I have a couple of Centos servers that were setup by someone no longer with the company. What's the best way to find what's installed and running?
4 Answers
You can get a list of current running processes using ps
:
# ps -fe
You can see what services are configured to start at boot using chkconfig
:
# chkconfig --list
Additionally, you can look in /etc/rc.d/rc3.d
(or rc5.d
, depending on your default runlevel) to get similar information (but this will also show startup scripts that don't make use of chkconfig
).
You can get a list of software installed using yum
and rpm
using rpm
:
# rpm -qa
Or yum:
# yum list installed
Also check /etc/rc.local for any entries which weren't listed in the /etc/rc.d directory.
I would also check the /opt directory. Some programs tend to put their files there.
-
Excellent additional examples of places where hand-edits tend to appear. Jan 10, 2011 at 18:23
Beyond the obvious chckconfig --list
and rpm -qa
, don't forget to do some manual checks in case the previous admin installed things manually. Some things to check:
- What files are installed under
/usr/local
?- In particular, is there anything in
/usr/local/etc
,/usr/local/bin
,/usr/local/sbin
?
- In particular, is there anything in
- Are there any hand-edits of /etc/crontab, indicating special cron jobs?
- Are there any manually added entries in
/etc/cron.*/
dirs? - Are there any special scripts in
/root/bin
? - Is there a crontab for root (run
crontab -l
as root)? - Are there any weird uses listed in
/etc/passwd
?- that is, any users that seem to be hand-added for running special tasks?
those are a few places to check to get a sense of what manual changes have been performed on the machine, separate from regular packages.
You can list the services that are running/not running by typing:
service --status-all