private key
# For your CSR:
CERT_CSR=$(ls *.csr)
echo $(openssl req -noout -modulus -in "${CERT_CSR}" | openssl md5 | awk '{print $2}'),"${CERT_CSR}",certificate signing request

==connect with ca private and public key==
openssl s_client -CAfile ca.pem -cert public.crt -key private.key -connect 10.12.118.184:1023 -tls1_2
==create a ca==
===Create ca and certificates.===
# Create folder structure.
mkdir /root/ca/
mkdir /root/ca/certs/
mkdir /root/ca/crl/
mkdir /root/ca/newcerts/
mkdir /root/ca/private/
mkdir /root/ca/requests/
touch /root/ca/index.txt
echo 1000 > /root/ca/serial
chmod 600 /root/ca
# Create private key for the CA certificate. pass phrase: $(pwgen 15)
cd /root/ca/
openssl genrsa -aes256 -out private/cakey.pem 4096
# Create a public certificate for the CA.
openssl req -new -x509 -key /root/ca/private/cakey.pem -out cacert.pem -days 36525

Country Name (2 letter code) [AU]:SE
State or Province Name (full name) [Some-State]:Stockholm
Locality Name (eg, city) []:Stockholm
Organization Name (eg, company) [Internet Widgits Pty Ltd]:Company
Organizational Unit Name (eg, section) []:Company
Common Name (e.g. server FQDN or YOUR name) []:Certificate Authority
Email Address []:anden@halfface.se

# Copy system openssl.cnf to /root/ca dir. Then change dir in config.
vim openssl.cnf
[ CA_default ]
dir = /root/ca # Where everything is kept

===Create signed certificate keypair===
cd requests/
# Create csr
openssl req -new -newkey rsa:2048 -nodes -keyout <client>.key -out <client>.csr -config ../openssl.cnf
# Issue certificate for csr.
openssl ca -in <client>.csr -out <client>.crt -config ../openssl.cnf -days 36525

==talk http via openssl==
openssl s_client -crlf -quiet -connect www.halfface.se:443 <<EOF
GET / HTTP/2.0
Host: www.halfface.se

EOF

==look at cert==
openssl asn1parse -in rb-ca.crt.2021-02-28
==performance testing==
openssl speed -evp aes-256-ecb
==confirm that ca is correct==
echo | openssl s_client -CAfile Sectigo_RSA_Domain_Validation_Secure_Server_CA.pem -no-CAfile -no-CApath -tls1_2 -connect 172.30.32.141:5044 2>&1 | grep Verification
Verification: OK
==openssl s_server==
Setup server listening as http server.
openssl s_server -status_verbose -HTTP -cert host.inter.net.crt -key host.inter.net.key
Setup https server listening on https on port 4433 providing complete chain
openssl s_server -status_verbose -HTTP -cert halfface.se.pem -cert_chain halfface.se.intermediate.pem -key halfface.se.key -accept 4433

==othername:<unsupported>==
You will have to locate the "OCTET STRING" line just below the "OBJECT :X509v3 Subject Alternative Name" line then strpars
# print section offset via
openssl asn1parse -in yourcert.pem
# parse otherName from "OCTET STRING" <offset> is the value in the beginning of the line.
openssl asn1parse -in yourcert.pem -strparse <offset>
Another way of seeing same data is through
openssl asn1parse -in /tmp/tmp -dump -strictpem

=create password string=
openssl passwd -6 -salt $RANDOM $PASSWORD

=pactl=
Pulse Audio cli tool.
List output devices.
pactl list short sinks
Set default output device
pactl set-default-sink $i
List where applications send output.
pactl list short sink-inputs
Move application to other output device.
pactl move-sink-input $applicaiton $sink

=pam=
Troubleshooting pam.
/etc/syslog.conf
# Get debugging data.
*.debug /var/log/debug.log
Create logfile and restart *syslog.
touch /var/log/debug.log
service syslog restart
Put pam in debug mode.
touch /etc/pam_debug
OR you can enable debugging only for the modules you're interested in by adding "debug" to the end of the relevant lines in /etc/pam.d/system-auth or the other /etc/pam.d/* files:
login auth required pam_unix.so debug
Debugging is found in /var/log/debug.log.

=pam_tally2=
Configured here.
/etc/pam.d/password-auth:auth required pam_tally2.so file=/var/log/tallylog onerr=fail per_user deny=6 no_magic_root
What is status from account?
pam_tally2 --user=user1
Login Failures Latest failure From
user1 8 04/20/15 11:39:54 192.168.1.1

=parallel=
Run command 10 times in parallel.
seq 10 | parallel -n0 echo "Hello, World"
Run command 10 times in parallel dryrun.
seq 10 | parallel --dry-run -n0 echo "Hello, World"
Compress logfiles in parallel.
parallel gzip ::: *.log
=partprobe=
Rescan block device to setup device files
partprobe /dev/sde
=partx=
partx /dev/sda -l ; partx /dev/sda -u ; partx /dev/sda -l

=paste=
Combine to files to one in multiple column. Replace tab with spaces.
paste /tmp/check_name_nagios /tmp/filename | column -t -s $'\t'
Combine every second line with a space in between.
paste -d' ' - -

=pcregrep=
Multiline grep
pcregrep -M 'pattern: line1\nPattern lin2' /temp/files_*
=pdftotext=
grab text from pdf document.
pdftotext document.pdf
=pdftk=
Rotate clockwise
PDF=<file.pdf> ; pdftk "${PDF}" cat 1-endwest output "${PDF}".rotate
Rotate counter clockwise
PDF=<file.pdf> ; pdftk "${PDF}" cat 1-endeast output "${PDF}".rotate
Create one pdf from others.
pdftk <file.pdf>* cat output <file_combo.pdf>
Extract one page from pdf.
pdftk input.pdf cat 11 output page11.pdf
Extract series of pages from pdf
pdftk input.pdf cat 3-7 output pages_3-7.pdf

=pidof=
which pids has a program stared. Find pid.

=ping=
Ping ipv6 loopback
ping6 ::1 -c1
Ping ipv6 broadcast
ping6 ff02::1%2 | cut -d\ -f4
Ping short output
export ADDRESS=2001:4860:4860::8888 ; PING=$(ping6 -w1 -q -c1 -i10 ${ADDRESS} 2>&1) ; RTT=$( grep rtt <<<"${PING}" | awk -F/ '{print $6}') ; RECEIVED=$(grep received <<<"${PING}") ; echo $ADDRESS $RECEIVED, rtt=${RTT}
Ping to discover mtu. 1460, 1450. When reply increase with 2. when found highest value increase with 28 to get mtu.
ping -M do -s 1472 123.45.56.78

=pip=
==which versions of django exist==
pip install pylibmc
==which versions are installed==
pip list

==which files does pip package provide.==
pip show -f $package
==Uppgrade package.==
pip install $package --upgrade
==where your own packages might end up==
/usr/local/lib/python3.9
/usr/lib/python2.7/site-packages/
==upgrade pip==
ls -la /usr/lib64/libldap_r.so /usr/lib64/libldap.so
==do not use cache==
pip3 install -r requirements.txt --no-cache-dir

=pgrep=
Grep any processlines including 1066
pgrep -lf 1066
=pmap=
Look at memory usage of process.
sudo pmap 2258

=postfix=
remove mails in queue.
mailq | grep ^[A-F0-9] | awk '{print $1}' | postsuper -d -
list mails in queue
mailq | grep "^[A-F0-9]"
Get mails in better output to better decide what to do with mails.
mailq | grep -v -- "-Queue ID-" | sed 's/^$/\x0/g' | tr -d '\n' | sed 's/\x0/\n/g'
Remove stuck emails.
postsuper -d ALL deferred
List email
postcat -q E55692442F
Read mail
postcat -vq [message-id]

=pr=
Print two files between each other.
pr -w200 -m -t /tmp/1 /tmp/2
=printf=
Convert octal to utf-8
printf '\360\237\222\200'
decimal to integral
printf "%.0f" <decimal>

=printscreen=
import -window root test.png
Gnome copy graphics to paste buffer. Copy selected portion of screen.
gnome-screenshot -a

=/proc=
*/proc/meminfo
MemTotal — Total amount of physical RAM, in kilobytes.

MemFree — The amount of physical RAM, in kilobytes, left unused by the system.

Buffers — The amount of physical RAM, in kilobytes, used for file buffers.

Cached — The amount of physical RAM, in kilobytes, used as cache memory.

SwapCached — The amount of swap, in kilobytes, used as cache memory.

Active — The total amount of buffer or page cache memory, in kilobytes, that is in active use. This is memory that has been recently used and is usually not reclaimed for other purposes.

Inactive — The total amount of buffer or page cache memory, in kilobytes, that are free and available. This is memory that has not been recently used and can be reclaimed for other purposes.

HighTotal and HighFree — The total and free amount of memory, in kilobytes, that is not directly mapped into kernel space. The HighTotal value can vary based on the type of kernel used.

LowTotal and LowFree — The total and free amount of memory, in kilobytes, that is directly mapped into kernel space. The LowTotal value can vary based on the type of kernel used.

SwapTotal — The total amount of swap available, in kilobytes.

SwapFree — The total amount of swap free, in kilobytes.

Dirty — The total amount of memory, in kilobytes, waiting to be written back to the disk.

Writeback — The total amount of memory, in kilobytes, actively being written back to the disk.

Mapped — The total amount of memory, in kilobytes, which have been used to map devices, files, or libraries using the mmap command.

Slab — The total amount of memory, in kilobytes, used by the kernel to cache data structures for its own use.

Committed_AS — The total amount of memory, in kilobytes, estimated to complete the workload. This value represents the worst case scenario value, and also includes swap memory.

PageTables — The total amount of memory, in kilobytes, dedicated to the lowest page table level.

VMallocTotal — The total amount of memory, in kilobytes, of total allocated virtual address space.

VMallocUsed — The total amount of memory, in kilobytes, of used virtual address space.

VMallocChunk — The largest contiguous block of memory, in kilobytes, of available virtual address space.

HugePages_Total — The total number of hugepages for the system. The number is derived by dividing Hugepagesize by the megabytes set aside for hugepages specified in /proc/sys/vm/hugetlb_pool. This statistic only appears on the x86, Itanium, and AMD64 architectures.

HugePages_Free — The total number of hugepages available for the system. This statistic only appears on the x86, Itanium, and AMD64 architectures.

Hugepagesize — The size for each hugepages unit in kilobytes. By default, the value is 4096 KB on uniprocessor kernels for 32 bit architectures. For SMP, hugemem kernels, and AMD64, the default is 2048 KB. For Itanium architectures, the default is 262144 KB. This statistic only appears on the x86, Itanium, and AMD64 architectures.

=ps=
==Process list in tree view.==
ps axfww
==Process sort by cpu usage.==
ps auxwww --sort -%cpu | head
==How long has process been running.==
ps -p 1 -o etime=
==Process list sorted after memory usage.==
ps aux --sort=size
==Process show memory usage... sort...==
ps axo rss,%cpu,pid,euser,cmd | sort -nr | head -n 10 | less -ISRM
==Process sort by mem usage.==
ps auxwww --sort -rss | head
==Processes sorted by time running.==
ps aux --sort -time
==Processes sorted by time started==
ps -auxwww --sort=start_time
==ps showing threads.==
ps -efL
==How long has process been running.==
echo -n $(( ($(date +%s) - $( stat -c%X /proc/$(pgrep -f [a]ctivemq.jar))) / 3600 ))
==ps long usernames==
ps axo user:20,pid,pcpu,pmem,vsz,rss,tty,stat,start,time,comm
==ps including nice==
ps -eo pid,user,ni,comm

=pstack=
print a stack trace of a running process

=pulseaudio=
# Is pulseaudio running?
ps uxawww| grep -E pulseaudi[o]
# stop pulseaudio
pulseaudio -k
# start pulseaudio as found by ps | grep pulseaudio
/usr/bin/pulseaudio --start --log-target=syslog

=putty=
Run putty from cli with login
"C:\Program Files\PuTTY\putty.exe" -l <username> -pw <password> <host_url>
Always setup stay alive.
connection -> keepalive -> 60
set up tunnel
putty -load blt.homeip.net -l bjorklun -pw password -L 19242:192.168.0.42:3389 blt.homeip.net
putty without taking tty.
plink -load www.halfface.se -l user_name -pw password -R *:3389:localhost:3389 -2 -4 -N
reverse tunnel. Connect remote host 3400 to machine running putty localhost:3389.
connection -> ssh -> tunnels -> "Source Port" = 3400 -> destination = localhost:3389 -> remote.
socks server.
connection -> ssh -> tunnels -> Source port: 3128 , Destination: localhost:3128, Dynamic:true -> add -> apply.
Change font size
echo Windows Registry Editor Version 5.00 > putty.reg && echo [HKEY_CURRENT_USER\Software\SimonTatham\PuTTY\Sessions\Default%20Settings] >> putty.reg && echo "Font"="Courier New" >> putty.reg && echo "FontHeight"="12" >> putty.reg && reg import putty.reg

=pv=
throughput in pipe. speed.
pv
pv -cN
make a dd and limit througput to 20MB/s.
dd if=${HOST}.qcow2 bs=4k conv=noerror,sync | pv -L 20M | dd of=${HOST}.dd_noerror.qcow2
=pwgen=
Create less complicated password.
pwgen -sy 15 -r \'\"\^\`\~\;\[\]\{\}\,

=qalculate=
qalc
> 40 euro to SEK
40 * euro = approx. SEK 417.36
=readpst=
output pst file in separate files in out directory
readpst -S -o out/ outlook.pst
=reboot=
Hard reboot mean that shutdown scripts will not run and machine reboot immediately without syncing hard disk drives.
This commands enable sysrq and after this call fast reboot.
echo 1 > /proc/sys/kernel/sysrq
echo b > /proc/sysrq-trigger
Force shutdown
echo 1 > /proc/sys/kernel/sysrq
echo o > /proc/sysrq-trigger
Kernel panic
echo c > /proc/sysrq-trigger
==List last reboots==
last --time-format iso reboot

=rename=
Recursive lowercase to uppercase
for i in $(find * -depth); do (mv $i $(echo $i | sed 's%[^/][^/]*$%%')$(echo $i | sed 's!.*/!!' | tr [:upper:] [:lower:])); done
Upper to lower case
for f in `find .`; do mv -v "$f" "`echo $f | tr '[A-Z]' '[a-z]'`"; done

=reposync=
reposync -n -c /etc/yum/yum.conf -p /repos/centos6 -d -r base -r updates -r extras -r centosplus -r contrib
createrepo -g /repos/centos6/base/repodata/comps.xml /repos/centos6/base
createrepo /repos/centos6/updates
createrepo /repos/centos6/extras
createrepo /repos/centos6/centosplus
halfface -> sync repo. -d delete what is not on remote, -n only newest version, -p store here, -r which repos to sync
reposync -d -n -p /install/system/linux/fedora/24/repo/ -r updates -r fedora -r rpmfusion-free -r rpmfusion-free-updates -r rpmfusion-nonfree -r rpmfusion-nonfree-updates
halfface -> create repository
REPODIR=/install/system/linux/fedora/24/repo ; for REPO in $(cd $REPODIR; ls) ; do echo $REPO ; createrepo_c ${REPODIR}/${REPO} ;done
=reptyr=
Reparent a running program to a new terminal. (move tty)

=rfcomm=
list usb devices
hcitool scan
What properties does the device have.
sdptool browse 00:0D:B5:30:07:79
connect bluetooth device virtual servial.
rfcomm bind /dev/rfcomm0 00:0D:B5:30:07:79 1
=rkhunter=
Run rkhunter full scan no keypresses needed
sudo rkhunter --checkall --skip-keypress -x
Update database
sudo rkhunter --propupd
Search for what triggered alarm.
sudo grep -E 'Warning|Suspicious' /var/log/rkhunter/rkhunter.log

=dnf update rkhunter. Update dnf after rkhunter scan=
tail -1 /etc/sysconfig/rkhunter
sleep 300 && ( dnf -e 0 -y update ; rkhunter --propupd ) >> /tmp/dnf_update_rkhunter--propupd.$(date +%F_%H-%M-%S).log 2>&1 &

=rotatelogs=
Write standard output to logfile. Rotate at 100M. Keep 3 files.
your_script.sh | rotatelogs -n3 /var/log/your.log 100M
=route=
The route to a network is behind 10.111.222.7
route add -net 10.111.223.0 netmask 255.255.255.0 gw 10.111.222.7
Add default route
route add default gw 192.168.122.1
Permanent route under redhat
/etc/sysconfig/static-routes
any net 198.18.129.0/24 gw 10.240.175.12
/etc/sysconfig/network-scripts/route-eth1
1.2.3.4/23 via 1.2.3.1
Drop packages to ip.
route add -host 192.168.1.51 reject
Remove reject rule.
route del -host 192.168.1.51 reject
Remove route
route -n
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
192.168.122.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0
169.254.0.0 0.0.0.0 255.255.0.0 U 1002 0 0 eth0
10.0.0.0 0.0.0.0 255.0.0.0 U 0 0 0 eth0
0.0.0.0 192.168.122.1 0.0.0.0 UG 0 0 0 eth0
route del -net 10.0.0.0 gw 0.0.0.0 netmask 255.0.0.0 dev eth0

=rpm=
==install src.rpm==
rpmbuild --rebuild alien-6.51-1.src.rpm
rpm -i /usr/src/redhat/RPMS/x86_64/alien-6.51-1.rpm
==List contents of rpm.==
rpm -qlp myfile.rpm
==Extract single file from rpm.==
rpm2cpio package.rpm | cpio -idv ./search_path_to_file_from_listing_above.txt
==List information about non installed rpm.==
rpm -qip foo.rpm
==Extract contents of rpm.==
rpm2cpio *.rpm | cpio -i --make-directories
==Which version of rpm is installed.==
/etc/rpm/macros ~/.rpmmacros
%_query_all_fmt %%{name}-%%{version}-%%{release}.%%{arch}
==list architecture==
rpm -qa --qf "%{n}-%{v}-%{r}.%{arch}\n"
==List only name of installed rpms.==
rpm -qa --qf "%{NAME}\n"
==Extract rpms in subdirectories.==
for RPM in $(ls *|sed 's_\.rpm$__g');do echo $RPM; mkdir $RPM; rpm2cpio $RPM.rpm | (cd $RPM && cpio -i --make-directories);done
==Verify content of rpm==
rpm -V package
# What does those cryptic letters mean from rpm -V:
S file Size differs
M Mode differs (includes permissions and file type)
5 MD5 sum differs
D Device major/minor number mismatch
L readlink(2) path mismatch
U User ownership differs
G Group ownership differs
T mTime differs
==Reinstall rpm==
rpm -iv --replacepkgs package.rpm
==Dependencies of rpm==
rpm -qpR ${rpm}
rpm -qR ${packagename}
rpm -qp mypackage.rpm --provides
rpm -qp mypackage.rpm --requires
==Rebuild rpm database.==
\rm /var/lib/rpm/__db*
rpm --rebuilddb

==Update minor release.==
yum --releasever=6.11 update sl-release
yum clean all
yum update
==Downgrade rpm.==
rpm -Uvh --oldpackage /tmp/app.x86_64.rpm
==Which rpm:s are required by rpm. Can be used to install rpm on machine without access to yum repo.==
PKG=openssh-server ; yum install --downloadonly --installroot=/tmp/$PKG-installroot --releasever=7 --downloaddir=/tmp/$PKG $PKG
==CVE:s fixed by rpm==
rpm -qi --changelog openssh-server | grep -i CVE

=rsync=
Syncronize folders. Delete non existing files on remote host. Compress.
rsync --delete -az -e ssh bjorklun@semco.homeip.net:/install/program/windows/
Syncronize files over ssh on port 2222. Show progress. Syncronize even empty directories.
rsync -Pae 'ssh -p 2222' localhost:/opt/techops/bin/ /opt/techops/bin/
rsync with total progress bar.
rsync -a --info=progress2 /dir1/ /dir2/
Run rsync in both ends but transfer data with normal user.
sudo rsync -aP /tmp/andreas/ andreasbj@localhost:/tmp/andreas2/ --rsync-path='sudo rsync'
rsync with limit of 8 MB/s.
rsync -aP --bwlimit=8000 /source/ /destination/
rsync excluding directory
rsync -r --exclude=.svn /source/ /destination/
rsync including selinux information. Preserve hard links.
rsync -aPXH /source /destination
rsync don't keep links. Copy files referenced.
rsync -rLP /source/ /destination
Record which files to sync.
rsync -r -ptgo --delete -P --size-only -n www.halfface.se:/mp3/ /mp3/ -n | tee /temp/mp3_$(date +%Y-%m-%d)_diff.txt
Rsync new files.
rsync -RDa0P --files-from=<(find /sourcedir -mtime -7 -print0) . /targetdir/
rsync ignore existing files.
rsync -P --ignore-existing /source/* /destination/ -n
rsync excluding directories matching pattern.
SOURCE=/apps/IP400 ; DESTINATION=/apps/IP400.$(date '+%Y-%m-%d_%H-%M-%S') ; rsync -aP "${SOURCE}"/ "${DESTINATION}"/ --exclude-from=<(cd "${SOURCE}" ; find -type d -name log | sed -e 's|./||')
Sync files partially.
rsync -avz --partial --inplace
which files differ between hosts.
rsync -nrlptDqv --delete --exclude napsjb/server/naps/tmp/ /opt/ongame/ 10.6.21.11:/opt/ongame | less
-n dry run.
-r recursive
-l copy symlinks av symlinks.
-p preserve permission
-t preserve tims.
-D --device --special. Keep special files.
-q quiet
-v verbose

=sar=
Old sar information.
sar -f /var/log/sa/sa25 -s 00:00:00 -e 23:59:00
load average.
sar -q -f /var/log/sa/sa25 -s 00:00:00 -e 23:59:00
All information.
sar -A -f /var/log/sa/sa25 -s 00:00:00 -e 23:59:00
View network statistics.
LANG=c sar -n DEV | grep eth0
realtime summary.
sar 4 5
=script=
Run command under shell even if it does not exist.
script -q -f -c "commands or scripts to run"
Run session under screen in script.
screen -dm bash -c 'script --timing=script1.tm script1.out'
Replay script recorded file
scriptreplay --timing script1.tm --typescript script1.out
=scp=
Limit to 1.2MB/s.
scp -l 10240 Rocky-8.5-x86_64-minimal.iso halfface.se:/temp/

=search&replace=
perl
grep -rsl '10.6.4.102' * | xargs perl -pi -e 's/10.6.4.102/10.6.4.103/'
sed
find . -type f -exec sed -i 's/string1/string2/g' {} \;
Grep for regexp starting with CN= and stop at first occurrence of ,. not greedy
grep -oE 'CN=[^,]*,'
=set=
Look at current settings. Expanded or simple view.
set -o
echo $-

=setfacl=
Add rwx permission for user_name recursivly from /directory
setfacl -Rm u:user_name:rwx /directory
Remove acl:s
setfacl -bn foobar
=setpriv=
Dump your privileges.
setpriv -d

=shred=
Recurse remove dir
find /tmp/secret -type f -exec shred {} \;

=shuf=
Pick random line in file.
shuf -n1 /file
Get random number
shuf -i 10-120 -n1

=sms=
Mail to sms gateway.
tele2
07XXXXXXXX@sms.tele2.se

Comviq
467xxxxxxxx@sms.comviq.se

Europolitan
4670xxxxxxx@europolitan.se

=snmptrap=
# send more than one string.
snmptrap -v 2c -Ci -u user -c community localhost "" .1.3.6.1.4.1.5089.1.0.1 1 s "This is the first string" 2 s "This is the second string"
snmptrap -v 2c -Ci -u user -c community localhost '' .1.3.6.1.4.1.5089.1.0.1 1 s "This is the first string" 2 s "This is the second string"
snmptrap -v 2c -c xxxxxxx localhost '' .1.3.6.1.4.1.5089.1.0.1 .1.3.6.1.4.1.5089.2.0.999 s "Hej Hej"
Simple trap
snmptrap -v 1 -c public localhost '' 0 0 ''

=snmptrapd=
# Enable logfile. /etc/sysconfig/snmptrapd
OPTIONS="-Lf /var/log/snmptrapd.log"
# Disable authorization and put in logfile. /etc/snmp/snmptrapd.conf
disableAuthorization yes
authCommunity log public

=snmpwalk=
Get information from an oid.
snmpwalk -v 1 -c public snmp.device.net .1.3.6.1.4.1.2021.84
Do tcpdump while running.
tcpdump -i eth0 -n -s0 -v host snmp.device.net and port snmp
=socat=
Create a tunnel between localhost 2222 to remote host 2222
socat TCP-LISTEN:2222,fork TCP:10.111.222.2:2222
socat TCP-LISTEN:22,fork,bind=127.0.0.1 TCP:192.168.0.15:5900
socat TCP-LISTEN:2222,fork TCP:10.8.110.20:22,bind=172.19.14.251
Listen on 10.120.50.12:9090 and forward to 127.0.0.1:9090
socat TCP-LISTEN:9090,bind=10.120.50.12,fork TCP:127.0.0.1:9090
Create tunnel via systemctl
Create file similar to this. /etc/systemd/system/socat_win.service
[Service]
ExecStart=/usr/bin/socat TCP-LISTEN:3389,fork TCP:192.168.122.204:3389
[Install]
WantedBy=multi-user.target
Enable new file.
systemctl daemon-reload
Start new daemon
systemctl start socat_win

=sort=
Sort ip address.
sort -t. +0n -1 +1n -2 +2n -3 +3n -4
sort -t . -k 1,1n -k 2,2n -k 3,3n -k 4,4n
sort on fift column
sort -t, -k5n,5 /tmp/gfp
Get a list of configured ip for a set of hosts. Sort on domain then hostname
pdsh ^/host_list 'ip route get 8.8.8.8 | awk "NR==1 {print \$NF}"' | sort -t . -k 2 -k 1
Sort on first column only.
sort -n -k 1,1

=spawn=
Encode wav to ogg in parallel.
# ls -1 *.wav | while read ; do echo "oggenc -q6 \"$REPLY\"" ; done | spawn -j4
=split=
Devide file into parts containing 100 lines.
split -l 100 create_updated_2013-10-29_sort_created_ci_id_name.txt --numeric-suffixes --suffix-length=3 Cleanup.
Devide file in 10 parts. Suffix length 4.
split -n 10 -a 3 bigfile.tar.gz

=sqlite=
Is db broken?
sqlite3 mydata.db "PRAGMA integrity_check"
recover db
sqlite3 mydata.db ".dump" | sqlite3 new.db
sqlite3 stellar.db .recover | sqlite3 stellar_2.db
Show databases
sqlite> .databases
main: /var/lib/tuptime/tuptime.db
List tables
sqlite> .tables
tuptime
Run sql command
sqlite> select * from tuptime;
1544984636|2387765.42|-1|0|0.0|Linux-4.19.8-200.fc28.x86_64-x86_64-with-fedora-28-Twenty_Eight
exit|quit
.quit
==vacuum==
/usr/local/openvpn_as/bin/sqlite3 /usr/local/openvpn_as/etc/db/log.db "VACUUM"
==count tables==
DB=files.db ; for TABLE in $( sqlite3 $DB ".tables") ; do echo -e $TABLE\\t$(sqlite3 $DB "SELECT COUNT(1) FROM $TABLE;") ; done | column_tab

=ss=
List all connections.
ss -an
List processes and which port they listen too. Grep process.
ss -tulpn | grep 5405

=ssh=
==ssh-keygen==
Create key pair without input.
<pre>
KEYNAME=cluster-info-reporting ; KEYNAME_PATH=/tmp/${KEYNAME}-$(date '+%Y-%m-%d_%H-%M-%S') ; ssh-keygen -q -t ed25519 -N '' -C $KEYNAME <<< $'\ny' >/dev/null 2>&1 -f "${KEYNAME_PATH}" ; echo Keys: $(ls "${KEYNAME_PATH}"*)
</pre>

==which private ssh keys are password protected==
ls ${HOME}/.ssh/* | grep -Ev 'pub$|authorized_keys|config|known_hosts|ssh-agent.sock' | while read i ; do SSH_PASSWORD=$(ssh-keygen -y -P "" -f "$i" 2>&1 | grep "incorrect passphrase supplied to decrypt private key") ; if [ -z "${SSH_PASSWORD}" ] ; then echo No password encrypted ssh private key: $i ; fi ; done

==Remove pass phrase==
ssh-keygen -p [-P old_passphrase] [-N new_passphrase] [-f keyfile]

==view fingerprint==
ssh-keygen -l -E md5 -f /tmp/ssh-keygen.pub

==change the name of private key==
ssh-keygen -c -C "first.lastname@example.com" -f ~/.ssh/id_ed25519

==Copy public key to authorized_keys==
ssh-copy-id user@host
List supported ciphers
ssh -Q cipher
List supported MACs
ssh -Q mac
List supported public key type
ssh -Q key
List supported key exchange algorithms
ssh -Q kex
List supported ciphers, macs and kexalgorithms.
sshd -T | grep "$ciphers\|macs\|kexalgorithms$"
Run command each time you login via ssh.
$HOME/.ssh/rc

==Tunnel==
sudo ssh -nNTx -R 2222:localhost:22 andreasbj@www.halfface.se
Reverse tunnel.
ssh -D \*:666 www.halfface.se
ssh -N ipmon10.ny1.ip-soft.net -L43389:ippc01.ongame.ip-soft.net:3389
-n Dont take console. Good for background.
-N Do not execute a remote command
-T Disable pseudo-tty allocation.
-x Disables X11 forwarding.
-R port:host:hostport
sudo ssh -N -L 2222:www.halfface.se:22 www.halfface.se
sudo ssh -nNTx -R 2222:www.halfface.se:22 www.halfface.se
sudo ssh -nNTx -R 443:satellite.ongame.com:443 root@10.0.254.30 # Tunnel 443 over ssh from remote host via local host.
Open tunnel on remote host. Start remote proxy server forwarding to internal network.
ssh remotehost -R remoteport:localhost:localport "ssh -D 9050 localhost:remoteport"
Multiple reverse tunnel controled by autossh. (-M)Control port,(-f)background, (-N) no remote command, reverse tunnel (-R)
autossh -M 41000 -f -N -R 0.0.0.0:8001:192.168.1.10:80 -R 0.0.0.0:8002:192.168.1.20:80 user@remotehost

==reverse tunnel bound to all interfaces==
The config has to allow to bind to * interface. /etc/ssh/sshd_config GatewayPorts yes
sudo ssh -i ${HOME}/.ssh/id_dsa -N -R \*:2222:localhost:22 ${USER}@www.halfface.se

==Create an ssh tunnel link==
https://help.ubuntu.com/community/SSH_VPN
echo 1 > /proc/sys/net/ipv4/ip_forward
vim /etc/ssh/sshd_config PermitTunnel=yes
sudo ssh -NTCf -w 0:0 1.2.3.4
sudo ssh -v -w any:any www.halfface.se
###
local:
ip link set tun0 up
ip addr add 169.254.0.1/32 peer 169.254.0.2 dev tun0
ip route add 192.168.0/24 via 169.254.0.2
remote:
ip link set tun1 up
ip addr add 169.254.0.2/32 peer 169.254.0.1 dev tun1
arp -sD 169.254.0.2 eth1 pub
### Change default gateway. In this case, 192.168.0.1 is Machine B's current default gateway; it is the gateway on Network B that provides internet connectivity
ip route add 1.2.3.4/32 via 192.168.0.1
ip route replace default via 10.0.0.1

==Limit ssh access with pam_access==
/etc/security/access.conf

==Proxycommand without nc==
Host server1
Hostname 10.0.1.1
ProxyCommand ssh -q -x jumphost -W %h:22

==ssh over ipv6 via 2 network interface.==
ssh -6 fe80::1ec1:deff:fecb:6ce%2

==ssh options==
None interactive. Dont ask for password.
-o BatchMode=yes
Accept all keys.
-o StrictHostKeyChecking=no

==ssh via proxy/squid==
ssh -o 'ProxyCommand nc --proxy proxy.inter.net:3128 --proxy-type http %h %p' host.inter.net hostname
ssh -o 'ProxyCommand nc -X connect -x proxy.inter.net:3128 %h %p' host.inter.net hostname

==brow.sh==
browser in terminal window.
ssh brow.sh

==jail==
/etc/sshd/sshd_config
Match group mychroot
ChrootDirectory /jail/
X11Forwarding no
AllowTcpForwarding no

==sshd debug==
Start deamon once in debug mode and put output to your console.
/etc/sysconfig/sshd
OPTIONS="-ddd"
Kill of sshd which is listening for new connections. Start sshd with the following command. Debug level can bee changed.
/usr/sbin/sshd -De -o LogLevel=DEBUG3

==ssh multiple jumps one cli==
Jump through host1.net to get to host2.net
ssh -t host1.net ssh -t host2
Jump through host1.net to host2.net and bring port 8080 with you.
ssh -t host1.net -L 8080:localhost:8080 ssh -t host2.net -L 8080:localhost:8080

==ssh force password login==
ssh -o StrictHostKeyChecking=no -o ControlPath=none -o ControlMaster=no -o PubkeyAuthentication=no user@host

==ssh via jumphost==
ssh -J core@1.1.1.1 core@2.2.2.2

==socks==
# Setup socks server exiting on remote host
ssh -D '*:3128' halfface.se
# Use socks setup above.
curl --socks5 localhost:3128 https://ifconfig.me

==Create public key from private==
ssh-keygen -y -f <private_key_with_return_at_end>

=sshfs mount filesystem over ssh=
sshfs name@server:/path/to/folder /path/to/mount/point
=sshpass=
ssh with password provided on the command line.
sshpass -p P@ssW0rd ssh -t -o ControlPath=none -o PreferredAuthentications=password -o PubkeyAuthentication=no -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o LogLevel=Error user@localhost hostname
=specify key=
ssh -o "IdentitiesOnly=yes" -i <private key>

=sshuttle=
create a network route over ssh.
sshuttle -D -r user@remotehost:2222 192.168.1.0/24

=stat=
View file permissions only.
stat -c "%a %n" /usr/bin/bash
Access - the last time the file was read
Modify - the last time the file was modified (content has been modified)
Change - the last time meta data of the file was changed (e.g. permissions)
Copy permissions from one location to another.
rpm -qlp package.rpm | while read FILE ; do echo chmod $(stat -c "%a" $FILE) \"$FILE\";done > /tmp/copy_permissions.sh

=strace=
==File open activity.==
strace -e open -f ls -la /temp/
==File open activity under directory.==
strace -e open -P /temp/ -f ls -la /temp/
==More file activity.==
strace -e trace=file -p 1234
strace -e trace=desc -p 1234
==Trace network activity.==
sudo strace -f -e trace=network -p 1476
# 1024 long strings.
sudo strace -s 1024 -f -e trace=network -p 1476
# strace follow process with matching regex.
strace -f -e poll,select,connect,recvfrom,sendto -p $(pgrep -f login-sync.xml)
# trace nework activity
strace -f -e trace=network -s 1000000 nc localhost 3333

==Memory usage==
sudo strace -f -e trace=memory -p $(pgrep -f firefox)
==What is taking time==
[root@util01 abjorklund]# strace -f -c -p 9657
% time seconds usecs/call calls errors syscall
------ ----------- ----------- --------- --------- ----------------
88.11 11.614155 1644 7065 1565 futex
9.94 1.310794 16183 81 73 restart_syscall
1.86 0.245018 86 2850 recvfrom
0.05 0.006784 30 228 poll
0.03 0.004006 2 1838 sendto
0.00 0.000271 1 253 sched_yield
0.00 0.000134 12 11 mmap
0.00 0.000107 0 5176 ioctl
0.00 0.000026 0 148 148 stat
0.00 0.000000 0 1 read
0.00 0.000000 0 254 write
0.00 0.000000 0 44 mprotect
0.00 0.000000 0 1 rt_sigreturn
------ ----------- ----------- --------- --------- ----------------
100.00 13.181295 17950 1786 total

==strace multiple processes==
strace -s 1024 -f -o /tmp/strace $(pidof Process_name | sed 's/$[0-9]*$/-p \1/g')
==strace to hex output. Convert to utf8.==
strace -xx -f -o/tmp/strace -s0 echo bajskorv
cat /tmp/strace | while read -r line; do printf "%b\n" "$line" ; done

=stty=
List settings
stty -a
speed 38400 baud; rows 50; columns 200; line = 0;
intr = ^C; quit = ^\; erase = ^?; kill = ^U; eof = ^D; eol = <undef>; eol2 = <undef>; swtch = <undef>; start = ^Q; stop = ^S; susp = ^Z; rprnt = ^R; werase = ^W; lnext = ^V; discard = ^O; min = 1; time = 0;
-parenb -parodd -cmspar cs8 -hupcl -cstopb cread -clocal -crtscts
-ignbrk -brkint -ignpar -parmrk -inpck -istrip -inlcr -igncr icrnl ixon -ixoff -iuclc -ixany -imaxbel -iutf8
opost -olcuc -ocrnl onlcr -onocr -onlret -ofill -ofdel nl0 cr0 tab0 bs0 vt0 ff0
isig icanon iexten echo echoe echok -echonl -noflsh -xcase -tostop -echoprt echoctl echoke -flusho -extproc
Set terminal properties.
stty rows 50 cols 200

=sudo=
Enable sudo logging
sed -i "$(( $(grep -n ^Defaults /etc/sudoers | tail -1 | awk -F: '{print $1}') + 1 ))iDefaults log_output\nDefaults log_input" /etc/sudoers
Command above adds the following to /etc/sudoers
Defaults log_output
Defaults log_input
List sudo-io logs.
sudoreplay -l
Search for string in logs.
zgrep search_string $(find /var/log/sudo-io/ -type f)
Replay session. Max wait 1s. 5 times the speed.
sudoreplay -m1 -s5 000002
Replay session including stdin
sudo sudoreplay -m1 -s5 -f stdin,stdout,stderr,ttyin,ttyout 000001
Which rules apply to user
sudo -l -U username
==Add user to sudoers.d so you do not need to add password for that user.==
SUDO_USER=<user> ; echo -e "# Adding $SUDO_USER user to sudo users.\n$SUDO_USER ALL=(ALL) NOPASSWD:ALL" > /etc/sudoers.d/90-${SUDO_USER//./_} ; chmod 440 /etc/sudoers.d/90-${SUDO_USER//./_}

=swapon/swapof=
Free swap
(swapoff -a; swapon -a) & watch free -m

=sysbench=
cpu test.
sysbench cpu --cpu-max-prime=20000 --threads=32 run | grep "events per second"
ram test
sysbench memory --threads=32 run | grep sec
disk test
RAM_TWO=$(( $(grep MemTotal /proc/meminfo | awk '{print $2}') * 2 ))kb
sysbench fileio --file-total-size=${RAM_TWO} prepare > /dev/null
sysbench fileio --file-total-size=${RAM_TWO} --file-test-mode=rndrw --time=300 --max-requests=0 run|grep -E ' read, | written, '
sysbench fileio --file-total-size=${RAM_TWO} cleanup > /dev/null

=sysctl=
Rename machine.
sysctl kernel.hostname=ipmonxx.${CLIENT}.ip-soft.net
Set tcp keepalive
$ sysctl -a | grep tcp_keepalive
net.ipv4.tcp_keepalive_time = 1800
net.ipv4.tcp_keepalive_probes = 9
net.ipv4.tcp_keepalive_intvl = 75
sudo sysctl -w net.ipv4.tcp_keepalive_time=60 net.ipv4.tcp_keepalive_probes=3 net.ipv4.tcp_keepalive_intvl=10
net.ipv4.tcp_keepalive_time = 60
net.ipv4.tcp_keepalive_probes = 3
net.ipv4.tcp_keepalive_intvl = 10
Reload config files
sysctl --system

=systemctl=
==init 3==
systemctl isolate runlevel3.target
systemctl isolate multi-user.target
systemctl set-default multi-user.target

==init 5==
systemctl isolate runlevel5.target
systemctl isolate graphical.target
systemctl set-default graphical.target

==When you have made changes to /etc/systemd/system/*.service==
systemctl daemon-reload

==List all units==
systemctl list-unit-files
==List units with problems==
systemctl list-units --failed
==create service==
cd /etc/systemd/system ; vim $service.service ; systemctl daemon-reload
[Unit]
Description=Set laptop brightness
After=multi-user.target

[Service]
Type=forking
ExecStart=/bin/sh -c 'echo 1000 > /sys/class/backlight/intel_backlight/brightness'
LimitNOFILE=65535
LimitNPROC=65535

[Install]
WantedBy=default.target

==Add groups to processes started by services script==
[Service]
SupplementaryGroups=33 518
==takes a long time to login==
systemctl daemon-reexec
systemctl restart systemd-logind

=strace process started by systemctl=
strace -f -o /tmp/strace.log -s 2048 -p 1 & systemctl restart httpd.service
=systemctl show puma=
Show variables of service
systemctl show puma

=systemd-analyze=
What takes time at startup.
systemd-analyze plot > /tmp/systemd-analyze-plot.svg ; chrome /tmp/systemd-analyze-plot.svg
=systemd-resolved=
resolvectl status
clear cache.
sudo systemd-resolve --flush-caches
Look at stats.
systemd-resolve --statistics
==restart daemon to apply settings==
systemctl daemon-reload
systemctl restart systemd-networkd
systemctl restart systemd-resolved
=systemctl show=
will show all available properties
systemctl show $service

=tail=
Tail from line number 21.
tail -n +21 /file
=talk=
Talks swedish.
espeak -v swedish -f /tmp/file

=tar=
Make a backup of a directory or disk.
server: tar -cpsf - $dir | pv -b | nc -l 3333
client: nc server 3333 | pv -b | tar -xpst -
Inline tar archive.
awk '/^__ARCHIVE_FOLLOWS__/ { print NR + 1; exit 0; }' $0
tail -n $0 > archive.tar # tail -n +347 Filename
Backup dir but exclude files within
tar zcf /tmp/backup_$(date '+%Y-%m-%d_%H-%M-%S').tar.gz /apps/app --exclude=/apps/app/var/* --exclude=/apps/app/logs/*
extract files remove 5 path element components.
tar xf archive.tar --strip-components 5
extract to other directory.
tar -xzf bar.tar.gz -C foo
extract files excluding path.
tar xf $file.tar.gz --transform='s/.*\///'

=tcpdump=
dump trafic information, -e Print the link-level header on each dump line, -vvv verbose.
tcpdump -e -vvv port 21
dump all trafic to and from machine. -w write to file, -s0 size of package, host to listen from.
time tcpdump -w ssl_dump -s0 host test.x30.webservices.itsfogo.com
dump all trafic into files of max 100MB. 270MB in reality.
tcpdump -w snoop -s0 -C 100000000
dump all trafic. compress logfiles. Create 10 files which are 10 MB big. Dont convert numbers to names. Dont truncate frames create logfile with this name.
tcpdump -z gzip -i wlan0 -C 10 -W 10 -n -s0 -w /tmp/tcpdump.log
Which machines send a syn packet.
sudo tcpdump -nn -i eth0 'tcp[13] = 2'
Show information about all traffic on interface.
tcpdump -s0 -i eth1 -vv
Show information about communication over port 514
tcpdump -Xni any port 514
listen on port 1023 for incoming trafic. disable local subnets.
sudo tcpdump -n -i eth0 tcp and dst host 172.17.17.6 and not src net 172.17.17.0/24 and not src net 158.0.0.0/8 and 'port 1023'
listen after torrent traffic.
sudo tcpdump -Xni any portrange 6882-6999
View content of http trafic
sudo tcpdump -i any -A -s 1500 dst 89.253.75.84 and port 80
View post in utf-8 format.
<pre>
sudo tcpdump -lnp -i any -A -s 1500 dst 89.253.75.84 and port 80 -w - | tr -t '[^[:print:]]' ''
</pre>
Get cookie
tcpdump -i lo -A -l dst port 8000 | grep "^Cookie: "
To create cookie for curl: https://xiix.wordpress.com/2006/03/23/mozillafirefox-cookie-format/
Look at traffic from specific ip
tcpdump -n -i any -n host 198.18.130.9
Eavesdrop password
tcpdump -i any -A -s0 port 8030 | grep Authorization:
==flags==
tcpdump -enni eth0 host 172.30.142.11 port 5432
F - FIN
S - SYN
R - RST
P - PSH
U - URG
E - ECN Echo
W - ECN Cwnd Reduced
. - ACK only
==get ftp username/password==
sudo tcpdump -n -vvv -i any -A -f "port 21" | grep -i "user\|pass"

=tcptraceroute=
tcptraceroute -n -q 1 192.168.0.1 -p 22
=teamdctl=
teamdctl team0 state view -v
=tee=
Feed tee with an unbuffered stream.
sar -n DEV 2 | stdbuf -oL grep wlp0s20f3 | tee /temp/sar_-n_wlp0s20f3.$(date)

=telnet=
Look at world map. a - z zoom.
telnet mapscii.me
=testssl=
test ssl certificate
testssl www.halfface.se

=tftp=
# Download test.file
tftp -v 172.17.17.6 -c get test.file
# Upload file.
tftp -v 172.17.17.6 -c put /tmp/test.put test.put
# Enable upload file in in.tftpd
/etc/xinetd.d/tftp
server_args = -c -s /var/lib/tftpboot
=tibco=
show permissions.
help permissions
Create user
create user surveillance "Surveillance user" password=surveillance
Grant user permission to view all
grant admin user=surveillance view-all
=tif=
cli image viewer.
tif $IMAGE.jpg

=time=
Time in a loop.
{ time sleep 2 >> ${LOG} ; } 2>> ${LOG}
How long did a command take
TIME=$( { /usr/bin/time -f "%e" sleep 1.5 ;} 2>&1 ) ; echo $TIME
Built in time command. 3 decimals in seconds.
TIMEFORMAT='%3R'; time ( sleep 61.22222 )
=timedatectl=
Show info how clock is synced.
timedatectl timesync-status
Which time zones exist
timedatectl list-timezones | cat -v | grep -i stockholm
Set timezone.
timedatectl set-timezone "Europe/Stockholm"
Show ntp servers
timedatectl show-timesync --all
Sync clock
timedatectl set-ntp true
Enable clock sync.
systemctl enable systemd-timesyncd --now

=timeout=
limit waiting for a period.
timeout 2s sleep 100
Run function under timeout
export -f my_function ; timeout 1 bash -c 'my_function options'
Run loop for some time then exit.
timeout 172800 bash -c -- 'while true ; do echo $(TZ=UTC date "+%Y-%m-%d %H:%M:%S %Z") $(ping -w1 -q -c1 -i10 192.168.10.120 | grep received) ; sleep 1 ; done| tee /tmp/ping_192.168.10.120.log'

=tnef=
List content of winmail.dat. Remove options to extract to current dir.
tnef -t -f winmail.dat
=toilet=
Generate graphics text similar to banner.
toilet -F gay -f mono12 "Some Funky Text"
=tor=
Select outgoing country. https://en.wikipedia.org/wiki/ISO_3166-1_alpha-2
Set country in:
torrc
One or several exit countries.
ExitNodes {us}
ExitNodes {kr},{ru},{sy},{cn}
test exit node
ifconfig.me
=toolbox=
toolbox create --distro rhel --release 9.5
==running rocky==
podman pull docker.io/rockylinux/rocky-toolbox:9
toolbox create --image docker.io/rockylinux/rocky-toolbox:9

=top(the command)=
Top batch mode run one iteration
top -bn1
Sort by memory usage
for i in {1..10};do date; top -c -b -o +%MEM | head -n 17|tail -11;sleep 5;done
Top used in openshift.
top -bcn1 -w512 | less -ISRM

=top derivates=
apachetop
dnstop
iftop
latencytop
glances

=touch=
touch -am 0910120003 Give a new access time on a file 0910120003MMDDhhmmyy
linux
touch -t 197102162324 *

=tput=
No line wraps
tput rmam
Line wraps
tput smam
invisible cursor
tput civis
visible cursor
tput cnorm
reset is a good command to reset shell
reset

=tr=
translate capital to lower letter.
tr '[:upper:]' '[:lower:]'
null character to new line
tr '\000' '\n' < /proc/3575/environ
Remove unprintable characters.
<pre>
tr -dc '[[:print:]]'
</pre>

=trickle=
Speed limit for download
rsync -ae "trickle -d 80 ssh" user@host:/src/ /dst/
Speed limit for upload.
rsync -ae "trickle -u 80 ssh" user@host:/src/ /dst/
Limit wget to 64kbit upload and download.
trickle -d 64 -u 64 wget "https://www.halfface.se/file.txt"
=ts=
timestamp
ls -la | ts '%F %H:%M:%S'

=tune2fs(tunefs)=
tune2fs -m 0 /dev/sdb1

=type=
What kind of command do we use. builtin or some file?
type ls

=udevadm=
Monitor udev events.
udevadm monitor
udevadm info --query=all --name=sda
look at values for disk. Can be used to locate san source.

=udr=
rsync over udp.
udr -a 57621 -b 57631 rsync -rP host.inter.net:/source/ /destination/
=ulimt=
Look at current limits for logged in user.
ulimit -a
Look at limits for process with pid 12345.
cat /proc/12345/limits
=unalias=
Unalias all aliases
unalias -a
=unhide=
Find hidden ports.
unhide -v proc

=unetbootin=
Boot iso image from usb memory.
=update-crypto-policies=
Change crypt policies so that I am able to start openvpn connection.
sudo update-crypto-policies --set DEFAULT:SHA1

=upower=
# Powerstatus of the system. battery charge.
upower --dump
=uptime=
Uptime in seconds.
awk -F . '{print $1}' /proc/uptime

=urldecode/urlencode=
Encode
perl -pe's/([^-_.~A-Za-z0-9])/sprintf("%%%02X", ord($1))/seg'
jq -sRr @uri
Decode
perl -pe 's/%([0-9a-f]{2})/sprintf("%s", pack("H2",$1))/eig'
jq -r @uri

=useradd=
useradd --uid 666 --gid 666 --comment 'devil' devil && echo 'devil:VerySecretPassword' | chpasswd

=v4l2=
Video player
qv4l2
List available formatats and resolutions.
v4l2-ctl --list-formats-ext
List available formats
v4l2-ctl --list-formats
Set camera to h264
v4l2-ctl --set-fmt-video=width=800,height=448,pixelformat=1
Set framerate.
v4l2-ctl --set-parm=30
List video parameters
v4l2-ctl --get-fmt-video
List video output
v4l2-ctl --all
Disable autofocus
v4l2-ctl --verbose --set-ctrl=focus_auto=0
v4l2-ctl --verbose --set-ctrl=focus_absolute=0
=version of linux=
cat /etc/os-release

=vi=
:set ignorecase
:set list show all keys.
:set nolist show their representative.
=wipefs=
Wipe removes information about file system without removing actual data.
wipefs -a /dev/sdc

=vmstat=
top over time.
vmstat -n 5
Description:
r=procs waiting for cpu time.
b=procs in sleep mode.
swpd=virtual memory in use in swap.
free=memory free.
buff=memory used by buffers
cache=memory used as cache.
si=swap in.
so=swap out.
bi=io block in.
bo=io block out.
in=interups
cs=contex switching.
us=cpu user space
sy=cpu system usage to serve.
id=cpu idle
wa=cpu waiting for input output. iowait.
st=cpu time stolen from a virtual machine

procs -----------memory---------- ---swap-- -----io---- --system-- -----cpu-----
r b swpd free buff cache si so bi bo in cs us sy id wa st
2 1 814984 167992 26820 999460 0 0 1 0 2467 5088 2 2 95 1 0
0 0 814984 168100 26820 999540 0 0 2 150 2467 5026 1 2 97 0 0
=w3m(elinks)=
curl -s https://google.com | w3m -T text/html -dump

=wget=
wget -r -nH -np --cut-dirs=1 --no-check-certificate -U Mozilla --user={uname} --password={pwd} https://my-host/my-webdav-dir/my-dir-in-webdav
wget to standard output.
wget --no-check-certificate -S -O- http://inter.net
Special heather
wget 'http://halfface.se' --header='Cookie: has_js=1'
Mirror
wget 'https://halfface.se/test' -r -l 3 --convert-links -o log --html-extension

=whois=
# When does a domain expire.
whois -h whois.iana.org sivberg.se
# which ipranges does an ipaddress belong too. In this case looking at google.
whois -h whois.radb.net -- "-i origin $(whois -s -h whois.radb.net 172.217.26.68 | grep ^origin | awk '{print $2}' | tail -1)" | grep ^route | awk '{print $2}'
# Who to find address range for site.
host www.facebook.com
whois 157.240.194.35 | grep CIDR

=wireshark=
find packet
packet details
string
==ssl decryption==
export SSLKEYLOGFILE=/tmp/sslkeylog ; curl -sv -d "blablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablablabla" https://www.halfface.se
wireshark. Edit - Preferences - Protocols - TLS - (Pre) -master-Secret log file.
==tshark==
cli version
tshark -V -r $dump.pcap
=wlr-randr=
Change dpi in wayland.
wlr-randr --output eDP-1 --scale 2
Change resolution
wlr-randr --output DP-1 --mode 1920x1080

=wodim=
Burning disks.
wodim -scanbus # Scan scsi bus for burners.
wodim --devices # Discover basic information.
wodim -checkdrive # Information about burner.
wodim -tao speed=0 dev=/dev/sr0 -v -data /temp/files/ # Burn disk containing structure from /temp/files/
wodim -eject -tao speed=0 dev=/dev/scd0 -v -data /my/directory/image.iso # Burn image to disc.
=write=
Send message to someone via tty.
who | grep user
write message end with CTRL + d
write abjorklund pts/2

=xargs=
locate case insensetive, regular expression. xargs string to replace imput. Print output to standard error.
locate -ir ".*\.crt$" | xargs -I '{}' -t cp {} /temp/ssl/
Do something on everything from standard input.
ls -la | xargs -i% echo '# beginning #' % '# end of line #'
split several lines into groups.
for i in {00..99} ; do echo $i, ; done | xargs -L 20

=xdotool=
When you have to move your mouse but you dont want to push it.
xdotool mousemove_relative -- -1 -1
xdotool mousemove_relative 1 1
Send ab to window.
xdotool search --onlyvisible --name freerdp key a key b
=xfs=
xfs_repair -L /dev/mapper/vg00-root

=xinput=
# List xinputs.
xinput list
# List properties.
xinput list-props "Logitech Unifying Device. Wireless PID:400e"
# Middle button emulation.
xinput set-prop "Logitech Unifying Device. Wireless PID:400e" "Evdev Middle Button Emulation" 1
xinput set-prop 12 "libinput Middle Emulation Enabled" 1
=xkill=
Kill xorg process with id 0xb6ffa0
xkill -id 0xb6ffa0
List x applictions
xwininfo
Get recursive list of x applications.
xwininfo -root -tree

=xmllint=
prettify xml
xmllint --format -

=xset=
Disable screen saver
xset -dpms ; xset s noblank ;xset s off
Disable repeat
xset r off
Enable repeat
xset r on

=xxd=
Hex to binary
xxd -r -p hex.txt output.bin
Hex to binary in pipe
echo "$HEX" | xxd -r -p -
=yum=
download src rpm
yumdownloader --source net-snmp
Reinstall default repos.
yum reinstall yum-conf-sl6x-1-2
This will give you a directory with all rpm:s that are required to install rpm.
PKG=openssh-server ; yum install --downloadonly --installroot=/tmp/$PKG-installroot --releasever=6 --downloaddir=/tmp/$PKG $PKG
==broken repos==
yum install bareos-client --disablerepo=* --enablerepo=bareos
==search for different versions==
yum --showduplicates search percona-xtrabackup
==Add repos to centos 6==
curl https://www.getpagespeed.com/files/centos6-eol.repo --output /etc/yum.repos.d/CentOS-Base.repo
curl https://www.getpagespeed.com/files/centos6-epel-eol.repo --output /etc/yum.repos.d/epel.repo
==fix yum in Centos 7, 8==
<pre>
sed -i 's%^enabled=.%enabled=0%' /etc/yum/pluginconf.d/subscription-manager.conf
sed -i 's/^mirrorlist/#mirrorlist/g' /etc/yum.repos.d/*
sed -i 's%^#baseurl=http://mirror.centos.org%baseurl=http://vault.centos.org%g' /etc/yum.repos.d/*
</pre>

==Get variables to test /etc/yum-repos.d/<file>.conf files==
export releasever=$(lsb_release -r | awk '{print $NF}' | awk -F . '{print $1}')
export basearch=$(uname -m)

=zip=
Zip directory exclude files .svn directory.
zip -r /temp/ssl.zip . -x ".svn/*"
List contents of zip archive.
unzip -l archive.zip
Unzip single file
unzip file.zip file/you/want/to/extract/the_file.txt
unzip excluding path.
unzip -j file.zip

=zdump=
View information from timezone tz.
zdump -v /etc/localtime
Change timezone on host
ln -sfT ../usr/share/zoneinfo/Europe/Stockholm localtime

=zfs=
==Get sync==
zfs get sync datapool/netstorage/dog/prod
NAME PROPERTY VALUE SOURCE
datapool/netstorage/dog/prod sync standard default
==set sync==
zfs set sync=disabled datapool/netstorage/dog/prod
==List snapshots(can take time)==
zfs list -t snapshot
==List snapshots for one mount point.==
zfs list -r -t snapshot -o name,creation datapool/netstorage/bro/prod
==Displays the detailed health status==
zpool status
==List datasets==
zfs list
==Create dataset==
zfs create datapool/netstorage/media
==zdb==
display zpool debugging and consistency information
zdb -d dataset
==zpool list==
Lists the given pools along with a health status and space usage.
==iostat==
Get iostat with values since last second.
zpool iostat are -y 1 -l

[[Category:Applications]]
[[Category:Unix]]
[[Category:Commands]]

Windows

2026-03-10T08:49:21Z

Ekaanbj: /* empty recyclebin */

=connect to windows from windows(rdp)=
mstsc /v:172.30.142.11
Login with password.
# Define the server and credentials
$server = "<server>"
$username = "<username>"
$password = "<password>"
# Create credentials using cmdkey
cmdkey /generic:"TERMSRV/$server" /user:$username /pass:$password
# Start MSTSC to connect to the server
Start-Process "mstsc" -ArgumentList "/v:$server"
# Delete the credentials after MSTSC session is done
cmdkey /delete:TERMSRV/<servername>

=which version of powershell is installed=
$PSVersionTable

=hibernate=
powercfg.exe -h off

=enable powershell=
set-executionpolicy unrestricted
=List network interfaces with ips=
Get-NetIPAddress | Select-Object InterfaceAlias, IPAddress
=List network interfaces and routes=
Get-NetIPAddress | Select-Object InterfaceAlias, IPAddress | Format-Table ; Get-NetRoute | Format-Table

=Configure network=
# Static ip.
netsh interface ip set address name="Local Area Connection" static 192.168.122.41 255.255.255.0 192.168.122.1 1
# Dhcp
netsh interface is set address name="Local Area Connection" dhcp
# Verify mtu settings.
netsh interface ipv4 show subinterfaces
# Set correct mtu.
netsh interface ipv4 set subinterface "Ethernet 2" mtu=1000

=extract msi=
msiexec /a "C:\software.msi" /qb TARGETDIR="C:\Folder"

=restart network=
netsh interface set interface extbond admin = disabled
ping 127.0.0.1 -n 6
netsh interface set interface extbond admin = enabled

=Profile=
# Profile
C:\Users\abjorklund\AppData\Roaming\Microsoft\Windows\Start Menu

=restart via rdesktop=
CTRL + ALT + END
=alternative shutdown=
Shutdown with restart
shutdown /t 0 /r /f
Shutdown
shutdown /t 0 /s /f
logoff/logout
shutdown /l /f

=mount drive=
net use z: \\www.halfface.se\storage /user:alex <password> /persistent:no
=change password=
Start a command prompt as administrator.
net user username password

=activate account=
net user username /active:yes

=remove cached passwords=
list/remove cached passwords graphically
rundll32.exe keymgr.dll,KRShowKeyMgr
list/remove cached passwords cli
cmdkey /list

=is your account locked. bat file=
@echo off
:again
date /t & time /t
net user /domain mdinkel > c:\temp\mdinkel
find "active" c:\temp\mdinkel
timeout 10
goto again

=unlock account=
Net user username /DOMAIN /active:YES

=Browse active dirctory structure=
adsiedit.msc
=time zone conversion=
Here you can convert from Windows to unix time zones tz.
http://www.unicode.org/cldr/charts/latest/supplemental/zone_tzid.html
=uptime=
net statistics server
Uptime and other information
systeminfo /FO CSV | ConvertFrom-CSV

=credetial manager empty cache=
rundll32.exe keymgr.dll,KRShowKeyMgr
=remote powershell pssession=
Create pssession.
$secpasswd = ConvertTo-SecureString "*************" -AsPlainText -Force
$mycreds = New-Object System.Management.Automation.PSCredential ("domain\user", $secpasswd)
New-PSSession -ComputerName 10.111.222.5 -Credential $mycreds

get pssessions.
get-pssession

enter pssession
Enter-PSSession -Name
Enter-PSSession -ComputerName 10.50.197.70
Enter-PSSession 172.18.1.198 -Credential domain\uer

remove pssession
remove-pssession -name Session15

Run remote command.
Invoke-Command -name "Session14" -ScriptBlock { hostname }

Login to remote machine
Enter-PSSession 10.50.197.70 -Credential $mycreds

=PowerShell=
=gc=
Get-content. Print content of file.
gc c:\temp\file.txt
=Set-content=
Set-Content -path REMOTE\Filename.txt
=Out-File=
Out-File -Encoding UTF8

=replace text in file=
Get-Content REMOTE\Filename.txt | foreach-object { $_ -replace "OLD", "NEW" } | Set-Content REMOTE\Filename.txt

=get-service=
Status of one service.
get-service ipeventwatcher
status of all services. list services.
Get-Service
find service
get-service *service_to_find* | select -expand name
=get failed services=
Get-Service | Where-Object {$_.Status -eq 'Stopped' -and $_.StartType -eq 'Automatic'}
=failed service from boot=
Write-Host "`n=== Stopped Automatic Services ===" -ForegroundColor Cyan
Get-Service | Where-Object { $_.Status -eq 'Stopped' -and $_.StartType -eq 'Automatic'} | Select-Object Name, DisplayName, Status | Format-Table -AutoSize
Write-Host "`n=== Disabled Scheduled Tasks ===" -ForegroundColor Cyan
Get-ScheduledTask | Where-Object {$_.State -eq 'Disabled'} | Select-Object TaskName, TaskPath | Format-Table -AutoSize
Write-Host "`n=== Recent Service Failures (Event Log) ===" -ForegroundColor Cyan
Get-EventLog -LogName System -Source "Service Control Manager" -EntryType Error -Newest 10 | Select-Object TimeGenerated, Message | Format-List

=stop-service=
stop-service ipeventwatcher
=restart-service=
restart-service ipremote -force
restart-service check_mk_agent -force
Restart-Service -Force -Name "TermService"
=tell windows to restart service automatically=
$serviceName = "icinga2"
sc.exe failure $serviceName reset= 86400 actions= restart/60000/restart/60000/restart/60000

=start-service=
start-service ipeventwatcher
=autostart service=
Set-Service -Name sshd -StartupType Automatic

=variable=
Set variable to content of file.
$a = gc IPremote.exe.config
=md5sum=
[CmdletBinding(SupportsShouldProcess=$False)]
param([string]$File)

function Get-Checksum([string]$strInFile)
{
$objCrypto = New-Object "System.Security.Cryptography.MD5CryptoServiceProvider"
$objFile = Get-Item $strInFile
$objStream = $objFile.OpenRead()
$objBytes = $objCrypto.ComputeHash($objStream)
$strChecksum = ""
foreach($objByte in $objBytes) {
$strChecksum += $objByte.ToString('x2')
}
$objStream.Close() | Out-Null
return $strChecksum
}

$strFileToCheck = $File
if(Test-Path($strFileToCheck)) {
Get-Checksum $strFileToCheck
}

Get md5sum of all files.
gci * | Get-FileHash -Algorithm md5 | ft Hash,@{n="File";e={(Get-item $_.Path).Name}}

=tcp connect port=
netcat nc
(New-Object Net.Sockets.TcpClient).Connect("1.2.3.4",80)
$Tcp = New-Object Net.Sockets.TcpClient;$Tcp.BeginConnect("1.2.3.4", 80, $null, $null).AsyncWaitHandle.WaitOne(5000);$Tcp.Close()
New-Object System.Net.Sockets.TCPClient -ArgumentList "1.2.3.4",3389

Test-NetConnection -ComputerName 192.168.122.1 -InformationLevel Detailed -port 23
Latest and greatest.
$Computer="127.0.0.1"; $Port=20010; $Socket = New-Object Net.Sockets.TcpClient;($Socket.BeginConnect($Computer, $Port, $Null, $Null)).AsyncWaitHandle.WaitOne(200);$Socket.Close();

=What is using tcp connections=
Get-NetTCPConnection | Group-Object -Property State, OwningProcess | Select -Property Count, Name, @{Name="ProcessName";Expression={(Get-Process -PID ($_.Name.Split(',')[-1].Trim(' '))).Name}}, Group | Sort Count -Descending
=grep=
gc IPremoteDebug.log | select-string "ip2date"

=List all processes. Grep for string=
Get-Process -IncludeUserName | findstr dkarlslatt

=grep recursive=
dir -Recurse | Select-String -pattern "192.168.19.102"

=list processes=
Get-Process
=kill processes from user=
Get-Process -IncludeUserName | Where UserName -match joe | Stop-Process -force

=restart processes=
get-process -name powershellserver | stop-process

=clear content=
Clear-Content filename.doc
=dir recursive=
dir /a/s/b filename.txt
=dir recursive=
'Get-ChildItem "c:\program files\" -rec | ForEach-Object -Process {$_.FullName}'
'Get-ChildItem . -recurse -force | ForEach-Object -Process {$_.FullName}'
=locate a file=
List recursive look for file with file name.
Get-Childitem -Path C:\ -Include *filename* -Recurse -ErrorAction SilentlyContinue

=dir filename size=
'get-childitem "C:\Program Files\directory" -rec | where {!$_.PSIsContainer} | select-object Name, Length'
=find file with filename=
Get-ChildItem -Path C:\ -Recurse -Filter *sshd_config* -ErrorAction SilentlyContinue
=find old files=
Get-ChildItem | Where-Object {$_.LastWriteTime -lt (Get-Date).AddDays(-30)}

=find old files and remove them=
$Folder = "G:\Downloads"
#Delete files older than 6 months
Get-ChildItem $Folder -Recurse -Force -ea 0 |
? {!$_.PsIsContainer -and $_.LastWriteTime -lt (Get-Date).AddDays(-180)} |
ForEach-Object {
$_ | del -Force
$_.FullName | Out-File C:\log\deletedlog.txt -Append
}

=calculate size of directory=
Value returned is in Scientific notation format. Add number of zeroes to value. 1.00E-6 is 1000000.
'(gci "D:\data\db" | measure Length -s).Sum /1GB'
=remove directory=
rd /s /q $DIRECTORY

=dir human readable file size=
function
Function Format-FileSize() {
Param ([int]$size)
If ($size -gt 1TB) {[string]::Format("{0:0.00} TB", $size / 1TB)}
ElseIf ($size -gt 1GB) {[string]::Format("{0:0.00} GB", $size / 1GB)}
ElseIf ($size -gt 1MB) {[string]::Format("{0:0.00} MB", $size / 1MB)}
ElseIf ($size -gt 1KB) {[string]::Format("{0:0.00} kB", $size / 1KB)}
ElseIf ($size -gt 0) {[string]::Format("{0:0.00} B", $size)}
Else {""}
}
command
Get-ChildItem | Select-Object Name, @{Name="Size";Expression={Format-FileSize($_.Length)}}

=base64=
decode base64 string
[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String("YmxhaGJsYWg="))
decode content of file.
ssh ip_address_hostname '$Text=(get-content "C:\Program Files\application\application.log") ; $Bytes = [System.Text.Encoding]::Unicode.GetBytes($Text) ; $EncodedText =[Convert]::ToBase64String($Bytes) ; $EncodedText' | base64 -d

=troubleshooting network=
netstat -ano | findstr <ipremote-pid>

=diff=
Compare two files.
compare-object (get-content one.txt) (get-content two.txt)
=log file. Eventlog=
List event logs.
Get-EventLog -list
List events in a log.
Get-EventLog -LogName IPremoteLog
List events sins date.
Get-EventLog -LogName Application -after "den 5 november 2014 10:00:00"

=get-winevent=
# List event logs.
Get-WinEvent -ListLog * | where {$_.RecordCount -gt 0}
# Get latest rdp log entries.
Get-WinEvent -LogName "Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational" | select * -first 1 | fl

=date=
Get-Date
Date in iso format.
Get-Date -UFormat '+%Y-%m-%d %H:%M:%S.000Z'

=full output=
Print all variable with full output
'(Get-Variable).StdOut'
Send output to line like the following to get more output.
| Ft -autosize | out-string -width 4096

=restart services via samba=
install samba-common
yum install samba-common
List services.
net rpc service list -I IPADDRESS -U USERNAME%PASSWORD
Stop service.
net rpc service start ipremote -I IPADDRESS -U 'user%password'
Start service.
net rpc service start ipeventwatcher -I IPADDRESS -U 'user%password'
=Windows version=
[System.Environment]::OSVersion.Version
http://msdn.microsoft.com/en-us/library/windows/desktop/ms724833%28v=vs.85%29.aspx
(Get-WmiObject -class Win32_OperatingSystem).Caption
Which architecture.
gwmi win32_operatingsystem | select osarchitecture

=set windows proxy=
Set-ItemProperty "HKCU:\Software\Microsoft\Windows\CurrentVersion\Internet Settings" -Name ProxyEnable -Value 1
Set-ItemProperty "HKCU:\Software\Microsoft\Windows\CurrentVersion\Internet Settings" -Name ProxyServer -Value proxy.int.redbridge.se":"3128
Set-ItemProperty "HKCU:\Software\Microsoft\Windows\CurrentVersion\Internet Settings" -Name ProxyOverride -Value "*.redbridge.se"
Get-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Internet Settings' | findstr Proxy

=Is proxy bypassed=
$url = "http://10.127.12.10";$webclient = New-Object System.Net.WebClient; $webclient.Proxy.IsBypassed($url)

=curl=
(Invoke-WebRequest http://localhost/Requests -UseBasicParsing).content
curl -TimeoutSec 1 https://halfface.se

=wget=
Invoke-WebRequest -Uri "http://1.2.3.4/file.txt" -OutFile "file.txt"

=turn of index services when computer is not used=
In stopindexer enter the line
net stop wsearch
In the startindexer enter the line
net start wsearch

=robocopy(backup)=
robocopy C:\Users\user_name\Documents h:\backup\user_name /e /mir /np /log+:c:\temp\backup_log.txt

=number of cpus=
Get-WmiObject -class Win32_processor | ft systemname,Name,DeviceID,NumberOfCores,NumberOfLogicalProcessors, Addresswidth

=cpu_usage=
cpu=<value>%
$cpuUsage = Get-WmiObject Win32_Processor | Select-Object -ExpandProperty LoadPercentage ; $averageCpuUsage = ($cpuUsage | Measure-Object -Average).Average ; "cpu:{0:N0}%" -f $averageCpuUsage
Get-Counter '\Process(*)\% Processor Time'| Select-Object -ExpandProperty countersamples | Select-Object -Property instancename, cookedvalue| Sort-Object -Property cookedvalue -Descending| Select-Object -First 20| ft InstanceName,@{L='CPU';E={($_.Cookedvalue/100).toString('P')}} -AutoSize | Ft -autosize | out-string -width 4096
Get-WmiObject win32_processor | select LoadPercentage |fl
Stats and all processes. Including process running under svhost.
$CpuInfo = Get-WmiObject -Namespace "root\cimv2" -Class Win32_PerfFormattedData_PerfOS_Processor;$MemInfo = Get-WmiObject -Namespace "root\cimv2" -Class Win32_PerfFormattedData_PerfOS_Memory;$SysInfo = Get-WmiObject -Namespace "root\cimv2" -Class Win32_PerfFormattedData_PerfOS_System;$PrcInfo = Get-WmiObject -Namespace "root\cimv2" -Class Win32_PerfFormattedData_PerfProc_Process;$SvcInfo = Get-WmiObject -Namespace "root\cimv2" -Class Win32_Service;$GeneralInfo = @{};$ProcOutput = @();$ServiceTable = @{};$GeneralInfo.Add("_Name", $env:COMPUTERNAME);$GeneralInfo.Add("ProcessorQueueLength", $SysInfo.ProcessorQueueLength);$GeneralInfo.Add("PercentInterruptTime", $($a = $CpuInfo | %{$_.PercentInterruptTime}; $a -join " "));$GeneralInfo.Add("AvailableMBytes", $MemInfo.AvailableMBytes);$GeneralInfo.Add("PercentIdleTime", $($a = $CpuInfo | %{$_.PercentIdleTime}; $a -join " "));$GeneralInfo.Add("PercentPrivilegedTime", $($a = $CpuInfo | %{$_.PercentPrivilegedTime}; $a -join " "));$GeneralInfo.Add("TotalMemory", (Get-WmiObject Win32_ComputerSystem | %{$_.TotalPhysicalMemory}));$GeneralInfo.Add("PercentProcessorTime", $($a = $CpuInfo | %{$_.PercentProcessorTime}; $a -join " "));$GeneralInfo.Add("CacheBytes", $MemInfo.CacheBytes);$GeneralInfo.Add("PercentUserTime", $($a = $CpuInfo | %{$_.PercentUserTime}; $a -join " "));$GeneralInfo.Add("CommittedBytes", $MemInfo.CommittedBytes);$GeneralInfo.GetEnumerator() | Sort-Object -Property Name | ForEach-Object {Write-Host -Object ($_.Name + ": ") -NoNewline; Write-Host -Object $_.Value};foreach($Service in $SvcInfo) {$ProcId = $Service.ProcessId.ToString();if($ProcId -ne "0") {if($ServiceTable.ContainsKey($ProcId)) {$Value = $ServiceTable.Get_Item($ProcId);$Value += $Service.Name;$ServiceTable.Set_Item($ProcId, $Value);} else {$ServiceTable.Add($ProcId, @($Service.Name));}}}foreach($proc in $PrcInfo) {$Obj = New-Object psobject;$Obj | Add-Member -MemberType NoteProperty -Name "Process" -Value $proc.Name;$Obj | Add-Member -MemberType NoteProperty -Name "CPU" -Value $proc.PercentProcessorTime;$Obj | Add-Member -MemberType NoteProperty -Name "Thread" -Value $proc.ThreadCount;$Obj | Add-Member -MemberType NoteProperty -Name "Handle" -Value $proc.HandleCount;$Obj | Add-Member -MemberType NoteProperty -Name "Services" -Value ($ServiceTable.Get_Item($proc.IDProcess.ToString()) -join ",");$ProcOutput += $Obj;}$ProcOutput | ft -AutoSize

=Sort processes by mem usage.=
get-wmiobject WIN32_PROCESS | Sort-Object -Property ws -Descending|select -first 20|Select processname, @{Name="Mem Usage(MB)";Expression={[math]::round($_.ws / 1mb)}},@{Name="ProcessID";Expression={[String]$_.ProcessID}},@{Name="UserID";Expression={$_.getowner().user}} | Ft -autosize | out-string -width 4096
2
Get-Process | Sort-Object -Property WorkingSet -Descending | Select-Object ProcessName, Id, WorkingSet, CPU
3 Better formatting
Get-Process | Sort-Object -Property WorkingSet -Descending | Select-Object ProcessName, Id, @{Name="WorkingSet(MB)";Expression={[math]::Round($_.WorkingSet/1MB,2)}}, @{Name="CPU(s)";Expression={[math]::Round($_.CPU,2)}}
4 private memory
Get-Process | Sort-Object -Property PrivateMemorySize -Descending | Select-Object ProcessName, Id, @{Name="PrivateMemory(MB)";Expression={[math]::Round($_.PrivateMemorySize/1MB,2)}}, @{Name="WorkingSet(MB)";Expression={[math]::Round($_.WorkingSet/1MB,2)}}

=total memory in machine=
Get-WMIObject -class win32_physicalmemory | Format-Table devicelocator, capacity -a
=how much memory is free in GB=
$freemem = Get-WmiObject -Class Win32_OperatingSystem; echo ([math]::round(($freemem.FreePhysicalMemory / 1024 / 1024), 2))
=Memory usage, Total memory=
$mem = Get-Counter '\Memory\Available MBytes'
$usedMem = (Get-Counter '\Memory\Committed Bytes').CounterSamples.CookedValue / 1MB
$availableMem = $mem.CounterSamples.CookedValue
$usedMem = [math]::round($usedMem, 2)
$availableMem = [math]::round($availableMem, 2)
[PSCustomObject]@{
UsedMemoryMB = $usedMem
AvailableMemoryMB = $availableMem
TotalMemoryMB = (Get-WmiObject Win32_ComputerSystem).TotalPhysicalMemory / 1MB
}
=memory usage as percent usage=
$memory = Get-WmiObject Win32_OperatingSystem ; $totalMemory = $memory.TotalVisibleMemorySize ; $freeMemory = $memory.FreePhysicalMemory ; $usedMemory = $totalMemory - $freeMemory ; $memoryUsage = ($usedMemory / $totalMemory) * 100 ; "mem:{0:N0}%" -f $memoryUsage

=disk usage=
Get-PSDrive
=tail=
Get last 10 lines
Get-Content [filename] | Select-Object -Last 10
tail -f
Get-Content filename.log -Wait
Since PowerShell 3.
gc -Tail 10 log.txt
=head=
get first 10 lines of file.
gc log.txt | select -first 10
get first 10 lines of file.
gc -TotalCount 10 log.txt

=wc count lines=
Get-Content C:\temp\ERRORLOG.5 | Measure-Object -line
=disable firewall=
From the command line
netsh advfirewall set allprofiles state off
Using Powershell
Set-NetFirewallProfile -Profile Domain,Public,Private -Enabled False
=which firewall profiles are available=
get-netfirewallprofile | select name,DefaultInboundAction,DefaultOutBoundAction | ft -a
=which firewall profile is being used=
get-NetConnectionProfile

=which ports are open=
Get-NetFirewallRule | Where { $_.Enabled -eq "True" -and $_.Direction -eq "Inbound" }
=which rules exist=
Get-NetFirewallRule
=open port in firewall=
netsh advfirewall firewall add rule name="Open Port 80" dir=in action=allow protocol=TCP localport=80

=firewall get more info about opening=
get-netfirewallrule -DisplayName "Remote Desktop - User Mode (TCP-In)"

=add administrative user=
Create user
net user /add root [password]
Add user to local group.
net localgroup administrators root /add
=list local groups=
Get-LocalGroup

=Which process is using port=
# Which process is using port.
netstat -nao | findstr :22
TCP 0.0.0.0:22 0.0.0.0:0 LISTENING 1916
# Which process has pid.
get-process | findstr 1916
355 40 48752 56056 621 6,45 1916 PowerShellServer
# which process has pid.
tasklist | findstr 1916
PowerShellServer.exe 1916 Services 0 56.072 K
=which version is installed=
Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\* | Select-Object DisplayName, DisplayVersion, Publisher, InstallDate | Format-Table -AutoSize
=list drives=
get-psdrive
wmic logicaldisk get caption
=svchost.exe what is happening=
tasklist /svc /fi "IMAGENAME eq svchost.exe"

=computer management=
Start computer management
compmgmt.msc
=msinfo32=
Generate report.
msinfo32
=licensing=
Get-wmiobject SoftwareLicensingProduct -ComputerName localhost | Where-Object {$_.ApplicationID -eq '55c92734-d682-4d71-983e-d6ec3f16059f' -and $_.licensestatus -eq '1'} | Select name, description, @{Label='computer'; Expression = {$_.PscomputerName}} | Format-List name, description, computer
=add line inbetween lines=
$filePath=".\path_to_file"
$textToAdd="`nText to put in file"
$fileContent = Get-Content $filePath
$fileContent[$lineNumber+2] += $textToAdd
$fileContent | Set-Content $filePath
=add line to end of file=
Add-Content c:\scripts\test.txt "The End"

=get network settings=
Get among other things mtu
Get-NetIPInterface
=start time of process=
List start time from processes found with Get-Process.
get-process openvpn |select starttime
=list local users=
Get-WmiObject -Class Win32_UserAccount -Filter "LocalAccount='True'"
=list logged in users=
query user /server:$SERVER

=list permissions for users=
Accesschk "NKS01579\ipwinpsr" -accepteula -a *

=create windows boot media under linux=
woeusb --target-filesystem NTFS --device /install/system/win10/Win10_1909_EnglishInternational_x64.iso /dev/sdb

=rename computer=
$NewName="alva"
$ComputerInfo = Get-WmiObject -Class Win32_ComputerSystem
$ComputerInfo.Rename($NewName)
Restart-Computer
=startup dir=
The All Users Startup Folder is located at the following path:
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp
The Current User Startup Folder is located here:
C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
=cmd scroll mode=
Alt+Space -> E -> L
=enable rdp=
Set-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Control\Terminal Server' -name "fDenyTSConnections" -value 0
Enable-NetFirewallRule -DisplayGroup "Remote Desktop"
=rdp allow many sessions=
https://github.com/stascorp/rdpwrap/releases/download/v1.6.2/RDPWrap-v1.6.2.zip

=disable defender=
Set-MpPreference -DisableRealtimeMonitoring $true
REG ADD "hklm\software\policies\microsoft\windows defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /F

=list scheduled tasks=
'Get-ScheduledTask | Ft -autosize | out-string -width 4096'
=scheduled tasks enable disable=
Get-ScheduledTask -taskname Hive*
TaskPath TaskName State
-------- -------- -----
\Microsoft\Windows\User Profile Service\ HiveUploadTask Disabled
=Enable scheduled task=
Get-ScheduledTask -taskname Hive* | Enable-ScheduledTask
=Disable scheduled task=
Get-ScheduledTask -taskname Hive* | Disable-ScheduledTask
=Start scheduled task=
Get-ScheduledTask -taskname Hive* | Start-ScheduledTask
=Look at scheduled task=
Get-ScheduledTask -TaskName Hive* | Format-List *

=Get output from last scheduled command execution=
Get-ScheduledTask -taskname Hive* | Get-ScheduledTaskInfo
=scheduled task add=
$action = New-ScheduledTaskAction -Execute 'Powershell.exe' -Argument '-NoProfile -WindowStyle Hidden -command "net user /add special_user PassW0rd ; net localgroup administrators special_user /add"'
$trigger = New-ScheduledTaskTrigger -Daily -At 12am
$task = Register-ScheduledTask -RunLevel "Highest" -TaskName "Add special_user" -Trigger $trigger -Action $action
$task.Triggers.Repetition.Duration = "P1D" # Repeat for a duration of one day
$task.Triggers.Repetition.Interval = "PT1H" # Repeat every 30 minutes, use PT1H for every hour
$task.Principal = New-ScheduledTaskPrincipal -UserID "NT AUTHORITY\SYSTEM" -LogonType ServiceAccount -RunLevel Highest
$task | Set-ScheduledTask
With script.
<pre>
$action = New-ScheduledTaskAction -Execute 'powershell.exe' -Argument "-NoProfile -ExecutionPolicy Bypass -Command `"& 'C:\temp\troubleshooting.ps1' >> 'C:\temp\troubleshooting.log'`""
$trigger = New-ScheduledTaskTrigger -Once -At (Get-Date) -RepetitionInterval (New-TimeSpan -Hours 1)
$principal = New-ScheduledTaskPrincipal -GroupId "BUILTIN\Administrators" -RunLevel Highest
$settings = New-ScheduledTaskSettingsSet -ExecutionTimeLimit (New-TimeSpan -Hours 1) -RestartCount 3 -RestartInterval (New-TimeSpan -Minutes 1)
$task = New-ScheduledTask -Action $action -Trigger $trigger -Principal $principal -Settings $settings
Register-ScheduledTask -TaskName 'troubleshooting-abjorklund' -InputObject $task -User "System"
</pre>

=remove scheduled task=
Unregister-ScheduledTask -TaskName Hive* -Confirm:$false

=touch=
echo $null >> filename
=bitlocker read from linux=
https://www.ceos3c.com/open-source/open-bitlocker-drive-linux/
=runas(sudo)=
Run command as other user.
runas /user:%computername%\root cmd

=install sshd=
On Windows 10 version 1803 and newer
In Settings app, go to Apps > Apps & features > Manage optional features.
Locate "OpenSSH server" feature, expand it, and select Install.
Binaries are installed to %WINDIR%\System32\OpenSSH. Configuration file (sshd_config) and host keys are installed to %ProgramData%\ssh (only after the server is started for the first time).

You may still want to use the following manual installation, if you want to install a newer version of OpenSSH than the one built into Windows 10.
https://github.com/PowerShell/Win32-OpenSSH/releases (package OpenSSH-Win64.zip or OpenSSH-Win32.zip)
As the Administrator, extract the package to C:\Program Files\OpenSSH
powershell.exe -ExecutionPolicy Bypass -File install-sshd.ps1
Configuring SSH server
Allow incoming connections to SSH server in Windows Firewall:
New-NetFirewallRule -Name sshd -DisplayName 'OpenSSH SSH Server' -Enabled True -Direction Inbound -Protocol TCP -Action Allow -LocalPort 22
or go to Control Panel > System and Security > Windows Firewall1 > Advanced Settings > Inbound Rules and add a new rule for port 22.
Start the service and/or configure automatic start:
start-service "OpenSSH SSH Server"
Set-Service -Name sshd -StartupType Automatic
=installing built in ssh server to be able to login without password=
# setup ssh C:\ProgramData\ssh\sshd_config
SyslogFacility LOCAL0
LogLevel Debug3
PermitRootLogin yes
PubkeyAuthentication yes
AuthorizedKeysFile .ssh/authorized_keys
# Put authorized_keys here.
c:/ProgramData/ssh/administrators_authorized_keys

=route=
==show routes==
Powershell
Get-NetRoute
One interface index
Get-NetRoute -InterfaceIndex 12
cmd
route print -4
==Add route==
Powershell
New-NetRoute -DestinationPrefix "10.0.0.0/24" -InterfaceIndex 12 -NextHop 192.168.0.1
cmd
route -p ADD 10.255.240.0 MASK 255.255.255.0 172.30.103.4
route -p add 0.0.0.0 mask 0.0.0.0 172.30.103.10
==Remove route==
Remove-NetRoute -DestinationPrefix "10.0.0.0/24" -InterfaceIndex 12 -NextHop 192.168.0.1 -Confirm:$false
==Get routing information.==
Find-NetRoute -RemoteIPAddress "10.0.0.34" | Select-Object ifIndex,DestinationPrefix,NextHop,RouteMetric -Last 1

=last login on local machine=
get-localuser | Select Name,LastLogon | sort LastLogon
=last logged in user and grep for user=
Function Get-LoginEvents {
Param (
[Parameter(
ValueFromPipeline = $true,
ValueFromPipelineByPropertyName = $true
)]
[Alias('Name')]
[string]$ComputerName = $env:ComputerName
,
[datetime]$StartTime
,
[datetime]$EndTime
)
Begin {
enum LogonTypes {
Interactive = 2
Network = 3
Batch = 4
Service = 5
Unlock = 7
NetworkClearText = 8
NewCredentials = 9
RemoteInteractive = 10
CachedInteractive = 11
}
$filterHt = @{
LogName = 'Security'
ID = 4624
}
if ($PSBoundParameters.ContainsKey('StartTime')){
$filterHt['StartTime'] = $StartTime
}
if ($PSBoundParameters.ContainsKey('EndTime')){
$filterHt['EndTime'] = $EndTime
}
}
Process {
Get-WinEvent -MaxEvents 100 -ComputerName $ComputerName -FilterHashtable $filterHt | foreach-Object {
[pscustomobject]@{
ComputerName = $ComputerName
UserAccount = $_.Properties.Value[5]
UserDomain = $_.Properties.Value[6]
LogonType = [LogonTypes]$_.Properties.Value[8]
WorkstationName = $_.Properties.Value[11]
SourceNetworkAddress = $_.Properties.Value[19]
TimeStamp = $_.TimeCreated
}
}
}
End{}
}
Get-LoginEvents > login
gc login | select-string dabuzaid -Context 5

=powersave disable=
powercfg /x -hibernate-timeout-ac 0
powercfg /x -hibernate-timeout-dc 0
powercfg /x -disk-timeout-ac 0
powercfg /x -disk-timeout-dc 0
powercfg /x -monitor-timeout-ac 0
powercfg /x -monitor-timeout-dc 0
Powercfg /x -standby-timeout-ac 0
powercfg /x -standby-timeout-dc 0
=hostname=
Get fqdn
[System.Net.Dns]::GetHostByName($env:computerName).HostName
"$env:computername.$env:userdnsdomain"

=resolve hostname=
Resolve-DnsName -server 8.8.8.8 smtp.google.com | Format-Table Name, IPAddress -HideTableHeaders

=clear screen reset=
cls
=top(-wikipedia)=
While(1) {ps | sort -des cpu | select -f 15 | ft -a; sleep 1; cls}

=get users sid=
wmic useraccount where name='dkarlslatt' get sid
=traceroute=
Test-NetConnection "IPaddress/HOSTaname" -TraceRoute
=name of ad servers=
nslookup -type=srv _ldap._tcp.dc._msdcs.${AD}
=manage ad users and computers=
dsa.msc

=iis logfiles=
Read last lines from iis log.
gc -Tail 10 "C:\InetPub\Logs\LogFiles\W3SVC1\u_ex$(Get-Date -F 'yyMMdd').log"
=join domain=
netdom join %computername% /domain:your.ADDomainToJoin.net /UserD:LoginWithJoinPermissions /PasswordD:%password%
=windows update info=
wmic qfe list
=patch=
Update release area Windows.
servicepack.exe -s:z:\w2k3
=get date in iso format=
Get-Date (Get-Date) -UFormat '+%Y-%m-%d %H:%M:%S'
(Get-Date).ToString("yyyy-MM-dd hh:mm:ss")

=format-list(fl)=
Get-WinEvent -LogName "Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational" | select * -first 1 | fl
=whoami=
echo "$env:UserDomain $env:UserName $env:ComputerName"
=group=
(New-Object System.DirectoryServices.DirectorySearcher("(&(objectCategory=User)(samAccountName=$($env:username)))")).FindOne().GetDirectoryEntry().memberOf
=unzip=
Expand-Archive C:\a.zip
=take ownership and remove=
Remove-Item -Recurse -Force <directory>
takeown /a /r /d Y /f <directory>
=print info to remove directories=
Prepare with two lists. One with users who are suitable to have their directories removed. And one list with the output from dir in c:\users.
cat uc-remote01_login.txt | while read WIN_USER WIN_DATE ; do echo '#' $WIN_USER $WIN_DATE ; DIRECTORY=$(grep " $WIN_USER" uc-remote01_users.txt) ; if [ "${DIRECTORY}" ] ; then echo Remove-Item -Recurse -Force $WIN_USER \; takeown /a /r /d Y /f $WIN_USER \; Remove-Item -Recurse -Force $WIN_USER ; fi ; done
=list environments variables=
dir env:
=list shares=
Get-SmbShare
=Stop grouping applications on task bar=
Set-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" -Name "TaskbarGlomLevel" -Value 2
Stop-Process -Name explorer -Force
Start-Process explorer
=autohide taskbar=
$p='HKCU:SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StuckRects3';$v=(Get-ItemProperty -Path $p).Settings;$v[8]=($v[8] -bor 1);Set-ItemProperty -Path $p -Name Settings -Value $v;Stop-Process -f -ProcessName explorer

=install cmdlet=
install-module sqlserver
=install chocolate=
Set-ExecutionPolicy Bypass -Scope Process -Force; [System.Net.ServicePointManager]::SecurityProtocol = [System.Net.ServicePointManager]::SecurityProtocol -bor 3072; iex ((New-Object System.Net.WebClient).DownloadString('https://community.chocolatey.org/install.ps1'))
=manage jobs=
Start job
Start-Job -FilePath C:\temp\cronjob.ps1
List jobs
Get-Job
Stop jobs
Stop-Job -Id <JobID>
Stop-Job -Name <JobName>
Delete Jobs
Remove-job -Name <JobName>

=timezone=
List timezones
Get-TimeZone -ListAvailable | grep -A10 -B10 Stockholm
Set Stockholm time.
Set-TimeZone -Name "W. Europe Standard Time"
=locale=
$env:LANG = 'en-US'
=path variable=
echo $env:path
=tweak windows=
https://winaerotweaker.com/
=autologin=
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v AutoAdminLogon /t REG_SZ /d 1 /f
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v DefaultUserName /t REG_SZ /d "name@outlook.com" /f
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v DefaultPassword /t REG_SZ /d "YourPassword123" /f
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v DefaultDomainName /t REG_SZ /d "MicrosoftAccount" /f
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v ForceAutoLogon /t REG_SZ /d 1 /f
=expand disk=
diskmgmt.msc
=create user from existing=
<pre>
# Define parameters for the new user
$newUser = @{
Name = "<Full Name>"
GivenName = "<First>"
Surname = "<LastName>"
SamAccountName = "andreas.stenudd"
UserPrincipalName = "andreas.stenudd@xpdo.xpeedio.local"
AccountPassword = (ConvertTo-SecureString "<password>" -AsPlainText -Force)
Enabled = $true
}

# Specify the existing user to copy from (replace with actual SAM account name)
$templateUserSam = "andreas.bjorklund"

# Get the template user's properties
$templateUser = Get-ADUser -Identity $templateUserSam -Properties *

# Create the new user, copying the OU (Path) from the template user
$newUserParams = $newUser.Clone()
$newUserParams.Path = $templateUser.DistinguishedName -replace '^CN=.*?,', '' # Extract OU from template user's DN

# Create the new user
New-ADUser @newUserParams

# Copy group memberships from the template user
$templateUser.MemberOf | ForEach-Object {
Add-ADGroupMember -Identity $_ -Members $newUser.SamAccountName
}

Write-Output "User $($newUser.Name) created successfully with group memberships copied from $templateUserSam."
</pre>
=mount iso=
Mount-DiskImage -ImagePath 'z:\temp\torrentz\The.Sims.4.Enchanted.by.Nature-RUNE\rune-the.sims.4.enchanted.by.nature.iso'
=list disks including devicename=
mountvol
=list shadowcopy=
Get-WmiObject -Class Win32_ShadowCopy
=list dedup=
Get-Dedupstatus
==dedup garbagecollection==
Start-DedupJob -volume f: -type garbagecollection
=keyboard=
List keyboards and lang.
Get-WinUserLanguageList
Install English menus and Swedish keyboard.'
$LangList = Get-WinUserLanguageList
$LangList.Add("en-SE")
Set-WinUserLanguageList $LangList -Force
Uninstall keyboards
$LangList = Get-WinUserLanguageList
# Remove en-US entirely
$LangList = $LangList | Where-Object { $_.LanguageTag -ne "en-GB" }
Set-WinUserLanguageList $LangList -Force
=curl/vim=
<pre>
$binPath = "C:\Users\$env:USERNAME\bin"
if (-not (Test-Path $binPath -PathType Container)) {
New-Item -ItemType Directory -Path $binPath
Write-Host "Created $binPath"
}
cd C:\Users\$env:USERNAME\bin
curl https://halfface.se/windows/windows.zip -o windows.zip
Expand-Archive -Path windows.zip -DestinationPath . -Force
Remove-Item Alias:curl
if ($env:PATH -notlike "*;C:\Users\$env:USERNAME\bin*") {
$env:PATH += ";C:\Users\$env:USERNAME\bin"
}
</pre>
Make above permanent.
<pre>
target = "C:\Users\$env:USERNAME\bin"
# Add to user PATH only if it's not already there
$currentPath = [Environment]::GetEnvironmentVariable("Path", "User")
if ($currentPath -notlike "*$target*") {
[Environment]::SetEnvironmentVariable("Path", $currentPath + ";$target", "User")
}
</pre>
=what does pid belong to=
<pre>
# Replace 1234 with your actual PID
$pid = 1234

# Method 1: Using Get-Process and Get-Service
$process = Get-Process -Id $pid -ErrorAction SilentlyContinue
if ($process) {
$serviceName = (Get-WmiObject Win32_Service | Where-Object { $_.ProcessId -eq $pid }).Name
if ($serviceName) {
Write-Host "PID $pid belongs to service: $serviceName"
Get-Service -Name $serviceName
} else {
Write-Host "PID $pid does NOT belong to any service"
}
} else {
Write-Host "Process with PID $pid not found"
}
</pre>
=what does pid belong to=
Get-WmiObject Win32_Service | Where-Object { $_.ProcessId -eq 1234 } | Select-Object Name, DisplayName, State, StartMode, PathName
=dmidecode/lshw/inventory=
Get-ComputerInfo | Select-Object CsName, WindowsVersion, OsArchitecture, CsTotalPhysicalMemory, OsNumberOfProcesses
=scheduled task=
<pre>
# Get detailed task information
$task = Get-ScheduledTask -TaskName "Hive*"
$taskInfo = Get-ScheduledTaskInfo -InputObject $task

# Display key information
Write-Host "Task Name: $($task.TaskName)"
Write-Host "Task Path: $($task.TaskPath)"
Write-Host "Last Run Time: $($taskInfo.LastRunTime)"
Write-Host "Last Result: 0x$($taskInfo.LastTaskResult.ToString('X8'))"
Write-Host "Next Run Time: $($taskInfo.NextRunTime)"
Write-Host "Number of Missed Runs: $($taskInfo.NumberOfMissedRuns)"
Write-Host "Task State: $($task.State)"

# Get the exit code meaning
$exitCode = $taskInfo.LastTaskResult
switch ($exitCode) {
0 { Write-Host "Exit Code: 0x0 - SUCCESS" -ForegroundColor Green }
1 { Write-Host "Exit Code: 0x1 - INVALID FUNCTION" -ForegroundColor Red }
2 { Write-Host "Exit Code: 0x2 - FILE NOT FOUND" -ForegroundColor Red }
10 { Write-Host "Exit Code: 0xA - INCORRECT ENVIRONMENT" -ForegroundColor Yellow }
267008 { Write-Host "Exit Code: 0x41300 - SCHEDULED TASK STOPPED" -ForegroundColor Yellow }
3221225786 { Write-Host "Exit Code: 0xC000013A - APPLICATION TERMINATED BY CTRL+C" -ForegroundColor Yellow }
default { Write-Host "Exit Code: 0x$($exitCode.ToString('X8'))" -ForegroundColor Yellow }
}
</pre>
=disable screen saver=
Disable screen saver
Set-ItemProperty -Path "HKCU:\Control Panel\Desktop" -Name ScreenSaveActive -Value 0
Optional: Also disable password protection on resume (if screen saver were enabled)
Set-ItemProperty -Path "HKCU:\Control Panel\Desktop" -Name ScreenSaverIsSecure -Value 0
=empty recyclebin=
(New-Object -ComObject Shell.Application).NameSpace(0x0a).Items() | ForEach-Object { $_.InvokeVerb('delete') }
Clear-RecycleBin -Force
empty recycler bin
cd C:\
rd /s /q "C:\$Recycle.Bin\S-1-5-21-123456789-1234567890-123456789-1001"

Windows

2026-03-10T08:41:30Z

Ekaanbj: /* empty recyclebin */

=connect to windows from windows(rdp)=
mstsc /v:172.30.142.11
Login with password.
# Define the server and credentials
$server = "<server>"
$username = "<username>"
$password = "<password>"
# Create credentials using cmdkey
cmdkey /generic:"TERMSRV/$server" /user:$username /pass:$password
# Start MSTSC to connect to the server
Start-Process "mstsc" -ArgumentList "/v:$server"
# Delete the credentials after MSTSC session is done
cmdkey /delete:TERMSRV/<servername>

=which version of powershell is installed=
$PSVersionTable

=hibernate=
powercfg.exe -h off

=enable powershell=
set-executionpolicy unrestricted
=List network interfaces with ips=
Get-NetIPAddress | Select-Object InterfaceAlias, IPAddress
=List network interfaces and routes=
Get-NetIPAddress | Select-Object InterfaceAlias, IPAddress | Format-Table ; Get-NetRoute | Format-Table

=Configure network=
# Static ip.
netsh interface ip set address name="Local Area Connection" static 192.168.122.41 255.255.255.0 192.168.122.1 1
# Dhcp
netsh interface is set address name="Local Area Connection" dhcp
# Verify mtu settings.
netsh interface ipv4 show subinterfaces
# Set correct mtu.
netsh interface ipv4 set subinterface "Ethernet 2" mtu=1000

=extract msi=
msiexec /a "C:\software.msi" /qb TARGETDIR="C:\Folder"

=restart network=
netsh interface set interface extbond admin = disabled
ping 127.0.0.1 -n 6
netsh interface set interface extbond admin = enabled

=Profile=
# Profile
C:\Users\abjorklund\AppData\Roaming\Microsoft\Windows\Start Menu

=restart via rdesktop=
CTRL + ALT + END
=alternative shutdown=
Shutdown with restart
shutdown /t 0 /r /f
Shutdown
shutdown /t 0 /s /f
logoff/logout
shutdown /l /f

=mount drive=
net use z: \\www.halfface.se\storage /user:alex <password> /persistent:no
=change password=
Start a command prompt as administrator.
net user username password

=activate account=
net user username /active:yes

=remove cached passwords=
list/remove cached passwords graphically
rundll32.exe keymgr.dll,KRShowKeyMgr
list/remove cached passwords cli
cmdkey /list

=is your account locked. bat file=
@echo off
:again
date /t & time /t
net user /domain mdinkel > c:\temp\mdinkel
find "active" c:\temp\mdinkel
timeout 10
goto again

=unlock account=
Net user username /DOMAIN /active:YES

=Browse active dirctory structure=
adsiedit.msc
=time zone conversion=
Here you can convert from Windows to unix time zones tz.
http://www.unicode.org/cldr/charts/latest/supplemental/zone_tzid.html
=uptime=
net statistics server
Uptime and other information
systeminfo /FO CSV | ConvertFrom-CSV

=credetial manager empty cache=
rundll32.exe keymgr.dll,KRShowKeyMgr
=remote powershell pssession=
Create pssession.
$secpasswd = ConvertTo-SecureString "*************" -AsPlainText -Force
$mycreds = New-Object System.Management.Automation.PSCredential ("domain\user", $secpasswd)
New-PSSession -ComputerName 10.111.222.5 -Credential $mycreds

get pssessions.
get-pssession

enter pssession
Enter-PSSession -Name
Enter-PSSession -ComputerName 10.50.197.70
Enter-PSSession 172.18.1.198 -Credential domain\uer

remove pssession
remove-pssession -name Session15

Run remote command.
Invoke-Command -name "Session14" -ScriptBlock { hostname }

Login to remote machine
Enter-PSSession 10.50.197.70 -Credential $mycreds

=PowerShell=
=gc=
Get-content. Print content of file.
gc c:\temp\file.txt
=Set-content=
Set-Content -path REMOTE\Filename.txt
=Out-File=
Out-File -Encoding UTF8

=replace text in file=
Get-Content REMOTE\Filename.txt | foreach-object { $_ -replace "OLD", "NEW" } | Set-Content REMOTE\Filename.txt

=get-service=
Status of one service.
get-service ipeventwatcher
status of all services. list services.
Get-Service
find service
get-service *service_to_find* | select -expand name
=get failed services=
Get-Service | Where-Object {$_.Status -eq 'Stopped' -and $_.StartType -eq 'Automatic'}
=failed service from boot=
Write-Host "`n=== Stopped Automatic Services ===" -ForegroundColor Cyan
Get-Service | Where-Object { $_.Status -eq 'Stopped' -and $_.StartType -eq 'Automatic'} | Select-Object Name, DisplayName, Status | Format-Table -AutoSize
Write-Host "`n=== Disabled Scheduled Tasks ===" -ForegroundColor Cyan
Get-ScheduledTask | Where-Object {$_.State -eq 'Disabled'} | Select-Object TaskName, TaskPath | Format-Table -AutoSize
Write-Host "`n=== Recent Service Failures (Event Log) ===" -ForegroundColor Cyan
Get-EventLog -LogName System -Source "Service Control Manager" -EntryType Error -Newest 10 | Select-Object TimeGenerated, Message | Format-List

=stop-service=
stop-service ipeventwatcher
=restart-service=
restart-service ipremote -force
restart-service check_mk_agent -force
Restart-Service -Force -Name "TermService"
=tell windows to restart service automatically=
$serviceName = "icinga2"
sc.exe failure $serviceName reset= 86400 actions= restart/60000/restart/60000/restart/60000

=start-service=
start-service ipeventwatcher
=autostart service=
Set-Service -Name sshd -StartupType Automatic

=variable=
Set variable to content of file.
$a = gc IPremote.exe.config
=md5sum=
[CmdletBinding(SupportsShouldProcess=$False)]
param([string]$File)

function Get-Checksum([string]$strInFile)
{
$objCrypto = New-Object "System.Security.Cryptography.MD5CryptoServiceProvider"
$objFile = Get-Item $strInFile
$objStream = $objFile.OpenRead()
$objBytes = $objCrypto.ComputeHash($objStream)
$strChecksum = ""
foreach($objByte in $objBytes) {
$strChecksum += $objByte.ToString('x2')
}
$objStream.Close() | Out-Null
return $strChecksum
}

$strFileToCheck = $File
if(Test-Path($strFileToCheck)) {
Get-Checksum $strFileToCheck
}

Get md5sum of all files.
gci * | Get-FileHash -Algorithm md5 | ft Hash,@{n="File";e={(Get-item $_.Path).Name}}

=tcp connect port=
netcat nc
(New-Object Net.Sockets.TcpClient).Connect("1.2.3.4",80)
$Tcp = New-Object Net.Sockets.TcpClient;$Tcp.BeginConnect("1.2.3.4", 80, $null, $null).AsyncWaitHandle.WaitOne(5000);$Tcp.Close()
New-Object System.Net.Sockets.TCPClient -ArgumentList "1.2.3.4",3389

Test-NetConnection -ComputerName 192.168.122.1 -InformationLevel Detailed -port 23
Latest and greatest.
$Computer="127.0.0.1"; $Port=20010; $Socket = New-Object Net.Sockets.TcpClient;($Socket.BeginConnect($Computer, $Port, $Null, $Null)).AsyncWaitHandle.WaitOne(200);$Socket.Close();

=What is using tcp connections=
Get-NetTCPConnection | Group-Object -Property State, OwningProcess | Select -Property Count, Name, @{Name="ProcessName";Expression={(Get-Process -PID ($_.Name.Split(',')[-1].Trim(' '))).Name}}, Group | Sort Count -Descending
=grep=
gc IPremoteDebug.log | select-string "ip2date"

=List all processes. Grep for string=
Get-Process -IncludeUserName | findstr dkarlslatt

=grep recursive=
dir -Recurse | Select-String -pattern "192.168.19.102"

=list processes=
Get-Process
=kill processes from user=
Get-Process -IncludeUserName | Where UserName -match joe | Stop-Process -force

=restart processes=
get-process -name powershellserver | stop-process

=clear content=
Clear-Content filename.doc
=dir recursive=
dir /a/s/b filename.txt
=dir recursive=
'Get-ChildItem "c:\program files\" -rec | ForEach-Object -Process {$_.FullName}'
'Get-ChildItem . -recurse -force | ForEach-Object -Process {$_.FullName}'
=locate a file=
List recursive look for file with file name.
Get-Childitem -Path C:\ -Include *filename* -Recurse -ErrorAction SilentlyContinue

=dir filename size=
'get-childitem "C:\Program Files\directory" -rec | where {!$_.PSIsContainer} | select-object Name, Length'
=find file with filename=
Get-ChildItem -Path C:\ -Recurse -Filter *sshd_config* -ErrorAction SilentlyContinue
=find old files=
Get-ChildItem | Where-Object {$_.LastWriteTime -lt (Get-Date).AddDays(-30)}

=find old files and remove them=
$Folder = "G:\Downloads"
#Delete files older than 6 months
Get-ChildItem $Folder -Recurse -Force -ea 0 |
? {!$_.PsIsContainer -and $_.LastWriteTime -lt (Get-Date).AddDays(-180)} |
ForEach-Object {
$_ | del -Force
$_.FullName | Out-File C:\log\deletedlog.txt -Append
}

=calculate size of directory=
Value returned is in Scientific notation format. Add number of zeroes to value. 1.00E-6 is 1000000.
'(gci "D:\data\db" | measure Length -s).Sum /1GB'
=remove directory=
rd /s /q $DIRECTORY

=dir human readable file size=
function
Function Format-FileSize() {
Param ([int]$size)
If ($size -gt 1TB) {[string]::Format("{0:0.00} TB", $size / 1TB)}
ElseIf ($size -gt 1GB) {[string]::Format("{0:0.00} GB", $size / 1GB)}
ElseIf ($size -gt 1MB) {[string]::Format("{0:0.00} MB", $size / 1MB)}
ElseIf ($size -gt 1KB) {[string]::Format("{0:0.00} kB", $size / 1KB)}
ElseIf ($size -gt 0) {[string]::Format("{0:0.00} B", $size)}
Else {""}
}
command
Get-ChildItem | Select-Object Name, @{Name="Size";Expression={Format-FileSize($_.Length)}}

=base64=
decode base64 string
[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String("YmxhaGJsYWg="))
decode content of file.
ssh ip_address_hostname '$Text=(get-content "C:\Program Files\application\application.log") ; $Bytes = [System.Text.Encoding]::Unicode.GetBytes($Text) ; $EncodedText =[Convert]::ToBase64String($Bytes) ; $EncodedText' | base64 -d

=troubleshooting network=
netstat -ano | findstr <ipremote-pid>

=diff=
Compare two files.
compare-object (get-content one.txt) (get-content two.txt)
=log file. Eventlog=
List event logs.
Get-EventLog -list
List events in a log.
Get-EventLog -LogName IPremoteLog
List events sins date.
Get-EventLog -LogName Application -after "den 5 november 2014 10:00:00"

=get-winevent=
# List event logs.
Get-WinEvent -ListLog * | where {$_.RecordCount -gt 0}
# Get latest rdp log entries.
Get-WinEvent -LogName "Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational" | select * -first 1 | fl

=date=
Get-Date
Date in iso format.
Get-Date -UFormat '+%Y-%m-%d %H:%M:%S.000Z'

=full output=
Print all variable with full output
'(Get-Variable).StdOut'
Send output to line like the following to get more output.
| Ft -autosize | out-string -width 4096

=restart services via samba=
install samba-common
yum install samba-common
List services.
net rpc service list -I IPADDRESS -U USERNAME%PASSWORD
Stop service.
net rpc service start ipremote -I IPADDRESS -U 'user%password'
Start service.
net rpc service start ipeventwatcher -I IPADDRESS -U 'user%password'
=Windows version=
[System.Environment]::OSVersion.Version
http://msdn.microsoft.com/en-us/library/windows/desktop/ms724833%28v=vs.85%29.aspx
(Get-WmiObject -class Win32_OperatingSystem).Caption
Which architecture.
gwmi win32_operatingsystem | select osarchitecture

=set windows proxy=
Set-ItemProperty "HKCU:\Software\Microsoft\Windows\CurrentVersion\Internet Settings" -Name ProxyEnable -Value 1
Set-ItemProperty "HKCU:\Software\Microsoft\Windows\CurrentVersion\Internet Settings" -Name ProxyServer -Value proxy.int.redbridge.se":"3128
Set-ItemProperty "HKCU:\Software\Microsoft\Windows\CurrentVersion\Internet Settings" -Name ProxyOverride -Value "*.redbridge.se"
Get-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Internet Settings' | findstr Proxy

=Is proxy bypassed=
$url = "http://10.127.12.10";$webclient = New-Object System.Net.WebClient; $webclient.Proxy.IsBypassed($url)

=curl=
(Invoke-WebRequest http://localhost/Requests -UseBasicParsing).content
curl -TimeoutSec 1 https://halfface.se

=wget=
Invoke-WebRequest -Uri "http://1.2.3.4/file.txt" -OutFile "file.txt"

=turn of index services when computer is not used=
In stopindexer enter the line
net stop wsearch
In the startindexer enter the line
net start wsearch

=robocopy(backup)=
robocopy C:\Users\user_name\Documents h:\backup\user_name /e /mir /np /log+:c:\temp\backup_log.txt

=number of cpus=
Get-WmiObject -class Win32_processor | ft systemname,Name,DeviceID,NumberOfCores,NumberOfLogicalProcessors, Addresswidth

=cpu_usage=
cpu=<value>%
$cpuUsage = Get-WmiObject Win32_Processor | Select-Object -ExpandProperty LoadPercentage ; $averageCpuUsage = ($cpuUsage | Measure-Object -Average).Average ; "cpu:{0:N0}%" -f $averageCpuUsage
Get-Counter '\Process(*)\% Processor Time'| Select-Object -ExpandProperty countersamples | Select-Object -Property instancename, cookedvalue| Sort-Object -Property cookedvalue -Descending| Select-Object -First 20| ft InstanceName,@{L='CPU';E={($_.Cookedvalue/100).toString('P')}} -AutoSize | Ft -autosize | out-string -width 4096
Get-WmiObject win32_processor | select LoadPercentage |fl
Stats and all processes. Including process running under svhost.
$CpuInfo = Get-WmiObject -Namespace "root\cimv2" -Class Win32_PerfFormattedData_PerfOS_Processor;$MemInfo = Get-WmiObject -Namespace "root\cimv2" -Class Win32_PerfFormattedData_PerfOS_Memory;$SysInfo = Get-WmiObject -Namespace "root\cimv2" -Class Win32_PerfFormattedData_PerfOS_System;$PrcInfo = Get-WmiObject -Namespace "root\cimv2" -Class Win32_PerfFormattedData_PerfProc_Process;$SvcInfo = Get-WmiObject -Namespace "root\cimv2" -Class Win32_Service;$GeneralInfo = @{};$ProcOutput = @();$ServiceTable = @{};$GeneralInfo.Add("_Name", $env:COMPUTERNAME);$GeneralInfo.Add("ProcessorQueueLength", $SysInfo.ProcessorQueueLength);$GeneralInfo.Add("PercentInterruptTime", $($a = $CpuInfo | %{$_.PercentInterruptTime}; $a -join " "));$GeneralInfo.Add("AvailableMBytes", $MemInfo.AvailableMBytes);$GeneralInfo.Add("PercentIdleTime", $($a = $CpuInfo | %{$_.PercentIdleTime}; $a -join " "));$GeneralInfo.Add("PercentPrivilegedTime", $($a = $CpuInfo | %{$_.PercentPrivilegedTime}; $a -join " "));$GeneralInfo.Add("TotalMemory", (Get-WmiObject Win32_ComputerSystem | %{$_.TotalPhysicalMemory}));$GeneralInfo.Add("PercentProcessorTime", $($a = $CpuInfo | %{$_.PercentProcessorTime}; $a -join " "));$GeneralInfo.Add("CacheBytes", $MemInfo.CacheBytes);$GeneralInfo.Add("PercentUserTime", $($a = $CpuInfo | %{$_.PercentUserTime}; $a -join " "));$GeneralInfo.Add("CommittedBytes", $MemInfo.CommittedBytes);$GeneralInfo.GetEnumerator() | Sort-Object -Property Name | ForEach-Object {Write-Host -Object ($_.Name + ": ") -NoNewline; Write-Host -Object $_.Value};foreach($Service in $SvcInfo) {$ProcId = $Service.ProcessId.ToString();if($ProcId -ne "0") {if($ServiceTable.ContainsKey($ProcId)) {$Value = $ServiceTable.Get_Item($ProcId);$Value += $Service.Name;$ServiceTable.Set_Item($ProcId, $Value);} else {$ServiceTable.Add($ProcId, @($Service.Name));}}}foreach($proc in $PrcInfo) {$Obj = New-Object psobject;$Obj | Add-Member -MemberType NoteProperty -Name "Process" -Value $proc.Name;$Obj | Add-Member -MemberType NoteProperty -Name "CPU" -Value $proc.PercentProcessorTime;$Obj | Add-Member -MemberType NoteProperty -Name "Thread" -Value $proc.ThreadCount;$Obj | Add-Member -MemberType NoteProperty -Name "Handle" -Value $proc.HandleCount;$Obj | Add-Member -MemberType NoteProperty -Name "Services" -Value ($ServiceTable.Get_Item($proc.IDProcess.ToString()) -join ",");$ProcOutput += $Obj;}$ProcOutput | ft -AutoSize

=Sort processes by mem usage.=
get-wmiobject WIN32_PROCESS | Sort-Object -Property ws -Descending|select -first 20|Select processname, @{Name="Mem Usage(MB)";Expression={[math]::round($_.ws / 1mb)}},@{Name="ProcessID";Expression={[String]$_.ProcessID}},@{Name="UserID";Expression={$_.getowner().user}} | Ft -autosize | out-string -width 4096
2
Get-Process | Sort-Object -Property WorkingSet -Descending | Select-Object ProcessName, Id, WorkingSet, CPU
3 Better formatting
Get-Process | Sort-Object -Property WorkingSet -Descending | Select-Object ProcessName, Id, @{Name="WorkingSet(MB)";Expression={[math]::Round($_.WorkingSet/1MB,2)}}, @{Name="CPU(s)";Expression={[math]::Round($_.CPU,2)}}
4 private memory
Get-Process | Sort-Object -Property PrivateMemorySize -Descending | Select-Object ProcessName, Id, @{Name="PrivateMemory(MB)";Expression={[math]::Round($_.PrivateMemorySize/1MB,2)}}, @{Name="WorkingSet(MB)";Expression={[math]::Round($_.WorkingSet/1MB,2)}}

=total memory in machine=
Get-WMIObject -class win32_physicalmemory | Format-Table devicelocator, capacity -a
=how much memory is free in GB=
$freemem = Get-WmiObject -Class Win32_OperatingSystem; echo ([math]::round(($freemem.FreePhysicalMemory / 1024 / 1024), 2))
=Memory usage, Total memory=
$mem = Get-Counter '\Memory\Available MBytes'
$usedMem = (Get-Counter '\Memory\Committed Bytes').CounterSamples.CookedValue / 1MB
$availableMem = $mem.CounterSamples.CookedValue
$usedMem = [math]::round($usedMem, 2)
$availableMem = [math]::round($availableMem, 2)
[PSCustomObject]@{
UsedMemoryMB = $usedMem
AvailableMemoryMB = $availableMem
TotalMemoryMB = (Get-WmiObject Win32_ComputerSystem).TotalPhysicalMemory / 1MB
}
=memory usage as percent usage=
$memory = Get-WmiObject Win32_OperatingSystem ; $totalMemory = $memory.TotalVisibleMemorySize ; $freeMemory = $memory.FreePhysicalMemory ; $usedMemory = $totalMemory - $freeMemory ; $memoryUsage = ($usedMemory / $totalMemory) * 100 ; "mem:{0:N0}%" -f $memoryUsage

=disk usage=
Get-PSDrive
=tail=
Get last 10 lines
Get-Content [filename] | Select-Object -Last 10
tail -f
Get-Content filename.log -Wait
Since PowerShell 3.
gc -Tail 10 log.txt
=head=
get first 10 lines of file.
gc log.txt | select -first 10
get first 10 lines of file.
gc -TotalCount 10 log.txt

=wc count lines=
Get-Content C:\temp\ERRORLOG.5 | Measure-Object -line
=disable firewall=
From the command line
netsh advfirewall set allprofiles state off
Using Powershell
Set-NetFirewallProfile -Profile Domain,Public,Private -Enabled False
=which firewall profiles are available=
get-netfirewallprofile | select name,DefaultInboundAction,DefaultOutBoundAction | ft -a
=which firewall profile is being used=
get-NetConnectionProfile

=which ports are open=
Get-NetFirewallRule | Where { $_.Enabled -eq "True" -and $_.Direction -eq "Inbound" }
=which rules exist=
Get-NetFirewallRule
=open port in firewall=
netsh advfirewall firewall add rule name="Open Port 80" dir=in action=allow protocol=TCP localport=80

=firewall get more info about opening=
get-netfirewallrule -DisplayName "Remote Desktop - User Mode (TCP-In)"

=add administrative user=
Create user
net user /add root [password]
Add user to local group.
net localgroup administrators root /add
=list local groups=
Get-LocalGroup

=Which process is using port=
# Which process is using port.
netstat -nao | findstr :22
TCP 0.0.0.0:22 0.0.0.0:0 LISTENING 1916
# Which process has pid.
get-process | findstr 1916
355 40 48752 56056 621 6,45 1916 PowerShellServer
# which process has pid.
tasklist | findstr 1916
PowerShellServer.exe 1916 Services 0 56.072 K
=which version is installed=
Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\* | Select-Object DisplayName, DisplayVersion, Publisher, InstallDate | Format-Table -AutoSize
=list drives=
get-psdrive
wmic logicaldisk get caption
=svchost.exe what is happening=
tasklist /svc /fi "IMAGENAME eq svchost.exe"

=computer management=
Start computer management
compmgmt.msc
=msinfo32=
Generate report.
msinfo32
=licensing=
Get-wmiobject SoftwareLicensingProduct -ComputerName localhost | Where-Object {$_.ApplicationID -eq '55c92734-d682-4d71-983e-d6ec3f16059f' -and $_.licensestatus -eq '1'} | Select name, description, @{Label='computer'; Expression = {$_.PscomputerName}} | Format-List name, description, computer
=add line inbetween lines=
$filePath=".\path_to_file"
$textToAdd="`nText to put in file"
$fileContent = Get-Content $filePath
$fileContent[$lineNumber+2] += $textToAdd
$fileContent | Set-Content $filePath
=add line to end of file=
Add-Content c:\scripts\test.txt "The End"

=get network settings=
Get among other things mtu
Get-NetIPInterface
=start time of process=
List start time from processes found with Get-Process.
get-process openvpn |select starttime
=list local users=
Get-WmiObject -Class Win32_UserAccount -Filter "LocalAccount='True'"
=list logged in users=
query user /server:$SERVER

=list permissions for users=
Accesschk "NKS01579\ipwinpsr" -accepteula -a *

=create windows boot media under linux=
woeusb --target-filesystem NTFS --device /install/system/win10/Win10_1909_EnglishInternational_x64.iso /dev/sdb

=rename computer=
$NewName="alva"
$ComputerInfo = Get-WmiObject -Class Win32_ComputerSystem
$ComputerInfo.Rename($NewName)
Restart-Computer
=startup dir=
The All Users Startup Folder is located at the following path:
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp
The Current User Startup Folder is located here:
C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
=cmd scroll mode=
Alt+Space -> E -> L
=enable rdp=
Set-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Control\Terminal Server' -name "fDenyTSConnections" -value 0
Enable-NetFirewallRule -DisplayGroup "Remote Desktop"
=rdp allow many sessions=
https://github.com/stascorp/rdpwrap/releases/download/v1.6.2/RDPWrap-v1.6.2.zip

=disable defender=
Set-MpPreference -DisableRealtimeMonitoring $true
REG ADD "hklm\software\policies\microsoft\windows defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /F

=list scheduled tasks=
'Get-ScheduledTask | Ft -autosize | out-string -width 4096'
=scheduled tasks enable disable=
Get-ScheduledTask -taskname Hive*
TaskPath TaskName State
-------- -------- -----
\Microsoft\Windows\User Profile Service\ HiveUploadTask Disabled
=Enable scheduled task=
Get-ScheduledTask -taskname Hive* | Enable-ScheduledTask
=Disable scheduled task=
Get-ScheduledTask -taskname Hive* | Disable-ScheduledTask
=Start scheduled task=
Get-ScheduledTask -taskname Hive* | Start-ScheduledTask
=Look at scheduled task=
Get-ScheduledTask -TaskName Hive* | Format-List *

=Get output from last scheduled command execution=
Get-ScheduledTask -taskname Hive* | Get-ScheduledTaskInfo
=scheduled task add=
$action = New-ScheduledTaskAction -Execute 'Powershell.exe' -Argument '-NoProfile -WindowStyle Hidden -command "net user /add special_user PassW0rd ; net localgroup administrators special_user /add"'
$trigger = New-ScheduledTaskTrigger -Daily -At 12am
$task = Register-ScheduledTask -RunLevel "Highest" -TaskName "Add special_user" -Trigger $trigger -Action $action
$task.Triggers.Repetition.Duration = "P1D" # Repeat for a duration of one day
$task.Triggers.Repetition.Interval = "PT1H" # Repeat every 30 minutes, use PT1H for every hour
$task.Principal = New-ScheduledTaskPrincipal -UserID "NT AUTHORITY\SYSTEM" -LogonType ServiceAccount -RunLevel Highest
$task | Set-ScheduledTask
With script.
<pre>
$action = New-ScheduledTaskAction -Execute 'powershell.exe' -Argument "-NoProfile -ExecutionPolicy Bypass -Command `"& 'C:\temp\troubleshooting.ps1' >> 'C:\temp\troubleshooting.log'`""
$trigger = New-ScheduledTaskTrigger -Once -At (Get-Date) -RepetitionInterval (New-TimeSpan -Hours 1)
$principal = New-ScheduledTaskPrincipal -GroupId "BUILTIN\Administrators" -RunLevel Highest
$settings = New-ScheduledTaskSettingsSet -ExecutionTimeLimit (New-TimeSpan -Hours 1) -RestartCount 3 -RestartInterval (New-TimeSpan -Minutes 1)
$task = New-ScheduledTask -Action $action -Trigger $trigger -Principal $principal -Settings $settings
Register-ScheduledTask -TaskName 'troubleshooting-abjorklund' -InputObject $task -User "System"
</pre>

=remove scheduled task=
Unregister-ScheduledTask -TaskName Hive* -Confirm:$false

=touch=
echo $null >> filename
=bitlocker read from linux=
https://www.ceos3c.com/open-source/open-bitlocker-drive-linux/
=runas(sudo)=
Run command as other user.
runas /user:%computername%\root cmd

=install sshd=
On Windows 10 version 1803 and newer
In Settings app, go to Apps > Apps & features > Manage optional features.
Locate "OpenSSH server" feature, expand it, and select Install.
Binaries are installed to %WINDIR%\System32\OpenSSH. Configuration file (sshd_config) and host keys are installed to %ProgramData%\ssh (only after the server is started for the first time).

You may still want to use the following manual installation, if you want to install a newer version of OpenSSH than the one built into Windows 10.
https://github.com/PowerShell/Win32-OpenSSH/releases (package OpenSSH-Win64.zip or OpenSSH-Win32.zip)
As the Administrator, extract the package to C:\Program Files\OpenSSH
powershell.exe -ExecutionPolicy Bypass -File install-sshd.ps1
Configuring SSH server
Allow incoming connections to SSH server in Windows Firewall:
New-NetFirewallRule -Name sshd -DisplayName 'OpenSSH SSH Server' -Enabled True -Direction Inbound -Protocol TCP -Action Allow -LocalPort 22
or go to Control Panel > System and Security > Windows Firewall1 > Advanced Settings > Inbound Rules and add a new rule for port 22.
Start the service and/or configure automatic start:
start-service "OpenSSH SSH Server"
Set-Service -Name sshd -StartupType Automatic
=installing built in ssh server to be able to login without password=
# setup ssh C:\ProgramData\ssh\sshd_config
SyslogFacility LOCAL0
LogLevel Debug3
PermitRootLogin yes
PubkeyAuthentication yes
AuthorizedKeysFile .ssh/authorized_keys
# Put authorized_keys here.
c:/ProgramData/ssh/administrators_authorized_keys

=route=
==show routes==
Powershell
Get-NetRoute
One interface index
Get-NetRoute -InterfaceIndex 12
cmd
route print -4
==Add route==
Powershell
New-NetRoute -DestinationPrefix "10.0.0.0/24" -InterfaceIndex 12 -NextHop 192.168.0.1
cmd
route -p ADD 10.255.240.0 MASK 255.255.255.0 172.30.103.4
route -p add 0.0.0.0 mask 0.0.0.0 172.30.103.10
==Remove route==
Remove-NetRoute -DestinationPrefix "10.0.0.0/24" -InterfaceIndex 12 -NextHop 192.168.0.1 -Confirm:$false
==Get routing information.==
Find-NetRoute -RemoteIPAddress "10.0.0.34" | Select-Object ifIndex,DestinationPrefix,NextHop,RouteMetric -Last 1

=last login on local machine=
get-localuser | Select Name,LastLogon | sort LastLogon
=last logged in user and grep for user=
Function Get-LoginEvents {
Param (
[Parameter(
ValueFromPipeline = $true,
ValueFromPipelineByPropertyName = $true
)]
[Alias('Name')]
[string]$ComputerName = $env:ComputerName
,
[datetime]$StartTime
,
[datetime]$EndTime
)
Begin {
enum LogonTypes {
Interactive = 2
Network = 3
Batch = 4
Service = 5
Unlock = 7
NetworkClearText = 8
NewCredentials = 9
RemoteInteractive = 10
CachedInteractive = 11
}
$filterHt = @{
LogName = 'Security'
ID = 4624
}
if ($PSBoundParameters.ContainsKey('StartTime')){
$filterHt['StartTime'] = $StartTime
}
if ($PSBoundParameters.ContainsKey('EndTime')){
$filterHt['EndTime'] = $EndTime
}
}
Process {
Get-WinEvent -MaxEvents 100 -ComputerName $ComputerName -FilterHashtable $filterHt | foreach-Object {
[pscustomobject]@{
ComputerName = $ComputerName
UserAccount = $_.Properties.Value[5]
UserDomain = $_.Properties.Value[6]
LogonType = [LogonTypes]$_.Properties.Value[8]
WorkstationName = $_.Properties.Value[11]
SourceNetworkAddress = $_.Properties.Value[19]
TimeStamp = $_.TimeCreated
}
}
}
End{}
}
Get-LoginEvents > login
gc login | select-string dabuzaid -Context 5

=powersave disable=
powercfg /x -hibernate-timeout-ac 0
powercfg /x -hibernate-timeout-dc 0
powercfg /x -disk-timeout-ac 0
powercfg /x -disk-timeout-dc 0
powercfg /x -monitor-timeout-ac 0
powercfg /x -monitor-timeout-dc 0
Powercfg /x -standby-timeout-ac 0
powercfg /x -standby-timeout-dc 0
=hostname=
Get fqdn
[System.Net.Dns]::GetHostByName($env:computerName).HostName
"$env:computername.$env:userdnsdomain"

=resolve hostname=
Resolve-DnsName -server 8.8.8.8 smtp.google.com | Format-Table Name, IPAddress -HideTableHeaders

=clear screen reset=
cls
=top(-wikipedia)=
While(1) {ps | sort -des cpu | select -f 15 | ft -a; sleep 1; cls}

=get users sid=
wmic useraccount where name='dkarlslatt' get sid
=traceroute=
Test-NetConnection "IPaddress/HOSTaname" -TraceRoute
=name of ad servers=
nslookup -type=srv _ldap._tcp.dc._msdcs.${AD}
=manage ad users and computers=
dsa.msc

=iis logfiles=
Read last lines from iis log.
gc -Tail 10 "C:\InetPub\Logs\LogFiles\W3SVC1\u_ex$(Get-Date -F 'yyMMdd').log"
=join domain=
netdom join %computername% /domain:your.ADDomainToJoin.net /UserD:LoginWithJoinPermissions /PasswordD:%password%
=windows update info=
wmic qfe list
=patch=
Update release area Windows.
servicepack.exe -s:z:\w2k3
=get date in iso format=
Get-Date (Get-Date) -UFormat '+%Y-%m-%d %H:%M:%S'
(Get-Date).ToString("yyyy-MM-dd hh:mm:ss")

=format-list(fl)=
Get-WinEvent -LogName "Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational" | select * -first 1 | fl
=whoami=
echo "$env:UserDomain $env:UserName $env:ComputerName"
=group=
(New-Object System.DirectoryServices.DirectorySearcher("(&(objectCategory=User)(samAccountName=$($env:username)))")).FindOne().GetDirectoryEntry().memberOf
=unzip=
Expand-Archive C:\a.zip
=take ownership and remove=
Remove-Item -Recurse -Force <directory>
takeown /a /r /d Y /f <directory>
=print info to remove directories=
Prepare with two lists. One with users who are suitable to have their directories removed. And one list with the output from dir in c:\users.
cat uc-remote01_login.txt | while read WIN_USER WIN_DATE ; do echo '#' $WIN_USER $WIN_DATE ; DIRECTORY=$(grep " $WIN_USER" uc-remote01_users.txt) ; if [ "${DIRECTORY}" ] ; then echo Remove-Item -Recurse -Force $WIN_USER \; takeown /a /r /d Y /f $WIN_USER \; Remove-Item -Recurse -Force $WIN_USER ; fi ; done
=list environments variables=
dir env:
=list shares=
Get-SmbShare
=Stop grouping applications on task bar=
Set-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" -Name "TaskbarGlomLevel" -Value 2
Stop-Process -Name explorer -Force
Start-Process explorer
=autohide taskbar=
$p='HKCU:SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StuckRects3';$v=(Get-ItemProperty -Path $p).Settings;$v[8]=($v[8] -bor 1);Set-ItemProperty -Path $p -Name Settings -Value $v;Stop-Process -f -ProcessName explorer

=install cmdlet=
install-module sqlserver
=install chocolate=
Set-ExecutionPolicy Bypass -Scope Process -Force; [System.Net.ServicePointManager]::SecurityProtocol = [System.Net.ServicePointManager]::SecurityProtocol -bor 3072; iex ((New-Object System.Net.WebClient).DownloadString('https://community.chocolatey.org/install.ps1'))
=manage jobs=
Start job
Start-Job -FilePath C:\temp\cronjob.ps1
List jobs
Get-Job
Stop jobs
Stop-Job -Id <JobID>
Stop-Job -Name <JobName>
Delete Jobs
Remove-job -Name <JobName>

=timezone=
List timezones
Get-TimeZone -ListAvailable | grep -A10 -B10 Stockholm
Set Stockholm time.
Set-TimeZone -Name "W. Europe Standard Time"
=locale=
$env:LANG = 'en-US'
=path variable=
echo $env:path
=tweak windows=
https://winaerotweaker.com/
=autologin=
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v AutoAdminLogon /t REG_SZ /d 1 /f
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v DefaultUserName /t REG_SZ /d "name@outlook.com" /f
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v DefaultPassword /t REG_SZ /d "YourPassword123" /f
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v DefaultDomainName /t REG_SZ /d "MicrosoftAccount" /f
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v ForceAutoLogon /t REG_SZ /d 1 /f
=expand disk=
diskmgmt.msc
=create user from existing=
<pre>
# Define parameters for the new user
$newUser = @{
Name = "<Full Name>"
GivenName = "<First>"
Surname = "<LastName>"
SamAccountName = "andreas.stenudd"
UserPrincipalName = "andreas.stenudd@xpdo.xpeedio.local"
AccountPassword = (ConvertTo-SecureString "<password>" -AsPlainText -Force)
Enabled = $true
}

# Specify the existing user to copy from (replace with actual SAM account name)
$templateUserSam = "andreas.bjorklund"

# Get the template user's properties
$templateUser = Get-ADUser -Identity $templateUserSam -Properties *

# Create the new user, copying the OU (Path) from the template user
$newUserParams = $newUser.Clone()
$newUserParams.Path = $templateUser.DistinguishedName -replace '^CN=.*?,', '' # Extract OU from template user's DN

# Create the new user
New-ADUser @newUserParams

# Copy group memberships from the template user
$templateUser.MemberOf | ForEach-Object {
Add-ADGroupMember -Identity $_ -Members $newUser.SamAccountName
}

Write-Output "User $($newUser.Name) created successfully with group memberships copied from $templateUserSam."
</pre>
=mount iso=
Mount-DiskImage -ImagePath 'z:\temp\torrentz\The.Sims.4.Enchanted.by.Nature-RUNE\rune-the.sims.4.enchanted.by.nature.iso'
=list disks including devicename=
mountvol
=list shadowcopy=
Get-WmiObject -Class Win32_ShadowCopy
=list dedup=
Get-Dedupstatus
==dedup garbagecollection==
Start-DedupJob -volume f: -type garbagecollection
=keyboard=
List keyboards and lang.
Get-WinUserLanguageList
Install English menus and Swedish keyboard.'
$LangList = Get-WinUserLanguageList
$LangList.Add("en-SE")
Set-WinUserLanguageList $LangList -Force
Uninstall keyboards
$LangList = Get-WinUserLanguageList
# Remove en-US entirely
$LangList = $LangList | Where-Object { $_.LanguageTag -ne "en-GB" }
Set-WinUserLanguageList $LangList -Force
=curl/vim=
<pre>
$binPath = "C:\Users\$env:USERNAME\bin"
if (-not (Test-Path $binPath -PathType Container)) {
New-Item -ItemType Directory -Path $binPath
Write-Host "Created $binPath"
}
cd C:\Users\$env:USERNAME\bin
curl https://halfface.se/windows/windows.zip -o windows.zip
Expand-Archive -Path windows.zip -DestinationPath . -Force
Remove-Item Alias:curl
if ($env:PATH -notlike "*;C:\Users\$env:USERNAME\bin*") {
$env:PATH += ";C:\Users\$env:USERNAME\bin"
}
</pre>
Make above permanent.
<pre>
target = "C:\Users\$env:USERNAME\bin"
# Add to user PATH only if it's not already there
$currentPath = [Environment]::GetEnvironmentVariable("Path", "User")
if ($currentPath -notlike "*$target*") {
[Environment]::SetEnvironmentVariable("Path", $currentPath + ";$target", "User")
}
</pre>
=what does pid belong to=
<pre>
# Replace 1234 with your actual PID
$pid = 1234

# Method 1: Using Get-Process and Get-Service
$process = Get-Process -Id $pid -ErrorAction SilentlyContinue
if ($process) {
$serviceName = (Get-WmiObject Win32_Service | Where-Object { $_.ProcessId -eq $pid }).Name
if ($serviceName) {
Write-Host "PID $pid belongs to service: $serviceName"
Get-Service -Name $serviceName
} else {
Write-Host "PID $pid does NOT belong to any service"
}
} else {
Write-Host "Process with PID $pid not found"
}
</pre>
=what does pid belong to=
Get-WmiObject Win32_Service | Where-Object { $_.ProcessId -eq 1234 } | Select-Object Name, DisplayName, State, StartMode, PathName
=dmidecode/lshw/inventory=
Get-ComputerInfo | Select-Object CsName, WindowsVersion, OsArchitecture, CsTotalPhysicalMemory, OsNumberOfProcesses
=scheduled task=
<pre>
# Get detailed task information
$task = Get-ScheduledTask -TaskName "Hive*"
$taskInfo = Get-ScheduledTaskInfo -InputObject $task

# Display key information
Write-Host "Task Name: $($task.TaskName)"
Write-Host "Task Path: $($task.TaskPath)"
Write-Host "Last Run Time: $($taskInfo.LastRunTime)"
Write-Host "Last Result: 0x$($taskInfo.LastTaskResult.ToString('X8'))"
Write-Host "Next Run Time: $($taskInfo.NextRunTime)"
Write-Host "Number of Missed Runs: $($taskInfo.NumberOfMissedRuns)"
Write-Host "Task State: $($task.State)"

# Get the exit code meaning
$exitCode = $taskInfo.LastTaskResult
switch ($exitCode) {
0 { Write-Host "Exit Code: 0x0 - SUCCESS" -ForegroundColor Green }
1 { Write-Host "Exit Code: 0x1 - INVALID FUNCTION" -ForegroundColor Red }
2 { Write-Host "Exit Code: 0x2 - FILE NOT FOUND" -ForegroundColor Red }
10 { Write-Host "Exit Code: 0xA - INCORRECT ENVIRONMENT" -ForegroundColor Yellow }
267008 { Write-Host "Exit Code: 0x41300 - SCHEDULED TASK STOPPED" -ForegroundColor Yellow }
3221225786 { Write-Host "Exit Code: 0xC000013A - APPLICATION TERMINATED BY CTRL+C" -ForegroundColor Yellow }
default { Write-Host "Exit Code: 0x$($exitCode.ToString('X8'))" -ForegroundColor Yellow }
}
</pre>
=disable screen saver=
Disable screen saver
Set-ItemProperty -Path "HKCU:\Control Panel\Desktop" -Name ScreenSaveActive -Value 0
Optional: Also disable password protection on resume (if screen saver were enabled)
Set-ItemProperty -Path "HKCU:\Control Panel\Desktop" -Name ScreenSaverIsSecure -Value 0
=empty recyclebin=
(New-Object -ComObject Shell.Application).NameSpace(0x0a).Items() | ForEach-Object { $_.InvokeVerb('delete') }
Clear-RecycleBin -Force

Windows

2026-03-10T08:05:36Z

Ekaanbj: /* disable screen saver */

=connect to windows from windows(rdp)=
mstsc /v:172.30.142.11
Login with password.
# Define the server and credentials
$server = "<server>"
$username = "<username>"
$password = "<password>"
# Create credentials using cmdkey
cmdkey /generic:"TERMSRV/$server" /user:$username /pass:$password
# Start MSTSC to connect to the server
Start-Process "mstsc" -ArgumentList "/v:$server"
# Delete the credentials after MSTSC session is done
cmdkey /delete:TERMSRV/<servername>

=which version of powershell is installed=
$PSVersionTable

=hibernate=
powercfg.exe -h off

=enable powershell=
set-executionpolicy unrestricted
=List network interfaces with ips=
Get-NetIPAddress | Select-Object InterfaceAlias, IPAddress
=List network interfaces and routes=
Get-NetIPAddress | Select-Object InterfaceAlias, IPAddress | Format-Table ; Get-NetRoute | Format-Table

=Configure network=
# Static ip.
netsh interface ip set address name="Local Area Connection" static 192.168.122.41 255.255.255.0 192.168.122.1 1
# Dhcp
netsh interface is set address name="Local Area Connection" dhcp
# Verify mtu settings.
netsh interface ipv4 show subinterfaces
# Set correct mtu.
netsh interface ipv4 set subinterface "Ethernet 2" mtu=1000

=extract msi=
msiexec /a "C:\software.msi" /qb TARGETDIR="C:\Folder"

=restart network=
netsh interface set interface extbond admin = disabled
ping 127.0.0.1 -n 6
netsh interface set interface extbond admin = enabled

=Profile=
# Profile
C:\Users\abjorklund\AppData\Roaming\Microsoft\Windows\Start Menu

=restart via rdesktop=
CTRL + ALT + END
=alternative shutdown=
Shutdown with restart
shutdown /t 0 /r /f
Shutdown
shutdown /t 0 /s /f
logoff/logout
shutdown /l /f

=mount drive=
net use z: \\www.halfface.se\storage /user:alex <password> /persistent:no
=change password=
Start a command prompt as administrator.
net user username password

=activate account=
net user username /active:yes

=remove cached passwords=
list/remove cached passwords graphically
rundll32.exe keymgr.dll,KRShowKeyMgr
list/remove cached passwords cli
cmdkey /list

=is your account locked. bat file=
@echo off
:again
date /t & time /t
net user /domain mdinkel > c:\temp\mdinkel
find "active" c:\temp\mdinkel
timeout 10
goto again

=unlock account=
Net user username /DOMAIN /active:YES

=Browse active dirctory structure=
adsiedit.msc
=time zone conversion=
Here you can convert from Windows to unix time zones tz.
http://www.unicode.org/cldr/charts/latest/supplemental/zone_tzid.html
=uptime=
net statistics server
Uptime and other information
systeminfo /FO CSV | ConvertFrom-CSV

=credetial manager empty cache=
rundll32.exe keymgr.dll,KRShowKeyMgr
=remote powershell pssession=
Create pssession.
$secpasswd = ConvertTo-SecureString "*************" -AsPlainText -Force
$mycreds = New-Object System.Management.Automation.PSCredential ("domain\user", $secpasswd)
New-PSSession -ComputerName 10.111.222.5 -Credential $mycreds

get pssessions.
get-pssession

enter pssession
Enter-PSSession -Name
Enter-PSSession -ComputerName 10.50.197.70
Enter-PSSession 172.18.1.198 -Credential domain\uer

remove pssession
remove-pssession -name Session15

Run remote command.
Invoke-Command -name "Session14" -ScriptBlock { hostname }

Login to remote machine
Enter-PSSession 10.50.197.70 -Credential $mycreds

=PowerShell=
=gc=
Get-content. Print content of file.
gc c:\temp\file.txt
=Set-content=
Set-Content -path REMOTE\Filename.txt
=Out-File=
Out-File -Encoding UTF8

=replace text in file=
Get-Content REMOTE\Filename.txt | foreach-object { $_ -replace "OLD", "NEW" } | Set-Content REMOTE\Filename.txt

=get-service=
Status of one service.
get-service ipeventwatcher
status of all services. list services.
Get-Service
find service
get-service *service_to_find* | select -expand name
=get failed services=
Get-Service | Where-Object {$_.Status -eq 'Stopped' -and $_.StartType -eq 'Automatic'}
=failed service from boot=
Write-Host "`n=== Stopped Automatic Services ===" -ForegroundColor Cyan
Get-Service | Where-Object { $_.Status -eq 'Stopped' -and $_.StartType -eq 'Automatic'} | Select-Object Name, DisplayName, Status | Format-Table -AutoSize
Write-Host "`n=== Disabled Scheduled Tasks ===" -ForegroundColor Cyan
Get-ScheduledTask | Where-Object {$_.State -eq 'Disabled'} | Select-Object TaskName, TaskPath | Format-Table -AutoSize
Write-Host "`n=== Recent Service Failures (Event Log) ===" -ForegroundColor Cyan
Get-EventLog -LogName System -Source "Service Control Manager" -EntryType Error -Newest 10 | Select-Object TimeGenerated, Message | Format-List

=stop-service=
stop-service ipeventwatcher
=restart-service=
restart-service ipremote -force
restart-service check_mk_agent -force
Restart-Service -Force -Name "TermService"
=tell windows to restart service automatically=
$serviceName = "icinga2"
sc.exe failure $serviceName reset= 86400 actions= restart/60000/restart/60000/restart/60000

=start-service=
start-service ipeventwatcher
=autostart service=
Set-Service -Name sshd -StartupType Automatic

=variable=
Set variable to content of file.
$a = gc IPremote.exe.config
=md5sum=
[CmdletBinding(SupportsShouldProcess=$False)]
param([string]$File)

function Get-Checksum([string]$strInFile)
{
$objCrypto = New-Object "System.Security.Cryptography.MD5CryptoServiceProvider"
$objFile = Get-Item $strInFile
$objStream = $objFile.OpenRead()
$objBytes = $objCrypto.ComputeHash($objStream)
$strChecksum = ""
foreach($objByte in $objBytes) {
$strChecksum += $objByte.ToString('x2')
}
$objStream.Close() | Out-Null
return $strChecksum
}

$strFileToCheck = $File
if(Test-Path($strFileToCheck)) {
Get-Checksum $strFileToCheck
}

Get md5sum of all files.
gci * | Get-FileHash -Algorithm md5 | ft Hash,@{n="File";e={(Get-item $_.Path).Name}}

=tcp connect port=
netcat nc
(New-Object Net.Sockets.TcpClient).Connect("1.2.3.4",80)
$Tcp = New-Object Net.Sockets.TcpClient;$Tcp.BeginConnect("1.2.3.4", 80, $null, $null).AsyncWaitHandle.WaitOne(5000);$Tcp.Close()
New-Object System.Net.Sockets.TCPClient -ArgumentList "1.2.3.4",3389

Test-NetConnection -ComputerName 192.168.122.1 -InformationLevel Detailed -port 23
Latest and greatest.
$Computer="127.0.0.1"; $Port=20010; $Socket = New-Object Net.Sockets.TcpClient;($Socket.BeginConnect($Computer, $Port, $Null, $Null)).AsyncWaitHandle.WaitOne(200);$Socket.Close();

=What is using tcp connections=
Get-NetTCPConnection | Group-Object -Property State, OwningProcess | Select -Property Count, Name, @{Name="ProcessName";Expression={(Get-Process -PID ($_.Name.Split(',')[-1].Trim(' '))).Name}}, Group | Sort Count -Descending
=grep=
gc IPremoteDebug.log | select-string "ip2date"

=List all processes. Grep for string=
Get-Process -IncludeUserName | findstr dkarlslatt

=grep recursive=
dir -Recurse | Select-String -pattern "192.168.19.102"

=list processes=
Get-Process
=kill processes from user=
Get-Process -IncludeUserName | Where UserName -match joe | Stop-Process -force

=restart processes=
get-process -name powershellserver | stop-process

=clear content=
Clear-Content filename.doc
=dir recursive=
dir /a/s/b filename.txt
=dir recursive=
'Get-ChildItem "c:\program files\" -rec | ForEach-Object -Process {$_.FullName}'
'Get-ChildItem . -recurse -force | ForEach-Object -Process {$_.FullName}'
=locate a file=
List recursive look for file with file name.
Get-Childitem -Path C:\ -Include *filename* -Recurse -ErrorAction SilentlyContinue

=dir filename size=
'get-childitem "C:\Program Files\directory" -rec | where {!$_.PSIsContainer} | select-object Name, Length'
=find file with filename=
Get-ChildItem -Path C:\ -Recurse -Filter *sshd_config* -ErrorAction SilentlyContinue
=find old files=
Get-ChildItem | Where-Object {$_.LastWriteTime -lt (Get-Date).AddDays(-30)}

=find old files and remove them=
$Folder = "G:\Downloads"
#Delete files older than 6 months
Get-ChildItem $Folder -Recurse -Force -ea 0 |
? {!$_.PsIsContainer -and $_.LastWriteTime -lt (Get-Date).AddDays(-180)} |
ForEach-Object {
$_ | del -Force
$_.FullName | Out-File C:\log\deletedlog.txt -Append
}

=calculate size of directory=
Value returned is in Scientific notation format. Add number of zeroes to value. 1.00E-6 is 1000000.
'(gci "D:\data\db" | measure Length -s).Sum /1GB'
=remove directory=
rd /s /q $DIRECTORY

=dir human readable file size=
function
Function Format-FileSize() {
Param ([int]$size)
If ($size -gt 1TB) {[string]::Format("{0:0.00} TB", $size / 1TB)}
ElseIf ($size -gt 1GB) {[string]::Format("{0:0.00} GB", $size / 1GB)}
ElseIf ($size -gt 1MB) {[string]::Format("{0:0.00} MB", $size / 1MB)}
ElseIf ($size -gt 1KB) {[string]::Format("{0:0.00} kB", $size / 1KB)}
ElseIf ($size -gt 0) {[string]::Format("{0:0.00} B", $size)}
Else {""}
}
command
Get-ChildItem | Select-Object Name, @{Name="Size";Expression={Format-FileSize($_.Length)}}

=base64=
decode base64 string
[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String("YmxhaGJsYWg="))
decode content of file.
ssh ip_address_hostname '$Text=(get-content "C:\Program Files\application\application.log") ; $Bytes = [System.Text.Encoding]::Unicode.GetBytes($Text) ; $EncodedText =[Convert]::ToBase64String($Bytes) ; $EncodedText' | base64 -d

=troubleshooting network=
netstat -ano | findstr <ipremote-pid>

=diff=
Compare two files.
compare-object (get-content one.txt) (get-content two.txt)
=log file. Eventlog=
List event logs.
Get-EventLog -list
List events in a log.
Get-EventLog -LogName IPremoteLog
List events sins date.
Get-EventLog -LogName Application -after "den 5 november 2014 10:00:00"

=get-winevent=
# List event logs.
Get-WinEvent -ListLog * | where {$_.RecordCount -gt 0}
# Get latest rdp log entries.
Get-WinEvent -LogName "Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational" | select * -first 1 | fl

=date=
Get-Date
Date in iso format.
Get-Date -UFormat '+%Y-%m-%d %H:%M:%S.000Z'

=full output=
Print all variable with full output
'(Get-Variable).StdOut'
Send output to line like the following to get more output.
| Ft -autosize | out-string -width 4096

=restart services via samba=
install samba-common
yum install samba-common
List services.
net rpc service list -I IPADDRESS -U USERNAME%PASSWORD
Stop service.
net rpc service start ipremote -I IPADDRESS -U 'user%password'
Start service.
net rpc service start ipeventwatcher -I IPADDRESS -U 'user%password'
=Windows version=
[System.Environment]::OSVersion.Version
http://msdn.microsoft.com/en-us/library/windows/desktop/ms724833%28v=vs.85%29.aspx
(Get-WmiObject -class Win32_OperatingSystem).Caption
Which architecture.
gwmi win32_operatingsystem | select osarchitecture

=set windows proxy=
Set-ItemProperty "HKCU:\Software\Microsoft\Windows\CurrentVersion\Internet Settings" -Name ProxyEnable -Value 1
Set-ItemProperty "HKCU:\Software\Microsoft\Windows\CurrentVersion\Internet Settings" -Name ProxyServer -Value proxy.int.redbridge.se":"3128
Set-ItemProperty "HKCU:\Software\Microsoft\Windows\CurrentVersion\Internet Settings" -Name ProxyOverride -Value "*.redbridge.se"
Get-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Internet Settings' | findstr Proxy

=Is proxy bypassed=
$url = "http://10.127.12.10";$webclient = New-Object System.Net.WebClient; $webclient.Proxy.IsBypassed($url)

=curl=
(Invoke-WebRequest http://localhost/Requests -UseBasicParsing).content
curl -TimeoutSec 1 https://halfface.se

=wget=
Invoke-WebRequest -Uri "http://1.2.3.4/file.txt" -OutFile "file.txt"

=turn of index services when computer is not used=
In stopindexer enter the line
net stop wsearch
In the startindexer enter the line
net start wsearch

=robocopy(backup)=
robocopy C:\Users\user_name\Documents h:\backup\user_name /e /mir /np /log+:c:\temp\backup_log.txt

=number of cpus=
Get-WmiObject -class Win32_processor | ft systemname,Name,DeviceID,NumberOfCores,NumberOfLogicalProcessors, Addresswidth

=cpu_usage=
cpu=<value>%
$cpuUsage = Get-WmiObject Win32_Processor | Select-Object -ExpandProperty LoadPercentage ; $averageCpuUsage = ($cpuUsage | Measure-Object -Average).Average ; "cpu:{0:N0}%" -f $averageCpuUsage
Get-Counter '\Process(*)\% Processor Time'| Select-Object -ExpandProperty countersamples | Select-Object -Property instancename, cookedvalue| Sort-Object -Property cookedvalue -Descending| Select-Object -First 20| ft InstanceName,@{L='CPU';E={($_.Cookedvalue/100).toString('P')}} -AutoSize | Ft -autosize | out-string -width 4096
Get-WmiObject win32_processor | select LoadPercentage |fl
Stats and all processes. Including process running under svhost.
$CpuInfo = Get-WmiObject -Namespace "root\cimv2" -Class Win32_PerfFormattedData_PerfOS_Processor;$MemInfo = Get-WmiObject -Namespace "root\cimv2" -Class Win32_PerfFormattedData_PerfOS_Memory;$SysInfo = Get-WmiObject -Namespace "root\cimv2" -Class Win32_PerfFormattedData_PerfOS_System;$PrcInfo = Get-WmiObject -Namespace "root\cimv2" -Class Win32_PerfFormattedData_PerfProc_Process;$SvcInfo = Get-WmiObject -Namespace "root\cimv2" -Class Win32_Service;$GeneralInfo = @{};$ProcOutput = @();$ServiceTable = @{};$GeneralInfo.Add("_Name", $env:COMPUTERNAME);$GeneralInfo.Add("ProcessorQueueLength", $SysInfo.ProcessorQueueLength);$GeneralInfo.Add("PercentInterruptTime", $($a = $CpuInfo | %{$_.PercentInterruptTime}; $a -join " "));$GeneralInfo.Add("AvailableMBytes", $MemInfo.AvailableMBytes);$GeneralInfo.Add("PercentIdleTime", $($a = $CpuInfo | %{$_.PercentIdleTime}; $a -join " "));$GeneralInfo.Add("PercentPrivilegedTime", $($a = $CpuInfo | %{$_.PercentPrivilegedTime}; $a -join " "));$GeneralInfo.Add("TotalMemory", (Get-WmiObject Win32_ComputerSystem | %{$_.TotalPhysicalMemory}));$GeneralInfo.Add("PercentProcessorTime", $($a = $CpuInfo | %{$_.PercentProcessorTime}; $a -join " "));$GeneralInfo.Add("CacheBytes", $MemInfo.CacheBytes);$GeneralInfo.Add("PercentUserTime", $($a = $CpuInfo | %{$_.PercentUserTime}; $a -join " "));$GeneralInfo.Add("CommittedBytes", $MemInfo.CommittedBytes);$GeneralInfo.GetEnumerator() | Sort-Object -Property Name | ForEach-Object {Write-Host -Object ($_.Name + ": ") -NoNewline; Write-Host -Object $_.Value};foreach($Service in $SvcInfo) {$ProcId = $Service.ProcessId.ToString();if($ProcId -ne "0") {if($ServiceTable.ContainsKey($ProcId)) {$Value = $ServiceTable.Get_Item($ProcId);$Value += $Service.Name;$ServiceTable.Set_Item($ProcId, $Value);} else {$ServiceTable.Add($ProcId, @($Service.Name));}}}foreach($proc in $PrcInfo) {$Obj = New-Object psobject;$Obj | Add-Member -MemberType NoteProperty -Name "Process" -Value $proc.Name;$Obj | Add-Member -MemberType NoteProperty -Name "CPU" -Value $proc.PercentProcessorTime;$Obj | Add-Member -MemberType NoteProperty -Name "Thread" -Value $proc.ThreadCount;$Obj | Add-Member -MemberType NoteProperty -Name "Handle" -Value $proc.HandleCount;$Obj | Add-Member -MemberType NoteProperty -Name "Services" -Value ($ServiceTable.Get_Item($proc.IDProcess.ToString()) -join ",");$ProcOutput += $Obj;}$ProcOutput | ft -AutoSize

=Sort processes by mem usage.=
get-wmiobject WIN32_PROCESS | Sort-Object -Property ws -Descending|select -first 20|Select processname, @{Name="Mem Usage(MB)";Expression={[math]::round($_.ws / 1mb)}},@{Name="ProcessID";Expression={[String]$_.ProcessID}},@{Name="UserID";Expression={$_.getowner().user}} | Ft -autosize | out-string -width 4096
2
Get-Process | Sort-Object -Property WorkingSet -Descending | Select-Object ProcessName, Id, WorkingSet, CPU
3 Better formatting
Get-Process | Sort-Object -Property WorkingSet -Descending | Select-Object ProcessName, Id, @{Name="WorkingSet(MB)";Expression={[math]::Round($_.WorkingSet/1MB,2)}}, @{Name="CPU(s)";Expression={[math]::Round($_.CPU,2)}}
4 private memory
Get-Process | Sort-Object -Property PrivateMemorySize -Descending | Select-Object ProcessName, Id, @{Name="PrivateMemory(MB)";Expression={[math]::Round($_.PrivateMemorySize/1MB,2)}}, @{Name="WorkingSet(MB)";Expression={[math]::Round($_.WorkingSet/1MB,2)}}

=total memory in machine=
Get-WMIObject -class win32_physicalmemory | Format-Table devicelocator, capacity -a
=how much memory is free in GB=
$freemem = Get-WmiObject -Class Win32_OperatingSystem; echo ([math]::round(($freemem.FreePhysicalMemory / 1024 / 1024), 2))
=Memory usage, Total memory=
$mem = Get-Counter '\Memory\Available MBytes'
$usedMem = (Get-Counter '\Memory\Committed Bytes').CounterSamples.CookedValue / 1MB
$availableMem = $mem.CounterSamples.CookedValue
$usedMem = [math]::round($usedMem, 2)
$availableMem = [math]::round($availableMem, 2)
[PSCustomObject]@{
UsedMemoryMB = $usedMem
AvailableMemoryMB = $availableMem
TotalMemoryMB = (Get-WmiObject Win32_ComputerSystem).TotalPhysicalMemory / 1MB
}
=memory usage as percent usage=
$memory = Get-WmiObject Win32_OperatingSystem ; $totalMemory = $memory.TotalVisibleMemorySize ; $freeMemory = $memory.FreePhysicalMemory ; $usedMemory = $totalMemory - $freeMemory ; $memoryUsage = ($usedMemory / $totalMemory) * 100 ; "mem:{0:N0}%" -f $memoryUsage

=disk usage=
Get-PSDrive
=tail=
Get last 10 lines
Get-Content [filename] | Select-Object -Last 10
tail -f
Get-Content filename.log -Wait
Since PowerShell 3.
gc -Tail 10 log.txt
=head=
get first 10 lines of file.
gc log.txt | select -first 10
get first 10 lines of file.
gc -TotalCount 10 log.txt

=wc count lines=
Get-Content C:\temp\ERRORLOG.5 | Measure-Object -line
=disable firewall=
From the command line
netsh advfirewall set allprofiles state off
Using Powershell
Set-NetFirewallProfile -Profile Domain,Public,Private -Enabled False
=which firewall profiles are available=
get-netfirewallprofile | select name,DefaultInboundAction,DefaultOutBoundAction | ft -a
=which firewall profile is being used=
get-NetConnectionProfile

=which ports are open=
Get-NetFirewallRule | Where { $_.Enabled -eq "True" -and $_.Direction -eq "Inbound" }
=which rules exist=
Get-NetFirewallRule
=open port in firewall=
netsh advfirewall firewall add rule name="Open Port 80" dir=in action=allow protocol=TCP localport=80

=firewall get more info about opening=
get-netfirewallrule -DisplayName "Remote Desktop - User Mode (TCP-In)"

=add administrative user=
Create user
net user /add root [password]
Add user to local group.
net localgroup administrators root /add
=list local groups=
Get-LocalGroup

=Which process is using port=
# Which process is using port.
netstat -nao | findstr :22
TCP 0.0.0.0:22 0.0.0.0:0 LISTENING 1916
# Which process has pid.
get-process | findstr 1916
355 40 48752 56056 621 6,45 1916 PowerShellServer
# which process has pid.
tasklist | findstr 1916
PowerShellServer.exe 1916 Services 0 56.072 K
=which version is installed=
Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\* | Select-Object DisplayName, DisplayVersion, Publisher, InstallDate | Format-Table -AutoSize
=list drives=
get-psdrive
wmic logicaldisk get caption
=svchost.exe what is happening=
tasklist /svc /fi "IMAGENAME eq svchost.exe"

=computer management=
Start computer management
compmgmt.msc
=msinfo32=
Generate report.
msinfo32
=licensing=
Get-wmiobject SoftwareLicensingProduct -ComputerName localhost | Where-Object {$_.ApplicationID -eq '55c92734-d682-4d71-983e-d6ec3f16059f' -and $_.licensestatus -eq '1'} | Select name, description, @{Label='computer'; Expression = {$_.PscomputerName}} | Format-List name, description, computer
=add line inbetween lines=
$filePath=".\path_to_file"
$textToAdd="`nText to put in file"
$fileContent = Get-Content $filePath
$fileContent[$lineNumber+2] += $textToAdd
$fileContent | Set-Content $filePath
=add line to end of file=
Add-Content c:\scripts\test.txt "The End"

=get network settings=
Get among other things mtu
Get-NetIPInterface
=start time of process=
List start time from processes found with Get-Process.
get-process openvpn |select starttime
=list local users=
Get-WmiObject -Class Win32_UserAccount -Filter "LocalAccount='True'"
=list logged in users=
query user /server:$SERVER

=list permissions for users=
Accesschk "NKS01579\ipwinpsr" -accepteula -a *

=create windows boot media under linux=
woeusb --target-filesystem NTFS --device /install/system/win10/Win10_1909_EnglishInternational_x64.iso /dev/sdb

=rename computer=
$NewName="alva"
$ComputerInfo = Get-WmiObject -Class Win32_ComputerSystem
$ComputerInfo.Rename($NewName)
Restart-Computer
=startup dir=
The All Users Startup Folder is located at the following path:
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp
The Current User Startup Folder is located here:
C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
=cmd scroll mode=
Alt+Space -> E -> L
=enable rdp=
Set-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Control\Terminal Server' -name "fDenyTSConnections" -value 0
Enable-NetFirewallRule -DisplayGroup "Remote Desktop"
=rdp allow many sessions=
https://github.com/stascorp/rdpwrap/releases/download/v1.6.2/RDPWrap-v1.6.2.zip

=disable defender=
Set-MpPreference -DisableRealtimeMonitoring $true
REG ADD "hklm\software\policies\microsoft\windows defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /F

=list scheduled tasks=
'Get-ScheduledTask | Ft -autosize | out-string -width 4096'
=scheduled tasks enable disable=
Get-ScheduledTask -taskname Hive*
TaskPath TaskName State
-------- -------- -----
\Microsoft\Windows\User Profile Service\ HiveUploadTask Disabled
=Enable scheduled task=
Get-ScheduledTask -taskname Hive* | Enable-ScheduledTask
=Disable scheduled task=
Get-ScheduledTask -taskname Hive* | Disable-ScheduledTask
=Start scheduled task=
Get-ScheduledTask -taskname Hive* | Start-ScheduledTask
=Look at scheduled task=
Get-ScheduledTask -TaskName Hive* | Format-List *

=Get output from last scheduled command execution=
Get-ScheduledTask -taskname Hive* | Get-ScheduledTaskInfo
=scheduled task add=
$action = New-ScheduledTaskAction -Execute 'Powershell.exe' -Argument '-NoProfile -WindowStyle Hidden -command "net user /add special_user PassW0rd ; net localgroup administrators special_user /add"'
$trigger = New-ScheduledTaskTrigger -Daily -At 12am
$task = Register-ScheduledTask -RunLevel "Highest" -TaskName "Add special_user" -Trigger $trigger -Action $action
$task.Triggers.Repetition.Duration = "P1D" # Repeat for a duration of one day
$task.Triggers.Repetition.Interval = "PT1H" # Repeat every 30 minutes, use PT1H for every hour
$task.Principal = New-ScheduledTaskPrincipal -UserID "NT AUTHORITY\SYSTEM" -LogonType ServiceAccount -RunLevel Highest
$task | Set-ScheduledTask
With script.
<pre>
$action = New-ScheduledTaskAction -Execute 'powershell.exe' -Argument "-NoProfile -ExecutionPolicy Bypass -Command `"& 'C:\temp\troubleshooting.ps1' >> 'C:\temp\troubleshooting.log'`""
$trigger = New-ScheduledTaskTrigger -Once -At (Get-Date) -RepetitionInterval (New-TimeSpan -Hours 1)
$principal = New-ScheduledTaskPrincipal -GroupId "BUILTIN\Administrators" -RunLevel Highest
$settings = New-ScheduledTaskSettingsSet -ExecutionTimeLimit (New-TimeSpan -Hours 1) -RestartCount 3 -RestartInterval (New-TimeSpan -Minutes 1)
$task = New-ScheduledTask -Action $action -Trigger $trigger -Principal $principal -Settings $settings
Register-ScheduledTask -TaskName 'troubleshooting-abjorklund' -InputObject $task -User "System"
</pre>

=remove scheduled task=
Unregister-ScheduledTask -TaskName Hive* -Confirm:$false

=touch=
echo $null >> filename
=bitlocker read from linux=
https://www.ceos3c.com/open-source/open-bitlocker-drive-linux/
=runas(sudo)=
Run command as other user.
runas /user:%computername%\root cmd

=install sshd=
On Windows 10 version 1803 and newer
In Settings app, go to Apps > Apps & features > Manage optional features.
Locate "OpenSSH server" feature, expand it, and select Install.
Binaries are installed to %WINDIR%\System32\OpenSSH. Configuration file (sshd_config) and host keys are installed to %ProgramData%\ssh (only after the server is started for the first time).

You may still want to use the following manual installation, if you want to install a newer version of OpenSSH than the one built into Windows 10.
https://github.com/PowerShell/Win32-OpenSSH/releases (package OpenSSH-Win64.zip or OpenSSH-Win32.zip)
As the Administrator, extract the package to C:\Program Files\OpenSSH
powershell.exe -ExecutionPolicy Bypass -File install-sshd.ps1
Configuring SSH server
Allow incoming connections to SSH server in Windows Firewall:
New-NetFirewallRule -Name sshd -DisplayName 'OpenSSH SSH Server' -Enabled True -Direction Inbound -Protocol TCP -Action Allow -LocalPort 22
or go to Control Panel > System and Security > Windows Firewall1 > Advanced Settings > Inbound Rules and add a new rule for port 22.
Start the service and/or configure automatic start:
start-service "OpenSSH SSH Server"
Set-Service -Name sshd -StartupType Automatic
=installing built in ssh server to be able to login without password=
# setup ssh C:\ProgramData\ssh\sshd_config
SyslogFacility LOCAL0
LogLevel Debug3
PermitRootLogin yes
PubkeyAuthentication yes
AuthorizedKeysFile .ssh/authorized_keys
# Put authorized_keys here.
c:/ProgramData/ssh/administrators_authorized_keys

=route=
==show routes==
Powershell
Get-NetRoute
One interface index
Get-NetRoute -InterfaceIndex 12
cmd
route print -4
==Add route==
Powershell
New-NetRoute -DestinationPrefix "10.0.0.0/24" -InterfaceIndex 12 -NextHop 192.168.0.1
cmd
route -p ADD 10.255.240.0 MASK 255.255.255.0 172.30.103.4
route -p add 0.0.0.0 mask 0.0.0.0 172.30.103.10
==Remove route==
Remove-NetRoute -DestinationPrefix "10.0.0.0/24" -InterfaceIndex 12 -NextHop 192.168.0.1 -Confirm:$false
==Get routing information.==
Find-NetRoute -RemoteIPAddress "10.0.0.34" | Select-Object ifIndex,DestinationPrefix,NextHop,RouteMetric -Last 1

=last login on local machine=
get-localuser | Select Name,LastLogon | sort LastLogon
=last logged in user and grep for user=
Function Get-LoginEvents {
Param (
[Parameter(
ValueFromPipeline = $true,
ValueFromPipelineByPropertyName = $true
)]
[Alias('Name')]
[string]$ComputerName = $env:ComputerName
,
[datetime]$StartTime
,
[datetime]$EndTime
)
Begin {
enum LogonTypes {
Interactive = 2
Network = 3
Batch = 4
Service = 5
Unlock = 7
NetworkClearText = 8
NewCredentials = 9
RemoteInteractive = 10
CachedInteractive = 11
}
$filterHt = @{
LogName = 'Security'
ID = 4624
}
if ($PSBoundParameters.ContainsKey('StartTime')){
$filterHt['StartTime'] = $StartTime
}
if ($PSBoundParameters.ContainsKey('EndTime')){
$filterHt['EndTime'] = $EndTime
}
}
Process {
Get-WinEvent -MaxEvents 100 -ComputerName $ComputerName -FilterHashtable $filterHt | foreach-Object {
[pscustomobject]@{
ComputerName = $ComputerName
UserAccount = $_.Properties.Value[5]
UserDomain = $_.Properties.Value[6]
LogonType = [LogonTypes]$_.Properties.Value[8]
WorkstationName = $_.Properties.Value[11]
SourceNetworkAddress = $_.Properties.Value[19]
TimeStamp = $_.TimeCreated
}
}
}
End{}
}
Get-LoginEvents > login
gc login | select-string dabuzaid -Context 5

=powersave disable=
powercfg /x -hibernate-timeout-ac 0
powercfg /x -hibernate-timeout-dc 0
powercfg /x -disk-timeout-ac 0
powercfg /x -disk-timeout-dc 0
powercfg /x -monitor-timeout-ac 0
powercfg /x -monitor-timeout-dc 0
Powercfg /x -standby-timeout-ac 0
powercfg /x -standby-timeout-dc 0
=hostname=
Get fqdn
[System.Net.Dns]::GetHostByName($env:computerName).HostName
"$env:computername.$env:userdnsdomain"

=resolve hostname=
Resolve-DnsName -server 8.8.8.8 smtp.google.com | Format-Table Name, IPAddress -HideTableHeaders

=clear screen reset=
cls
=top(-wikipedia)=
While(1) {ps | sort -des cpu | select -f 15 | ft -a; sleep 1; cls}

=get users sid=
wmic useraccount where name='dkarlslatt' get sid
=traceroute=
Test-NetConnection "IPaddress/HOSTaname" -TraceRoute
=name of ad servers=
nslookup -type=srv _ldap._tcp.dc._msdcs.${AD}
=manage ad users and computers=
dsa.msc

=iis logfiles=
Read last lines from iis log.
gc -Tail 10 "C:\InetPub\Logs\LogFiles\W3SVC1\u_ex$(Get-Date -F 'yyMMdd').log"
=join domain=
netdom join %computername% /domain:your.ADDomainToJoin.net /UserD:LoginWithJoinPermissions /PasswordD:%password%
=windows update info=
wmic qfe list
=patch=
Update release area Windows.
servicepack.exe -s:z:\w2k3
=get date in iso format=
Get-Date (Get-Date) -UFormat '+%Y-%m-%d %H:%M:%S'
(Get-Date).ToString("yyyy-MM-dd hh:mm:ss")

=format-list(fl)=
Get-WinEvent -LogName "Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational" | select * -first 1 | fl
=whoami=
echo "$env:UserDomain $env:UserName $env:ComputerName"
=group=
(New-Object System.DirectoryServices.DirectorySearcher("(&(objectCategory=User)(samAccountName=$($env:username)))")).FindOne().GetDirectoryEntry().memberOf
=unzip=
Expand-Archive C:\a.zip
=take ownership and remove=
Remove-Item -Recurse -Force <directory>
takeown /a /r /d Y /f <directory>
=print info to remove directories=
Prepare with two lists. One with users who are suitable to have their directories removed. And one list with the output from dir in c:\users.
cat uc-remote01_login.txt | while read WIN_USER WIN_DATE ; do echo '#' $WIN_USER $WIN_DATE ; DIRECTORY=$(grep " $WIN_USER" uc-remote01_users.txt) ; if [ "${DIRECTORY}" ] ; then echo Remove-Item -Recurse -Force $WIN_USER \; takeown /a /r /d Y /f $WIN_USER \; Remove-Item -Recurse -Force $WIN_USER ; fi ; done
=list environments variables=
dir env:
=list shares=
Get-SmbShare
=Stop grouping applications on task bar=
Set-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" -Name "TaskbarGlomLevel" -Value 2
Stop-Process -Name explorer -Force
Start-Process explorer
=autohide taskbar=
$p='HKCU:SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StuckRects3';$v=(Get-ItemProperty -Path $p).Settings;$v[8]=($v[8] -bor 1);Set-ItemProperty -Path $p -Name Settings -Value $v;Stop-Process -f -ProcessName explorer

=install cmdlet=
install-module sqlserver
=install chocolate=
Set-ExecutionPolicy Bypass -Scope Process -Force; [System.Net.ServicePointManager]::SecurityProtocol = [System.Net.ServicePointManager]::SecurityProtocol -bor 3072; iex ((New-Object System.Net.WebClient).DownloadString('https://community.chocolatey.org/install.ps1'))
=manage jobs=
Start job
Start-Job -FilePath C:\temp\cronjob.ps1
List jobs
Get-Job
Stop jobs
Stop-Job -Id <JobID>
Stop-Job -Name <JobName>
Delete Jobs
Remove-job -Name <JobName>

=timezone=
List timezones
Get-TimeZone -ListAvailable | grep -A10 -B10 Stockholm
Set Stockholm time.
Set-TimeZone -Name "W. Europe Standard Time"
=locale=
$env:LANG = 'en-US'
=path variable=
echo $env:path
=tweak windows=
https://winaerotweaker.com/
=autologin=
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v AutoAdminLogon /t REG_SZ /d 1 /f
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v DefaultUserName /t REG_SZ /d "name@outlook.com" /f
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v DefaultPassword /t REG_SZ /d "YourPassword123" /f
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v DefaultDomainName /t REG_SZ /d "MicrosoftAccount" /f
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v ForceAutoLogon /t REG_SZ /d 1 /f
=expand disk=
diskmgmt.msc
=create user from existing=
<pre>
# Define parameters for the new user
$newUser = @{
Name = "<Full Name>"
GivenName = "<First>"
Surname = "<LastName>"
SamAccountName = "andreas.stenudd"
UserPrincipalName = "andreas.stenudd@xpdo.xpeedio.local"
AccountPassword = (ConvertTo-SecureString "<password>" -AsPlainText -Force)
Enabled = $true
}

# Specify the existing user to copy from (replace with actual SAM account name)
$templateUserSam = "andreas.bjorklund"

# Get the template user's properties
$templateUser = Get-ADUser -Identity $templateUserSam -Properties *

# Create the new user, copying the OU (Path) from the template user
$newUserParams = $newUser.Clone()
$newUserParams.Path = $templateUser.DistinguishedName -replace '^CN=.*?,', '' # Extract OU from template user's DN

# Create the new user
New-ADUser @newUserParams

# Copy group memberships from the template user
$templateUser.MemberOf | ForEach-Object {
Add-ADGroupMember -Identity $_ -Members $newUser.SamAccountName
}

Write-Output "User $($newUser.Name) created successfully with group memberships copied from $templateUserSam."
</pre>
=mount iso=
Mount-DiskImage -ImagePath 'z:\temp\torrentz\The.Sims.4.Enchanted.by.Nature-RUNE\rune-the.sims.4.enchanted.by.nature.iso'
=list disks including devicename=
mountvol
=list shadowcopy=
Get-WmiObject -Class Win32_ShadowCopy
=list dedup=
Get-Dedupstatus
==dedup garbagecollection==
Start-DedupJob -volume f: -type garbagecollection
=keyboard=
List keyboards and lang.
Get-WinUserLanguageList
Install English menus and Swedish keyboard.'
$LangList = Get-WinUserLanguageList
$LangList.Add("en-SE")
Set-WinUserLanguageList $LangList -Force
Uninstall keyboards
$LangList = Get-WinUserLanguageList
# Remove en-US entirely
$LangList = $LangList | Where-Object { $_.LanguageTag -ne "en-GB" }
Set-WinUserLanguageList $LangList -Force
=curl/vim=
<pre>
$binPath = "C:\Users\$env:USERNAME\bin"
if (-not (Test-Path $binPath -PathType Container)) {
New-Item -ItemType Directory -Path $binPath
Write-Host "Created $binPath"
}
cd C:\Users\$env:USERNAME\bin
curl https://halfface.se/windows/windows.zip -o windows.zip
Expand-Archive -Path windows.zip -DestinationPath . -Force
Remove-Item Alias:curl
if ($env:PATH -notlike "*;C:\Users\$env:USERNAME\bin*") {
$env:PATH += ";C:\Users\$env:USERNAME\bin"
}
</pre>
Make above permanent.
<pre>
target = "C:\Users\$env:USERNAME\bin"
# Add to user PATH only if it's not already there
$currentPath = [Environment]::GetEnvironmentVariable("Path", "User")
if ($currentPath -notlike "*$target*") {
[Environment]::SetEnvironmentVariable("Path", $currentPath + ";$target", "User")
}
</pre>
=what does pid belong to=
<pre>
# Replace 1234 with your actual PID
$pid = 1234

# Method 1: Using Get-Process and Get-Service
$process = Get-Process -Id $pid -ErrorAction SilentlyContinue
if ($process) {
$serviceName = (Get-WmiObject Win32_Service | Where-Object { $_.ProcessId -eq $pid }).Name
if ($serviceName) {
Write-Host "PID $pid belongs to service: $serviceName"
Get-Service -Name $serviceName
} else {
Write-Host "PID $pid does NOT belong to any service"
}
} else {
Write-Host "Process with PID $pid not found"
}
</pre>
=what does pid belong to=
Get-WmiObject Win32_Service | Where-Object { $_.ProcessId -eq 1234 } | Select-Object Name, DisplayName, State, StartMode, PathName
=dmidecode/lshw/inventory=
Get-ComputerInfo | Select-Object CsName, WindowsVersion, OsArchitecture, CsTotalPhysicalMemory, OsNumberOfProcesses
=scheduled task=
<pre>
# Get detailed task information
$task = Get-ScheduledTask -TaskName "Hive*"
$taskInfo = Get-ScheduledTaskInfo -InputObject $task

# Display key information
Write-Host "Task Name: $($task.TaskName)"
Write-Host "Task Path: $($task.TaskPath)"
Write-Host "Last Run Time: $($taskInfo.LastRunTime)"
Write-Host "Last Result: 0x$($taskInfo.LastTaskResult.ToString('X8'))"
Write-Host "Next Run Time: $($taskInfo.NextRunTime)"
Write-Host "Number of Missed Runs: $($taskInfo.NumberOfMissedRuns)"
Write-Host "Task State: $($task.State)"

# Get the exit code meaning
$exitCode = $taskInfo.LastTaskResult
switch ($exitCode) {
0 { Write-Host "Exit Code: 0x0 - SUCCESS" -ForegroundColor Green }
1 { Write-Host "Exit Code: 0x1 - INVALID FUNCTION" -ForegroundColor Red }
2 { Write-Host "Exit Code: 0x2 - FILE NOT FOUND" -ForegroundColor Red }
10 { Write-Host "Exit Code: 0xA - INCORRECT ENVIRONMENT" -ForegroundColor Yellow }
267008 { Write-Host "Exit Code: 0x41300 - SCHEDULED TASK STOPPED" -ForegroundColor Yellow }
3221225786 { Write-Host "Exit Code: 0xC000013A - APPLICATION TERMINATED BY CTRL+C" -ForegroundColor Yellow }
default { Write-Host "Exit Code: 0x$($exitCode.ToString('X8'))" -ForegroundColor Yellow }
}
</pre>
=disable screen saver=
Disable screen saver
Set-ItemProperty -Path "HKCU:\Control Panel\Desktop" -Name ScreenSaveActive -Value 0
Optional: Also disable password protection on resume (if screen saver were enabled)
Set-ItemProperty -Path "HKCU:\Control Panel\Desktop" -Name ScreenSaverIsSecure -Value 0
=empty recyclebin=
(New-Object -ComObject Shell.Application).NameSpace(0x0a).Items() | ForEach-Object { $_.InvokeVerb('delete') }

Postgresql

2026-03-09T14:37:06Z

Ekaanbj: /* sleep 2s */

=psql=
==run command from cli==
psql -c "SELECT datname FROM pg_database;"
==Connect to remote database:==
export PGPASSWORD=<password> && psql --host=<host> --port=5432 --username=<username> --no-password postgres
With variables
export PGHOST=<database_host>
export PGPORT=5432
export PGUSER=<user>
export PGPASSWORD=<password>
export PGDATABASE=<database>
psql

==get what you ask for and less cruft==
psql -A -t -c "SELECT * FROM pg_replication_slots;"

=install psql=
apt-get install freetds-bin

=List databases=
==Alternative 1==
SELECT datname FROM pg_database;
==Alternative 2==
gives more information too.
\l
Name | Owner | Encoding | Collate | Ctype | Access privileges
-------------+-------------+----------+-------------+-------------+-----------------------
indata_mdb | uc_etl_prod | UTF8 | sv_SE.UTF-8 | sv_SE.UTF-8 |
...
==Alternative 3==
\l+

=select database=
\c testdb;
=show tables=
List all tables in all schemas
\dt *.*
list tables in current schema
\dt
Or from command line.
su - postgres -c "psql -c \"\\dt \" database"
=list schemas=
\dn
=list schemas with permissions=
\dn+

=schema/search_path=
List current schema
SHOW search_path;
Change search path.
SET search_path TO myschema, public;

=describe table=
\d table;
\d dc_store.document;

=Change view. One line per attribute(\G in mysql)=
\x on
psql -x -c "select * from blabla limit 1;"

=exit/quit=
\q

=update=
UPDATE users SET admin = 1 WHERE user_id = 14002;
=Create user=
CREATE USER username WITH PASSWORD 'MYPASS';
=Create database=
CREATE DATABASE database OWNER username;

=create table=
CREATE TABLE testtable (
code char(5) CONSTRAINT firstkey PRIMARY KEY,
title varchar(40) NOT NULL,
did integer NOT NULL,
date_prod date,
kind varchar(10),
len interval hour to minute
);
=Add row to table=
INSERT INTO testtable (code, title, did, date_prod, kind, len)
VALUES ('A1234', 'Test Item', 101, '2025-01-08', 'example', '02:30');
=add random rows to table=
INSERT INTO testtable (code, title, did, date_prod, kind, len)
SELECT
'A' || LPAD(num::text, 4, '0') AS code, -- Generate code like A0001, A0002, ...
'Test Item ' || num::text AS title, -- Title with the number
(num % 10) + 1 AS did, -- Random did value (1 to 10)
CURRENT_DATE - (num % 30) AS date_prod, -- Random date in the last 30 days
'example' AS kind, -- Example kind
(num % 5 || ' hours')::interval AS len -- Convert the generated text to interval
FROM generate_series(1, 100) AS s(num);

=create readaccess role and grant user access=
CREATE ROLE readaccess;
GRANT CONNECT ON DATABASE <database> TO readaccess;
GRANT USAGE ON SCHEMA public TO readaccess;
GRANT SELECT ON ALL TABLES IN SCHEMA public TO readaccess;
CREATE USER <user> WITH PASSWORD '<password>';
GRANT readaccess TO <user>;
=grant access to a role for a user=
GRANT ROLE <role_name> TO USER <user_name>;
GRANT <role_name> TO <user_name>;
=grant all permissions to a user on a table=
GRANT ALL PRIVILEGES ON TABLE table_name TO username;

=Delete database=
DROP DATABASE dbname;
==delete database from cli==
dropdb $dbname
==delete table==
DROP TABLE IF EXISTS table_name;

=Import a database=
psql username -h hostname -d dbname < dump.sql
=change password=
ALTER USER user_name WITH PASSWORD 'new_password';

=Set super privileges=
ALTER USER username WITH SUPERUSER;
=Deleting user=
DROP USER nomusr
=Getting help=
\? or \h
=size of database=
SELECT pg_size_pretty( pg_database_size('database') );
=size of table=
SELECT pg_size_pretty( pg_total_relation_size('tablename') );
=clean archives older than 2 days=
su postgres -c "/usr/pgsql-9.5/bin/pg_archivecleanup /var/lib/pgsql/9.5/archivedir/ $(basename $(find /var/lib/pgsql/9.5/archivedir/ -ctime +2 | tail -n 1))"
=backup=
# Backup database.
DATABASE=very_nice_database ; pg_dump -Fc -Z 2 --file=/tmp/${DATABASE}.$(date '+%Y%m%d').dump ${DATABASE}
# Is database in backup
SELECT pg_is_in_backup();

=restore=
Look at permissions on database
psql -c "\l"
export DATABASE=very_nice_database
Drop database connectipons.
psql -c "SELECT pg_terminate_backend(pg_stat_activity.pid) FROM pg_stat_activity WHERE pg_stat_activity.datname = '${DATABASE}' AND pid <> pg_backend_pid();"
Drop database.
dropdb ${DATABASE}
Create database
createdb -T template0 ${DATABASE}
Restore database
pg_restore -j8 -d ${DATABASE} --no-privileges --no-owner --clean --if-exists --exit-on-error /tmp/${DATABASE}.$(date '+%Y%m%d' --date "-4 days").dump
# Set correct permissions.
psql -c "ALTER DATABASE ${DATABASE} OWNER TO ${OWNER};"

=bookmarks=
https://wiki.postgresql.org/wiki/Disk_Usage
=bloat=
Every record that has been deleted but is still taking some space is called a dead tuple.
Once there is no dependency on those dead tuples with the already running transactions, the dead tuples are no longer needed.
Thus, PostgreSQL runs VACUUM on such Tables. VACUUM reclaims the storage occupied by these dead tuples.
The space occupied by these dead tuples may be referred to as Bloat.
VACUUM scans the pages for dead tuples and marks them to the freespace map (FSM).
Query for bloat(which looks bloated... :-)
SELECT
current_database(), schemaname, tablename, /*reltuples::bigint, relpages::bigint, otta,*/
ROUND((CASE WHEN otta=0 THEN 0.0 ELSE sml.relpages::FLOAT/otta END)::NUMERIC,1) AS tbloat,
CASE WHEN relpages < otta THEN 0 ELSE bs*(sml.relpages-otta)::BIGINT END AS wastedbytes,
iname, /*ituples::bigint, ipages::bigint, iotta,*/
ROUND((CASE WHEN iotta=0 OR ipages=0 THEN 0.0 ELSE ipages::FLOAT/iotta END)::NUMERIC,1) AS ibloat,
CASE WHEN ipages < iotta THEN 0 ELSE bs*(ipages-iotta) END AS wastedibytes
FROM (
SELECT
schemaname, tablename, cc.reltuples, cc.relpages, bs,
CEIL((cc.reltuples*((datahdr+ma-
(CASE WHEN datahdr%ma=0 THEN ma ELSE datahdr%ma END))+nullhdr2+4))/(bs-20::FLOAT)) AS otta,
COALESCE(c2.relname,'?') AS iname, COALESCE(c2.reltuples,0) AS ituples, COALESCE(c2.relpages,0) AS ipages,
COALESCE(CEIL((c2.reltuples*(datahdr-12))/(bs-20::FLOAT)),0) AS iotta -- very rough approximation, assumes all cols
FROM (
SELECT
ma,bs,schemaname,tablename,
(datawidth+(hdr+ma-(CASE WHEN hdr%ma=0 THEN ma ELSE hdr%ma END)))::NUMERIC AS datahdr,
(maxfracsum*(nullhdr+ma-(CASE WHEN nullhdr%ma=0 THEN ma ELSE nullhdr%ma END))) AS nullhdr2
FROM (
SELECT
schemaname, tablename, hdr, ma, bs,
SUM((1-null_frac)*avg_width) AS datawidth,
MAX(null_frac) AS maxfracsum,
hdr+(
SELECT 1+COUNT(*)/8
FROM pg_stats s2
WHERE null_frac<>0 AND s2.schemaname = s.schemaname AND s2.tablename = s.tablename
) AS nullhdr
FROM pg_stats s, (
SELECT
(SELECT current_setting('block_size')::NUMERIC) AS bs,
CASE WHEN SUBSTRING(v,12,3) IN ('8.0','8.1','8.2') THEN 27 ELSE 23 END AS hdr,
CASE WHEN v ~ 'mingw32' THEN 8 ELSE 4 END AS ma
FROM (SELECT version() AS v) AS foo
) AS constants
GROUP BY 1,2,3,4,5
) AS foo
) AS rs
JOIN pg_class cc ON cc.relname = rs.tablename
JOIN pg_namespace nn ON cc.relnamespace = nn.oid AND nn.nspname = rs.schemaname AND nn.nspname <> 'information_schema'
LEFT JOIN pg_index i ON indrelid = cc.oid
LEFT JOIN pg_class c2 ON c2.oid = i.indexrelid
) AS sml
ORDER BY wastedbytes DESC

==clear space vacuum==
\c database
vacuum;
if that doesn't work do:
vacuum: freeze; or vacuum full;
==vacuum table==
Select database
\c ucc
select role
SET search_path TO myschema, kdl;
Vacuum table
vacuum full taxation_initial_data;

=autovacuum=
Is autovacuum enabled.
SHOW autovacuum;

=count table=
SELECT COUNT(*) FROM TABLE_NAME;
If you don't need an exact count, the current statistic from the catalog table pg_class might be good enough and is much faster to retrieve for big tables.
SELECT reltuples AS approximate_row_count FROM pg_class WHERE relname = 'table_name';
=number of connections=
su - postgres -c "psql -t -c 'SELECT * FROM pg_stat_activity;'" | wc -l

=drop connections=
SELECT pg_terminate_backend(pg_stat_activity.pid) FROM pg_stat_activity WHERE pg_stat_activity.datname = 'dbname' AND pid <> pg_backend_pid();

=postgres configuration=
postgresql.conf
=pg_hba.conf=
Connections are configured in this file.
=reread configuration=
su - postgres
/usr/bin/pg_ctl reload
From psql
SELECT pg_reload_conf();

=list prepared transactions=
select * from pg_prepared_xacts where database='cti_batch';

=remove prepared connecion=
ROLLBACK PREPARED '131077_AAAAAAAAAAAAAP//rB6PFn41NfBevSfGABG7nTE=_AAAAAAAAAAAAAP//rB6PFn41NfBevSfGABG7pAAAAAIAAAAA';
=pager off=
\pset pager off
=pager less=
\x auto
\pset pager on
\setenv PAGER less

=pager=
export PAGER=less
=config file=
.my.cnf
.pgpass
hostname:port:database:username:password
hostname:port:*:username:password

=Permissions in postgres=
pg_hba.conf local file which is a local file that defines which sources for login credentials to use. (ldap, local users... to me it feels like nsswitch.conf)
owner database of database. The right to modify or destroy an object is always the privilege of the owner only.
role:s separate database are like user and groups combined. One role can inherit another. Different attributes gives various capabilities. login, superuser...
privileges database on (table, function...): SELECT , INSERT , UPDATE , DELETE
You can login with one role and then switch to another.
=privileges granted to users on all tables=
<pre>
SELECT
grantee,
table_schema,
table_name,
privilege_type
FROM
information_schema.role_table_grants
ORDER BY
grantee, table_schema, table_name;
</pre>
=Listing Users and Their Membership in Roles=
<pre>
SELECT
r.rolname AS role_name,
m.rolname AS member_name
FROM
pg_auth_members am
JOIN
pg_roles r ON r.oid = am.roleid
JOIN
pg_roles m ON m.oid = am.member
ORDER BY
role_name, member_name;
</pre>
=Listing All Users with Their Database-Level Privileges=
<pre>
SELECT
pg_database.datname,
pg_roles.rolname,
has_database_privilege(pg_roles.rolname, pg_database.datname, 'CONNECT') AS can_connect,
has_database_privilege(pg_roles.rolname, pg_database.datname, 'CREATE') AS can_create,
has_database_privilege(pg_roles.rolname, pg_database.datname, 'TEMP') AS can_create_temp_tables
FROM
pg_database
CROSS JOIN
pg_roles
ORDER BY
pg_database.datname, pg_roles.rolname;
</pre>
=Is user superuser=
<pre>
SELECT
rolname AS role_name,
CASE WHEN rolsuper THEN 'Yes' ELSE 'No' END AS is_superuser
FROM
pg_roles;

</pre>

=roles/users=
Which roles and users exist.
\du

=set new role=
set role super-man;
=current role=
user name of current execution context
SELECT current_user;
=session user=
SELECT session_user;

=display privileges=
\dp
\z
=tablespaces=
List tablespaces
SELECT spcname FROM pg_tablespace;
=how many rows in table=
SELECT reltuples AS estimate FROM pg_class where relname = 'member_offer';

=delete rows matching value and timestamp=
DELETE FROM receipt_transaction WHERE status_point = 'FAIL_POINT_CALC' and business_date < ( now() - interval '+14 day' ) ;
=delete all rows=
TRUNCATE TABLE public.subscribe;
DELETE FROM public.subscribe;

=user password=
~/.pgpass
hostname:port:database:username:password
=kill=
Kill less agressive
select pg_cancel_backend(16967);
kill
select pg_terminate_backend(16967) from pg_stat_activity;

=who are you and where do you come from, whoami=
SELECT CURRENT_USER usr, :'HOST' host, inet_server_port() port;
or
\conninfo
=running queries on standby=
max_standby_archive_delay = 600s
max_standby_streaming_delay = 600s
=analyze query=
EXPLAIN ANALYZE select ...
=version=
SELECT version();
=master/slave setup=
Streaming replication in PostgreSQL works on log shipping. Every transaction in postgres is written to a transaction log called WAL (write-ahead log) to achieve durability. A slave uses these WAL segments to continuously replicate changes from its master.
There exists three mandatory processes – wal sender , wal receiver and startup process, these play a major role in achieving streaming replication in postgres.
Log Sequence Number, or LSN, is a pointer to a location in the WAL.
=wal(write ahead log)=
pg_xlog directory holds the WAL (Write Ahead Log) files.WAL files contain a record of all changes made to the database.

=Is replication moving=
This LSN(Log Sequence Number) indicates the position in the WAL(Write-Ahead Log) up to which changes have been safely flushed and confirmed by subscribers or replication processes.
SELECT slot_name, plugin, confirmed_flush_lsn, slot_type, restart_lsn FROM pg_replication_slots;
=grant user replication permissions=
ALTER ROLE <username> WITH REPLICATION;

=how much space is used by wal=
SELECT slot_name, pg_size_pretty(pg_wal_lsn_diff(pg_current_wal_lsn(),restart_lsn)) AS replicationSlotLag, active FROM pg_replication_slots ;

=List tablespaces=
\db

=list clusters=
pg_lsclusters
=pgbackrest=
# https://pgbackrest.org/user-guide.html#introduction
# Install pgbackrest
apt-get install -y pgbackrest
# pg-primary - Create pgBackRest configuration file and directories
mkdir -p -m 770 /var/log/pgbackrest
chown postgres:postgres /var/log/pgbackrest
mkdir -p /etc/pgbackrest
mkdir -p /etc/pgbackrest/conf.d
touch /etc/pgbackrest/pgbackrest.conf
chmod 640 /etc/pgbackrest/pgbackrest.conf
chown postgres:postgres /etc/pgbackrest/pgbackrest.conf
# Does it work?
sudo -u postgres pgbackrest
# Configure the PostgreSQL cluster data directory
# pg-primary:/etc/pgbackrest/pgbackrest.conf
[billo_dev]
pg1-path=/var/lib/postgresql/12/billo_dev
# On machine taking backups.
# Configure the pgBackRest repository path
# /etc/pgbackrest/pgbackrest.conf
[demo]
pg1-path=/var/lib/postgresql/12/demo
[global]
repo1-path=/var/lib/pgbackrest
# /etc/postgresql/12/main/postgresql.conf
archive_command = 'pgbackrest --stanza=billo_dev archive-push %p'
archive_mode = on
max_wal_senders = 3
wal_level = replica
# setup backup.
sudo -u postgres pgbackrest --stanza=billo_dev --log-level-console=info stanza-create
# check configuration
sudo -u postgres pgbackrest --stanza=billo_dev --log-level-console=info check
# Run backup
sudo -u postgres pgbackrest --stanza=billo_dev --log-level-console=info backup
# Differential backup
sudo -u postgres pgbackrest --stanza=billo_dev --log-level-console=info --type=diff backup
# Full backup
sudo -u postgres pgbackrest --stanza=billo_dev --log-level-console=info --type=full backup
# Every 10 minutes except for 2:00-2:59
*/10 0-1,3-23 * * * pgbackrest --stanza=billo_dev --type=diff backup
# 02:10 02:20 02:30 02:40 02:50
10-50/10 2 * * * pgbackrest --stanza=billo_dev --type=diff backup
# 3:00 Full
0 2 * * * pgbackrest --stanza=billo_dev --type=full backup
# List backup information
sudo -u postgres pgbackrest info
...
# Restore backup last backup.
sudo -u postgres find /var/lib/postgresql/12/billo_dev -mindepth 1 -delete
# Restore the cluster and start PostgreSQL
sudo -u postgres pgbackrest --stanza=billo_dev restore
sudo pg_ctlcluster 12 restore start
...
# Restore backup from certain time.
sudo -u postgres find /var/lib/postgresql/12/billo_dev -mindepth 1 -delete
# Restore the cluster and start PostgreSQL
sudo -u postgres pgbackrest --stanza=billo_dev --set 20220321-113900F_20220321-122001D restore
sudo pg_ctlcluster 12 restore start
==install on remote machine==
===repository===
sudo adduser --disabled-password --gecos "" pgbackrest
===setup directories===
mkdir -p -m 770 /var/log/pgbackrest
chown pgbackrest:pgbackrest /var/log/pgbackrest
mkdir -p /etc/pgbackrest
mkdir -p /etc/pgbackrest/conf.d
touch /etc/pgbackrest/pgbackrest.conf
chmod 640 /etc/pgbackrest/pgbackrest.conf
chown pgbackrest:pgbackrest /etc/pgbackrest/pgbackrest.conf
mkdir -p /var/lib/pgbackrest
chmod 750 /var/lib/pgbackrest
chown pgbackrest:pgbackrest /var/lib/pgbackrest
===passwordless login===
sudo -u pgbackrest mkdir -m 750 /home/pgbackrest/.ssh
sudo -u pgbackrest ssh-keygen -f /home/pgbackrest/.ssh/id_rsa -t rsa -b 4096 -N ""
==Install on Postgres server==
sudo -u postgres mkdir -m 750 -p /var/lib/postgresql/.ssh
sudo -u postgres ssh-keygen -f /var/lib/postgresql/.ssh/id_rsa -t rsa -b 4096 -N ""
===ssh keys===
server -> postgres -> ssh pgbackrest@repository /usr/bin/pgbackrest
no-agent-forwarding,no-X11-forwarding,no-port-forwarding,command="/usr/bin/pgbackrest ${SSH_ORIGINAL_COMMAND#* }" ssh-rsa $public_ssh_key postgres@server

repository -> pgbackrest -> ssh postgres@server /usr/bin/pgbackrest.
no-agent-forwarding,no-X11-forwarding,no-port-forwarding,command="/usr/bin/pgbackrest ${SSH_ORIGINAL_COMMAND#* }" ssh-rsa $public_ssh_key pgbackrest@repository
=prompt=
Create ~/.psqlrc with below here document.
cat << 'EOF' > ~/.psqlrc
\set PROMPT1 '(%n@%M:%>) %`date "+%H:%M:%S %Z"` [%/] \n%x%# '
\set PROMPT2 '%M %n@%/%R %# '
\x auto
\pset pager on
\setenv PAGER less
EOF

=index=
Size of index.
SELECT i.indexrelname, x.indexrelid, pg_size_pretty(size)
FROM (SELECT indexrelid, pg_indexes_size(indrelid) AS size
FROM pg_index) x
JOIN pg_stat_user_indexes i ON i.indexrelid = x.indexrelid
ORDER BY size DESC;
=Privilege Abbreviation=
Privilege Abbreviation Applicable Object Types
SELECT r (“read”) LARGE OBJECT, SEQUENCE, TABLE (and table-like objects), table column
INSERT a (“append”) TABLE, table column
UPDATE w (“write”) LARGE OBJECT, SEQUENCE, TABLE, table column
DELETE d TABLE
TRUNCATE D TABLE
REFERENCES x TABLE, table column
TRIGGER t TABLE
CREATE C DATABASE, SCHEMA, TABLESPACE
CONNECT c DATABASE
TEMPORARY T DATABASE
EXECUTE X FUNCTION, PROCEDURE
USAGE U DOMAIN, FOREIGN DATA WRAPPER, FOREIGN SERVER, LANGUAGE, SCHEMA, SEQUENCE, TYPE
SET s PARAMETER
ALTER SYSTEM A PARAMETER
=which codepage is being used on database=
SELECT datname, pg_encoding_to_char(encoding) AS encoding FROM pg_database;
=install postgres ubuntu (24)=
apt install postgresql-16 postgresql-contrib-16
systemctl enable postgresql --now
vim /etc/postgresql/16/main/pg_hba.conf
sed -i "s/.*listen_addresses.*/listen_addresses = '*'/g" /etc/postgresql/16/main/postgresql.conf
systemctl restart postgresql

=install postgres fedora(40)=
sudo dnf install postgresql-server postgresql-contrib
sudo systemctl enable postgresql
sudo postgresql-setup --initdb --unit postgresql
# Grant access for user.
sudo vim /var/lib/pgsql/data/pg_hba.conf
local all all md5
# Allow database to be reached.
sudo sed -i "s/.*listen_addresses.*/listen_addresses = '*'/g" /var/lib/pgsql/data/postgresql.conf
# Make changes active.
sudo service postgresql restart
CREATE USER username WITH PASSWORD 'password';
CREATE DATABASE database OWNER username;
CREATE TABLE testtable (
code char(5) CONSTRAINT firstkey PRIMARY KEY,
title varchar(40) NOT NULL,
did integer NOT NULL,
date_prod date,
kind varchar(10),
len interval hour to minute
);
GRANT SELECT ON TABLE testtable TO username;
# Test connectivity
export PGPASSWORD=password && psql --host=$(hostname -f) --port=5432 --username=username --no-password postgres

=uptime=
select current_timestamp - pg_postmaster_start_time() as uptime;
=frequently running query=
with
a as (select dbid, queryid, query, calls s from pg_stat_statements),
b as (select dbid, queryid, query, calls s from pg_stat_statements, pg_sleep(1))
select
pd.datname as db_name,
substr(a.query, 1, 400) as the_query,
sum(b.s-a.s) as runs_per_second
from a, b, pg_database pd
where
a.dbid= b.dbid
and
a.queryid = b.queryid
and
pd.oid=a.dbid
group by 1, 2
order by 3 desc;
=sessions older than 1 second=
select
now()-query_start as runtime,
pid as process_id,
datname as db_name,
client_addr,
client_hostname,
query
from pg_stat_activity
where state!='idle'
and now() - query_start > '1 seconds'::interval
order by 1 desc;

=cpu usage per query=
SELECT
pss.userid,
pss.dbid,
pd.datname as db_name,
round((pss.total_exec_time + pss.total_plan_time)::numeric, 2) as total_time,
pss.calls,
round((pss.mean_exec_time+pss.mean_plan_time)::numeric, 2) as mean,
round((100 * (pss.total_exec_time + pss.total_plan_time) / sum((pss.total_exec_time + pss.total_plan_time)::numeric) OVER ())::numeric, 2) as cpu_portion_pctg,
pss.query
FROM pg_stat_statements pss, pg_database pd
WHERE pd.oid=pss.dbid
ORDER BY (pss.total_exec_time + pss.total_plan_time)
DESC LIMIT 30;
=performance troubleshooting=
https://jfrog.com/community/data-science/troubleshooting-high-cpu-utilization-in-postgresql-databases-a-how-to-guide/
=Which charactertable does database use?=
psql -d <database> -c 'SHOW SERVER_ENCODING;'
=change owner of table=
ALTER TABLE heartbeat OWNER TO pguser;
==View status of postgresql server==
sudo -u postgres repmgr cluster show
=sleep 2s=
select pg_sleep(2);

Postgresql

2026-03-09T14:36:00Z

Ekaanbj: /* View status of postgresql server */

Windows

2026-03-06T14:34:51Z

Ekaanbj: /* scheduled task */

=connect to windows from windows(rdp)=
mstsc /v:172.30.142.11
Login with password.
# Define the server and credentials
$server = "<server>"
$username = "<username>"
$password = "<password>"
# Create credentials using cmdkey
cmdkey /generic:"TERMSRV/$server" /user:$username /pass:$password
# Start MSTSC to connect to the server
Start-Process "mstsc" -ArgumentList "/v:$server"
# Delete the credentials after MSTSC session is done
cmdkey /delete:TERMSRV/<servername>

=which version of powershell is installed=
$PSVersionTable

=hibernate=
powercfg.exe -h off

=enable powershell=
set-executionpolicy unrestricted
=List network interfaces with ips=
Get-NetIPAddress | Select-Object InterfaceAlias, IPAddress
=List network interfaces and routes=
Get-NetIPAddress | Select-Object InterfaceAlias, IPAddress | Format-Table ; Get-NetRoute | Format-Table

=Configure network=
# Static ip.
netsh interface ip set address name="Local Area Connection" static 192.168.122.41 255.255.255.0 192.168.122.1 1
# Dhcp
netsh interface is set address name="Local Area Connection" dhcp
# Verify mtu settings.
netsh interface ipv4 show subinterfaces
# Set correct mtu.
netsh interface ipv4 set subinterface "Ethernet 2" mtu=1000

=extract msi=
msiexec /a "C:\software.msi" /qb TARGETDIR="C:\Folder"

=restart network=
netsh interface set interface extbond admin = disabled
ping 127.0.0.1 -n 6
netsh interface set interface extbond admin = enabled

=Profile=
# Profile
C:\Users\abjorklund\AppData\Roaming\Microsoft\Windows\Start Menu

=restart via rdesktop=
CTRL + ALT + END
=alternative shutdown=
Shutdown with restart
shutdown /t 0 /r /f
Shutdown
shutdown /t 0 /s /f
logoff/logout
shutdown /l /f

=mount drive=
net use z: \\www.halfface.se\storage /user:alex <password> /persistent:no
=change password=
Start a command prompt as administrator.
net user username password

=activate account=
net user username /active:yes

=remove cached passwords=
list/remove cached passwords graphically
rundll32.exe keymgr.dll,KRShowKeyMgr
list/remove cached passwords cli
cmdkey /list

=is your account locked. bat file=
@echo off
:again
date /t & time /t
net user /domain mdinkel > c:\temp\mdinkel
find "active" c:\temp\mdinkel
timeout 10
goto again

=unlock account=
Net user username /DOMAIN /active:YES

=Browse active dirctory structure=
adsiedit.msc
=time zone conversion=
Here you can convert from Windows to unix time zones tz.
http://www.unicode.org/cldr/charts/latest/supplemental/zone_tzid.html
=uptime=
net statistics server
Uptime and other information
systeminfo /FO CSV | ConvertFrom-CSV

=credetial manager empty cache=
rundll32.exe keymgr.dll,KRShowKeyMgr
=remote powershell pssession=
Create pssession.
$secpasswd = ConvertTo-SecureString "*************" -AsPlainText -Force
$mycreds = New-Object System.Management.Automation.PSCredential ("domain\user", $secpasswd)
New-PSSession -ComputerName 10.111.222.5 -Credential $mycreds

get pssessions.
get-pssession

enter pssession
Enter-PSSession -Name
Enter-PSSession -ComputerName 10.50.197.70
Enter-PSSession 172.18.1.198 -Credential domain\uer

remove pssession
remove-pssession -name Session15

Run remote command.
Invoke-Command -name "Session14" -ScriptBlock { hostname }

Login to remote machine
Enter-PSSession 10.50.197.70 -Credential $mycreds

=PowerShell=
=gc=
Get-content. Print content of file.
gc c:\temp\file.txt
=Set-content=
Set-Content -path REMOTE\Filename.txt
=Out-File=
Out-File -Encoding UTF8

=replace text in file=
Get-Content REMOTE\Filename.txt | foreach-object { $_ -replace "OLD", "NEW" } | Set-Content REMOTE\Filename.txt

=get-service=
Status of one service.
get-service ipeventwatcher
status of all services. list services.
Get-Service
find service
get-service *service_to_find* | select -expand name
=get failed services=
Get-Service | Where-Object {$_.Status -eq 'Stopped' -and $_.StartType -eq 'Automatic'}
=failed service from boot=
Write-Host "`n=== Stopped Automatic Services ===" -ForegroundColor Cyan
Get-Service | Where-Object { $_.Status -eq 'Stopped' -and $_.StartType -eq 'Automatic'} | Select-Object Name, DisplayName, Status | Format-Table -AutoSize
Write-Host "`n=== Disabled Scheduled Tasks ===" -ForegroundColor Cyan
Get-ScheduledTask | Where-Object {$_.State -eq 'Disabled'} | Select-Object TaskName, TaskPath | Format-Table -AutoSize
Write-Host "`n=== Recent Service Failures (Event Log) ===" -ForegroundColor Cyan
Get-EventLog -LogName System -Source "Service Control Manager" -EntryType Error -Newest 10 | Select-Object TimeGenerated, Message | Format-List

=stop-service=
stop-service ipeventwatcher
=restart-service=
restart-service ipremote -force
restart-service check_mk_agent -force
Restart-Service -Force -Name "TermService"
=tell windows to restart service automatically=
$serviceName = "icinga2"
sc.exe failure $serviceName reset= 86400 actions= restart/60000/restart/60000/restart/60000

=start-service=
start-service ipeventwatcher
=autostart service=
Set-Service -Name sshd -StartupType Automatic

=variable=
Set variable to content of file.
$a = gc IPremote.exe.config
=md5sum=
[CmdletBinding(SupportsShouldProcess=$False)]
param([string]$File)

function Get-Checksum([string]$strInFile)
{
$objCrypto = New-Object "System.Security.Cryptography.MD5CryptoServiceProvider"
$objFile = Get-Item $strInFile
$objStream = $objFile.OpenRead()
$objBytes = $objCrypto.ComputeHash($objStream)
$strChecksum = ""
foreach($objByte in $objBytes) {
$strChecksum += $objByte.ToString('x2')
}
$objStream.Close() | Out-Null
return $strChecksum
}

$strFileToCheck = $File
if(Test-Path($strFileToCheck)) {
Get-Checksum $strFileToCheck
}

Get md5sum of all files.
gci * | Get-FileHash -Algorithm md5 | ft Hash,@{n="File";e={(Get-item $_.Path).Name}}

=tcp connect port=
netcat nc
(New-Object Net.Sockets.TcpClient).Connect("1.2.3.4",80)
$Tcp = New-Object Net.Sockets.TcpClient;$Tcp.BeginConnect("1.2.3.4", 80, $null, $null).AsyncWaitHandle.WaitOne(5000);$Tcp.Close()
New-Object System.Net.Sockets.TCPClient -ArgumentList "1.2.3.4",3389

Test-NetConnection -ComputerName 192.168.122.1 -InformationLevel Detailed -port 23
Latest and greatest.
$Computer="127.0.0.1"; $Port=20010; $Socket = New-Object Net.Sockets.TcpClient;($Socket.BeginConnect($Computer, $Port, $Null, $Null)).AsyncWaitHandle.WaitOne(200);$Socket.Close();

=What is using tcp connections=
Get-NetTCPConnection | Group-Object -Property State, OwningProcess | Select -Property Count, Name, @{Name="ProcessName";Expression={(Get-Process -PID ($_.Name.Split(',')[-1].Trim(' '))).Name}}, Group | Sort Count -Descending
=grep=
gc IPremoteDebug.log | select-string "ip2date"

=List all processes. Grep for string=
Get-Process -IncludeUserName | findstr dkarlslatt

=grep recursive=
dir -Recurse | Select-String -pattern "192.168.19.102"

=list processes=
Get-Process
=kill processes from user=
Get-Process -IncludeUserName | Where UserName -match joe | Stop-Process -force

=restart processes=
get-process -name powershellserver | stop-process

=clear content=
Clear-Content filename.doc
=dir recursive=
dir /a/s/b filename.txt
=dir recursive=
'Get-ChildItem "c:\program files\" -rec | ForEach-Object -Process {$_.FullName}'
'Get-ChildItem . -recurse -force | ForEach-Object -Process {$_.FullName}'
=locate a file=
List recursive look for file with file name.
Get-Childitem -Path C:\ -Include *filename* -Recurse -ErrorAction SilentlyContinue

=dir filename size=
'get-childitem "C:\Program Files\directory" -rec | where {!$_.PSIsContainer} | select-object Name, Length'
=find file with filename=
Get-ChildItem -Path C:\ -Recurse -Filter *sshd_config* -ErrorAction SilentlyContinue
=find old files=
Get-ChildItem | Where-Object {$_.LastWriteTime -lt (Get-Date).AddDays(-30)}

=find old files and remove them=
$Folder = "G:\Downloads"
#Delete files older than 6 months
Get-ChildItem $Folder -Recurse -Force -ea 0 |
? {!$_.PsIsContainer -and $_.LastWriteTime -lt (Get-Date).AddDays(-180)} |
ForEach-Object {
$_ | del -Force
$_.FullName | Out-File C:\log\deletedlog.txt -Append
}

=calculate size of directory=
Value returned is in Scientific notation format. Add number of zeroes to value. 1.00E-6 is 1000000.
'(gci "D:\data\db" | measure Length -s).Sum /1GB'
=remove directory=
rd /s /q $DIRECTORY

=dir human readable file size=
function
Function Format-FileSize() {
Param ([int]$size)
If ($size -gt 1TB) {[string]::Format("{0:0.00} TB", $size / 1TB)}
ElseIf ($size -gt 1GB) {[string]::Format("{0:0.00} GB", $size / 1GB)}
ElseIf ($size -gt 1MB) {[string]::Format("{0:0.00} MB", $size / 1MB)}
ElseIf ($size -gt 1KB) {[string]::Format("{0:0.00} kB", $size / 1KB)}
ElseIf ($size -gt 0) {[string]::Format("{0:0.00} B", $size)}
Else {""}
}
command
Get-ChildItem | Select-Object Name, @{Name="Size";Expression={Format-FileSize($_.Length)}}

=base64=
decode base64 string
[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String("YmxhaGJsYWg="))
decode content of file.
ssh ip_address_hostname '$Text=(get-content "C:\Program Files\application\application.log") ; $Bytes = [System.Text.Encoding]::Unicode.GetBytes($Text) ; $EncodedText =[Convert]::ToBase64String($Bytes) ; $EncodedText' | base64 -d

=troubleshooting network=
netstat -ano | findstr <ipremote-pid>

=diff=
Compare two files.
compare-object (get-content one.txt) (get-content two.txt)
=log file. Eventlog=
List event logs.
Get-EventLog -list
List events in a log.
Get-EventLog -LogName IPremoteLog
List events sins date.
Get-EventLog -LogName Application -after "den 5 november 2014 10:00:00"

=get-winevent=
# List event logs.
Get-WinEvent -ListLog * | where {$_.RecordCount -gt 0}
# Get latest rdp log entries.
Get-WinEvent -LogName "Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational" | select * -first 1 | fl

=date=
Get-Date
Date in iso format.
Get-Date -UFormat '+%Y-%m-%d %H:%M:%S.000Z'

=full output=
Print all variable with full output
'(Get-Variable).StdOut'
Send output to line like the following to get more output.
| Ft -autosize | out-string -width 4096

=restart services via samba=
install samba-common
yum install samba-common
List services.
net rpc service list -I IPADDRESS -U USERNAME%PASSWORD
Stop service.
net rpc service start ipremote -I IPADDRESS -U 'user%password'
Start service.
net rpc service start ipeventwatcher -I IPADDRESS -U 'user%password'
=Windows version=
[System.Environment]::OSVersion.Version
http://msdn.microsoft.com/en-us/library/windows/desktop/ms724833%28v=vs.85%29.aspx
(Get-WmiObject -class Win32_OperatingSystem).Caption
Which architecture.
gwmi win32_operatingsystem | select osarchitecture

=set windows proxy=
Set-ItemProperty "HKCU:\Software\Microsoft\Windows\CurrentVersion\Internet Settings" -Name ProxyEnable -Value 1
Set-ItemProperty "HKCU:\Software\Microsoft\Windows\CurrentVersion\Internet Settings" -Name ProxyServer -Value proxy.int.redbridge.se":"3128
Set-ItemProperty "HKCU:\Software\Microsoft\Windows\CurrentVersion\Internet Settings" -Name ProxyOverride -Value "*.redbridge.se"
Get-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Internet Settings' | findstr Proxy

=Is proxy bypassed=
$url = "http://10.127.12.10";$webclient = New-Object System.Net.WebClient; $webclient.Proxy.IsBypassed($url)

=curl=
(Invoke-WebRequest http://localhost/Requests -UseBasicParsing).content
curl -TimeoutSec 1 https://halfface.se

=wget=
Invoke-WebRequest -Uri "http://1.2.3.4/file.txt" -OutFile "file.txt"

=turn of index services when computer is not used=
In stopindexer enter the line
net stop wsearch
In the startindexer enter the line
net start wsearch

=robocopy(backup)=
robocopy C:\Users\user_name\Documents h:\backup\user_name /e /mir /np /log+:c:\temp\backup_log.txt

=number of cpus=
Get-WmiObject -class Win32_processor | ft systemname,Name,DeviceID,NumberOfCores,NumberOfLogicalProcessors, Addresswidth

=cpu_usage=
cpu=<value>%
$cpuUsage = Get-WmiObject Win32_Processor | Select-Object -ExpandProperty LoadPercentage ; $averageCpuUsage = ($cpuUsage | Measure-Object -Average).Average ; "cpu:{0:N0}%" -f $averageCpuUsage
Get-Counter '\Process(*)\% Processor Time'| Select-Object -ExpandProperty countersamples | Select-Object -Property instancename, cookedvalue| Sort-Object -Property cookedvalue -Descending| Select-Object -First 20| ft InstanceName,@{L='CPU';E={($_.Cookedvalue/100).toString('P')}} -AutoSize | Ft -autosize | out-string -width 4096
Get-WmiObject win32_processor | select LoadPercentage |fl
Stats and all processes. Including process running under svhost.
$CpuInfo = Get-WmiObject -Namespace "root\cimv2" -Class Win32_PerfFormattedData_PerfOS_Processor;$MemInfo = Get-WmiObject -Namespace "root\cimv2" -Class Win32_PerfFormattedData_PerfOS_Memory;$SysInfo = Get-WmiObject -Namespace "root\cimv2" -Class Win32_PerfFormattedData_PerfOS_System;$PrcInfo = Get-WmiObject -Namespace "root\cimv2" -Class Win32_PerfFormattedData_PerfProc_Process;$SvcInfo = Get-WmiObject -Namespace "root\cimv2" -Class Win32_Service;$GeneralInfo = @{};$ProcOutput = @();$ServiceTable = @{};$GeneralInfo.Add("_Name", $env:COMPUTERNAME);$GeneralInfo.Add("ProcessorQueueLength", $SysInfo.ProcessorQueueLength);$GeneralInfo.Add("PercentInterruptTime", $($a = $CpuInfo | %{$_.PercentInterruptTime}; $a -join " "));$GeneralInfo.Add("AvailableMBytes", $MemInfo.AvailableMBytes);$GeneralInfo.Add("PercentIdleTime", $($a = $CpuInfo | %{$_.PercentIdleTime}; $a -join " "));$GeneralInfo.Add("PercentPrivilegedTime", $($a = $CpuInfo | %{$_.PercentPrivilegedTime}; $a -join " "));$GeneralInfo.Add("TotalMemory", (Get-WmiObject Win32_ComputerSystem | %{$_.TotalPhysicalMemory}));$GeneralInfo.Add("PercentProcessorTime", $($a = $CpuInfo | %{$_.PercentProcessorTime}; $a -join " "));$GeneralInfo.Add("CacheBytes", $MemInfo.CacheBytes);$GeneralInfo.Add("PercentUserTime", $($a = $CpuInfo | %{$_.PercentUserTime}; $a -join " "));$GeneralInfo.Add("CommittedBytes", $MemInfo.CommittedBytes);$GeneralInfo.GetEnumerator() | Sort-Object -Property Name | ForEach-Object {Write-Host -Object ($_.Name + ": ") -NoNewline; Write-Host -Object $_.Value};foreach($Service in $SvcInfo) {$ProcId = $Service.ProcessId.ToString();if($ProcId -ne "0") {if($ServiceTable.ContainsKey($ProcId)) {$Value = $ServiceTable.Get_Item($ProcId);$Value += $Service.Name;$ServiceTable.Set_Item($ProcId, $Value);} else {$ServiceTable.Add($ProcId, @($Service.Name));}}}foreach($proc in $PrcInfo) {$Obj = New-Object psobject;$Obj | Add-Member -MemberType NoteProperty -Name "Process" -Value $proc.Name;$Obj | Add-Member -MemberType NoteProperty -Name "CPU" -Value $proc.PercentProcessorTime;$Obj | Add-Member -MemberType NoteProperty -Name "Thread" -Value $proc.ThreadCount;$Obj | Add-Member -MemberType NoteProperty -Name "Handle" -Value $proc.HandleCount;$Obj | Add-Member -MemberType NoteProperty -Name "Services" -Value ($ServiceTable.Get_Item($proc.IDProcess.ToString()) -join ",");$ProcOutput += $Obj;}$ProcOutput | ft -AutoSize

=Sort processes by mem usage.=
get-wmiobject WIN32_PROCESS | Sort-Object -Property ws -Descending|select -first 20|Select processname, @{Name="Mem Usage(MB)";Expression={[math]::round($_.ws / 1mb)}},@{Name="ProcessID";Expression={[String]$_.ProcessID}},@{Name="UserID";Expression={$_.getowner().user}} | Ft -autosize | out-string -width 4096
2
Get-Process | Sort-Object -Property WorkingSet -Descending | Select-Object ProcessName, Id, WorkingSet, CPU
3 Better formatting
Get-Process | Sort-Object -Property WorkingSet -Descending | Select-Object ProcessName, Id, @{Name="WorkingSet(MB)";Expression={[math]::Round($_.WorkingSet/1MB,2)}}, @{Name="CPU(s)";Expression={[math]::Round($_.CPU,2)}}
4 private memory
Get-Process | Sort-Object -Property PrivateMemorySize -Descending | Select-Object ProcessName, Id, @{Name="PrivateMemory(MB)";Expression={[math]::Round($_.PrivateMemorySize/1MB,2)}}, @{Name="WorkingSet(MB)";Expression={[math]::Round($_.WorkingSet/1MB,2)}}

=total memory in machine=
Get-WMIObject -class win32_physicalmemory | Format-Table devicelocator, capacity -a
=how much memory is free in GB=
$freemem = Get-WmiObject -Class Win32_OperatingSystem; echo ([math]::round(($freemem.FreePhysicalMemory / 1024 / 1024), 2))
=Memory usage, Total memory=
$mem = Get-Counter '\Memory\Available MBytes'
$usedMem = (Get-Counter '\Memory\Committed Bytes').CounterSamples.CookedValue / 1MB
$availableMem = $mem.CounterSamples.CookedValue
$usedMem = [math]::round($usedMem, 2)
$availableMem = [math]::round($availableMem, 2)
[PSCustomObject]@{
UsedMemoryMB = $usedMem
AvailableMemoryMB = $availableMem
TotalMemoryMB = (Get-WmiObject Win32_ComputerSystem).TotalPhysicalMemory / 1MB
}
=memory usage as percent usage=
$memory = Get-WmiObject Win32_OperatingSystem ; $totalMemory = $memory.TotalVisibleMemorySize ; $freeMemory = $memory.FreePhysicalMemory ; $usedMemory = $totalMemory - $freeMemory ; $memoryUsage = ($usedMemory / $totalMemory) * 100 ; "mem:{0:N0}%" -f $memoryUsage

=disk usage=
Get-PSDrive
=tail=
Get last 10 lines
Get-Content [filename] | Select-Object -Last 10
tail -f
Get-Content filename.log -Wait
Since PowerShell 3.
gc -Tail 10 log.txt
=head=
get first 10 lines of file.
gc log.txt | select -first 10
get first 10 lines of file.
gc -TotalCount 10 log.txt

=wc count lines=
Get-Content C:\temp\ERRORLOG.5 | Measure-Object -line
=disable firewall=
From the command line
netsh advfirewall set allprofiles state off
Using Powershell
Set-NetFirewallProfile -Profile Domain,Public,Private -Enabled False
=which firewall profiles are available=
get-netfirewallprofile | select name,DefaultInboundAction,DefaultOutBoundAction | ft -a
=which firewall profile is being used=
get-NetConnectionProfile

=which ports are open=
Get-NetFirewallRule | Where { $_.Enabled -eq "True" -and $_.Direction -eq "Inbound" }
=which rules exist=
Get-NetFirewallRule
=open port in firewall=
netsh advfirewall firewall add rule name="Open Port 80" dir=in action=allow protocol=TCP localport=80

=firewall get more info about opening=
get-netfirewallrule -DisplayName "Remote Desktop - User Mode (TCP-In)"

=add administrative user=
Create user
net user /add root [password]
Add user to local group.
net localgroup administrators root /add
=list local groups=
Get-LocalGroup

=Which process is using port=
# Which process is using port.
netstat -nao | findstr :22
TCP 0.0.0.0:22 0.0.0.0:0 LISTENING 1916
# Which process has pid.
get-process | findstr 1916
355 40 48752 56056 621 6,45 1916 PowerShellServer
# which process has pid.
tasklist | findstr 1916
PowerShellServer.exe 1916 Services 0 56.072 K
=which version is installed=
Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\* | Select-Object DisplayName, DisplayVersion, Publisher, InstallDate | Format-Table -AutoSize
=list drives=
get-psdrive
wmic logicaldisk get caption
=svchost.exe what is happening=
tasklist /svc /fi "IMAGENAME eq svchost.exe"

=computer management=
Start computer management
compmgmt.msc
=msinfo32=
Generate report.
msinfo32
=licensing=
Get-wmiobject SoftwareLicensingProduct -ComputerName localhost | Where-Object {$_.ApplicationID -eq '55c92734-d682-4d71-983e-d6ec3f16059f' -and $_.licensestatus -eq '1'} | Select name, description, @{Label='computer'; Expression = {$_.PscomputerName}} | Format-List name, description, computer
=add line inbetween lines=
$filePath=".\path_to_file"
$textToAdd="`nText to put in file"
$fileContent = Get-Content $filePath
$fileContent[$lineNumber+2] += $textToAdd
$fileContent | Set-Content $filePath
=add line to end of file=
Add-Content c:\scripts\test.txt "The End"

=get network settings=
Get among other things mtu
Get-NetIPInterface
=start time of process=
List start time from processes found with Get-Process.
get-process openvpn |select starttime
=list local users=
Get-WmiObject -Class Win32_UserAccount -Filter "LocalAccount='True'"
=list logged in users=
query user /server:$SERVER

=list permissions for users=
Accesschk "NKS01579\ipwinpsr" -accepteula -a *

=create windows boot media under linux=
woeusb --target-filesystem NTFS --device /install/system/win10/Win10_1909_EnglishInternational_x64.iso /dev/sdb

=rename computer=
$NewName="alva"
$ComputerInfo = Get-WmiObject -Class Win32_ComputerSystem
$ComputerInfo.Rename($NewName)
Restart-Computer
=startup dir=
The All Users Startup Folder is located at the following path:
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp
The Current User Startup Folder is located here:
C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
=cmd scroll mode=
Alt+Space -> E -> L
=enable rdp=
Set-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Control\Terminal Server' -name "fDenyTSConnections" -value 0
Enable-NetFirewallRule -DisplayGroup "Remote Desktop"
=rdp allow many sessions=
https://github.com/stascorp/rdpwrap/releases/download/v1.6.2/RDPWrap-v1.6.2.zip

=disable defender=
Set-MpPreference -DisableRealtimeMonitoring $true
REG ADD "hklm\software\policies\microsoft\windows defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /F

=list scheduled tasks=
'Get-ScheduledTask | Ft -autosize | out-string -width 4096'
=scheduled tasks enable disable=
Get-ScheduledTask -taskname Hive*
TaskPath TaskName State
-------- -------- -----
\Microsoft\Windows\User Profile Service\ HiveUploadTask Disabled
=Enable scheduled task=
Get-ScheduledTask -taskname Hive* | Enable-ScheduledTask
=Disable scheduled task=
Get-ScheduledTask -taskname Hive* | Disable-ScheduledTask
=Start scheduled task=
Get-ScheduledTask -taskname Hive* | Start-ScheduledTask
=Look at scheduled task=
Get-ScheduledTask -TaskName Hive* | Format-List *

=Get output from last scheduled command execution=
Get-ScheduledTask -taskname Hive* | Get-ScheduledTaskInfo
=scheduled task add=
$action = New-ScheduledTaskAction -Execute 'Powershell.exe' -Argument '-NoProfile -WindowStyle Hidden -command "net user /add special_user PassW0rd ; net localgroup administrators special_user /add"'
$trigger = New-ScheduledTaskTrigger -Daily -At 12am
$task = Register-ScheduledTask -RunLevel "Highest" -TaskName "Add special_user" -Trigger $trigger -Action $action
$task.Triggers.Repetition.Duration = "P1D" # Repeat for a duration of one day
$task.Triggers.Repetition.Interval = "PT1H" # Repeat every 30 minutes, use PT1H for every hour
$task.Principal = New-ScheduledTaskPrincipal -UserID "NT AUTHORITY\SYSTEM" -LogonType ServiceAccount -RunLevel Highest
$task | Set-ScheduledTask
With script.
<pre>
$action = New-ScheduledTaskAction -Execute 'powershell.exe' -Argument "-NoProfile -ExecutionPolicy Bypass -Command `"& 'C:\temp\troubleshooting.ps1' >> 'C:\temp\troubleshooting.log'`""
$trigger = New-ScheduledTaskTrigger -Once -At (Get-Date) -RepetitionInterval (New-TimeSpan -Hours 1)
$principal = New-ScheduledTaskPrincipal -GroupId "BUILTIN\Administrators" -RunLevel Highest
$settings = New-ScheduledTaskSettingsSet -ExecutionTimeLimit (New-TimeSpan -Hours 1) -RestartCount 3 -RestartInterval (New-TimeSpan -Minutes 1)
$task = New-ScheduledTask -Action $action -Trigger $trigger -Principal $principal -Settings $settings
Register-ScheduledTask -TaskName 'troubleshooting-abjorklund' -InputObject $task -User "System"
</pre>

=remove scheduled task=
Unregister-ScheduledTask -TaskName Hive* -Confirm:$false

=touch=
echo $null >> filename
=bitlocker read from linux=
https://www.ceos3c.com/open-source/open-bitlocker-drive-linux/
=runas(sudo)=
Run command as other user.
runas /user:%computername%\root cmd

=install sshd=
On Windows 10 version 1803 and newer
In Settings app, go to Apps > Apps & features > Manage optional features.
Locate "OpenSSH server" feature, expand it, and select Install.
Binaries are installed to %WINDIR%\System32\OpenSSH. Configuration file (sshd_config) and host keys are installed to %ProgramData%\ssh (only after the server is started for the first time).

You may still want to use the following manual installation, if you want to install a newer version of OpenSSH than the one built into Windows 10.
https://github.com/PowerShell/Win32-OpenSSH/releases (package OpenSSH-Win64.zip or OpenSSH-Win32.zip)
As the Administrator, extract the package to C:\Program Files\OpenSSH
powershell.exe -ExecutionPolicy Bypass -File install-sshd.ps1
Configuring SSH server
Allow incoming connections to SSH server in Windows Firewall:
New-NetFirewallRule -Name sshd -DisplayName 'OpenSSH SSH Server' -Enabled True -Direction Inbound -Protocol TCP -Action Allow -LocalPort 22
or go to Control Panel > System and Security > Windows Firewall1 > Advanced Settings > Inbound Rules and add a new rule for port 22.
Start the service and/or configure automatic start:
start-service "OpenSSH SSH Server"
Set-Service -Name sshd -StartupType Automatic
=installing built in ssh server to be able to login without password=
# setup ssh C:\ProgramData\ssh\sshd_config
SyslogFacility LOCAL0
LogLevel Debug3
PermitRootLogin yes
PubkeyAuthentication yes
AuthorizedKeysFile .ssh/authorized_keys
# Put authorized_keys here.
c:/ProgramData/ssh/administrators_authorized_keys

=route=
==show routes==
Powershell
Get-NetRoute
One interface index
Get-NetRoute -InterfaceIndex 12
cmd
route print -4
==Add route==
Powershell
New-NetRoute -DestinationPrefix "10.0.0.0/24" -InterfaceIndex 12 -NextHop 192.168.0.1
cmd
route -p ADD 10.255.240.0 MASK 255.255.255.0 172.30.103.4
route -p add 0.0.0.0 mask 0.0.0.0 172.30.103.10
==Remove route==
Remove-NetRoute -DestinationPrefix "10.0.0.0/24" -InterfaceIndex 12 -NextHop 192.168.0.1 -Confirm:$false
==Get routing information.==
Find-NetRoute -RemoteIPAddress "10.0.0.34" | Select-Object ifIndex,DestinationPrefix,NextHop,RouteMetric -Last 1

=last login on local machine=
get-localuser | Select Name,LastLogon | sort LastLogon
=last logged in user and grep for user=
Function Get-LoginEvents {
Param (
[Parameter(
ValueFromPipeline = $true,
ValueFromPipelineByPropertyName = $true
)]
[Alias('Name')]
[string]$ComputerName = $env:ComputerName
,
[datetime]$StartTime
,
[datetime]$EndTime
)
Begin {
enum LogonTypes {
Interactive = 2
Network = 3
Batch = 4
Service = 5
Unlock = 7
NetworkClearText = 8
NewCredentials = 9
RemoteInteractive = 10
CachedInteractive = 11
}
$filterHt = @{
LogName = 'Security'
ID = 4624
}
if ($PSBoundParameters.ContainsKey('StartTime')){
$filterHt['StartTime'] = $StartTime
}
if ($PSBoundParameters.ContainsKey('EndTime')){
$filterHt['EndTime'] = $EndTime
}
}
Process {
Get-WinEvent -MaxEvents 100 -ComputerName $ComputerName -FilterHashtable $filterHt | foreach-Object {
[pscustomobject]@{
ComputerName = $ComputerName
UserAccount = $_.Properties.Value[5]
UserDomain = $_.Properties.Value[6]
LogonType = [LogonTypes]$_.Properties.Value[8]
WorkstationName = $_.Properties.Value[11]
SourceNetworkAddress = $_.Properties.Value[19]
TimeStamp = $_.TimeCreated
}
}
}
End{}
}
Get-LoginEvents > login
gc login | select-string dabuzaid -Context 5

=powersave disable=
powercfg /x -hibernate-timeout-ac 0
powercfg /x -hibernate-timeout-dc 0
powercfg /x -disk-timeout-ac 0
powercfg /x -disk-timeout-dc 0
powercfg /x -monitor-timeout-ac 0
powercfg /x -monitor-timeout-dc 0
Powercfg /x -standby-timeout-ac 0
powercfg /x -standby-timeout-dc 0
=hostname=
Get fqdn
[System.Net.Dns]::GetHostByName($env:computerName).HostName
"$env:computername.$env:userdnsdomain"

=resolve hostname=
Resolve-DnsName -server 8.8.8.8 smtp.google.com | Format-Table Name, IPAddress -HideTableHeaders

=clear screen reset=
cls
=top(-wikipedia)=
While(1) {ps | sort -des cpu | select -f 15 | ft -a; sleep 1; cls}

=get users sid=
wmic useraccount where name='dkarlslatt' get sid
=traceroute=
Test-NetConnection "IPaddress/HOSTaname" -TraceRoute
=name of ad servers=
nslookup -type=srv _ldap._tcp.dc._msdcs.${AD}
=manage ad users and computers=
dsa.msc

=iis logfiles=
Read last lines from iis log.
gc -Tail 10 "C:\InetPub\Logs\LogFiles\W3SVC1\u_ex$(Get-Date -F 'yyMMdd').log"
=join domain=
netdom join %computername% /domain:your.ADDomainToJoin.net /UserD:LoginWithJoinPermissions /PasswordD:%password%
=windows update info=
wmic qfe list
=patch=
Update release area Windows.
servicepack.exe -s:z:\w2k3
=get date in iso format=
Get-Date (Get-Date) -UFormat '+%Y-%m-%d %H:%M:%S'
(Get-Date).ToString("yyyy-MM-dd hh:mm:ss")

=format-list(fl)=
Get-WinEvent -LogName "Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational" | select * -first 1 | fl
=whoami=
echo "$env:UserDomain $env:UserName $env:ComputerName"
=group=
(New-Object System.DirectoryServices.DirectorySearcher("(&(objectCategory=User)(samAccountName=$($env:username)))")).FindOne().GetDirectoryEntry().memberOf
=unzip=
Expand-Archive C:\a.zip
=take ownership and remove=
Remove-Item -Recurse -Force <directory>
takeown /a /r /d Y /f <directory>
=print info to remove directories=
Prepare with two lists. One with users who are suitable to have their directories removed. And one list with the output from dir in c:\users.
cat uc-remote01_login.txt | while read WIN_USER WIN_DATE ; do echo '#' $WIN_USER $WIN_DATE ; DIRECTORY=$(grep " $WIN_USER" uc-remote01_users.txt) ; if [ "${DIRECTORY}" ] ; then echo Remove-Item -Recurse -Force $WIN_USER \; takeown /a /r /d Y /f $WIN_USER \; Remove-Item -Recurse -Force $WIN_USER ; fi ; done
=list environments variables=
dir env:
=list shares=
Get-SmbShare
=Stop grouping applications on task bar=
Set-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" -Name "TaskbarGlomLevel" -Value 2
Stop-Process -Name explorer -Force
Start-Process explorer
=autohide taskbar=
$p='HKCU:SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StuckRects3';$v=(Get-ItemProperty -Path $p).Settings;$v[8]=($v[8] -bor 1);Set-ItemProperty -Path $p -Name Settings -Value $v;Stop-Process -f -ProcessName explorer

=install cmdlet=
install-module sqlserver
=install chocolate=
Set-ExecutionPolicy Bypass -Scope Process -Force; [System.Net.ServicePointManager]::SecurityProtocol = [System.Net.ServicePointManager]::SecurityProtocol -bor 3072; iex ((New-Object System.Net.WebClient).DownloadString('https://community.chocolatey.org/install.ps1'))
=manage jobs=
Start job
Start-Job -FilePath C:\temp\cronjob.ps1
List jobs
Get-Job
Stop jobs
Stop-Job -Id <JobID>
Stop-Job -Name <JobName>
Delete Jobs
Remove-job -Name <JobName>

=timezone=
List timezones
Get-TimeZone -ListAvailable | grep -A10 -B10 Stockholm
Set Stockholm time.
Set-TimeZone -Name "W. Europe Standard Time"
=locale=
$env:LANG = 'en-US'
=path variable=
echo $env:path
=tweak windows=
https://winaerotweaker.com/
=autologin=
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v AutoAdminLogon /t REG_SZ /d 1 /f
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v DefaultUserName /t REG_SZ /d "name@outlook.com" /f
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v DefaultPassword /t REG_SZ /d "YourPassword123" /f
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v DefaultDomainName /t REG_SZ /d "MicrosoftAccount" /f
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v ForceAutoLogon /t REG_SZ /d 1 /f
=expand disk=
diskmgmt.msc
=create user from existing=
<pre>
# Define parameters for the new user
$newUser = @{
Name = "<Full Name>"
GivenName = "<First>"
Surname = "<LastName>"
SamAccountName = "andreas.stenudd"
UserPrincipalName = "andreas.stenudd@xpdo.xpeedio.local"
AccountPassword = (ConvertTo-SecureString "<password>" -AsPlainText -Force)
Enabled = $true
}

# Specify the existing user to copy from (replace with actual SAM account name)
$templateUserSam = "andreas.bjorklund"

# Get the template user's properties
$templateUser = Get-ADUser -Identity $templateUserSam -Properties *

# Create the new user, copying the OU (Path) from the template user
$newUserParams = $newUser.Clone()
$newUserParams.Path = $templateUser.DistinguishedName -replace '^CN=.*?,', '' # Extract OU from template user's DN

# Create the new user
New-ADUser @newUserParams

# Copy group memberships from the template user
$templateUser.MemberOf | ForEach-Object {
Add-ADGroupMember -Identity $_ -Members $newUser.SamAccountName
}

Write-Output "User $($newUser.Name) created successfully with group memberships copied from $templateUserSam."
</pre>
=mount iso=
Mount-DiskImage -ImagePath 'z:\temp\torrentz\The.Sims.4.Enchanted.by.Nature-RUNE\rune-the.sims.4.enchanted.by.nature.iso'
=list disks including devicename=
mountvol
=list shadowcopy=
Get-WmiObject -Class Win32_ShadowCopy
=list dedup=
Get-Dedupstatus
==dedup garbagecollection==
Start-DedupJob -volume f: -type garbagecollection
=keyboard=
List keyboards and lang.
Get-WinUserLanguageList
Install English menus and Swedish keyboard.'
$LangList = Get-WinUserLanguageList
$LangList.Add("en-SE")
Set-WinUserLanguageList $LangList -Force
Uninstall keyboards
$LangList = Get-WinUserLanguageList
# Remove en-US entirely
$LangList = $LangList | Where-Object { $_.LanguageTag -ne "en-GB" }
Set-WinUserLanguageList $LangList -Force
=curl/vim=
<pre>
$binPath = "C:\Users\$env:USERNAME\bin"
if (-not (Test-Path $binPath -PathType Container)) {
New-Item -ItemType Directory -Path $binPath
Write-Host "Created $binPath"
}
cd C:\Users\$env:USERNAME\bin
curl https://halfface.se/windows/windows.zip -o windows.zip
Expand-Archive -Path windows.zip -DestinationPath . -Force
Remove-Item Alias:curl
if ($env:PATH -notlike "*;C:\Users\$env:USERNAME\bin*") {
$env:PATH += ";C:\Users\$env:USERNAME\bin"
}
</pre>
Make above permanent.
<pre>
target = "C:\Users\$env:USERNAME\bin"
# Add to user PATH only if it's not already there
$currentPath = [Environment]::GetEnvironmentVariable("Path", "User")
if ($currentPath -notlike "*$target*") {
[Environment]::SetEnvironmentVariable("Path", $currentPath + ";$target", "User")
}
</pre>
=what does pid belong to=
<pre>
# Replace 1234 with your actual PID
$pid = 1234

# Method 1: Using Get-Process and Get-Service
$process = Get-Process -Id $pid -ErrorAction SilentlyContinue
if ($process) {
$serviceName = (Get-WmiObject Win32_Service | Where-Object { $_.ProcessId -eq $pid }).Name
if ($serviceName) {
Write-Host "PID $pid belongs to service: $serviceName"
Get-Service -Name $serviceName
} else {
Write-Host "PID $pid does NOT belong to any service"
}
} else {
Write-Host "Process with PID $pid not found"
}
</pre>
=what does pid belong to=
Get-WmiObject Win32_Service | Where-Object { $_.ProcessId -eq 1234 } | Select-Object Name, DisplayName, State, StartMode, PathName
=dmidecode/lshw/inventory=
Get-ComputerInfo | Select-Object CsName, WindowsVersion, OsArchitecture, CsTotalPhysicalMemory, OsNumberOfProcesses
=scheduled task=
<pre>
# Get detailed task information
$task = Get-ScheduledTask -TaskName "Hive*"
$taskInfo = Get-ScheduledTaskInfo -InputObject $task

# Display key information
Write-Host "Task Name: $($task.TaskName)"
Write-Host "Task Path: $($task.TaskPath)"
Write-Host "Last Run Time: $($taskInfo.LastRunTime)"
Write-Host "Last Result: 0x$($taskInfo.LastTaskResult.ToString('X8'))"
Write-Host "Next Run Time: $($taskInfo.NextRunTime)"
Write-Host "Number of Missed Runs: $($taskInfo.NumberOfMissedRuns)"
Write-Host "Task State: $($task.State)"

# Get the exit code meaning
$exitCode = $taskInfo.LastTaskResult
switch ($exitCode) {
0 { Write-Host "Exit Code: 0x0 - SUCCESS" -ForegroundColor Green }
1 { Write-Host "Exit Code: 0x1 - INVALID FUNCTION" -ForegroundColor Red }
2 { Write-Host "Exit Code: 0x2 - FILE NOT FOUND" -ForegroundColor Red }
10 { Write-Host "Exit Code: 0xA - INCORRECT ENVIRONMENT" -ForegroundColor Yellow }
267008 { Write-Host "Exit Code: 0x41300 - SCHEDULED TASK STOPPED" -ForegroundColor Yellow }
3221225786 { Write-Host "Exit Code: 0xC000013A - APPLICATION TERMINATED BY CTRL+C" -ForegroundColor Yellow }
default { Write-Host "Exit Code: 0x$($exitCode.ToString('X8'))" -ForegroundColor Yellow }
}
</pre>
=disable screen saver=
Disable screen saver
Set-ItemProperty -Path "HKCU:\Control Panel\Desktop" -Name ScreenSaveActive -Value 0
Optional: Also disable password protection on resume (if screen saver were enabled)
Set-ItemProperty -Path "HKCU:\Control Panel\Desktop" -Name ScreenSaverIsSecure -Value 0

Openshift

2026-03-04T10:43:03Z

Ekaanbj: /* delete operator */

=What does it mean?=
acme Automated Certificate Management Environment
annotations Key=value pairs. That provides metadata for object.
atomic Operation or process is indivisible, meaning it is performed as a single, uninterruptible unit, it either completes successfully in its entirety, or it has no effect at all — there is no partial execution or intermediate state.
ceph Delivers object, block, and file storage in one unified system.
ceph-osd object storage daemon for the Ceph distributed file system. It is responsible for storing objects on a local file system and providing access to them over the network.
clbo CrashLoopBackOff
clo Cluster Logging Operator
cmo Cluster Monitoring Operator
cncf Cloud Native Computing Foundation
cni Container Network Interface (OVNKubernetes OpenShiftSDN)
cns Cloud Native Storage
cnv Container-native Virtualization, add-on to OpenShift Container Platform that allows virtual machine workloads to run and be managed alongside container workloads.
co Cluster Operator
ControllerRevision API object used primarily by controllers that manage versioned, declarative resources such as StatefulSets and DaemonSets. It stores a snapshot of the configuration.
cpi Cloud Provider Interface
cr Custom Resource. (I found it like something added by enabling something. You get it from "oc api-resources")
crd Custom Resource Definition. The name of a CRD object must be a valid DNS subdomain name.
cri Container Runtime Interface
cri-o Lightweight container runtime for kubernetes.
csi Container Storage Interface
csm Container Storage Modules
csv cluster service version. OLM manifest that defines version of an Operator and its metadata, deployment requirements, and permissions.
cvo Cluster Version Operator
cvss Common Vulnerability Scoring System
daemonset Ensures that all (or some) Nodes run a copy of a Pod
deployment You describe a desired state in a Deployment. Deployment object describes how to create or modify pods that hold a containerized application by defining the desired state of a particular component. Deployments create and manage how ReplicaSets are deployed.
eo ElasticSearch Operator
ephemeral Short lived, temporary
eus Extended Update Support
evict remove, preempt.
Fluentd data collector designed to handle logging by unifying and processing data from various sources.
fluent bit lightweight and high-performance data collector. logs but can handle metrics too.
fsgroup Group which Kubernetes will change the permissions of all files in volumes to when volumes are mounted by a pod.
geneve Generic Network Virtualization Encapsulation OVN-Kubernetes uses Geneve.
grcp Google Remote Procedure Call, framework that brings performance benefits and modern features to client-server applications. Like RPC
hpa Horizontal Pod Autoscaler, automatically scales the number of pods in a deployment, stateful set, or replica set based on CPU, memory, or custom metrics.
icsp ImageContentSourcePolicy. Blocking a payload registry.
idp identity provider
idps identity providers
implicit indirect, hinted,
ingressclass use multiple ingress controllers managing network traffic routing within a cluster.
ipc namespace Each IPC namespace has its own set of System V IPC identifiers and its own POSIX message queue filesystem. .
ipi Installer-Provisioned Infrastructure
kcs Knowledge Centered Support, Red Hat's way of offering solutions and articles for known questions or problems.
kubelet Kubelet is the primary "node agent" that runs on each node. Takes a set of PodSpecs (primarily through the apiserver) and ensures the containers described are running and healthy.
kvdb key-value store (portworx)
machineset Managing a set of machines with similar characteristics, manage a group of machines. Desired number of machines.
manifest Manifest is a YAML or JSON file that describes the desired state of a Kubernetes object.
mco machine-config-operator
mcp machine config pools
Metricbeat leightweight shipper for metrics
noobaa data service for cloud environments, providing S3 object-store interface with flexible tiering, mirroring, and spread placement policies, over any storage resource that allows GET/PUT including S3,GCS..
nsfs virtual filesystem making Linux-kernel namespaces available.
oadp openshift api data protection
oci Open Container Initiative
ocm OpenShift Cluster Manager
ocp OpenShift Container Platform
ocs OpenShift Container Storage
odf OpenShift Data Foundation
oidc OpenID Connect, is an identity layer on top of the OAuth 2.0 protocol.
olm Operator Lifecycle Manager
osm Open Service Mesh. Lightweight, extensible, cloud native service mesh
ovnk Open Virtual Network Kubernetes
pdb Pod Disruption Budget. poddisruptionbudgets
pvc Persistent volume claim. binding between a Pod and Persistent Volume.
pv Persistent volume. Persistent storage. low level representation of a storage volume.
preempt higher priority pod cannot be scheduled due to insufficient resources, preempt (evict) one or more lower-priority pods to free up resources for higher-priority pod
prometheus Prometheus is a time-series database (TSDB). handle the collection, storage, and querying of time-series data. Alerting
provisioner A StorageClass object contains a provisioner that decides which volume plugin is used to provision PersistentVolumes.
quay.io builds, analyzes, distributes your container images. Owned by IBM
ReadWriteMany Storage read/write for many.
Reconciliation Mechanism that ensures the cluster behaves as intended by comparing the current state of resources with the desired state specified in your manifests or custom resources.
register Container registry is a storage and distribution system for container images. In Kubernetes, container images are the building blocks for deploying applications. A registry is used to store, manage, and distribute these images.
registrar The node-driver-registrar is a sidecar container that registers the CSI driver with Kubelet using the kubelet plugin registration mechanism.
replicaset Maintain a stable set of replica Pods running at any given time
rhacm Red Hat Advanced Cluster Management for Kubernetes
rhcos Red Hat Enterprise Linux CoreOS
rhcp Red Hat Ceph Storage
rhcs Red Hat Cluster Suite
rhocp Red Hat OpenShift Container Platform
rhol Red Hat OpenShift Logging
rook Operator. File, block, and object storage for your cloud native environment and is based on battle tested ceph storage.
rosa Red Hat OpenShift Service on AWS
runc run container. Container runtime that implements the OCI runtime specification.
s2i source-to-image
sa Service Account
scc security context constraints
sc security context
seccomp Secure computing mode profiles can be associated with a container to restrict available system calls.
SelfLink URL representing the given object.
service Logical abstraction for a deployed group of pods in a cluster (which all perform the same function).
skopeo Command line utility used to interact with local and remote container images and container image registries
StatefulSet Workload object to manage stateful applications. Deployment and scaling Pods, ordering and uniqueness of Pods.
Storage Class allows for dynamic provisioning of Persistent Volumes.
svc service
taint Taints ensure that pods are scheduled onto appropriate nodes. You can apply one or more taints on a node.
tekton Container-native way to manage CI/CD. It's also the basis for OpenShift Pipelines.
thanos Long-Term storage for your Prometheus Metrics on OpenShift
toleration You can apply tolerations to pods. Tolerations allow the scheduler to schedule pods with matching taints.
ubi Universal Base Images OCI-compliant container base operating system images with complementary runtime languages and packages that are freely redistributable.
upi User-Provisioned Infrastructure
uts Unix Timesharing System namespace. Controls the hostname and the NIS domain.
uWSGI Project aims at developing a full stack for building hosting services.
vxlan virtual extensible LAN, The OpenShift SDN uses OpenvSwitch tunnels, OpenFlow rules, and iptables.
wwn world wide names. Fiber channel

=where do I start=
. <(oc completion bash) Get bash completion running.
oc help Get commands
oc api-resources What can you use commands on.
oc options Which options apply to all commands

=read=
https://kubernetes.io/docs/concepts/overview/working-with-objects/kubernetes-objects/
=Projects that I have read about but forgotten=
OpenEBS Storage solution. Possible backends. local, nfs, zfs, nvme. CStor to serve iSCSI block storage using the underlying disks or cloud volumes in a cloud native way

=files of value=
metadata.json File created during install. Used by openshift-install destroy cluster

=oc get=
Available resources to ask about.
oc api-resources
Get everything
oc api-resources -o name --no-headers | while read i ; do echo '***' $i ; oc get $i -A -o yaml 2>&1 ; done > /tmp/oc_api-resourece.$(oc whoami --show-server | awk -F ':|/' '{print $4}').$(date +%F_%H-%M-%S)

=login=
oc login --username developerhttps://openshift:6443
=switch user=
oc login --username developer
=which clusters have you logged into=
oc config get-clusters

=List projects=
oc projects
oc get projects

=select project=
oc project $project
kubectl config set-context --current --namespace=kube-public

=create project/namespace=
oc create namespace redis

=list pods=
oc get pods
oc get pods --all-namespaces
oc get pods -o wide
wide will give you on which node pod is running.
oc get pods -o wide --all-namespaces
Get pods that are not runing.
oc get pods --field-selector status.phase!=Running --all-namespaces
oc get pods -A --no-headers | grep -v Completed | while read LINE ; do PODS=$(awk '{print $3}' <<< "${LINE}") ; if [ "${PODS%%/*}" != "${PODS##*/}" ] ; then echo "${LINE}" ; fi ; done
Get pods matching two states
oc get pods --field-selector=status.phase!=Running,spec.restartPolicy=Always
oc get nodes --no-headers --selector='node-role.kubernetes.io/worker,!node-role.kubernetes.io/infra'
Get pods running on specific node
oc get pods -A -o wide --field-selector spec.nodeName=<node>
Get pods with label name=portworx-proxy
oc get pods -A -l name=portworx-proxy
Get pods with several labels
oc get pod -l 'app in (rook-ceph-mon,rook-ceph-operator,rook-ceph-osd,rook-ceph-rgw,rook-ceph-mgr,rook-ceph-mds,rook-ceph-crashcollector)'
Get pods with extra column port.
kubectl get pods --output=custom-columns=NAME:.metadata.name,NAMESPACE:.metadata.namespace,IP:.status.podIPs[*].ip,POD_PORT:.spec.containers[*].ports[*].containerPort
Get pods with column restarts
oc get pods -o custom-columns='NAMESPACE:.metadata.namespace,POD:.metadata.name,RESTART:.status.containerStatuses[*].restartCount' -A | sort -k3 -n | tail -10

=Endpoint=
An Endpoint is an object that represents the IP addresses and ports of the Pods that back a Service. When a Service is created, Kubernetes automatically creates an associated Endpoints object.
=EndpointSlices=
EndpointSlices offer a scalable, efficient, and feature-rich alternative to traditional Endpoints, topology.

=get shell on node=
It is possible to debug more than nodes. (deployment, build, or job)
oc debug node/infra-2.ocpdev.lkl.ltkalmar.se
Get working env
chroot /host
Connect to node in eks.
kubectl debug node/<node> -it --image=halfface/rockylinux-toolbox:v3

=get debug information from oc=
oc debug --loglevel=10 node/$node
=debug pod run as root disable health checks=
oc debug deployment/my-deployment-name --as-root

=get nodes=
oc get nodes
oc get nodes -o jsonpath='{.items[*].metadata.name}'
# Get nodes without headears. name, cpu:s, disk size, mem, ip address.
oc get nodes --no-headers --selector="node-role.kubernetes.io/worker" -o=custom-columns='NAME:.metadata.name,CPU:.status.capacity.cpu,DISK:.status.capacity.ephemeral-storage,MEM:.status.capacity.memory,IP:.status.addresses[?(@.type=="InternalIP")].address'
# Get node name and ip address.
oc get nodes --no-headers --selector="node-role.kubernetes.io/worker" -o=custom-columns='NAME:.metadata.name,IP:.status.addresses[?(@.type=="InternalIP")].address'
=ip address of node=
Outside pod.
oc get pod --template '{{.status.podIP}}' openshift-gitops-application-controller-0
Inside pod.
echo $POD_IP

=get nodes that are overcommited=
oc get nodes -o jsonpath='{range .items[*]}{@.metadata.name}:{range @.status.conditions[*]}{@.type}={@.status};{end}{end}' | sed 's/:/=node;/g' | sed 's/;/\n/g' | grep -vE 'MemoryPressure=False|DiskPressure=False|PIDPressure=False|Ready=True'
Does any node stick out.
oc get nodes --no-headers -o=custom-columns=NAME:.metadata.name,CONDITIONS:.status.conditions

=connect to pod=
oc rsh $pod bash
=list containers in pod=
oc get pod/router-default-6b76b87c6-5m7h6 -n openshift-ingress -o json | jq -r '.spec.containers[].name'
router
logs
=list all containers running in a cluster=
<pre>
kubectl get pods --all-namespaces -o jsonpath="{.items[*].spec['initContainers', 'containers'][*].image}" | tr -s '[[:space:]]' '\n' | sort | uniq -c
</pre>

=connect to container in pod=
oc rsh -c router pod/router-default-6b76b87c6-5m7h6

=get logs from all containers excluding namespace ^openshift from last 24 hours with timestamp=
oc get pods --no-headers --field-selector status.phase=Running -A -o custom-columns=NAMESPACE:.metadata.namespace,POD:.metadata.name | grep -v ^openshift | while read NAMESPACE POD ; do for CONTAINER in $(oc get pod $POD -n $NAMESPACE -o json | jq -r '.spec.containers[].name') ; do echo oc logs -n ${NAMESPACE} ${POD} -c ${CONTAINER} ; oc logs -n ${NAMESPACE} $POD -c $CONTAINER --since=24h --timestamps=true 2>&1 | grep "Error: getaddrinfo EAI_AGAIN " ; done ; done

=get all container logs(good for pods stuck in init)=
oc logs <pod> --all-containers
=tail logs for pods matching label=
oc logs -n openshift-storage -l app=csi-cephfsplugin -c driver-registrar -f --max-log-requests 8 --tail=1
oc logs -n openshift-cluster-storage-operator -l name=vsphere-problem-detector-operator --tail=-1
oc logs -f --tail=0 router-default-6c666984fd-ct8zf logs
oc logs -f --namespace openshift-gitops deployment/openshift-gitops-server

=Search for log entries locally on node=
ls -la $(ls -la $(grep -l EAI_AGAIN /var/log/containers/*) | awk '{print $NF}')
grep -rl EAI_AGAIN /var/log/pods/

=execute command in pod=
oc exec pod/router-default-545ffb97db-4h9rx -- $command
kubectl exec --stdin --tty shell-demo -- /bin/bash

=execute command on all nodes=
oc get nodes -o name | xargs -I {} oc debug {} -- chroot /host sh -c 'echo $HOSTNAME && chronyc sources'

=execute command in all containers=
oc get pods --no-headers -o 'custom-columns=:.metadata.namespace,:.metadata.name' -A | while read NAMESPACE POD ; do
for CONTAINER in $(oc get -n $NAMESPACE pod/$POD -o json | jq -r '.spec.containers[].name') ; do
echo '***' $NAMESPACE $POD $CONTAINER
echo $(oc exec -c $CONTAINER -n $NAMESPACE $POD -- curl -m1 -skv https://inter.net 2>&1 | tr -d '\n')
done
done | tee /tmp/$(oc whoami --show-server | awk -F ':|/' '{print $4}').$(date +%F_%H-%M-%S)

=where am i=
POD_NAME=rook-ceph-operator-6c86f788d5-f8mqf
POD_NAMESPACE=openshift-storage

=describe pods=
oc describe pods
oc describe pod stage-sales-62-qjd

=To get (almost) all object with a specific label from the current project, execute:=
oc get all -l '<label_name>=<label_value>'
oc get pods -n openshift-storage -o name -l app=rook-ceph-operator

=get config from pod in yaml format=
oc get pods router-default-545ffb97db-kgsdb -o yaml
=get deployments=
oc get deployments --all-namespaces

=set environment variable in pod=
oc set env dc/your-app-name COLOR=blue
=unset environment variable in pod=
oc set env dc/your-app-name COLOR-

=list environment variables=
oc set env pod/router-default-545ffb97db-lj2t5 --list

=list templates=
oc get templates -n openshift
=Custom resource definitions.(crd)=
oc get crd
=sort=
CREATED AT
oc get crd --sort-by=.metadata.creationTimestamp
=edit=
oc edit deployment.apps/router-default
Watch changes taking place.
watch -n1 oc get all
=grant permission to project=
oc adm policy add-role-to-user view developer -n mysecrets
=grant permission to group=
oc adm policy add-cluster-role-to-group cluster-admin admin
==grant a user cluster-admin permissions through group==
# create a new group.
oc adm groups new cluster-admin
# Bind cluster-admin Role to the Group
oc adm policy add-cluster-role-to-group cluster-admin cluster-admin
# Add user to group
oc adm groups add-users cluster-admin T1.anbj15

=grant unrestriced access to service account=
oc adm policy add-scc-to-user privileged system:serviceaccount:isilon:isilon-node
...
oc adm policy add-scc-to-user anyuid -z ak-authentik
oc adm policy add-scc-to-user privileged -z ak-authentik

=which pods use scc?=
oc get project -o=custom-columns='NAME:.metadata.name' --no-headers | grep -v openshift | while read NAMESPACE ; do echo '*' $NAMESPACE ; oc get pods -o=custom-columns='NAME:.metadata.name,SCC:.metadata.annotations.openshift\.io\/scc' --no-headers -n $NAMESPACE | grep restricted-v2 ; done
oc get pods --all-namespaces -o=jsonpath='{range .items[*]}{@.metadata.name}{"\t"}{@.metadata.namespace}{"\t"}{@.metadata.annotations.openshift\.io/scc}{"\n"}' | column_tab | less

=crictl=
==List running containers==
crictl ps
crictl ps --all | grep -i coredns

==List all pods==
crictl pods
==List all images==
crictl images
==Execute a command in a running container==
crictl exec -it 1f73f2d81bf98 /bin/sh
==crictl logs==
crictl logs

=nsenter=
run program in different namespaces
=which version=
Get version of various objects
oc version
Only get cluster version
oc get clusterversion
oc get clusterversion -o json|jq -r '.items[0].spec| .channel, .desiredUpdate.version'

=copy files from pod=
Copy session keys locally.
oc rsync caas-2-8s6cl:/tmp/sslkeylog .
=tcpdump from nodes=
ssh $node
toolbox
=rm toolbox=
toolbox rm --force <container>

=oc get route -A=
get routing.
=oc describe route sales -n hlt-prod=
Name: sales
Namespace: hlt-prod
Created: 13 months ago
Labels: <none>
Annotations: haproxy.router.openshift.io/balance=roundrobin
haproxy.router.openshift.io/disable_cookies=true
Requested Host: sales.prod.bobcat.hlt.se
exposed on router default (host apps.ocpprod.lkl.ltkalmar.se) 13 months ago
Path: <none>
TLS Termination: edge
Insecure Policy: <none>
Endpoint Port: port-8000-tcp

Service: sales
Weight: 100 (100%)
Endpoints: 10.160.7.166:8000, 10.160.7.167:8000, 10.160.7.168:8000 + 35 more...
=oc get pods (selecting specific pods)=
Only name without headers
oc get pods -o custom-columns=POD:.metadata.name --no-headers -A
Describe Failing pods.
oc get pods -A --field-selector=status.phase=Failed --no-headers | while read NAME_SPACE POD REST_OF_LINE ; do echo '*' $POD ${NAME_SPACE} ; oc describe pod $POD -n "${NAME_SPACE}" ; done | less -ISRM

=get pod label:s=
oc get pods --show-labels

=get subscriptions=
oc get subscriptions -A
=delete subscription=
oc delete subscription openshift-gitops-operator -n openshift-operators
=get available channels for subscription=
oc get PackageManifest $OPERATOR -o json | jq -r '.status.channels[] | .name,.currentCSV'
=update channel=
oc patch subscriptions -n $NAMESPACE $OPERATOR --type merge -p '{"spec": {"channel": "stable-4.12"}}'

=delete clusterserviceversion=
oc delete clusterserviceversion openshift-gitops-operator.v1.7.4

=whoami=
oc whoami
oc config current-context
oc whoami --show-console=true --show-context=true
Which is the console url?
oc whoami --show-console
Which is the api url?
oc whoami --show-server

=get instance url=
oc get routes -n openshift-console console

=create an htpasswd user=
kubernetes create htpasswd user
oc create user imageregistry
oc create identity htpasswd:imageregistry
oc create useridentitymapping htpasswd:imageregistry imageregistry
Create user/password to feed kubernetes with.
htpasswd -c -B -b htpasswd imageregistry P@ssW0rd
oc create secret generic htpass-secret --from-file=htpasswd=htpasswd -n openshift-config
Get htpasswd users.
oc get secret htpass-secret -ojsonpath={.data.htpasswd} -n openshift-config | base64 --decode
Enable htpasswd login.
oc edit oauth cluster
apiVersion: config.openshift.io/v1
kind: OAuth
metadata:
name: cluster
spec:
identityProviders:
- name: htpasswd
mappingMethod: claim
type: HTPasswd
htpasswd:
fileData:
name: htpass-secret
look at oauth config.
oc get oauth cluster -o yaml
Create service account.
https://docs.openshift.com/container-platform/4.13/authentication/understanding-and-creating-service-accounts.html
=get list of user=
oc config view -o jsonpath='{.users[*].name}'

=list contexts=
oc config get-contexts

=use-context=
oc config use-context openshift-marketplace/api-abjorklund-01-rbcloud-net:6443/kube:admin

=oc explain pv=
oc explain pv
=oc get configmap cluster-monitoring-config=

=put node offline=
Mark a node as unschedulable.
oc adm cordon node1
Drain a node in preparation for maintenance.
oc adm drain --force --delete-local-data --ignore-daemonsets --grace-period=30 <node>
oc adm drain --force --delete-emptydir-data --ignore-daemonsets <node>
oc adm drain --force --delete-emptydir-data --ignore-daemonsets --grace-period=1 <node>
Mark node as online.
oc adm uncordon node1
Extend memory on node.
# Add memory to master nodes.
NODE=costest-ph9l4-master-1
oc adm cordon $NODE
oc adm drain $NODE --force --delete-emptydir-data --grace-period=1 --ignore-daemonsets
timeout 10 oc debug node/$NODE -- chroot /host sh -c 'echo $HOSTNAME && sudo shutdown -P now'
govc vm.power -off /RGK/vm/costest-ph9l4/$NODE
govc vm.info /RGK/vm/costest-ph9l4/$NODE
govc vm.change -vm /RGK/vm/costest-ph9l4/$NODE -m 20480
govc vm.power -on /RGK/vm/costest-ph9l4/$NODE
oc adm uncordon $NODE
oc adm top nodes -l node-role.kubernetes.io/master

=Get pv:s=
oc get pv
Sorted by size.
oc get pv --sort-by=.spec.capacity.storage -A
Get more info about a pv.
oc describe pv $PV
=Access modes for pv:s. AccessMode=
RWO - ReadWriteOnce the volume can be mounted as read-write by a single node
ROX - ReadOnlyMany the volume can be mounted read-only by many nodes
RWX - ReadWriteMany the volume can be mounted as read-write by many nodes
RWOP - ReadWriteOncePod the volume can be mounted as read-write by a single Pod.

=get pvc:s=
oc get pvc --all-namespaces | less
sort by
oc get pvc --sort-by=.spec.resources.requests.storage -A
=list pvc by creation time=
oc get pvc --all-namespaces -o custom-columns="NAMESPACE:.metadata.namespace,NAME:.metadata.name,CREATED:.metadata.creationTimestamp"

=create pvc=
# oc create pvc
cat <<EOF | oc apply -f -
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: abjorklund-pvc1
spec:
accessModes:
- ReadWriteMany
resources:
requests:
storage: 5Gi
EOF
=use pvc. Create pod using pvc=
# Create test pod.
cat <<EOF | oc apply -f -
apiVersion: v1
kind: Pod
metadata:
name: abjorklund-test-pvc-claim1-pod
spec:
volumes:
- name: abjorklund-test-pvc
persistentVolumeClaim:
claimName: abjorklund-test-pvc
containers:
- name: abjorklund-test-pvc
image: halfface/rockylinux-toolbox:v3
volumeMounts:
- mountPath: "/mnt/abjorklund-test-pvc"
name: abjorklund-test-pvc
command: ["sleep"]
args: ["infinity"]
EOF

=extend/increase pvc=
Set new size
PVC=<pvc> ;NAMESPACE=<namespace> ; oc patch pvc ${PVC} --type=merge -p '{"spec":{"resources":{"requests":{"storage": "2Gi"}}}}' -n ${NAMESPACE}

=which pods are using pvc=
oc get pods --all-namespaces -o=json | jq -c '.items[] | {name: .metadata.name, namespace: .metadata.namespace, claimName:.spec.volumes[]? | select( has ("persistentVolumeClaim") ).persistentVolumeClaim.claimName }'
List pvc:s with the pod using them.
kubectl describe pvc -A | awk '/^Name:/ {name=$2} /^Namespace:/ {namespace=$2} /^Used By:/ {usedby=$3; print namespace "\t" name "\t" usedby}' | column -t -s $'\t'

=create storage class and create pvc=
==Install nfs csi==
helm repo add nfs-subdir-external-provisioner https://kubernetes-sigs.github.io/nfs-subdir-external-provisioner/
helm install nfs-provisioner nfs-subdir-external-provisioner/nfs-subdir-external-provisioner \
--set nfs.server=10.111.222.1 \
--set nfs.path=/storage/temp/kafka_nfs_root \
--set storageClass.name=nfs
==Make storage class default==
oc patch storageclass nfs -p '{"metadata": {"annotations":{"storageclass.kubernetes.io/is-default-class":"true"}}}'
==Create pvc using sc==
kubectl apply -f - <<EOF
apiVersion: v1
kind: PersistentVolumeClaim
metadata: {name: nfs-pvc, namespace: kafka}
spec: {accessModes: [ReadWriteOnce], resources: {requests: {storage: 1Gi}}, storageClassName: nfs}
EOF

=kubectl=
List contexts
kubectl config get-contexts
Select context
kubectl config use-context default/api-blabla-halfface-se:6443/kube:admin
=permissions=
==list groups==
oc get groups -o wide
==list cluserroles==
oc get clusterrole --all-namespaces
==list clusterrolebindings==
oc get crb
oc get clusterrolebindings

=scale=
oc scale --replicas=2 rc/postgresql-1
oc scale -n abjorklund deployment stress-hm-6x32 --replicas=0
oc scale --replicas=3 machineset <machineset> -n openshift-machine-api

=top(disable wikimedia top)=
oc adm top pods --use-protocol-buffers --all-namespaces
oc adm top pods --use-protocol-buffers --all-namespaces --sort-by=cpu | head -20| cut -c -200
oc adm top nodes --sort-by=cpu
oc adm top nodes --sort-by=memory

=get memory usage of all running pods in MB=
oc get pods -o custom-columns=POD:.metadata.name --no-headers --field-selector status.phase=Running| while read POD ; do echo $POD $(( $(oc exec -it $POD -- cat /sys/fs/cgroup/memory/memory.usage_in_bytes </dev/null 2>/dev/null) / 1024 / 1024 )) MB ; done
oc get pods -A -o wide --no-headers --field-selector spec.nodeName=ocp-04-9lxgz-worker-wlw9p --field-selector status.phase=Running | while read NAMESPACE POD NULL ; do oc project $NAMESPACE >/dev/null 2>&1 ; oc adm top pod $POD --containers --no-headers ; done | sort -k 4 -n| less
Get memory usage per pod on specific node.
NODE=ocp-01-4dfqx-worker-4n6mk ; oc get pods -A -o wide --no-headers --field-selector "spec.nodeName=${NODE},status.phase=Running" | while read NAMESPACE POD NULL ; do oc project $NAMESPACE >/dev/null 2>&1 ; oc adm top pod $POD --containers --no-headers ; done | sed 's/ */\t/g' | sort -k 4 -n | column -t -s $'\t'
=get memory usage of all nodes in % of total available ram=
oc get nodes -o name | xargs -I % oc debug % -- chroot /host sh -c 'BUFFER=($(free | grep Mem:)) ; echo $HOSTNAME $(( $(( ${BUFFER[1]} - ${BUFFER[6]} )) / $(( ${BUFFER[1]} / 100 )) ))' 2>/dev/null

=oc get crd=
Get Custom Resource Definitions.
oc get crd
=operators=
Automatically setup of a instances.
=list installed operators=
oc get ClusterServiceVersions -A
oc get csv -A
oc get operators -o json | jq -r '.items[].status.components.refs[]?|select(.kind=="ClusterServiceVersion")|.name'
Search all namespaces. Exclude namespace.
oc get csv -A -o=custom-columns='NAME:.metadata.name,VERSION:.spec.version,DISPLAY:.spec.displayName' --no-headers | sort | uniq

=list available operators=
oc get packagemanifests
=delete operator=
Delete via gui. If traces are left. Or unable to install again.
https://access.redhat.com/solutions/6762071 Remove potentially blocking references.
https://access.redhat.com/solutions/7026146 Remove label so operator is not recreated.
oc get operator prometheus.prometheus -o yaml -n openshift-operators | grep -i CustomResourceDefinition -A1 //It will list the CRDs
currently being referenced by the operator
oc edit crd thanosrulers.monitoring.coreos.com
-----------output truncated------------
labels:
operators.coreos.com/prometheus.prometheus: "" //Remove this line and then save and exit
# Remove possibly broken jobs.
oc get jobs.batch -n openshift-marketplace | grep -i 0/1
# If job was not broken then remove all references to that operator. Remove jobs and configmaps.
oc get job -n openshift-marketplace -o json | jq -r '.items[] | select(.spec.template.spec.containers[].env[].value|contains ("elasticsearch-operator")) | .metadata.name' | while read i ; do echo oc delete job $i -n openshift-marketplace ; echo oc delete configmap $i -n openshift-marketplace ; done
=delete operator=
export OPERATOR=gitops ; oc get csv,subscriptions -n openshift-operators | grep "${OPERATOR}" | awk '{print $1}' | while read i ; do oc_script_log_yaml_kubectl-neat oc get $i -n openshift-operators </dev/null; echo oc delete $i ; done ; oc get installplan -n openshift-operators --sort-by=.metadata.creationTimestamp | grep "${OPERATOR}" | tail -n1 | awk '{print $1}' | while read i ; do oc_script_log_yaml_kubectl-neat oc get installplan $i -n openshift-operators </dev/null ; echo oc delete installplan $i; done

=Select channel=
oc patch clusterversion version --type merge -p '{"spec": {"channel": "candidate-4.12"}}' # candidate-... channel offers unsupported early access to releases as soon as they are built.
oc patch clusterversion version --type merge -p '{"spec": {"channel": "fast-4.12"}}' # As soon as version as a general availability (GA) release. Fully supported. Used in production environments.
oc patch clusterversion version --type merge -p '{"spec": {"channel": "stable-4.12"}}' # Delay from fast. Looking at quality from fast. If found good then moved to stable
oc patch clusterversion version --type merge -p '{"spec": {"channel": "eus-4.12"}}' # Extended Update Support

=find if image exitst=
oc adm release info quay.io/openshift-release-dev/ocp-release:4.15.38-x86_64
=Upgrade to version that you found on github okd=
oc adm upgrade --to-image=

=oc adm upgrade=
Upgrade okd images.
=Launch a new instance of a pod for gathering debug information. Compress and deliver in support case=
cd /tmp && oc adm must-gather && tar czf /tmp/must-gather.$(oc whoami --show-server | awk -F ':|/' '{print $4}').$(date +%F_%H-%M-%S).tar.gz must-gather.local.*
=Must gather for odf=
DATE=$(date +%F_%H-%M-%S)
mkdir /tmp/${DATE} ; cd /tmp/${DATE} && oc adm must-gather --image=registry.redhat.io/odf4/odf-must-gather-rhel9:v4.16
tar czf /tmp/must-gather.$(oc whoami --show-server | awk -F ':|/' '{print $4}').${DATE}.tar.gz /tmp/${DATE}/

=oc adm certificate approve <csr_name>=
Approve csr certificate
==Approve all csr==
oc get csr --no-headers | grep -vE 'Pending|Issued' | awk '{print $1}' | xargs -r oc adm certificate approve

=certmanager=
==cert-manager design==
( +---------+ )
( | Ingress | ) Optional ACME Only!
( +---------+ )
| |
| +-------------+ +--------------------+ | +-------+ +-----------+
|-> | Certificate |----> | CertificateRequest | ----> | | Order | ----> | Challenge |
+-------------+ +--------------------+ | +-------+ +-----------+
==look at cert-manager cr==
oc api-resources | grep cert | awk '{print $1}' | while read i ; do echo '*' $i ; oc get $i -A ; done
==list certificates==
oc get certificate -A
==list ClusterIssuer==
oc get ClusterIssuer -A
==list orders by date==
oc get orders -n openshift-config --sort-by=.metadata.creationTimestamp
==install cmctl==
<pre>
curl -fsSL https://github.com/cert-manager/cert-manager/releases/latest/download/cmctl-linux-amd64.tar.gz | (cd /usr/local/bin/ ; sudo tar zxf - cmctl)
</pre>

==completion==
. <(cmctl completion bash)
==renew cert==
cmctl renew -n openshift-config cert-api
==status of cert==
cmctl status certificate -n openshift-ingress le-wildcard-apps-certificate
=cert-utils=
==cert check==
<pre>
apiVersion: monitoring.coreos.com/v1
kind: PrometheusRule
metadata:
name: cert-utils-operator-certificate-rule-alerts
namespace: cert-utils-operator
spec:
groups:
- name: cert-utils-operator-recording-rules
rules:
- expr: certutils_certificate_expiry_time - certutils_certificate_issue_time
record: cert:validity_duration:sec
- expr: certutils_certificate_expiry_time - time()
record: cert:time_to_expiration:sec
- name: cert-utils-operator-alerting-rules
rules:
- alert: CertificateApproachingExpiration
annotations:
message: Certificate {{ $labels.namespace }}/{{ $labels.name }} has less than 30 days left.
summary: Certificate {{ $labels.namespace }}/{{ $labels.name }} is approaching expiration (30 days left).
expr: |
cert:validity_duration:sec >= 7776000 and cert:time_to_expiration:sec < 2592000
labels:
severity: warning
- alert: CertificateIsAboutToExpire
annotations:
message: Certificate {{ $labels.namespace }}/{{ $labels.name }} has less than 15 days left.
summary: Certificate {{ $labels.namespace }}/{{ $labels.name }} is about to expire (15 days left).
expr: |
cert:validity_duration:sec >= 7776000 and cert:time_to_expiration:sec < 1296000
labels:
severity: critical
</pre>

=oc adm release info=
# Show information about the cluster's current release
oc adm release info
# Show the source code that comprises a release
oc adm release info 4.2.2 --commit-urls
# Show the source code difference between two releases
oc adm release info 4.2.0 4.2.2 --commits
# Show where the images referenced by the release are located
oc adm release info quay.io/openshift-release-dev/ocp-release:4.2.2 --pullspecs
# Show release info about a release
oc adm release info 4.10.47 --pullspecs
=release notes=
find changes between ocp versions / release note.
https://access.redhat.com/labs/ocpupgradegraph/update_path
Select source and destination.
At bottom there is graphical display.
Press each bubble and read rhba.
Point releases in the end.
https://docs.openshift.com/container-platform/4.12/release_notes/ocp-4-12-release-notes.html

=oc adm node-logs=
Look at logs from crio from master nodes.
oc adm node-logs --role master -u crio
Get logs from one node from unit crio
oc adm node-logs abjorklund-01-5tsbc-worker-0-kcr54 -u crio
Look at specific log
oc adm node-logs --role master --path=openshift-apiserver/audit.log
List logs
oc adm node-logs --role=master --path=/
List logs from specific node.
oc adm node-logs nord-ic-bc84t-master-0 --path=/oauth-server/
Logs since older reboots
oc adm node-logs --role=master --path=/
Search recursive where log file exist.
oc_debug_run_command_all_nodes 'find /var/log 2>&1 | grep <name_pod>'
==download logfile==
CONTAINER_PATH="/containers" ; SEARCH_STRING="rabbit" ; oc adm node-logs --role=worker --path="${CONTAINER_PATH}" | grep "${SEARCH_STRING}" | while read NODE LOGFILE ; do echo $NODE --path="${CONTAINER_PATH}/${LOGFILE}" ; oc adm node-logs $NODE --path="${CONTAINER_PATH}/${LOGFILE}" > ${NODE}:${CONTAINER_PATH//\//%}%${LOGFILE} ; done

=openshift upgrade path=
https://access.redhat.com/labs/ocpupgradegraph/update_path?channel=stable-4.9&arch=x86_64&is_show_hot_fix=false&current_ocp_version=4.9.15&target_ocp_version=4.10.11
=Upgrade openshift/okd=
https://docs.okd.io/latest/updating/preparing_for_updates/updating-cluster-prepare.html
Run below and look to se if api:s that are being removed has a count.
oc get apirequestcounts

=upgrade openshift=
# look for existing alerts.
# look for troublesome pods.
oc get pods -A | grep -Ev ' Running | Completed '
# Set channel
oc patch clusterversion version --type merge -p '{"spec": {"channel": "stable-4.10"}}'
oc adm upgrade --to=4.10.47
oc adm upgrade --include-not-recommended
oc adm upgrade --allow-not-recommended --to=4.10.0 --include-not-recommended
oc get clusterversion -o json|jq ".items[0].spec"
# View openshift version history.
oc get clusterversion -o json | jq -r '.items[0].status.history[] | [.version, .startedTime, .completionTime] | join(" ")'
# View progress of update.
watch -n1 oc whoami --show-console \; oc adm upgrade
watch -cn1 "oc get clusteroperators | grep --color=always -E \"$(oc get clusterversions.config.openshift.io version -o json | jq -r .status.desired.version)|\""
# Upgrade all operators
oc get installplan -A | grep Manual | grep false
oc patch installplan $INSTALLPLAN -n $NAMESPACE --type merge --patch '{"spec":{"approved":true}}'

=upgrade okd=
==Get upgrade path.==
Look here to find latest version https://github.com/okd-project/okd/releases
(cd /usr/local/bin/ ; sudo curl -s -O https://gist.githubusercontent.com/Goose29/ca7debd6aec7d1a4959faa2d1b661d93/raw/4584d89c49d4af197480539bdd873f6d9ca2dd83/upgrade-path.py ; sudo chmod 755 upgrade-path.py ) && (curl -sH 'Accept:application/json' 'https://amd64.origin.releases.ci.openshift.org/graph?channel=stable-4' | upgrade-path.py 4.13.0-0.okd-2023-07-23-051208 4.14.0-0.okd-2024-01-26-175629 )
==To view status of update process run. Command is harmless and gives information about ongoing process and blockers.==
oc adm upgrade
watch -cn1 "oc whoami --show-console ; echo ; oc get clusteroperators | grep --color=always -E \"$(oc get clusterversions.config.openshift.io version -o json|jq -r '.spec.desiredUpdate.version')|\""
==To get slightly other view. VERSION column gives information about version. When update is done all cluster operators will have same version number.==
oc get clusteroperators
==Make a report of cluster status before installing. To rule out issues that you have not caused.==
"status of kubernetes" below.

==Look for api:s that are used that are flagged for being removed.==
oc get apirequestcounts
==Upgrade okd until there are no more updates or you have reached wanted version.==
oc adm upgrade --to-latest=true --allow-explicit-upgrade
==If complaining about cert. ReleaseAccepted=False==
oc patch --type='merge' --patch='{"spec":{"desiredUpdate":{"force":true}}}' clusterversion version
==If client want specific version pinpoint that.==
oc adm upgrade --to=<version from oc adm upgrade> --allow-explicit-upgrade
oc adm upgrade gives: Upgradeable=False Reason: AdminAckRequiredn Follow instructions from link. Command will be something like below.
oc -n openshift-config patch cm admin-acks --patch '{"data":{"ack-<version>-kube-<version>-api-removals-in-<version>":"true"}}' --type=merge
==Get pods that are less than perfekt.==
oc get pods -A --no-headers | grep -v Completed | while read LINE ; do PODS=$(awk '{print $3}' <<< "${LINE}") ; if [ "${PODS%%/*}" != "${PODS##*/}" ] ; then echo "${LINE}" ; fi ; done
==Get critical alerts.==
oc -n openshift-monitoring exec -c prometheus prometheus-k8s-0 -- curl -s "http://localhost:9090/api/v1/alerts" | jq '.data.alerts[]|select(.state=="firing")|select(.labels.severity=="critical")'
==Get warning alerts.==
oc -n openshift-monitoring exec -c prometheus prometheus-k8s-0 -- curl -s "http://localhost:9090/api/v1/alerts" | jq '.data.alerts[]|select(.state=="firing")|select(.labels.severity=="warning")'

=upgrade odf=
# View existing config.
oc get subscriptions -n openshift-storage odf-operator -o yaml
# Patch subscription
oc patch subscriptions -n openshift-storage odf-operator --type merge -p '{"spec": {"channel": "<channel>"}}'
# Get install plans
oc get installplan -n openshift-storage -o wide
# Approve install plan.
oc get installplans.operators.coreos.com -A --no-headers | awk '$5 ~ /false/' | awk '$4 ~ /Manual/' | while read NAMESPACE INSTALLPLAN END ; do echo '*' $NAMESPACE $INSTALLPLAN ; oc patch installplan $INSTALLPLAN -n $NAMESPACE --type merge --patch '{"spec":{"approved":true}}' ; done

=odf troubleshooting=
# ceph problem. Run commands from rook-ceph-operator
oc rsh -n openshift-storage $(oc get pods -n openshift-storage -o name -l app=rook-ceph-operator)
export CEPH_ARGS='-c /var/lib/rook/openshift-storage/openshift-storage.config'
ceph -s
ceph osd pool ls
ceph osd pool autoscale-status
ceph config dump
# disable autoscaling
ceph osd pool ls | while read i ; do echo '*' $i ; ceph osd pool set $i pg_autoscale_mode off ; done
# Look to see how much data is being used for pg:s.
# Number of PGLog Entries, size of PGLog data in megabytes, and Average size of each PGLog item
for i in 0 1 2 ; do echo '*' $i ; osdid=$i ; ceph tell osd.$osdid dump_mempools | jq -r '.mempool.by_pool.osd_pglog | [ .items, .bytes /1024/1024, .bytes / .items ] | @csv' ;done
ceph df

=cronjobs=
oc get cj
oc get cronjobs -o wide -A
Run cronjob manually
export CRONJOB=ldap-sync ; oc create job --from=cronjob/${CRONJOB} ${CRONJOB}-manual-$(date '+%Y-%m-%d-%H-%M-%S')
Disable cronjob
.spec.suspend: true
Enable cronjob
oc patch cronjobs.batch write-to-nfs --type merge -p '{"spec": {"suspend": false}}'

=delete po (stop, kill)=
stop pod
oc delete po --all --force
oc delete pod openshift-gitops-server --namespace openshift-gitops
oc delete pods -n openshift-oauth-apiserver --all
oc get po -A | grep -v ^NAME | awk '$4 !~ /Running/' | sort -k4 | while read NAMESPACE POD READY STATUS END ; do echo '****' $POD $STATUS ; echo oc delete po $POD -n $NAMESPACE --force --grace-period=0 ; done
oc get pods -A --field-selector=status.phase!=Running --no-headers | while read NAME_SPACE POD REST_OF_LINE ; do echo oc delete pod $POD -n "${NAME_SPACE}" --force --grace-period=0 ; done
(oc get pods --field-selector="status.phase=Pending" --no-headers -A ; oc get pods --field-selector="status.phase=Failed" --no-headers -A) | while read NAME_SPACE POD REST_OF_LINE ; do echo oc delete pod $POD -n "${NAME_SPACE}" --force --grace-period=0 ; done
# Delete pods and generate report on what has been removed.
LOG=/tmp/oc_delete_pod_$(oc config current-context | awk -F '/|:' '{print $2}').$(date '+%Y-%m-%d_%H-%M-%S').log ; (oc get pods --field-selector="status.phase=Pending" --no-headers -A ; oc get pods --field-selector="status.phase=Failed" --no-headers -A) | while read NAME_SPACE POD REST_OF_LINE ; do oc delete pod $POD -n "${NAME_SPACE}" --force --grace-period=0 ; done | tee $LOG ; awk -F\" '{print $2}' $LOG | sed 's/-[a-z0-9]*$//g'| sed 's/-[a-z0-9]*$//g' | sort | uniq -c | sort -n | tail -20

=use other namespace=
oc rsh --namespace namespace-name pod-name
oc rsh --namespace namespace-name-operator pod-name bash -c 'echo $PATH $HOSTNAME'

=list namespaces=
oc get namespace
=use namespace=
oc rsh --namespace openshift-gitops openshift-gitops-application-controller-0
=kubectl get netnamespace=
Command line utility used to configure network. Egress address can be used to define outgoing address. Which can also cause other issues.
oc get netnamespace openshift-gitops -oyaml

=oc get routes=
oc get routes --namespace openshift-gitops
=oc get oauth=
Describe authentication methods.
oc get oauth cluster -o yaml
=decode token. base64=
https://jwt.io/
=view secrets=
oc get secret ca-key-pair -o go-template='{{range $k,$v := .data}}{{"### "}}{{$k}}{{"\n"}}{{$v|base64decode}}{{"\n\n"}}{{end}}'
=delete cluster=
openshift-install destroy cluster
=storageclasses(sc)=
oc get storageclasses
=get storageclasses defined as default=
oc get sc -o json | jq -r '.items[]|select(."metadata".annotations."storageclass.kubernetes.io/is-default-class"=="true")|.metadata.name'
=set default storageclass=
# Set all sc to default false.
oc get sc -o json | jq -r '.items[]|select(."metadata".annotations."storageclass.kubernetes.io/is-default-class"=="true")|.metadata.name' | while read i ; do echo '*' $i ; oc patch storageclass $i -p '{"metadata": {"annotations":{"storageclass.kubernetes.io/is-default-class":"false"}}}'; done
# Set default storageclass.
oc patch storageclass ocs-storagecluster-cephfs -p '{"metadata": {"annotations":{"storageclass.kubernetes.io/is-default-class":"true"}}}'

=get service accounts=
oc get serviceaccounts -A
oc get sa -A

=which permissions do I have=
oc auth can-i --as=fjuza --list
oc get groups -o wide
oc auth can-i --as-group=<group> --list

=alerts=
==How is alertmanager configured==
oc get secret -n openshift-monitoring alertmanager-main -o json | jq -r '.data."alertmanager.yaml"|@base64d'

==Save alertmanger config==
<pre>
oc get secret alertmanager-main -n openshift-monitoring --template='{{index .data "alertmanager.yaml" | base64decode}}' > /tmp/oc_get_secret_alertmanager-main.alertmanager.yaml.$(oc whoami --show-console=true | awk -F / '{print $3}').$(date '+%Y-%m-%d_%H-%M-%S')
oc extract secret/alertmanager-main --confirm -n openshift-monitoring
</pre>

==Restore alertmanager config==
oc set data secret alertmanager-main -n openshift-monitoring --from-file=alertmanager.yaml=<file_alertmanager.yaml>

==alertmanager==
View Alertmanager configured alerts.
oc get prometheusrules -A -o yaml | grep alert: | sort
View configuration of alert
oc get prometheusrules -A -o json | jq '.items[].spec.groups[].rules[]| select(.alert=="AlertmanagerReceiversNotConfigured")'
view alerts.
oc -n openshift-monitoring exec -c prometheus prometheus-k8s-0 -- curl -s "http://localhost:9090/api/v1/alerts" | jq . | less -ISRM
View specific alert.
oc rsh -n openshift-monitoring -c prometheus prometheus-k8s-0 -- curl 'http://localhost:9090/api/v1/query?query=absent%28up%7Bjob%3D"fluentd"%7D+%3D%3D+1%29' | jq .
View alerts in state firing
oc -n openshift-monitoring exec -c prometheus prometheus-k8s-0 -- curl -s "http://localhost:9090/api/v1/alerts" | jq '.data.alerts[]|select(.state=="firing")' | less -ISRM
View alerts in state firing with severity warning
oc -n openshift-monitoring exec -c prometheus prometheus-k8s-0 -- curl -s "http://localhost:9090/api/v1/alerts" | jq '.data.alerts[]|select(.state=="firing")|select(.labels.severity=="warning")' | less -ISRM
View historical alerts.
oc -n openshift-monitoring exec -c prometheus prometheus-k8s-0 -- curl -s "http://localhost:9090/api/v1/query_range?query=ALERTS&start=2022-08-08T00:00:00.781Z&end=2022-08-09T00:00:00.781Z&step=1m"
oc -n openshift-monitoring exec -c prometheus prometheus-k8s-0 -- curl -s "http://localhost:9090/api/v1/query_range?query=ALERTS&start=$(date '+%Y-%m-%d' --date '-2 days')T00:00:00.781Z&end=$(date '+%Y-%m-%dT%H:%M:%S').781Z&step=1m" | jq . | less -ISRM
Get warning alerts since the last week.
echo '***' $(oc whoami --show-console) ; oc -n openshift-monitoring exec -c prometheus prometheus-k8s-0 -- curl -s "http://localhost:9090/api/v1/query_range?query=ALERTS&start=$(TZ=UTC date '+%Y-%m-%dT%H:%M:%S.000Z' --date '-6 days')&end=$(TZ=UTC date '+%Y-%m-%dT%H:%M:%S').000Z&step=1m" | jq -r '.data.result[].metric | {alertname, severity, alertstate}| select(.severity=="warning")|select(.alertstate=="firing") | .alertname'
Get more info about fired alerts.
echo '***' $(oc whoami --show-console) ; oc -n openshift-monitoring exec -c prometheus prometheus-k8s-0 -- curl -s "http://localhost:9090/api/v1/query_range?query=ALERTS&start=$(TZ=UTC date '+%Y-%m-%dT%H:%M:%S.000Z' --date '-6 days')&end=$(TZ=UTC date '+%Y-%m-%dT%H:%M:%S').000Z&step=1m" | jq -r '.data.result[].metric | {alertname, severity, alertstate, pod, namespace}| select(.severity=="warning")|select(.alertstate=="firing")'
Get alert during the last 6 days. Give times when alert has fired.
oc -n openshift-monitoring exec -c prometheus prometheus-k8s-0 -- curl -s "http://localhost:9090/api/v1/query_range?query=ALERTS&start=$(TZ=UTC date '+%Y-%m-%dT%H:%M:%S.000Z' --date '-6 days')&end=$(TZ=UTC date '+%Y-%m-%dT%H:%M:%S').000Z&step=1m" | jq -r . | python3 -c "import sys, re, datetime; print(re.sub(r'\b\d{10}\b', lambda x: datetime.datetime.utcfromtimestamp(int(x.group())).isoformat() + 'Z', sys.stdin.read()))" | less -ISRM

=disable alermanager alert=
oc -n openshift-monitoring exec -ti alertmanager-main-0 -c alertmanager -- amtool silence add --alertmanager.url http://localhost:9093 alertname=AlertmanagerReceiversNotConfigured --end="2053-11-07T00:00:00-00:00" --comment "silence alertmanager"
=list silenced alerts=
oc -n openshift-monitoring exec -ti alertmanager-main-0 -c alertmanager -- amtool silence query --alertmanager.url http://localhost:9093
=Parsed config to alertmanager=
oc -n openshift-monitoring exec -ti alertmanager-main-0 -c alertmanager -- curl http://localhost:9093/api/v2/status | jq -r .config.original
=Version of alertmanager=
oc -n openshift-monitoring exec -ti alertmanager-main-0 -c alertmanager -- curl http://localhost:9093/api/v2/status | jq -r .versionInfo.version | strings

=Silence alertmanager not configured alert=
oc set data secret alertmanager-main -n openshift-monitoring --from-file=alertmanager.yaml=<(cat <<'EOF'
"global":
"resolve_timeout": "5m"
"inhibit_rules":
- "equal":
- "namespace"
- "alertname"
"source_match":
"severity": "critical"
"target_match_re":
"severity": "warning|info"
- "equal":
- "namespace"
- "alertname"
"source_match":
"severity": "warning"
"target_match_re":
"severity": "info"
"receivers":
- "name": "Default"
- "name": "Watchdog"
- "name": "Critical"
- "name": "testrec" # Dummy receiver with webhook config
"webhook_configs":
- "url": "http://xxxxdumyxxx.com"
"route":
"group_by":
- "namespace"
"group_interval": "5m"
"group_wait": "30s"
"receiver": "Default"
"repeat_interval": "12h"
"routes":
- "match":
"alertname": "dummyalert" # Dummy alert being routed to dummy receiver
"receiver": "testrec"
EOF
)

=prometheus=
Url to web interface.
https://prometheus-k8s-openshift-monitoring.apps.<url>
echo https://prometheus-k8s-openshift-monitoring.$(oc whoami --show-console | awk -F 'console-openshift-console.' '{print $2}')
echo https://$(oc get route -n openshift-monitoring prometheus-k8s -o jsonpath="{.spec.host}")
Get disk usage from odf
oc -n openshift-monitoring exec -c prometheus prometheus-k8s-0 -- curl -s "http://localhost:9090/api/v1/query?query=odf_system_raw_capacity_used_bytes" | jq -r .
Get disk usage from odf over time.(metrics)
oc -n openshift-monitoring exec -c prometheus prometheus-k8s-0 -- curl -s "http://localhost:9090/api/v1/query_range?query=odf_system_raw_capacity_used_bytes&start=$(date '+%Y-%m-%d' --date '-20 days')T00:00:00.781Z&end=$(date '+%Y-%m-%dT%H:%M:%S').781Z&step=1h" | jq . | less -ISRM
Search tips
https://prometheus.io/docs/prometheus/latest/querying/basics/
Disk usage per project. Taken from RH ticket.
oc -n openshift-monitoring exec prometheus-k8s-0 -c prometheus -- curl -s -g 'http://localhost:9090/api/v1/query?' --data-urlencode 'query=(sort_desc(topk(25,(sum(kubelet_volume_stats_used_bytes * on (namespace,persistentvolumeclaim) group_left(storageclass, provisioner) (kube_persistentvolumeclaim_info * on (storageclass) group_left(provisioner) kube_storageclass_info {provisioner=~"(.*cephfs.csi.ceph.com)"})) by (namespace)))))'

=openshift-user-workload-monitoring=
"annotations": {
"description": "Prometheus operator in openshift-user-workload-monitoring namespace rejected 2 prometheus/ServiceMonitor resources.",
"summary": "Resources rejected by Prometheus operator"
},...
# Look at what is causing.
oc logs -l app.kubernetes.io/name=prometheus-operator -n openshift-user-workload-monitoring
# After tweaking with monitoring settings kill pod and view log.
oc delete pod -l app.kubernetes.io/name=prometheus-operator -n openshift-user-workload-monitoring
oc logs -l app.kubernetes.io/name=prometheus-operator -n openshift-user-workload-monitoring | less
# Stop monitoring.
oc label namespace openshift-local-storage openshift.io/cluster-monitoring-
oc label namespace openshift-local-storage openshift.io/user-monitoring=false
# Allow monitoring.
oc label namespace openshift-operators openshift.io/cluster-monitoring=true

=Talk to api with Bearer.=
HOST=$(oc -n openshift-monitoring get route alertmanager-main -ojsonpath={.spec.host})
TOKEN=$(oc whoami -t)
curl -skH "Authorization: Bearer $TOKEN" "https://$HOST/api/v2/alerts" | jq .
=token=
token=`oc sa get-token prometheus-k8s -n openshift-monitoring` ## --- In OCP client 4.10 or lower ---
OR
token=`oc create token prometheus-k8s -n openshift-monitoring` ## --- In OCP client 4.11 or higher ---
curl using token
curl -k -H "Authorization: Bearer $token" 'https://alertmanager-main-openshift-monitoring.apps.domain/api/v1/alerts' | jq '.data[].labels'
=ServiceMonitor=
Prometheus Operator:
When using Prometheus Operator, custom resources like ServiceMonitor and PodMonitor might include metricsConfig settings to customize how Prometheus should scrape metrics from various services or pods.

=bash completion=
. <(oc completion bash)

=machineconfig=
view settings
oc describe machineconfigpool
==set ntp servers==
echo 'variant: openshift
version: 4.9.0
metadata:
name: 99-master-chrony
labels:
machineconfiguration.openshift.io/role: master
storage:
files:
- path: /etc/chrony.conf
mode: 0644
overwrite: true
contents:
inline: |
server ntp.lio.se iburst
driftfile /var/lib/chrony/drift
makestep 1.0 3
rtcsync
logdir /var/log/chrony' | butane | oc apply -f -
==get machineconfig value==
oc get mc 00-master -o json | jq -r '.spec.config.storage.files[]|select(.path=="/var/lib/kubelet/config.json")|.contents.source' | perl -pe 's/%([0-9a-f]{2})/sprintf("%s", pack("H2",$1))/eig' | sed 's/^data:,//g' | jq .

==List machineconfigs by creation time==
oc get mc --sort-by=.metadata.creationTimestamp

=get users=
oc get users
=give me kubeadmin ecrypted password=
oc get secret kubeadmin -n kube-system -o json -o=jsonpath='{.data.kubeadmin}' | base64 -d
=Give kubeadmin a new password=
==generate password hash==
htpasswd -bnBC 10 "" '<password>' | tr -d ':\n' | base64 -w0

==patch password hash==
oc patch secret/kubeadmin -n kube-system -p '{"data": {"kubeadmin": "UGFzc3dvcmQK=="}}'

=work with oc without login=
export KUBECONFIG=/var/lib/kubelet/kubeconfig
if on bootstrap node.
export KUBECONFIG=/etc/kubernetes/kubeconfig

=Add the following if cert is not trusted.ssl/tls/ignore/expired=
- cluster:
insecure-skip-tls-verify: true
server: https://127.0.0.1:443
name: my-cluster

=run oc when on node=
oc get pod -n openshift-monitoring --kubeconfig=/var/lib/kubelet/kubeconfig

=etcdctl=
oc rsh -c etcdctl -n openshift-etcd $(oc get pod -l app=etcd -oname -n openshift-etcd | awk -F"/" 'NR==1{ print $2 }')
[root@ocp-03-lm8km-master-1 /]# etcdctl --write-out=table endpoint status
+---------------------------+------------------+---------+---------+-----------+------------+-----------+------------+--------------------+--------+
| ENDPOINT | ID | VERSION | DB SIZE | IS LEADER | IS LEARNER | RAFT TERM | RAFT INDEX | RAFT APPLIED INDEX | ERRORS |
+---------------------------+------------------+---------+---------+-----------+------------+-----------+------------+--------------------+--------+
| htt://172.19.14.36:2379 | c4f7b42b92713818 | 3.5.0 | 105 MB | false | false | 6 | 2632074 | 2632074 | |
| htt://172.19.14.37:2379 | 5dea668b432969fc | 3.5.0 | 105 MB | false | false | 6 | 2632074 | 2632074 | |
| htt://172.19.14.41:2379 | 51cecd971b657ee5 | 3.5.0 | 105 MB | true | false | 6 | 2632074 | 2632074 | |
+---------------------------+------------------+---------+---------+-----------+------------+-----------+------------+--------------------+--------+
Verifying etcd while openshift is less than perfekt
# List etcd containers
crictl ps --label io.kubernetes.pod.namespace=openshift-etcd
# Execute command to verify health of etcd using crictl
crictl exec -it <container-id> etcdctl endpoint status --write-out=table

=create troubleshooting/debug/test pod=
oc run abjorklund-redhat-ubi8 --image=redhat/ubi8 -i --tty -- sh
oc run abjorklund-curlimage-curl --image=curlimages/curl -i --tty -- sh
oc run -it busybox --image=busybox --restart=Never -- ash
oc run abjorklund-rocky-rocky --image=rockylinux/rockylinux -i --tty -- bash
oc run ${USER}-rocky-rocky --image=rockylinux/rockylinux -i --tty -- bash # dnf -y install procps-ng iproute
oc run ${USER}-rocky-rocky --image=rockylinux/rockylinux --restart=Never --command sleep infinity
==install packages to get running==
yum install -y lsof procps-ng bind-utils

=proxy settings=
oc get proxy cluster -o yaml
Change ca
oc patch proxy/cluster --type=merge --patch='{"spec":{"trustedCA":{"name":"custom-ca"}}}'
=oc proxy=
Run a proxy to the Kubernetes API server
=port forward to pod=
oc port-forward <my-pod-name> <local-port>:<remote-port>
=alertmanager=
oc port-forward -n monitoring svc/kube-prometheus-stack-alertmanager 9093:9093 # http://localhost:9093/
=grafana access=
oc port-forward -n monitoring svc/kube-prometheus-stack-grafana 3000:80 # http://localhost:3000 admin prom-operator
=prometheus access=
oc port-forward -n monitoring svc/kube-prometheus-stack-prometheus 9090:9090 # http://localhost:9090
=akhq=
<pre>
kubectl port-forward service/akhq 8080:80
http://localhost:8080
</pre>

=thanos-queries=
oc port-forward -n openshift-monitoring svc/thanos-querier 9091:9091 # access via: curl -sk -H "Authorization: Bearer $(oc whoami -t)" https://localhost:9091/api/v1/status/buildinfo | jq . (via browser use requestly)

==proxy via pod==
# Create tunnel pod. Please remove when done.
oc apply -f - << 'EOF'
apiVersion: v1
kind: Pod
metadata:
name: proxy-pod
namespace: default
spec:
containers:
- name: socat-proxy
image: alpine/socat:latest
command: ["/bin/sh", "-c"]
args:
- |
apk add --no-cache socat && # Install socat if not in image
socat TCP-LISTEN:443,fork,reuseaddr TCP:scm.devops.cambio.se:443
ports:
- containerPort: 443
restartPolicy: Never
EOF
# Tunnel on localhost reaching destination.
sudo oc --kubeconfig=$KUBECONFIG port-forward pod/proxy-pod -n default 443:443
# Add hosts entry to use browser as "usual".
grep scm.devops.cambio.se /etc/hosts
127.0.0.1 localhost scm.devops.cambio.se

=Install additional ca certificate=
apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
metadata:
labels:
machineconfiguration.openshift.io/role: worker
name: 50-company-ca-cert
spec:
config:
ignition:
version: 3.1.0
storage:
files:
- contents:
source: data:text/plain;charset=utf-8;base64,LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURrVENDQW5tZ0F3SUJBZ0lFSC93Skh6QU5CZ2txaGtpRzl3MEJBUXNGQURBM01SVXdFd1lEVlFRS0RBeFMKUlVSQ1VrbEVSMFV1VTBVeEhqQWNCZ05WQkFNTUZVTmxjblJwWm1sallYUmxJRUYxZEdodmNtbDBlVEFlRncweQpNVEF5TWpNd056RTVOVFphRncwME1UQXlNak13TnpFNU5UWmFNRGN4RlRBVEJnTlZCQW9NREZKRlJFSlNTVVJIClJTNVRSVEVlTUJ3R0ExVUVBd3dWUTJWeWRHbG1hV05oZEdVZ1FYVjBhRzl5YVhSNU1JSUJJakFOQmdrcWhraUcKOXcwQkFRRUZBQU9DQVE4QU1JSUJDZ0tDQVFFQW5mY1F3YURwcEdzNWJxaUc5ajE5aFJVaG1sMzhjb2JGT2tzRQpsZFo3Y3RkV1d6VHJqSTFCRGxZSEd5SXBYMEo4ZU1PaDhvbUZqbVR6VTEzTkpWSnJrWm5RaDRhTzA1UGtKRlJRCkg1ZVA2N3R0S2pEb0txOFZVWXRZUldxRlFaalNxY2lQMzJobXZSNG42QVZDWDdCaUVBZjd2Y05ZVys0a1k5OUsKbTluV1BNbEpGU056M1puRnlWc1BtR1ZWeVN2RmFVL0dBTmt1Z25uSGdUM1VUUTNsc2NidU5keUpBcVEya3dHSwpKbkdZKzBSajVrUWpvdXptUjBDZ3pJN0hWSmhwK2Z6R1lyenRYQXA1Zkt0Z3ZTZFRtTndVVXZJR3pLTmU4WklGCmY0WVVUUDFPdU9jUmNIRDJQclVodDgzWlRLYzNwOUhLYk5CazIzWFFtYU85QVBqeEl3SURBUUFCbzRHa01JR2gKTUI4R0ExVWRJd1FZTUJhQUZMbWFrNHdDamtuakZvWkd6M1daRGErY2N4RGxNQjBHQTFVZERnUVdCQlM1bXBPTQpBbzVKNHhhR1JzOTFtUTJ2bkhNUTVUQVBCZ05WSFJNQkFmOEVCVEFEQVFIL01BNEdBMVVkRHdFQi93UUVBd0lCCnhqQStCZ2dyQmdFRkJRY0JBUVF5TURBd0xnWUlLd1lCQlFVSE1BR0dJbWgwZEhBNkx5OXBjR0V0WTJFdWNtVmsKWW5KcFpHZGxMbk5sTDJOaEwyOWpjM0F3RFFZSktvWklodmNOQVFFTEJRQURnZ0VCQURabURvUytJY1ZMcERBRwpiSXM0SWRJKzcxY0xINk90NjNkYWhBT25QRDJnMUhvVUFIZFdUcGdobER3TkFQWjg3UXQybFc4Q1B4eDhCQVZOCnlrZWlEN2paeVA5dmVCcDRxNjBiSTVYSENndWV5U2lGdjBBKzloKzMzekMrYy9WbStJVHJNTkZ0dlZMNE1kRWQKaVE4UVBhaFJEWW1qVkJVb1VIZWErMDdkWEY3TzQxY2t2YzZRb0lad2F5Y1Zhc0gvd05lVGNrdzl1TlNiajNTQwoyNHdpOUthQnpxdDZsWlF3TG5uUjVnNjNWUDZNZUprR2FXMTBxdExiQVM4NGZwQ1NWTUx3U051MGZqeFU2d2lPCkRjaWlKKzNZOG5ldjM5NGJHRkwxcG5ZVmM4YmpoL0xaaHM1dTRQUnhlNFBLRER2Y09NZUhpUkN1M1YySWRRTTgKbDl3enBQZz0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQoK
mode: 0644
overwrite: true
path: /etc/pki/ca-trust/source/anchors/company-ca.crt

=get raw api data=
oc get --raw "/api/v1/nodes/[node]/proxy/stats/summary"
Via proxy.
oc proxy &
Starting to serve on 127.0.0.1:8001
curl -s http://localhost:8001/api/v1/nodes/crc-lgph7-master-0/proxy/stats/summary
curl -s http://localhost:8001/api/v1/nodes/crc-lgph7-master-0/proxy/metrics/resource
=explain=
Get documentation for a resource. Get available attributes for an resource.
oc explain deployment

=events=
Get events.
oc get events -A --sort-by=.metadata.creationTimestamp
=jsonpath=
Get names of MachineConfigs one value per line.
oc get mc -o jsonpath='{range .items[*]}{.metadata.name}{"\n"}{end}' --no-headers
=ImageStreamTag=
ImageStreamTag represents an Image that is retrieved by tag name from an ImageStream.
=imagestream=
apiVersion: image.openshift.io/v1
kind: ImageStream
metadata:
name: myapp
==Tagging Images: When you tag an image, it is added to the ImageStream with a specified tag.==
oc tag myregistry/myapp:latest myapp:latest
==Using ImageStreams in Deployment Configurations: Deployment configurations can reference ImageStreams instead of direct image URLs.==
apiVersion: apps.openshift.io/v1
kind: DeploymentConfig
metadata:
name: myapp
spec:
template:
spec:
containers:
- name: myapp
image: image-registry.openshift-image-registry.svc:5000/myproject/myapp:latest

=BuildConfig=
Build configurations define a build process for new container images.
=download okd openshift-install=
# Show latest.
curl -skL https://github.com/okd-project/okd/releases | elinks --dump | sed 's/^ *//g' | grep " Latest"
# Download and install in /usr/local/bin. Keep old versions.
export OKD_VERSION=4.15.0-0.okd-2024-03-10-010116 ; (cd /temp/ ; oc adm release extract --tools quay.io/openshift/okd:${OKD_VERSION} ; cd /usr/local/bin/ ; sudo tar xf /temp/openshift-install-linux-${OKD_VERSION}.tar.gz openshift-install ; sudo mv openshift-install openshift-install.${OKD_VERSION})

=setup openshift cluster=
Download binary
<pre>
cd /tmp/ ; curl -L -O https://mirror.openshift.com/pub/openshift-v4/x86_64/clients/ocp/4.10.47/openshift-install-linux.tar.gz && sudo tar xf openshift-install-linux.tar.gz -C /usr/local/bin/
</pre>
Add vmware certs if using that backend.
(cd /tmp/ ; curl -sk https://${vspherer_server}/certs/download.zip -O) ; cd /etc/pki/ca-trust/source/anchors ; sudo unzip -oj /tmp/download.zip certs/lin/\* ; sudo update-ca-trust
Create config file
install-config.yaml
Then fire off install
openshift-install create cluster
Another example
ln -s install-config.yaml.2023-03-23 install-config.yaml
./openshift-install-4.12.0-0.okd-2023-04-16-041331 create cluster

=Edit install config after setup=
Save config
<pre>
oc get cm cluster-config-v1 -n kube-system --template='{{index .data "install-config" }}' > /tmp/cm_cluster-config-v1_-n_kube-system.$(oc whoami --show-console=true | awk -F / '{print $3}').$(date '+%Y-%m-%d_%H-%M-%S')
</pre>
Edit downloaded file and apply edited file.
oc set data cm cluster-config-v1 -n kube-system --from-file=install-config=/tmp/cm_cluster-config-v1_-n_kube-system.<suitable_name>

=look at install settings=
oc get -n kube-system cm/cluster-config-v1 -o yaml

=argocd login=
argocd login openshift-gitops-server-openshift-gitops.apps.costest.ltkronoberg.se --username kubeadmin --password asdfasfasdfas --sso --insecure
argocd login $(oc get routes -n openshift-gitops openshift-gitops-server -o json | jq -r .spec.host) --username $USER --password $COMPANY_PASSWORD --sso --insecure

=git sync heal=
argocd app list | grep -v NAME | awk '{print $1}' | while read i ; do echo '*' $i ; argocd app set $i --self-heal ; done

=metrics=
==Get available values==
Thanos monitoring points
curl -sk -H "Authorization: Bearer $(oc whoami -t)" https://$(oc get routes -n openshift-monitoring thanos-querier -o jsonpath='{.status.ingress[0].host}')/api/v1/metadata | jq .
node-exporter
oc --request-timeout=3 -n openshift-monitoring exec -c node-exporter $(oc get pod -n openshift-monitoring -l app.kubernetes.io/name=node-exporter -o=custom-columns='NAME:.metadata.name' --no-headers | head -1) -- curl -s 'http://localhost:9100/metrics' | grep -vE "^#|^$"
==Cpu usage per node.==
100 - (avg by (instance) (irate(node_cpu_seconds_total{mode="idle"}[30m])) * 100)
instance:node_cpu_utilisation:rate1m{job="node-exporter", cluster=""} != 0
instance:node_cpu_utilisation:rate1m{job="node-exporter"} != 0
==cpu usage per pod on node==
sum(node_namespace_pod_container:container_cpu_usage_seconds_total:sum_irate{cluster="", node=~"<node>"}) by (pod)
==iowait==
avg by (instance) (irate(node_cpu_seconds_total{mode="iowait"}[30m]))
==namespace==
cpu usage per namespace.
sum(node_namespace_pod_container:container_cpu_usage_seconds_total:sum_irate{cluster=""}) by (namespace)
==load==
Load 1 graph
instance:node_load1_per_cpu:ratio{job="node-exporter", cluster=""} != 0
==usage for pvc==
kubelet_volume_stats_used_bytes
kubelet_volume_stats_available_bytes
kubelet_volume_stats_used_bytes{persistentvolumeclaim="prometheus-prometheus-k8s-1"}
With % usage of all pvc
( kubelet_volume_stats_used_bytes / kubelet_volume_stats_capacity_bytes ) * 100

==Memory usage==
Memory usage of node.
instance:node_memory_utilisation:ratio
node_memory_MemAvailable_bytes
100 * (1 - (node_memory_MemAvailable_bytes / node_memory_MemTotal_bytes))
==Memory usage per pod on a node==
sum(container_memory_usage_bytes{node="<node_name>"}) by (pod, namespace)
==OOMKilled==
sum by (namespace, pod) (kube_pod_container_status_restarts_total) * on(namespace, pod) group_left(reason) kube_pod_container_status_last_terminated_reason{reason="OOMKilled"}
oc -n openshift-monitoring exec -c prometheus prometheus-k8s-0 -- curl -s "http://localhost:9090/api/v1/query_range?query=sum%20by%20(namespace,%20pod)%20(kube_pod_container_status_restarts_total)%20*%20on(namespace,%20pod)%20group_left(reason)%20kube_pod_container_status_last_terminated_reason%7Breason%3D%22OOMKilled%22%7D&start=$(date '+%Y-%m-%d' --date '-20 days')T00:00:00.781Z&end=$(date '+%Y-%m-%dT%H:%M:%S').781Z&step=1h" | jq .
==uptime==
oc exec -n openshift-monitoring -c prometheus prometheus-k8s-0 -- curl -s 'http://localhost:9090/api/v1/query?query=time%28%29%20-%20node_boot_time_seconds%7Bjob%3D%22node-exporter%22%7D%0A' | jq -r '.data.result[]|.metric.instance +"\t"+ (.value[1] | tonumber | floor | tostring)' | column_tab
==disk usage==
(1 - (node_filesystem_avail_bytes{mountpoint="/"} / node_filesystem_size_bytes{mountpoint="/"})) * 100
==disk inode usage==
(1 - (node_filesystem_files_free{mountpoint="/"} / node_filesystem_files{mountpoint="/"})) * 100
==disk utalization==
100 * (rate(node_disk_io_time_seconds_total[5m]) / 300)

==steal==
sum by (instance) (rate(node_cpu_seconds_total{mode="steal"}[1m])) * 100
==request memory==
sum by (node) ( kube_pod_container_resource_requests{resource="memory"} * on (namespace, pod) group_left kube_pod_status_phase{phase="Running"} ) / 1024 / 1024

=install oc and kubectl=
curl -fsSL https://mirror.openshift.com/pub/openshift-v4/x86_64/clients/ocp/latest/openshift-client-linux.tar.gz | (cd /usr/local/bin/ ; sudo tar zxf - oc kubectl )

=time and timezone in first pod(date)=
oc get pods --no-headers -o 'custom-columns=:.metadata.namespace,:.metadata.name' -A | grep -v cert-manager | head -1 | while read NAMESPACE POD ; do oc rsh -n $NAMESPACE $POD bash -c 'date "+%Y-%m-%d %H:%M:%S %Z"' 2>/dev/null ; done

=oc get installplan=
InstallPlan defines the installation of a set of operators.
oc get installplan install-bk8hw -n openshift-operators -o yaml
Approve all manual updates.
oc get installplans.operators.coreos.com -A --no-headers | awk '$5 ~ /false/' | awk '$4 ~ /Manual/' | while read NAMESPACE INSTALLPLAN END ; do echo '*' $NAMESPACE $INSTALLPLAN ; oc patch installplan $INSTALLPLAN -n $NAMESPACE --type merge --patch '{"spec":{"approved":true}}' ; done
Get selected info from all installplans
oc get installplans.operators.coreos.com -A --no-headers -o=custom-columns='DATE:.metadata.creationTimestamp,NAME:.metadata.name,PHASE:.status.phase,CSV:.spec.clusterServiceVersionNames,NAMESPACE:.metadata.namespace' --sort-by=.metadata.creationTimestamp

=oc extract=
Extract secrets or config maps to disk
# Extract only the key "nginx.conf" from config map "nginx" to the /tmp directory
oc extract configmap/nginx --to=/tmp --keys=nginx.conf
=dependencies,owner=
Search in output from
oc describe ...
Search for this.
Controlled By: ReplicaSet/rook-ceph-osd-0-6dcdc7fb48
=metadata.ownerReferences=
Define object that owns object

=nodeAffinity=
Pin pod to node with label (kubectl label nodes <your-node-name> disktype=ssd)
spec:
affinity:
nodeAffinity:
requiredDuringSchedulingIgnoredDuringExecution:
nodeSelectorTerms:
- matchExpressions:
- key: disktype
operator: In
values:
- ssd

=Add user to group=
oc adm groups add-users openshift-admins rb_janitor
=api-int=
api-int.<fqdn>
for i in api-int:6443 api:6443 test.apps:443 ; do ping -c1 -W1 ${i%%:*} 2>&1 | xargs ; curl -skI https://${i%%:*}:${i##*:} 2>&1 | xargs ; done | cut -c -150
for i in api-int:6443 api:6443 test.apps:443 ; do ping -c1 -W1 ${i%%:*} 2>&1 | xargs ; set -x ; curl -skv https://${i%%:*}:${i##*:} -o /dev/null 2>&1 | grep "Server certificate:" -A5 ; set +x ; done | cut -c -150
=test talk to api-int=
CACERT=/tmp/%var%lib%kubelet%kubeconfig%certificate-authority-data ; grep certificate-authority-data: /var/lib/kubelet/kubeconfig | awk '{print $2}' | base64 -d > /$CACERT ; curl -s --key /var/lib/kubelet/pki/kubelet-client-current.pem --cert /var/lib/kubelet/pki/kubelet-client-current.pem --cacert $CACERT -XGET "$(grep server /etc/kubernetes/kubeconfig | awk '{print $2}')/api/v1/namespaces/default/pods?limit=500"
=api urls=
kubernetes generic: reference to the Kubernetes API server.
kubernetes.default: reference to the Kubernetes API server within the "default" namespace.
kubernetes.default.svc: refers to the Kubernetes service within the "default" namespace.
kubernetes.default.svc.cluster.local: This is the fully-qualified domain name (FQDN) for the Kubernetes service within the "default" namespace.
openshift: Similar to "kubernetes," this is a generic reference to the OpenShift API server.
openshift.default: reference to the OpenShift API server within the "default" namespace.
openshift.default.svc: refers to the OpenShift service within the "default" namespace.
openshift.default.svc.cluster.local: fully-qualified domain name (FQDN) for the OpenShift service within the "default" namespace.

=okd setup fix=
# On bootstrap node. Could work on all clusters. First a test to se if it work already.
DOMAIN=$(grep " baseDomain: " /etc/mcc/bootstrap/cluster-dns-02-config.yml | awk '{print $2}')
for i in api-int api ; do ping -c1 -W1 $i.${DOMAIN} 2>&1 | xargs; done | cut -c -150
echo "10.1.0.5 api-int.${DOMAIN} api.${DOMAIN}" >> /etc/hosts

=oc annotate=
Update the annotations on one or more resources.
oc annotate pods foo description='my frontend'
=setuid setgid=
securityContext:
runAsUser: 10004000
runAsGroup: 10004000
=patch examples=
==Look at oc get ... -o json and copy line after line.==
oc patch redis redis-standalone --type merge --patch '{"spec": {"securityContext": {"runAsGroup": 1000400000}}}'
==Enable disable clusterlogging # Unmanaged/Managed==
oc patch clusterlogging -n openshift-logging instance --type merge -p '{"spec": {"managementState": "Unmanaged"}}'
==Enable disable elasticsearch(Unmanaged/Managed)==
oc patch elasticsearch -n openshift-logging elasticsearch --type merge -p '{"spec": {"managementState": "Unmanaged"}}' #
==Remove finalizers from pod.==
oc patch pod <pod> -n <namespace> -p '{"metadata":{"finalizers":null}}'
==remove value==
Remove .spec.kafka.version
oc patch kafka kafka-cluster --type='json' -p='[{"op": "remove", "path": "/spec/kafka/version"}]'

==Add finalizer==
oc patch pod <pod> -n <namespace> -p '{"metadata":{"finalizers":["kubernetes.io/pvc-protection"]}}'
==Replace finalizers value with this.==
oc patch pod <pod> -n <namespace> --type merge -p '{"metadata":{"finalizers":["kubernetes.io/pvc-protection","kubernetes"]}}'
==patch replicas deployment==
oc patch deployment <deployment-name> --patch '{"spec": {"replicas": 0}}'
==patch list entries do not wipe existing list entries==
oc patch deployment -n openshift-kube-apiserver-operator kube-apiserver-operator --type json -p '[{"op": "replace", "path": "/spec/template/spec/containers/0/image", "value": "quay.io/okd/scos-content@sha256:37d6b6c13d864deb7ea925acf2b2cb34305333f92ce64e7906d3f973a8071642"}]'
oc get deployment kube-apiserver-operator -n openshift-kube-apiserver-operator -o json | jq '.spec.template.spec.containers[0].env |= map(if .name == "IMAGE" then .value = "quay.io/okd/scos-content@sha256:5c9128668752a9b891a24a9ec36e0724d975d6d49e6e4e2d516b5ba80ae2fb23" else . end)' | oc apply -f -
oc get deployment kube-apiserver-operator -n openshift-kube-apiserver-operator -o json | jq '.spec.template.spec.containers[0].env |= map(if .name == "OPERATOR_IMAGE" then .value = "quay.io/okd/scos-content@sha256:37d6b6c13d864deb7ea925acf2b2cb34305333f92ce64e7906d3f973a8071642" else . end)' | oc apply -f -
oc get deployment kube-apiserver-operator -n openshift-kube-apiserver-operator -o json | jq '.spec.template.spec.containers[0].env |= map(if .name == "OPERAND_IMAGE_VERSION" then .value = "1.29.6" else . end)' | oc apply -f -
==patch service monitor==
kubectl patch servicemonitor cert-utils-operator-controller-manager-metrics-monitor -n openshift-operators -p='[{"op": "replace", "path": "/spec/endpoints/0/tlsConfig/serverName", "value": "cert-utils-operator-controller-manager-metrics-service.openshift-operators.svc"}]' --type='json'
==edit text/cert entry==
#!/bin/bash
SSL_URL=halfface.se
SSL_PORT=443
DATE_FILE=$(date +%F_%H-%M-%S)
openssl s_client -connect ${SSL_URL}:${SSL_PORT} -servername ${SSL_URL} -verify 5 -showcerts -certform pem </dev/null 2>/dev/null | sed -n '/^----/,/^----/p' > chain.${SSL_URL}.${SSL_PORT}.${DATE_FILE}.pem
ln chain.${SSL_URL}.${SSL_PORT}.${DATE_FILE}.pem ${SSL_URL}
oc create cm argocd-tls-certs-cm -n argocd --from-file ${SSL_URL} --dry-run=client -o yaml >> /tmp/chain.${SSL_URL}.${SSL_PORT}.${DATE_FILE}.pem.patch
oc patch configmap argocd-tls-certs-cm -n argocd --patch-file /tmp/chain.${SSL_URL}.${SSL_PORT}.${DATE_FILE}.pem.patch

=limits=
When your need to increase your cpu and memory resources.
cpu limit is either written as a number. 0.5 for half a cpu. Or rather a definition in milli. 500m for half a cpu.
spec:
containers:
...
resources:
limits:
cpu: "2"
memory: 5Gi
requests:
cpu: "2"
memory: 5Gi

=quotas on cpu memory pvc... per project=
oc get ResourceQuota
=tolerations|node selectors|...=
oc describe pod
Node-Selectors: node-role.kubernetes.io/app=
Tolerations: node.kubernetes.io/memory-pressure:NoSchedule op=Exists
node.kubernetes.io/not-ready:NoExecute op=Exists for 300s
node.kubernetes.io/unreachable:NoExecute op=Exists for 5s
node.ocs.openshift.io/storage=true:NoSchedule
=tolerate any taint=
tolerations:
- operator: Exists

=enable monitoring=
cat <<EOF | oc apply -f -
apiVersion: v1
kind: ConfigMap
metadata:
name: cluster-monitoring-config
namespace: openshift-monitoring
data:
config.yaml: |
prometheusK8s:
retention: 2d
EOF

=retention elasticsearch=
Edit the ClusterLogging CR to add or modify the retentionPolicy parameter:
apiVersion: "logging.openshift.io/v1"
kind: "ClusterLogging"
...
spec:
managementState: "Managed"
logStore:
type: "elasticsearch"
retentionPolicy:
application:
maxAge: 1d
infra:
maxAge: 7d
audit:
maxAge: 7d
elasticsearch:
nodeCount: 3
...

=retention prometheus=
Prometheus retention. https://docs.openshift.com/container-platform/4.10/monitoring/configuring-the-monitoring-stack.html#modifying-retention-time-for-prometheus-metrics-data_configuring-the-monitoring-stack
oc edit configmap cluster-monitoring-config -n openshift-monitoring
# Enable prometheus.
cat <<EOF | oc apply -f -
apiVersion: v1
kind: ConfigMap
metadata:
name: cluster-monitoring-config
namespace: openshift-monitoring
data:
config.yaml: |
prometheusK8s:
retention: 2d
EOF
=retention prometheus default=
oc get Prometheus k8s -n openshift-monitoring -o json | jq -r .spec.retention
oc -n openshift-monitoring exec -c prometheus prometheus-k8s-0 -- curl -s "http://localhost:9090/api/v1/status/runtimeinfo" | jq -r '.data.storageRetention'

=EFK(elk)=
ElasticSearch
# Fluentd
processing pipeline
# Kibana.
https://kibana-openshift-logging.apps.<url>

=grafana=
# grafana
https://grafana-openshift-monitoring.apps.<url>
=pull secret=
Get pull secret
<pre>
oc get secret/pull-secret -n openshift-config -o jsonpath='{.data.\.dockerconfigjson}' | base64 -d | jq .
oc get secret/pull-secret -n openshift-config --template='Template:Index .data ".dockerconfigjson"' -o json | jq .
oc get secret/pull-secret -n openshift-config --template='{{index .data ".dockerconfigjson" | base64decode}}' -o json | jq .
</pre>
Just the keys.
oc get secret/pull-secret -n openshift-config --template='Template:Index .data ".dockerconfigjson"' -o json | jq -r '.data.".dockerconfigjson"' | base64 -d | jq .
Name of each key and email.
oc get secret/pull-secret -n openshift-config --template='Template:Index .data ".dockerconfigjson"' -o json | jq -r '.data.".dockerconfigjson"' | base64 -d | jq -r '.auths | with_entries(.value = .value.email)' | sed 's/{//g;s/}//g;s/"//g' | grep -v '^$' | sed 's/ *//g' | sort
Download pull secret.
<pre>
oc get secret/pull-secret -n openshift-config --template='{{index .data ".dockerconfigjson" | base64decode}}' > /tmp/pull_secret.$(oc whoami --show-console=true | awk -F / '{print $3}').$(date '+%Y-%m-%d_%H-%M-%S')
</pre>
Set pull secret.
oc set data secret/pull-secret -n openshift-config --from-file=.dockerconfigjson=/tmp/pull_secret_<file_name>
==has pull secret been update==
<pre>
echo '#' pull-secret ; oc get secret/pull-secret -n openshift-config --template='{{index .data ".dockerconfigjson" | base64decode}}' | jq -r '.auths[].email'
echo '#' apiserver ; oc exec deployment/apiserver -n openshift-apiserver -c openshift-apiserver -- cat /var/lib/kubelet/config.json | jq
echo '#' nodes ; oc get nodes -o name | xargs -I {} oc debug {} -- chroot /host sh -c 'cat /var/lib/kubelet/config.json | jq'
</pre>

==Does pull secret work==
jq . /tmp/pull_secret.2024-01-10_12-00-01.registry.redhat.io
{
"auths": {
"registry.redhat.io": {
"auth": "YmxhYmxh"
}
}
}
podman pull --authfile /tmp/pull_secret.2024-01-10_12-00-01.registry.redhat.io registry.redhat.io/ubi8/ubi:latest
==Which pull secret does machineconfig contain==
oc get mc 00-master -o json | jq -r '.spec.config.storage.files[]|select(.path=="/var/lib/kubelet/config.json")|.contents.source' | perl -pe 's/%([0-9a-f]{2})/sprintf("%s", pack("H2",$1))/eig' | sed 's/^data:,//g' | jq .
==Is pull secret correct in machineconfigpool. Rendered config==
oc get mc rendered-master-3626460c7752fc1605e94c19b7a9aba7 -o json | jq -r '.spec.config.storage.files[]|select(.path=="/var/lib/kubelet/config.json")|.contents.source' | sed 's/^data:,//g' | perl -pe 's/%([0-9a-f]{2})/sprintf("%s", pack("H2",$1))/eig'| jq .

=change number of nodes=
oc get machineset -n openshift-machine-api
oc edit machineset -n openshift-machine-api <MachineSet>
=Elasticsearch status=
oc exec -n openshift-logging -c elasticsearch $(oc get pods -n openshift-logging -l component=elasticsearch -o custom-columns=:.metadata.name --no-headers | head -1) -- es_util --query=_cat/health?v
oc exec -n openshift-logging -c elasticsearch $(oc get pods -n openshift-logging -l component=elasticsearch -o custom-columns=:.metadata.name --no-headers | head -1) -- es_util --query=_cluster/health?pretty

=talk to elasticsearch=
oc rsh elasticsearch-cdm-q8apadpa-1-65f99d99b4-8b9wg
curl -s --key /etc/elasticsearch/secret/admin-key --cert /etc/elasticsearch/secret/admin-cert --cacert /etc/elasticsearch/secret/admin-ca https://localhost:9200
Oneliner
oc exec -n openshift-logging -c elasticsearch $(oc get pods -l component=elasticsearch -o custom-columns=:.metadata.name --no-headers -n openshift-logging | head -1) -- curl -s --key /etc/elasticsearch/secret/admin-key --cert /etc/elasticsearch/secret/admin-cert --cacert /etc/elasticsearch/secret/admin-ca https://localhost:9200
=Free disk space/reclaim=
oc exec -n openshift-logging -c elasticsearch $(oc get pods -l component=elasticsearch -o custom-columns=:.metadata.name --no-headers -n openshift-logging | head -1) -- curl -s --key /etc/elasticsearch/secret/admin-key --cert /etc/elasticsearch/secret/admin-cert --cacert /etc/elasticsearch/secret/admin-ca "https://localhost:9200/_forcemerge?only_expunge_deletes=true" -X POST

=which version of elasticsearch operator is installed=
oc get csv -n openshift-operators-redhat -l operators.coreos.com/elasticsearch-operator.openshift-operators-redhat="" -o=custom-columns='VERSION:.spec.version' --no-headers
==list nodes==
oc exec -c elasticsearch $(oc get pods -l component=elasticsearch -o custom-columns=:.metadata.name --no-headers | tail -1) -- es_util --query="_cat/nodes?v"
==Who is master node==
oc exec -c elasticsearch $(oc get pods -l component=elasticsearch -o custom-columns=:.metadata.name --no-headers | tail -1) -- es_util --query="_cat/master?v"
==Is cluster recovering==
oc exec -c elasticsearch $(oc get pods -l component=elasticsearch -o custom-columns=:.metadata.name --no-headers | tail -1) -- es_util --query="_cat/recovery?active_only=true"
==Look at all indices==
oc exec -n openshift-logging -c elasticsearch $(oc get pods -n openshift-logging -l component=elasticsearch -o custom-columns=:.metadata.name --no-headers | tail -1) -- es_util --query=_cat/indices?v

export INDICE=<indice> ; oc exec -n openshift-logging -c elasticsearch $(oc get pods -n openshift-logging -l component=elasticsearch -o custom-columns=:.metadata.name --no-headers | tail -1) -- es_util --query=$INDICE -XDELETE

=look at chards=
oc exec -c elasticsearch $(oc get pods -l component=elasticsearch -o custom-columns=:.metadata.name --no-headers | tail -1) -- es_util --query=_cat/indices?v
=Create audit index=
oc exec -n openshift-logging -c elasticsearch $(oc get pods -n openshift-logging -l component=elasticsearch -o custom-columns=:.metadata.name --no-headers | head -1) -- es_util --query=audit-000001 -XPUT
==Remove all red indices.==
oc exec -c elasticsearch $(oc get pods -l component=elasticsearch -o custom-columns=:.metadata.name --no-headers | tail -1) -- es_util --query=_cat/indices?v | grep ^red | awk '{print $3}' | while read i ; do echo '*' $i ; oc exec -c elasticsearch $(oc get pods -l component=elasticsearch -o custom-columns=:.metadata.name --no-headers | tail -1) -- es_util --query=${i} -X DELETE ; done
==recreate elasticsearch pvc:s==
# scale down elasticsearch to 0 pods to be able to remove pvc:s
oc get deployment -l component=elasticsearch -o custom-columns=NAME:.metadata.name --no-headers -n openshift-logging | while read DEPLOYMENT ; do echo '*' $DEPLOYMENT ; oc scale deployment $DEPLOYMENT --replicas 0 ; done
# Remove pvc:s.
oc delete pvc -l logging-cluster=elasticsearch -n openshift-logging
# scale up elasticsearch to 0 pods to be able to remove pvc:s
oc get deployment -l component=elasticsearch -o custom-columns=NAME:.metadata.name --no-headers -n openshift-logging | while read DEPLOYMENT ; do echo '*' $DEPLOYMENT ; oc scale deployment $DEPLOYMENT --replicas 1 ; done

=vsphere creds=
oc get -n kube-system cm/cluster-config-v1 -o yaml
=does vsphere account have expected permissions=
oc logs -n openshift-cluster-storage-operator -l name=vsphere-problem-detector-operator --timestamps --tail=100 | less

=Enable openshift/okd logging=
==Enable redhat-operators==
oc patch OperatorHub cluster --type json -p '[{"op": "add", "path": "/spec/disableAllDefaultSources", "value": false}]'
Or edit individual operator.
oc edit operatorhubs
Spec:
Disable All Default Sources: true
Sources:
Disabled: false
Name: community-operators
Disabled: false
Name: redhat-operators
Or patch OperatorHub for individual operators
oc patch operatorhub cluster --type='json' -p='[{"op": "add", "path": "/spec/sources/-", "value":{"name":"redhat-operators","disabled":false}}]'

==Create namespace==
cat <<EOF | oc apply -f -
apiVersion: v1
kind: Namespace
metadata:
name: openshift-operators-redhat
annotations:
openshift.io/node-selector: ""
labels:
openshift.io/cluster-monitoring: "true"
EOF
==Create namespace==
cat <<EOF | oc apply -f -
apiVersion: v1
kind: Namespace
metadata:
name: openshift-logging
annotations:
openshift.io/node-selector: ""
labels:
openshift.io/cluster-monitoring: "true"
EOF
==Create operatorgroup==
cat <<EOF | oc apply -f -
apiVersion: operators.coreos.com/v1
kind: OperatorGroup
metadata:
name: openshift-operators-redhat
namespace: openshift-operators-redhat
spec: {}
EOF
==Subscribe to OpenShift Elasticsearch Operator==
cat <<EOF | oc apply -f -
apiVersion: operators.coreos.com/v1alpha1
kind: Subscription
metadata:
name: "elasticsearch-operator"
namespace: "openshift-operators-redhat"
spec:
channel: "stable"
installPlanApproval: "Automatic"
source: "redhat-operators"
sourceNamespace: "openshift-marketplace"
name: "elasticsearch-operator"
EOF
==Install the openshift logging operator.==
cat <<EOF | oc apply -f -
apiVersion: operators.coreos.com/v1
kind: OperatorGroup
metadata:
name: cluster-logging
namespace: openshift-logging
spec:
targetNamespaces:
- openshift-logging
EOF
==Create a subscription object yaml file.==
cat <<EOF | oc apply -f -
apiVersion: operators.coreos.com/v1alpha1
kind: Subscription
metadata:
name: cluster-logging
namespace: openshift-logging
spec:
channel: "stable"
name: cluster-logging
source: redhat-operators
sourceNamespace: openshift-marketplace
EOF
==Create OpenShift Logging instance.==
cat <<EOF | oc apply -f -
apiVersion: "logging.openshift.io/v1"
kind: "ClusterLogging"
metadata:
name: "instance"
namespace: "openshift-logging"
spec:
managementState: "Managed"
logStore:
type: "elasticsearch"
retentionPolicy:
application:
maxAge: 1d
infra:
maxAge: 7d
audit:
maxAge: 7d
elasticsearch:
nodeCount: 3
storage:
storageClassName: "standard-csi"
size: 200G
resources:
limits:
memory: "16Gi"
requests:
memory: "16Gi"
proxy:
resources:
limits:
memory: 256Mi
requests:
memory: 256Mi
redundancyPolicy: "SingleRedundancy"
visualization:
type: "kibana"
kibana:
replicas: 1
collection:
logs:
type: "fluentd"
fluentd: {}
EOF

=telemetry=
Restart telemetry.
oc delete pod -n openshift-monitoring -l app.kubernetes.io/component=telemetry-metrics-collector
=Update vsphere/openstack creds=
oc edit cm cloud-provider-config -n openshift-config
default-datastore = "cl07-2-fc-loc-001"

=Get datastore=
oc get cm cloud-provider-config -n openshift-config -o json | jq -r .data.config | sed -nr "/^\[Workspace\]/ { :l /^default-datastore[ ]*=/ { s/[^=]*=[ ]*//; p; q;}; n; b l;}"

=Manage labels.=
Add a label to a node or pod:
oc label node node001.krenger.ch mylabel=myvalue
oc label pod mypod-34-g0f7k mylabel=myvalue
Remove a label (in the example “mylabel”) from a node or pod:
oc label node node001.krenger.ch mylabel-
oc label pod mypod-34-g0f7k mylabel-
Permanently label a node
oc edit machineset ocp-qz7hf-worker-us-west-1b -n openshift-machine-api
=rollout=
Restart pod in an deployment
oc rollout restart deployment -n openshift-storage csi-rbdplugin-provisioner
=api.<URL>=
openssl_x509_multi_line <(oc get secrets external-loadbalancer-serving-certkey -n openshift-kube-apiserver -o json | jq -r '.data."tls.crt"|@base64d')
=ssl certificates replace=
How to replace api.<url> and star.apps.<url> certs.
# api. Create full chain cert. Public - intermediate - root ca.
api.<url>.crt
api.<url>.key
# create secret
oc delete secret api-cert -n openshift-config
oc create secret tls api-cert --cert=api.<url>.crt --key=api.<url>.key -n openshift-config
# patch apiserver
oc patch apiserver cluster --type=merge -p '{"spec":{"servingCerts": {"namedCertificates": [{"names": ["api.<url>"], "servingCertificate": {"name": "api-cert"}}]}}}'
...
# star.apps. Create full chain cert. Public - intermediate - root ca.
star.apps.<url>.crt
star.apps.<url>.key
# create secret
oc delete secret custom-certs-default -n openshift-ingress
oc create secret tls custom-certs-default --cert=star.apps.<url>.crt --key=star.apps.<url>.key -n openshift-ingress
# patch ingress controller
oc patch --type=merge --namespace openshift-ingress-operator ingresscontrollers/default --patch '{"spec":{"defaultCertificate":{"name":"custom-certs-default"}}}'
==edit serving certs==
look at api cert
oc get secret -n openshift-config $(oc get apiservers cluster -o json | jq -r '.spec.servingCerts.namedCertificates[].servingCertificate.name') -o json | jq -r '.data."tls.crt"' | base64 -d
Patch secret api cert
oc patch secret -n openshift-config $(oc get apiservers cluster -o json | jq -r '.spec.servingCerts.namedCertificates[].servingCertificate.name') -p '{"data":{"tls.crt": "<new-base64-encoded-certificate>"}}'
Look at ingress cert. wildcard.apps.<url>
oc get secret -n openshift-ingress $(oc get -n openshift-ingress-operator ingresscontrollers default -o json | jq -r .spec.defaultCertificate.name) -o json | jq -r '.data."tls.crt"' | base64 -d
Patch secret ingress wildcard.apps.<url>
oc patch secret -n openshift-ingress $(oc get -n openshift-ingress-operator ingresscontrollers default -o json | jq -r .spec.defaultCertificate.name) -p '{"data":{"tls.crt": "<new-base64-encoded-certificate>"}}'

=After you update above certificates then the following config map is updated to reflect that=
openssl_x509_multi_line <(oc get cm kube-root-ca.crt -o json | jq -r '.data."ca.crt"')
=get cluster-id=
oc get clusterversion/version -o jsonpath="{.spec.clusterID}"

=api=
Process running api server. They scale horizontally. They all serve requests.
openshift-kube-apiserver
kube-apiserver
=kube-proxy=
kube-proxy is a network proxy that runs on each node in your cluster, implementing part of the Kubernetes Service concept.
kube-proxy maintains network rules on nodes. These network rules allow network communication to your Pods from network sessions inside or outside of your cluster.
kube-proxy uses the operating system packet filtering layer if there is one and it's available. Otherwise, kube-proxy forwards the traffic itself.
=Resource Allocation=
OS and Kubernetes overhead. You can see the reserved OS & Kubernetes overhead by comparing the Allocatable (what the Kubernetes Scheduler can allocate to Pods) and the Capacity.
Capacity:
->cpu: 4
ephemeral-storage: 125293548Ki
hugepages-1Gi: 0
hugepages-2Mi: 0
->memory: 16409360Ki
pods: 250
Allocatable:
->cpu: 3500m
ephemeral-storage: 114396791822
hugepages-1Gi: 0
hugepages-2Mi: 0
->memory: 15258384Ki
pods: 250
==requests/limits==
User pod allocation is calculated by looking at the “Requests” resource columns from the kubectl get nodes output.
The relevant columns here are the “Requests, not Limits.
Requests impact how the pod is scheduled, and what resources are allocated to it,
whereas limits are used to enable pods to burst beyond their allocation.
==look at current Allocated resources==
oc get nodes --no-headers --selector="node-role.kubernetes.io/worker" -o=custom-columns='NAME:.metadata.name' | while read NODE ; do oc describe node $NODE | grep "Allocated resources:" -A10 | grep -E ' cpu | memory ' | while read RESOURCE ; do echo $NODE $RESOURCE ; done ; done

==empty space==
Allocatable - Allocated resources = empty
Allocatable:
cpu: 3500m
ephemeral-storage: 114396791822
hugepages-1Gi: 0
hugepages-2Mi: 0
memory: 15258384Ki
pods: 250
...
Allocated resources:
(Total limits may be over 100 percent, i.e., overcommitted.)
Resource Requests Limits
-------- -------- ------
cpu 834m (23%) 0 (0%)
memory 2474Mi (16%) 736Mi (4%)
ephemeral-storage 0 (0%) 0 (0%)
hugepages-1Gi 0 (0%) 0 (0%)
hugepages-2Mi 0 (0%) 0 (0%)
=status of namespace=
Show an overview of the current project
oc status
=age of cluster=
Looking at age of machines.
oc get nodes -o json | jq -r '.items[].metadata.creationTimestamp' | sort -n | sed 's/T/ /g;s/Z//g'
=oc adm inspect=
oc adm inspect namespace/isilon
tar cf /tmp/inspect.isilon.$(date_file ) inspect.local.*
=Operations Lifecycle manager(olm)=
oc logs -l app=olm-operator -n openshift-operator-lifecycle-manager --tail=-1
=Reinstall operator that is no longer available with current openshift version=
# Force install odf which is not possible to install because openshift has moved more than 1 version.
# Save subscription
for i in operators.coreos.com/mcg-operator.openshift-storage= operators.coreos.com/ocs-operator.openshift-storage= operators.coreos.com/odf-csi-addons-operator.openshift-storage= operators.coreos.com/odf-operator.openshift-storage= ; do
oc get subscription -o yaml -l $i > oc_get_subscription_${i//\//_}.yaml ; done
...
# Save operators
for i in operators.coreos.com/odf-operator.openshift-storage= operators.coreos.com/ocs-operator.openshift-storage= operators.coreos.com/mcg-operator.openshift-storage= operators.coreos.com/odf-csi-addons-operator.openshift-storage= ; do
oc get csv -l $i -o yaml > oc_get_csv_-l_${i//\//_}.yaml ; done
...
# Confirm backup files contain usable yaml. Have we forgotten any operators or csv:s. Remove resources clearly not related to odf.
...
# delete the existing ODF related subscriptions and the ClusterServiceVersions related:
for i in operators.coreos.com/mcg-operator.openshift-storage= operators.coreos.com/ocs-operator.openshift-storage= operators.coreos.com/odf-csi-addons-operator.openshift-storage= operators.coreos.com/odf-operator.openshift-storage= ; do
oc delete subscription -l $i; done
for i in operators.coreos.com/odf-operator.openshift-storage= operators.coreos.com/ocs-operator.openshift-storage= operators.coreos.com/mcg-operator.openshift-storage= operators.coreos.com/odf-csi-addons-operator.openshift-storage= ; do
oc delete csv -l $i ; done
...
# Make sure you wait for the CSVs to be deleted before creating a subscription again.
...
# create only the the Subscription again:
# (optional: edit the subscription before recreate, changing the channel version to the goal version)
...
# Recreate subscription
oc create -f 'oc_get_subscription_operators.coreos.com_odf-operator.openshift-storage=.yaml'
# wait watching the events:
oc get events -w

=increase disk on node=
Update worker machineset.
oc patch machinesets -n openshift-machine-api $(oc get machinesets -n openshift-machine-api -o json | jq -r '.items[] | select(.spec.template.metadata.labels."machine.openshift.io/cluster-api-machine-role" == "worker")| .metadata.name') --type merge -p '{"spec": {"template": {"spec": {"providerSpec": {"value": {"rootVolume": {"diskSize" : 50}}}}}}}'
==View results from above==
oc get machinesets -n openshift-machine-api $(oc get machinesets -n openshift-machine-api -o json | jq -r '.items[] | select(.spec.template.metadata.labels."machine.openshift.io/cluster-api-machine-role" == "worker")| .metadata.name') -o yaml | tee /tmp/$(oc get DNS cluster -o=jsonpath='{.spec.baseDomain}').$(date +%F_%H-%M-%S).yaml

==Update on node only==
VOLUME=abjorklund-01-h4sxm-worker-0-rkk87-root
os volume set --size 40 $VOLUME --os-volume-api-version 3.42
dnf install cloud-utils-growpart xfsprogs
ssh core@worker
growpart /dev/sda 4
xfs_growfs /

=increase ram on worker nodes=
oc patch machinesets -n openshift-machine-api $(oc get machinesets -n openshift-machine-api -o json | jq -r '.items[] | select(.spec.template.metadata.labels."machine.openshift.io/cluster-api-machine-role" == "worker")| .metadata.name') --type merge -p '{"spec": {"template": {"spec": {"providerSpec": {"value": {"memoryMiB" : 24576}}}}}}'
=Change flavor of worker node=
oc patch machinesets -n openshift-machine-api $(oc get machinesets -n openshift-machine-api -o json | jq -r '.items[] | select(.spec.template.metadata.labels."machine.openshift.io/cluster-api-machine-role" == "worker")| .metadata.name') --type merge -p '{"spec": {"template": {"spec": {"providerSpec": {"value": {"flavor" : "hm.4x16"}}}}}}'

=set number of worker nodes=
oc patch machinesets -n openshift-machine-api $(oc get machinesets -n openshift-machine-api -o json | jq -r '.items[] | select(.spec.template.metadata.labels."machine.openshift.io/cluster-api-machine-role" == "worker")| .metadata.name') --type merge -p '{"spec": {"replicas" : 2}}'

=clusteroperator=
ClusterOperator is the Custom Resource object which holds the current state of an operator. Clusteroperator is resposible for core, systemwide functions like dns and so on.
oc get clusteroperators
oc get co
oc get clusteroperators -o custom-columns=NAME:.metadata.name,ANNOTATIONS:.metadata.annotations

=ignition=
Retrieve rendered ignition data.
curl https://api-int.$(grep ^search /etc/resolv.conf | awk '{print $NF}'):22623/config/master
curl -v https://api-int.$(grep ^search /etc/resolv.conf | awk '{print $2}'):22623/config/worker

=rockylinux container names=
ubi ("Standard"): OpenSSL, microdnf, and utilities like gzip and vi
ubi-minimal ("Minimal"): Minimized binaries and minimal yum stack.
ubi-init ("Multi-service"): Less than standard but more than minimal, plus systemd.
ubi-micro ("Micro"): Most minimal image without even a package manager.
=create a job/pod/script=

==Create config map of script==
Notice that I have to escape $. Since I give date in a here document. Where $ is being expanded.
cat <<EOF | oc apply -f -
apiVersion: v1
kind: ConfigMap
metadata:
name: dns-lookup.sh
data:
dns-lookup.sh: |
#!/bin/bash
# Verify if dns resolution works and how fast.
while true ; do
for DNS in \$(awk '/^nameserver / {print \$2}' /etc/resolv.conf) 10.2.0.10 ; do
echo \$(date '+%F %H:%M:%S %Z') \$DNS \$(host -v -t A ibm.se 2>&1 | tail -3 )
done
sleep 5
done
EOF

==create job==
cat <<EOF | oc apply -f -
apiVersion: batch/v1
kind: Job
metadata:
name: dns-lookup
spec:
template:
spec:
containers:
- name: dns-lookup
# image: rockylinux/rockylinux:9
image: halfface/rockylinux-toolbox:v2
command: ["/script/dns-lookup.sh"]
volumeMounts:
- name: script
mountPath: "/script"
# securityContext:
# runAsUser: 0
# privileged: true
volumes:
- name: script
configMap:
name: dns-lookup.sh
defaultMode: 0755
restartPolicy: Never
activeDeadlineSeconds: 1209600
EOF

=terminal fix=
No line wraps
tput rmam
=list operatorhub/catalogsources=
oc get catalogsources -n openshift-marketplace
oc get catalogsources -n openshift-marketplace -o custom-columns=NAME:.metadata.name,DISPLAY:.spec.displayName,STATE:.status.connectionState.lastObservedState,TYPE:.spec.sourceType,PUBLISHER:.spec.publisher,IMAGE:.spec.image

=remove catalogsources=
oc get catalogsources.operators.coreos.com -n openshift-marketplace -l company=cambio --no-headers -o custom-columns=:.metadata.name | while read i ; do echo oc get catalogsources $i -n openshift-marketplace -o yaml \>oc_get_catalogsources.$(oc_api_url).$i.$(date_file).yaml ; echo oc delete catalogsource -n openshift-marketplace $i ; done

=which changes will occure=
. /etc/node-sizing-enabled.env ; NODE_SIZES_ENV=/tmp/node-sizing.env /usr/local/sbin/dynamic-system-reserved-calc.sh true ${SYSTEM_RESERVED_MEMORY} ${SYSTEM_RESERVED_CPU} ${SYSTEM_RESERVED_ES} ; sdiff /etc/node-sizing.env /tmp/node-sizing.env
=SYSTEM_RESERVED=
cat <<EOF | oc apply -f -
apiVersion: machineconfiguration.openshift.io/v1
kind: KubeletConfig
metadata:
name: dynamic-node
spec:
autoSizingReserved: true
machineConfigPoolSelector:
matchLabels:
pools.operator.machineconfiguration.openshift.io/worker: ""
EOF

Which changes will occur.
oc get nodes -o name | xargs -I {} oc debug {} -- chroot /host sh -c 'hostname ; . /etc/node-sizing-enabled.env ; NODE_SIZES_ENV=/tmp/node-sizing.env /usr/local/sbin/dynamic-system-reserved-calc.sh true ${SYSTEM_RESERVED_MEMORY} ${SYSTEM_RESERVED_CPU} ${SYSTEM_RESERVED_ES} ; sdiff /etc/node-sizing.env /tmp/node-sizing.env' 2>/dev/null
==which processes is it complaining about==
systemd-cgls /system.slice | grep -o '[^─]*\.service' | cat -v | sed 's/^\^\[\[0m//g' | while read i ; do echo -e "$(systemctl show -p MemoryCurrent $i | awk -F = '{print $2}')\t$i" ; done | column -t -s $'\t' | sort -n

=CNI=
oc get networks cluster -o 'custom-columns=NETWORKTYPE:.spec.networkType'
Cni from install
echo -e "$(oc --request-timeout=5 get -n kube-system cm/cluster-config-v1 -o json | jq -r '."data"."install-config"')" | python -c 'import sys, yaml, json; json.dump(yaml.safe_load(sys.stdin), sys.stdout, indent=4)' | jq -r .networking.networkType
=autoscale.=
https://docs.openshift.com/container-platform/4.12/machine_management/applying-autoscaling.html
==ClusterAutoscaler==
# The two below has to be configured.
apiVersion: autoscaling.openshift.io/v1
kind: ClusterAutoscaler
metadata:
name: default
spec:
logVerbosity: 4
podPriorityThreshold: -10
resourceLimits:
cores:
max: 128
min: 0
maxNodesTotal: 24
memory:
max: 256
min: 0
scaleDown:
delayAfterAdd: 10m
delayAfterDelete: 5m
delayAfterFailure: 30s
enabled: true
unneededTime: 5m
utilizationThreshold: "0.4"
==MachineAutoscaler==
apiVersion: autoscaling.openshift.io/v1beta1
kind: MachineAutoscaler
metadata:
name: abjorklund-01-4rp8x-worker-1
namespace: openshift-machine-api
spec:
maxReplicas: 12
minReplicas: 0
scaleTargetRef:
apiVersion: machine.openshift.io/v1beta1
kind: MachineSet
name: abjorklund-01-4rp8x-worker-1
==Machineset example where machine is labeled and tainted.==
apiVersion: machine.openshift.io/v1beta1
kind: MachineSet
metadata:
annotations:
autoscaling.openshift.io/machineautoscaler: openshift-machine-api/abjorklund-01-4rp8x-worker-1
capacity.cluster-autoscaler.kubernetes.io/cpu: "4"
capacity.cluster-autoscaler.kubernetes.io/memory: "17179869184"
machine.openshift.io/cluster-api-autoscaler-node-group-max-size: "12"
machine.openshift.io/cluster-api-autoscaler-node-group-min-size: "0"
machine.openshift.io/memoryMb: "16384"
machine.openshift.io/vCPU: "4"
labels:
machine.openshift.io/cluster-api-cluster: abjorklund-01-4rp8x
machine.openshift.io/cluster-api-machine-role: worker
machine.openshift.io/cluster-api-machine-type: worker
name: abjorklund-01-4rp8x-worker-1
namespace: openshift-machine-api
spec:
replicas: 0
selector:
matchLabels:
machine.openshift.io/cluster-api-cluster: abjorklund-01-4rp8x
machine.openshift.io/cluster-api-machineset: abjorklund-01-4rp8x-worker-1
template:
metadata:
labels:
machine.openshift.io/cluster-api-cluster: abjorklund-01-4rp8x
machine.openshift.io/cluster-api-machine-role: worker
machine.openshift.io/cluster-api-machine-type: worker
machine.openshift.io/cluster-api-machineset: abjorklund-01-4rp8x-worker-1
spec:
metadata:
labels:
stress: stress
providerSpec:
value:
apiVersion: machine.openshift.io/v1alpha1
cloudName: openstack
cloudsSecret:
name: openstack-cloud-credentials
namespace: openshift-machine-api
flavor: hm.4x16
image: ""
kind: OpenstackProviderSpec
metadata:
creationTimestamp: null
networks:
- subnets:
- filter:
name: abjorklund-01-4rp8x-nodes
tags: openshiftClusterID=abjorklund-01-4rp8x
rootVolume:
diskSize: 64
sourceUUID: abjorklund-01-4rp8x-rhcos
volumeType: ssd
securityGroups:
- name: abjorklund-01-4rp8x-worker
- uuid: 1de812c6-ed8b-4212-a486-ca283dbe1444
serverGroupName: abjorklund-01-4rp8x-worker-1
serverMetadata:
Name: abjorklund-01-4rp8x-worker
openshiftClusterID: abjorklund-01-4rp8x
tags:
- openshiftClusterID=abjorklund-01-4rp8x
userDataSecret:
name: worker-user-data
taints:
- effect: NoExecute
key: stress
value: stress

==autoscaler does not scale down==
oc logs -l cluster-autoscaler=default -n openshift-machine-api --tail=-1 --timestamps=true
==Add dynamic load to cluster. deployment==
apiVersion: apps/v1
kind: Deployment
metadata:
annotations:
deployment.kubernetes.io/revision: "7"
labels:
app: stress
name: stress
namespace: stress
spec:
progressDeadlineSeconds: 600
replicas: 0
revisionHistoryLimit: 10
selector:
matchLabels:
app: stress
strategy:
rollingUpdate:
maxSurge: 25%
maxUnavailable: 25%
type: RollingUpdate
template:
metadata:
annotations:
kubectl.kubernetes.io/restartedAt: "2025-01-24T09:52:22+01:00"
creationTimestamp: null
labels:
app: stress
spec:
containers:
- command:
- /mnt/bin/stress.sh
image: halfface/rockylinux-toolbox:v3
imagePullPolicy: IfNotPresent
livenessProbe:
exec:
command:
- bash
- -c
- ps uxawww | grep -q [s]tress && echo 0 || echo 1
failureThreshold: 3
periodSeconds: 10
successThreshold: 1
timeoutSeconds: 1
name: stress
resources:
requests:
cpu: 700m
memory: 300Mi
terminationMessagePath: /dev/termination-log
terminationMessagePolicy: File
volumeMounts:
- mountPath: /mnt/bin/
name: stress
dnsPolicy: ClusterFirst
nodeSelector:
stress: stress
restartPolicy: Always
schedulerName: default-scheduler
terminationGracePeriodSeconds: 30
tolerations:
- effect: NoExecute
key: stress
value: stress
volumes:
- configMap:
defaultMode: 493
name: stress.sh
name: stress
==configmap==
apiVersion: v1
data:
stress.sh: |
#!/bin/bash
# stress pod.
while true ; do
echo $(date '+%F %H:%M:%S %Z') $( stress -m 1 --vm-bytes 1000M --vm-keep -t 300s )
sleep 5
done
kind: ConfigMap
metadata:
name: stress.sh
namespace: stress

=change dns server for domain=
oc edit dns.operator/default
apiVersion: operator.openshift.io/v1
kind: DNS
metadata:
name: default
spec:
servers:
- name: halffce-server
zones:
- halfface.se
forwardPlugin:
policy: Random
upstreams: 10.111.222.2
# View config.
oc get configmap/dns-default -n openshift-dns -o yaml

=coredns=
# tail logs.
oc get events -A --sort-by=.metadata.creationTimestamp
# Change debug level.
oc patch dnses.operator.openshift.io/default -p '{"spec":{"logLevel":"Debug"}}' --type=merge
Sets
log . {
class denial error
}
oc patch dnses.operator.openshift.io/default -p '{"spec":{"logLevel":"Trace"}}' --type=merge
Sets
log . {
class all
}
oc patch dnses.operator.openshift.io/default -p '{"spec":{"logLevel":"Normal"}}' --type=merge
Sets
log . {
class error
}
==Get log files for analyze==
oc get pods -l dns.operator.openshift.io/daemonset-dns=default -o custom-columns=POD:.metadata.name,NODE:.spec.nodeName --no-headers -n openshift-dns | while read i j ; do oc logs $i --tail=-1 -c dns --timestamps=true -n openshift-dns > /tmp/oc_logs_$j.$i.$(oc get DNS cluster -o=jsonpath='{.spec.baseDomain}').$(date +%F_%H-%M-%S) ; done

=get instance dns name=
oc get DNS cluster -o=jsonpath='{.spec.baseDomain}'
=Read values provided by coredns /metrics=
oc exec -it -n openshift-dns $(oc get pods -l dns.operator.openshift.io/daemonset-dns=default --no-headers -n openshift-dns| head -1) -- curl -s http://localhost:9153/metrics
=coredns default logformat=
# Default format
{remote}:{port} - {>id} "{type} {class} {name} {proto} {size} {>do} {>bufsize}" {rcode} {>rflags} {rsize} {duration}
# Values explained
{port}: client’s port
{remote}: client’s IP address, for IPv6 addresses these are enclosed in brackets: [::1]
{>id}: query ID
{type}: qtype of the request
{class}: qclass of the request
{name}: qname of the request
{proto}: protocol used (tcp or udp)
{size}: request size in bytes
{>do}: is the EDNS0 DO (DNSSEC OK) bit set in the query
{>bufsize}: the EDNS0 buffer size advertised in the query
{rcode}: response RCODE
{>rflags}: response flags, each set flag will be displayed, e.g. “aa, tc”. This includes the qr bit as well
{rsize}: raw (uncompressed), response size (a client may receive a smaller response)
{duration}: response duration
=Confirm that coredns hosts are possible to resolve=
<pre>
grep match /etc/coredns/Corefile | uniq | sed 's/\[//g;s/\]//g;s/^ *match //g;s/\.\*/test/g;s/^\^//g' | while read i ; do echo $(dig +short ${i}.) ${i}. ; done
</pre>

=Create lets encrypt certificates on dns domain in route53 which is managed by certmanager.=
#Create a domain in route 53.
#Create a user with a token for "Application running outside AWS"
==Fill in below values to be able to update config below.==
Hosted_Zone_id: <Hosted_Zone_id>
Access_key: <Access_key>
Secret_access_key: <Secret_access_key>
DNS_Domain: <DNS_Domain>
DNS_shortname: <DNS_shortname>
==Attach the following policy to your newly created user.==
(Populate all <Values> below.)
{
"Version": "2023-11-22",
"Statement": [
{
"Effect": "Allow",
"Action": "route53:GetChange",
"Resource": "arn:aws:route53:::change/*"
},
{
"Effect": "Allow",
"Action": "route53:ChangeResourceRecordSets",
"Resource": "arn:aws:route53:::hostedzone/<Hosted_Zone_id>"
},
{
"Effect": "Allow",
"Action": "route53:ListHostedZonesByName",
"Resource": "*"
}
]
}
==Create namespace==
oc create namespace cert-manager
==Install cert-manager community version via graphical fluff.==
==Create secret that includes <Secret_access_key>.==
oc create secret generic route53-secret --from-literal=secret-access-key="<Secret_access_key>" -n cert-manager
==Create ClusterIssuer for letsencrypt which uses route53 to show that you own dns.==
cat <<EOF | oc apply -f -
apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
name: letsencrypt-prod-dns
namespace: cert-manager
spec:
acme:
server: https://acme-v02.api.letsencrypt.org/directory
email: support@company.se
# Name of a secret used to store the ACME account private key
privateKeySecretRef:
name: <DNS_shortname>-issuer-account-key
solvers:
- selector:
dnsZones:
- "<DNS_Domain>"
dns01:
route53:
accessKeyID: <Access_key>
secretAccessKeySecretRef:
name: route53-secret
key: secret-access-key
hostedZoneID: <Hosted_Zone_id>
region: 'us-east-1'
EOF

==Create api certificate.==
cat <<EOF | oc apply -f -
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
name: cert-api
namespace: openshift-config
spec:
issuerRef:
name: letsencrypt-prod-dns
kind: ClusterIssuer
dnsNames:
- "api.<DNS_Domain>"
secretName: le-api-cert
commonName: "api.<DNS_Domain>"
EOF
==Start to use api certificate.==
oc patch apiserver cluster --type=merge -p '{"spec":{"servingCerts": {"namedCertificates": [{"names": ["api.<DNS_Domain>"], "servingCertificate": {"name": "le-api-cert"}}]}}}'

==Create ingress certificate==
cat <<EOF | oc apply -f -
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
name: le-wildcard-apps-certificate
namespace: openshift-ingress
spec:
issuerRef:
name: letsencrypt-prod-dns
kind: ClusterIssuer
dnsNames:
- "*.apps.<DNS_Domain>"
secretName: le-wildcard-apps-certificate
commonName: "*.apps.<DNS_Domain>"
EOF
==Start to use ingress certificate.==
oc patch --type=merge --namespace openshift-ingress-operator ingresscontrollers/default --patch '{"spec":{"defaultCertificate":{"name":"le-wildcard-apps-certificate"}}}'
=resolv.conf=
ndots 5. This means that the DNS client will automatically consider a domain name to be fully qualified (which will allow it to skip the search path iteration) if it has five or more dots.
=bind to external login sources ldap ad=
oc get authentications.operator.openshift.io cluster -o yaml
=get machine name and creation time=
oc get machines -o=custom-columns='NAME:.metadata.name,CREATIONTIMESTAMP:.metadata.creationTimestamp,TYPE:.spec.providerSpec.value.flavor,STATUS:.status.phase' -n openshift-machine-api

=setup nfs server=
nfs export shared between pods.
==Create server==
openstack server create --flavor gp.1x2 --availability-zone europe-se-1a --image rocky-8-x86_64 --boot-from-volume 30 --network abjorklund-01-bmc7w-openshift --security-group ssh_allow --key-name abjorklund_ed25519 abjorklund_$(date_file)
openstack volume create --size 50 --type ssd --description "nfs storage block device 0" nfs_storage_abjorklund-01
openstack server add volume e93d2db1-6d95-4364-a236-0bd1b9255e90 28adbdb9-c88d-4397-9a79-b13c505016a8 --device /dev/vdb
==install nfs dependencis==
dnf -y install cloud-utils-growpart nfs-utils iptables-utils epel-release vim-enhanced
==How to grow filesystem.==
partx growpart
os volume set --size 60 nfs_storage_abjorklund-01 --os-volume-api-version 3.42
==Create partion and disk.==
gdisk /dev/sdb
mkfs.ext4 /dev/sdb1
find /dev/ -ls | grep sdb | grep by-uuid
==Mount drive. /etc/fstab==
UUID=66998126-9f18-44ce-a462-827c870a57bd /netstorage ext4 defaults 0 0
mkdir /netstorage
mount /netstorage/
mkdir /netstorage/abjorklund-01
chmod 777 /netstorage/abjorklund-01
==export drive==
systemctl enable nfs-server.service --now
/etc/exports
/netstorage/abjorklund-01 10.1.0.0/16(rw,root_squash)
exportfs -rav

==setup deployment==
# deployment.yaml
cat <<EOF | oc apply -f -
apiVersion: apps/v1
kind: Deployment
metadata:
name: nfs-client-provisioner
labels:
app: nfs-client-provisioner
# replace with namespace where provisioner is deployed
namespace: default
spec:
replicas: 1
strategy:
type: Recreate
selector:
matchLabels:
app: nfs-client-provisioner
template:
metadata:
labels:
app: nfs-client-provisioner
spec:
affinity:
nodeAffinity:
requiredDuringSchedulingIgnoredDuringExecution:
nodeSelectorTerms:
- matchExpressions:
- key: node-role.kubernetes.io/worker
operator: Exists
serviceAccountName: nfs-client-provisioner
securityContext:
supplementalGroups:
- 65534
- 1261150637
containers:
- name: nfs-client-provisioner
image: gcr.io/k8s-staging-sig-storage/nfs-subdir-external-provisioner:v4.0.0
volumeMounts:
- name: nfs-client-root
mountPath: /persistentvolumes
env:
- name: PROVISIONER_NAME
value: auto-nfs-storage
- name: NFS_SERVER
value: 10.1.0.48
- name: NFS_PATH
value: "/netstorage/abjorklund-01"
volumes:
- name: nfs-client-root
nfs:
server: 10.1.0.48
path: /netstorage/abjorklund-01
EOF
# nfs-clusterrolebinding.yaml
cat <<EOF | oc apply -f -
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: run-nfs-client-provisioner
subjects:
- kind: ServiceAccount
name: nfs-client-provisioner
# replace with namespace where provisioner is deployed
namespace: default
roleRef:
kind: ClusterRole
name: nfs-client-provisioner-runner
apiGroup: rbac.authorization.k8s.io
EOF
# nfs-clusterrole.yaml
cat <<EOF | oc apply -f -
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: nfs-client-provisioner-runner
rules:
- apiGroups: [""]
resources: ["persistentvolumes"]
verbs: ["get", "list", "watch", "create", "delete"]
- apiGroups: [""]
resources: ["persistentvolumeclaims"]
verbs: ["get", "list", "watch", "update"]
- apiGroups: ["storage.k8s.io"]
resources: ["storageclasses"]
verbs: ["get", "list", "watch"]
- apiGroups: [""]
resources: ["events"]
verbs: ["create", "update", "patch"]
EOF
# nfs-rolebinding.yaml
cat <<EOF | oc apply -f -
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: leader-locking-nfs-client-provisioner
# replace with namespace where provisioner is deployed
namespace: default
subjects:
- kind: ServiceAccount
name: nfs-client-provisioner
# replace with namespace where provisioner is deployed
namespace: default
roleRef:
kind: Role
name: leader-locking-nfs-client-provisioner
apiGroup: rbac.authorization.k8s.io
EOF
# nfs-role.yaml
cat <<EOF | oc apply -f -
kind: Role
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: leader-locking-nfs-client-provisioner
# replace with namespace where provisioner is deployed
namespace: default
rules:
- apiGroups: [""]
resources: ["endpoints"]
verbs: ["get", "list", "watch", "create", "update", "patch"]
EOF
# nfs-sa.yaml
cat <<EOF | oc apply -f -
apiVersion: v1
kind: ServiceAccount
metadata:
name: nfs-client-provisioner
# replace with namespace where provisioner is deployed
namespace: default
EOF
# storageclass.yaml
cat <<EOF | oc apply -f -
apiVersion: storage.k8s.io/v1
kind: StorageClass
metadata:
name: managed-nfs-storage
provisioner: auto-nfs-storage # or choose another name, must match deployment's env PROVISIONER_NAME'
parameters:
onDelete: delete
EOF
# test-claim.yaml
cat <<EOF | oc apply -f -
kind: PersistentVolumeClaim
apiVersion: v1
metadata:
name: test-claim
namespace: default
spec:
storageClassName: managed-nfs-storage
accessModes:
- ReadWriteMany
resources:
requests:
storage: 1Mi
EOF
=set nfs csi driver=
https://github.com/kubernetes-csi/csi-driver-nfs

=dns=
https://access.redhat.com/solutions/3804501
==confirm upstream dns works==
for UPSTREAM_DNS_IP in 10.46.201.1 10.46.201.2 10.46.201.3 ; do UPSTREAM_DNS_PORT=53 ; echo -e "\nTCP\n"; for dnspod in `oc get pods -n openshift-dns -o name --no-headers -l dns.operator.openshift.io/daemonset-dns=default`; do echo "Pod $dnspod"; oc exec -n openshift-dns -c dns $dnspod -- dig @${UPSTREAM_DNS_IP} redhat.com -p ${UPSTREAM_DNS_PORT} +tcp +short; echo; done ; done
for UPSTREAM_DNS_IP in 10.46.201.1 10.46.201.2 10.46.201.3 ; do UPSTREAM_DNS_PORT=53 ; echo -e "\nUDP\n"; for dnspod in `oc get pods -n openshift-dns -o name --no-headers -l dns.operator.openshift.io/daemonset-dns=default`; do echo "Pod $dnspod"; oc exec -n openshift-dns -c dns $dnspod -- dig @${UPSTREAM_DNS_IP} redhat.com -p ${UPSTREAM_DNS_PORT} +notcp +short; echo; done ; done

=image=
Which images are ok.
oc get image.config.openshift.io cluster -o yaml
=enable sso with keycloak=
apiVersion: config.openshift.io/v1
kind: OAuth
metadata:
annotations: {}
labels:
app.kubernetes.io/instance: sso
name: cluster
spec:
identityProviders:
- mappingMethod: add
name: SSO
openID:
claims:
email:
- email
groups:
- groups
name:
- name
preferredUsername:
- preferred_username
clientID: <Client name in keycloak>
clientSecret:
name: keycloak-client-secret
extraScopes: []
issuer: <URL to issuer>
type: OpenID
---
apiVersion: v1
data:
clientSecret: <base64 secret>
kind: Secret
metadata:
labels:
app.kubernetes.io/instance: sso
name: keycloak-client-secret
namespace: openshift-config

=keepalive/api/ingress=
On nodes where nodes server the same ip for api or ingress.
oc get nodes -o name | xargs -I {} oc debug {} -- chroot /host sh -c 'echo "# unicast_peer" > /etc/keepalived/keepalived.conf'
Get info about where ingress is running.
oc get nodes -o name | xargs -I {} oc debug {} -- chroot /host sh -c 'ip a' 2>&1 | tee /tmp/tmp ; grep $(host $(oc whoami --show-server | awk -F ':|/' '{print $4}') | awk '{print $NF}') /tmp/tmp

=diff rendered mc=
export OLD_RENDERED=rendered-infra-6c7e5fc796264dd32341950aea971807 ; export NEW_RENDERED=rendered-infra-bac1dd431374a5c4c21742e547739c7c ; diff -NrU 5 <(oc get mc ${OLD_RENDERED} -o json) <(oc get mc ${NEW_RENDERED} -o json)
=secret management=
List secrets of they type tls.
get secrets --field-selector type=kubernetes.io/tls
=ocm=
==ocm install==
(cd /usr/local/bin/ ; sudo curl -vLsk https://github.com/openshift-online/ocm-cli/releases/download/v0.1.72/ocm-linux-amd64 -o ocm ; sudo chmod 755 ocm)
==ocm search examples==
ocm list clusters --parameter search="name like 'da0d9ade-d649-4948-8bc6-744a1fcb0960'"
ocm get /api/clusters_mgmt/v1/clusters --parameter search="name like '0047ccf6-134b-4bff-99e0-5f2d6532a3ea'"
ocm get /api/accounts_mgmt/v1/subscriptions/ --parameter size=1000 | jq -r '.items[]| .display_name +"\t"+ .status +"\t"+ .cluster_id +"\t"+ .created_at' | grep -v Archived | column_tab
Search for two states.
ocm get /api/accounts_mgmt/v1/subscriptions/ --parameter search="status like 'Active' or status like 'Stale'" --parameter size=1000

=PodDisruptionBudget=
API object that specifies the minimum number of replicas that must be up at a time.
=pod placement=
Does it look sane which pods run on worker nodes. Search for pods on worker nodes and look for the same pods on all nodes.
oc get nodes --no-headers --selector='node-role.kubernetes.io/worker,!node-role.kubernetes.io/infra' -o=custom-columns='NAME:.metadata.name' | while read NODE ; do oc get pods -A -o wide --no-headers --field-selector "spec.nodeName=$NODE" | while read NAMESPACE POD REST ; do echo '#' $NAMESPACE ${POD%-*} ; oc get pods -n $NAMESPACE -o wide | grep ${POD%-*} ; done ; done | less -ISRM
Are any user pods running outside worker nodes?
oc get project --no-headers -o=custom-columns='NAME:.metadata.name' | grep -v ^openshift- | while read NAMESPACE ; do echo '*' $NAMESPACE ; oc get pods -o wide -n $NAMESPACE ; done
=wait=
Wait for kafka getting ready.
kubectl wait kafka/my-cluster --for=condition=Ready --timeout=300s -n kafka
=list configured ssh public keys=
oc get machineconfig --no-headers -o custom-columns=":metadata.name" | grep -E '^99-.*-ssh$' | while read MACHINECONFIG ; do echo '*' "${MACHINECONFIG}" ; oc get machineconfig "${MACHINECONFIG}" -o json | jq -r '.spec.config.passwd.users[].sshAuthorizedKeys[]'; done
=Add key for ssh login=
oc get machineconfig --no-headers -o custom-columns=":metadata.name" | grep -E '^99-.*-ssh$' | while read MACHINE_CONFIG_SSH ; do echo '*' $MACHINE_CONFIG_SSH ; oc patch machineconfig $MACHINE_CONFIG_SSH --type=json --patch="[{\"op\":\"add\", \"path\":\"/spec/config/passwd/users/0/sshAuthorizedKeys/-\", \"value\":\"$(cat $HOME/.ssh/id_ed25519.pub)\"}]" ; done
With a save.
oc get machineconfig --no-headers -o custom-columns=":metadata.name" | grep -E '^99-.*-ssh$' | while read MACHINE_CONFIG_SSH ; do echo '*' $MACHINE_CONFIG_SSH ; oc_script_log oc get machineconfig $MACHINE_CONFIG_SSH -o yaml </dev/null ; oc patch machineconfig $MACHINE_CONFIG_SSH --type=json --patch="[{\"op\":\"add\", \"path\":\"/spec/config/passwd/users/0/sshAuthorizedKeys/-\", \"value\":\"$(cat $HOME/.ssh/id_ed25519.pub)\"}]" ; done

=readable output from df.=
df -lh | grep -Ev '^overlay|^tmpfs|^shm|^nsfs|^cgroup|^devtmpfs'
=give me openstack credentials=
oc get secret -n kube-system openstack-credentials -o json | jq -r '.data."clouds.yaml" | @base64d'
=extract content of container=
CONT_ID=$(docker create nginx:latest)
docker export ${CONT_ID} -o nginx.tar.gz

=shut down openshift=
Stolen with pride: https://docs.openshift.com/container-platform/4.12/backup_and_restore/graceful-cluster-shutdown.html
# Etcd bacup.
# Do we use proxy.
oc get proxy cluster -o yaml
# Make an etcd backup.
oc debug --as-root node/$(oc get nodes --no-headers --selector='node-role.kubernetes.io/master' -o=custom-columns='NAME:.metadata.name' | head -1) -- chroot /host sh -c '/usr/local/bin/cluster-backup.sh /home/core/assets/backup'
# Copy files locally.
MASTER=node/$(oc get nodes --no-headers --selector='node-role.kubernetes.io/master' -o=custom-columns='NAME:.metadata.name' | head -1) ; oc debug $MASTER -- chroot /host sh -c 'ls /home/core/assets/backup/*' 2>/dev/null | while read ETCD_BACKUP ; do echo '*' Copying ${ETCD_BACKUP##*/} ; oc debug $MASTER -- chroot /host sh -c "cat $ETCD_BACKUP | gzip -9" | zcat > ${ETCD_BACKUP##*/} ; done
# Confirm files are ok.
MASTER=node/$(oc get nodes --no-headers --selector='node-role.kubernetes.io/master' -o=custom-columns='NAME:.metadata.name' | head -1) ; oc debug $MASTER -- chroot /host sh -c 'ls /home/core/assets/backup/*' 2>/dev/null | while read ETCD_BACKUP ; do echo '*' md5sum ${ETCD_BACKUP##*/} ; oc debug $MASTER -- chroot /host sh -c "md5sum $ETCD_BACKUP" 2>/dev/null ; md5sum ${ETCD_BACKUP##*/} ; done
# When does certificate run out.
oc -n openshift-kube-apiserver-operator get secret kube-apiserver-to-kubelet-signer -o jsonpath='{.metadata.annotations.auth\.openshift\.io/certificate-not-after}{"\n"}'
# kubelet client/server certificate expiration.
oc get nodes -o name | xargs -I {} oc debug {} -- chroot /host sh -c 'openssl x509 -in /var/lib/kubelet/pki/kubelet-client-current.pem -noout -enddate; openssl x509 -in /var/lib/kubelet/pki/kubelet-server-current.pem -noout -enddate'
# If certs expire while being shut down. Then we manually have to approve csr:s when cluster comes up.
# oc get csr -o name | xargs oc adm certificate approve
# Shutdown all nodes.
oc get nodes -o name | xargs -I {} oc debug {} -- chroot /host sh -c 'shutdown -h 1'
# Now nodes can stay dead until reviving.
# To start up use command similar to this which is from openstack.
openstack server list -f value | grep SHUTOFF | awk '{print $2}' | xargs openstack server start

=statefulset=
StatefulSet is a Kubernetes controller designed to manage stateful applications that require stable network identities and persistent storage. It handles the deployment, scaling, and management of pods in an ordered and predictable manner, making it ideal for databases, distributed systems, and other applications where state preservation is critical.
=oc diff=
Se which changes would be made
kubectl diff -f <manifest>.yaml
=taint=
Remove taint from node.
kubectl taint node control-plane0.novalocal control-plane1.novalocal control-plane2.novalocal node.cloudprovider.kubernetes.io/uninitialized-
=list nodes with taints=
oc get nodes -o custom-columns=NAME:.metadata.name,TAINTS:.spec.taints

=Sealed secrets=
==create sealed secret==
kubeseal --controller-namespace=kube-system --format yaml --namespace openshift-config <ldap-secret.yaml > ldap-secret-sealed.yaml
==get secret that you want to unencrypt==
oc get sealedsecrets -n openshift-config ldap-secret -o yaml > sealedsecrets_-n_openshift-config_ldap-secret
==Unencrypt sealed secrets==
kubeseal --recovery-private-key <private_key_file> --recovery-unseal < sealedsecrets_-n_openshift-config_ldap-secret > sealedsecrets_-n_openshift-config_ldap-secret.unsealed
==Get private keys from from Sealed secrets==
oc get secret -n kube-system -l sealedsecrets.bitnami.com/sealed-secrets-key -o json | jq -r '.items[].data."tls.key"' | while read LINE ; do echo $LINE | base64 -d > $(echo "${LINE}" | cut -c -100) ; done

=imagetag=
ImageTag represents a single tag within an image stream and includes the spec, the status history, and the currently referenced image (if any) of the provided tag
"alertname": "SamplesImagestreamImportFailing",
"namespace": "openshift-cluster-samples-operator",
# Remove import fail
oc -n openshift get imagetag | grep "ImportFailed" | awk -e '{ print $1 }' | xargs -r oc -n openshift tag -d
oc delete pod -l name=cluster-samples-operator -n openshift-cluster-samples-operator

=custom-column examples=
oc get machine -n openshift-machine-api -o custom-columns=MACHINE:.metadata.name,SERVERGROUPNAME:.spec.providerSpec.value.serverGroupName,CREATIONTIME:.metadata.creationTimestamp --no-headers
=/etc/hosts=
BASE_URL=$(oc get DNS cluster -o=jsonpath='{.spec.baseDomain}')
cat << EOF
$( host api.${BASE_URL} | awk '{print $NF}') api.${BASE_URL}
$( host oauth-openshift.apps.${BASE_URL} | awk '{print $NF}') oauth-openshift.apps.${BASE_URL}
EOF
=--field-selector: examples=
List pods on node.
kubectl get pods --all-namespaces -o wide --field-selector spec.nodeName=<node-name>
List running pods
oc get pods --field-selector status.phase==Running
List not running pods
oc get pods --field-selector status.phase!=Running
=node is not ready. What could cause it=
oc logs -n openshift-machine-config-operator -l k8s-app=machine-config-controller
=Copy file from pod to your machine=
kubectl cp -n kafka $(oc get kafka -n kafka --no-headers -o custom-columns=:.metadata.name)-kafka-0:/opt/kafka/libs/kafka-tools-3.9.0.jar /temp/kafka-tools-3.9.0.jar
=category=
oc get crd -o jsonpath='{range .items[?(@.spec.names.categories)]}{.metadata.name}{"\t"}{.spec.names.categories}{"\n"}{end}' | awk -F '"' '{print $2}' | sort | uniq | while read i ; do echo '*' $i oc get $i -A ; done
* cluster-api oc get cluster-api -A
* coreoperators oc get coreoperators -A
* olm oc get olm -A
* prometheus-operator oc get prometheus-operator -A
=noobaa=
==recreate noobaa==
# Recreate noobaa. https://access.redhat.com/solutions/5948631
oc patch -n openshift-storage noobaa noobaa --type='merge' -p '{"spec":{"cleanupPolicy":{"allowNoobaaDeletion":true}}}'
oc delete -n openshift-storage noobaas.noobaa.io --all
# possibly run this command if hanging.
oc patch -n openshift-storage noobaas/noobaa --type=merge -p '{"metadata": {"finalizers":null}}'
# confirm working.
oc get pv,deployment,pods,sts -n openshift-storage|grep noobaa

=hdd to ssd convertion=
ceph osd crush rm-device-class osd.<id>
ceph osd crush set-device-class ssd osd.<id>
ROTA 1 means spinning platter
oc get nodes -l cluster.ocs.openshift.io/openshift-storage="" --no-headers -o custom-columns=:.metadata.name | xargs -I % oc debug node/% -- chroot /host sh -c "lsblk -d -o NAME,ROTA,MODEL" 2>/dev/null | grep -Ev '^loop|^sr0|^nbd|^rbd' ; oc exec -n openshift-storage $(oc get pods -n openshift-storage -o name -l app=rook-ceph-operator) -it -- bash -c "export CEPH_ARGS='-c /var/lib/rook/openshift-storage/openshift-storage.config'; exec ceph osd tree"

=lease=
I way of distributing resouces. In the case of nodes report back within time defined.
oc get leases -o custom-columns=NAMESPACE:.metadata.name,NAME:.metadata.name,HOLDER:.spec.holderIdentity,LEASEDURATION:.spec.leaseDurationSeconds,RENEWTIME:.spec.renewTime -A
=download oc for windows=
https://mirror.openshift.com/pub/openshift-v4/clients/oc/latest/
==missing commands==
ps_ls(){
echo "PID STATE COMMAND"
for pid in /proc/[0-9]*; do
[ -d "$pid" ] || continue
pid_num=$(basename "$pid")
cmd=$(cat "$pid/cmdline" 2>/dev/null | tr '\0' ' ')
state=$(cat "$pid/stat" 2>/dev/null | cut -d' ' -f3)
[ -n "$cmd" ] && printf "%-8s %-5s %s\n" "$pid_num" "$state" "$cmd"
done
}
=Create pod for testing read and write to pvc=
<pre>
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: odf-simple-test-pvc
namespace: default
spec:
accessModes:
- ReadWriteMany
resources:
requests:
storage: 1Gi
storageClassName: ocs-storagecluster-cephfs
---
apiVersion: v1
kind: Pod
metadata:
name: odf-simple-test-pod
namespace: default
spec:
containers:
- name: test-container
image: registry.redhat.io/ubi8/ubi:latest
command: ["/bin/bash"]
args:
- -c
- |
echo "Starting simple ODF PVC test..."
TEST_FILE="/mnt/test/simple-test.txt"

while true ; do
DATE=$(TZ=Europe/Stockholm date '+%F %H:%M:%S %Z')
# Write test
echo "${DATE}" > $TEST_FILE
# Read test
READ_RESULT=$(timeout 1 cat $TEST_FILE 2>/dev/null)
if [ "$READ_RESULT" = "${DATE}" ]; then
echo "${DATE} PVC Read/Write test PASSED"
else
echo "${DATE} PVC Read/Write test FAILED"
exit 1
fi
sleep 1
done
volumeMounts:
- name: test-volume
mountPath: /mnt/test
readinessProbe:
exec:
command: ["true"]
initialDelaySeconds: 5
periodSeconds: 5
livenessProbe:
exec:
command: ["true"]
initialDelaySeconds: 10
periodSeconds: 10
volumes:
- name: test-volume
persistentVolumeClaim:
claimName: odf-simple-test-pvc
restartPolicy: Never
</pre>
=PrometheusDuplicateTimestamps=
https://access.redhat.com/solutions/7101689
# Save yaml that you want to edit.
oc get configmap cluster-monitoring-config -n openshift-monitoring -o json | jq -r '.data."config.yaml"' | yq -e '.prometheusK8s.logLevel = "debug"' > config.yaml
# Upload the same
oc create configmap cluster-monitoring-config -n openshift-monitoring --from-file=config.yaml --dry-run=client -o yaml | kubectl apply -f -
# If above fails it may be caused by argocd managing the manifest. Disable sync
oc label application <argo-app> -n openshift-gitops owner-
# Command above should do the same as below command.
argocd app set openshift-gitops/<argo-app> --sync-policy=none
# Find trouble
oc logs -n openshift-monitoring prometheus-k8s-1 --tail=-1 | grep "Duplicate sample for timestam" | awk -F ' msg="Duplicate sample for timestamp"' '{print $2}' | sort | uniq -c
49 series="kube_persistentvolumeclaim_access_mode{namespace=\"rjh-mh-test\",persistentvolumeclaim=\"postgres-1\",access_mode=\"ReadWriteOnce\"}"
# Enable sync
oc label application <argo-app> -n openshift-gitops owner=rjh
# If above does not start sync.
argocd app set <argo-app> --sync-policy=automated --auto-prune --self-heal
=serverGroupName/server_groups=
<pre>
# Look at machinegroup on machineset and machine
oc get machinesets -n openshift-machine-api -o custom-columns=NAME:.metadata.name,SERVERGROUP:.spec.template.spec.providerSpec.value.serverGroupName
oc get machine -n openshift-machine-api -o custom-columns=NAME:.metadata.name,SERVERGROUPNAME:.spec.providerSpec.value.serverGroupName,CREATIONTIME:.metadata.creationTimestamp
# Patch machineset to suitable machinegroup
oc patch --namespace openshift-machine-api machineset <machineset> --type=merge --patch '{"spec":{"template":{"spec":{"providerSpec":{"value":{"serverGroupName":"<server-group>"}}}}}}'
# List servergroups.
openstack server group list
# Create servergroup with soft-affinity
openstack server group create --policy soft-anti-affinity <server_group_name>
# look at openstack what server group is.
openstack server list -f value -c ID | while read ID ; do openstack server show $ID -f json | jq -r '.|[.name,.server_groups[]]|@tsv' ; done
</pre>