Ten questions you eventually need to answer on a live Linux box - and the
one-liner for each. Most need sudo to see everything (attaching to another
user’s process, reading capabilities across the tree, per-process I/O).
| Task | Command |
|---|---|
| Change a process’s CPU affinity | taskset -cp 0-3 <pid> - pin PID to CPUs 0–3. Launch pinned: taskset -c 0,2 <cmd> |
| Modify a process’s I/O priority | ionice -c2 -n0 -p <pid> - class 2 (best-effort), level 0 (highest). Class 3 = idle |
| Intercept an app’s system calls | strace -p <pid> to attach; strace <cmd> to launch. Add -f for child threads, -e trace=network to filter |
| View a binary’s shared-library deps | ldd /path/to/binary (or objdump -p bin | grep NEEDED for the direct deps only) |
| Change a kernel variable at runtime | sudo sysctl -w net.ipv4.ip_forward=1. Persist it in /etc/sysctl.d/99-local.conf + sysctl --system |
| Check network-interface drop counters | ip -s link show eth0 (RX/TX errors + dropped). Deeper: ethtool -S eth0 |
| List extended file capabilities | getcap -r / 2>/dev/null (whole tree) or getcap <file>. Set with setcap |
| Monitor real-time disk I/O per process | sudo iotop (interactive). Scriptable: pidstat -d 1 |
| Display active shared-memory segments | ipcs -m (System V shm); ipcs for all IPC (queues, semaphores) |
| Find the PID using a specific port | sudo ss -ltnp 'sport = :8080' (or sudo lsof -i :8080, or sudo fuser 8080/tcp) |
A few notes
taskset/ionicechange scheduling, not the program - the process keeps running; you’re just telling the kernel where and how eagerly to run it.straceis a debugging superpower (see exactly what syscalls an app makes and where it hangs) but it slows the target - don’t leave it attached in production.sysctl -wis runtime-only; it resets on reboot unless you drop it in/etc/sysctl.d/. That split (live tweak vs. persisted) trips people up constantly.getcapshows Linux capabilities (fine-grained root powers likecap_net_bind_service), which are separate from file permissions and ACLs (getfacl) and attributes (lsattr).sshas replacednetstaton modern systems - same job, faster, still installed everywhere.