nethogs工具排查网络带宽异常

昨日线上服务器带宽突然被拉满，最后发现是mysql的原因，因此记录这一次排查的过程。

1.安装网络监控模块

如果是centos：

yum install libpcap nethogs
复制代码

ubuntu：

apt-get install nethogs
复制代码

具体的安装可以看nethogs的GitHub主页。剪切一段：

Nethogs monitors traffic going to/from a machine, per process. Other tools rather monitor what kind of traffic travels to, from or through a machine, etcetera. I’ll try to link to such tools here. By all means open an issue/PR if you know another:

• nettop shows packet types, sorts by either size or number of packets.
• ettercap is a network sniffer/interceptor/logger for ethernet
• darkstat breaks down traffic by host, protocol, etc. Geared towards analysing traffic gathered over a longer period, rather than `live’ viewing.
• iftop shows network traffic by service and host
• ifstat shows network traffic by interface in a vmstat/iostat-like manner
• gnethogs GTK-based GUI (work-in-progress)
• nethogs-qt Qt-based GUI
• hogwatch A bandwidth monitor(per process) with graphs for desktop/web.
• iptraf-ng is a console-based network monitoring program for Linux that displays information about IP traffic.
• nettop (by Emanuele Oriani) is a simple process/network usage report for Linux.
• iptstate is a top-like interface to your netfilter connection-tracking table.
• flowtop is a top-like netfilter connection tracking tool.

其中iftop查看总带宽使用，nload 查看最高流量ip，nethogs查看最高流量进程。

sudo nethogs
复制代码

2.定位问题

最后发现是一个IP上一直在查询云主机的mysql，重启mysql也没用，直接登录mysql查看正在查询的语句：

show processlist
复制代码

能看到所有库以及用户的执行情况，直接定位了正在操作数据库的账号。一个用户一个账号可以很快定位到问题。