Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm wondering about tools that are powerful and that most system administrators either don't know about or don't use (but should).

For one thing, I like the possibility of finding out about a tool that is good and that I should be using - or at least, trying out. I also find that giving these tools their time in the sun (again) can be a positive, letting others know about the wonderful tools that are out there.

Thus, things like sudo, vi, emacs, dtrace, ps, and top are out. I have some ideas but I just hate to skew the statistics...

I'll just wait and see if anyone mentions my favorites.


locked by EEAA Dec 6 '15 at 21:35

This question exists because it has historical significance, but it is not considered a good, on-topic question for this site, so please do not use it as evidence that you can ask similar questions here. This question and its answers are frozen and cannot be changed. More info: help center.

closed as not a real question by Chris S Feb 26 '12 at 20:07

It's difficult to tell what is being asked here. This question is ambiguous, vague, incomplete, overly broad, or rhetorical and cannot be reasonably answered in its current form. For help clarifying this question so that it can be reopened, visit the help center.If this question can be reworded to fit the rules in the help center, please edit the question.

There are so many 'what tools' questions, do we really need another? – Zoredache Jun 6 '09 at 9:49
I just have to ask: if no one's heard of a tool, then how will it get upvotes? – quux Jun 7 '09 at 2:52
+1 for camera phone. They are also incredibly useful when working with someone over the phone to troubleshoot a problem and there is a long error message on the screen. I wish all remote hands people had/made use of them. – Mark Jun 17 '09 at 18:40
I've used it to document lights on the front panel and ports on the back panel (in this case, of a DEC Alpha system). – Mei Jun 17 '09 at 23:18
Please mention one tool per answer. – Cristian Ciupitu Aug 4 '09 at 14:18

74 Answers 74

"arping" to determine if a machine in the LAN is really up. Bypasses all blocking efforts of ICMP echo (ping), by using ARP packets.

I should mention that the two arping programs are available in most distributions and that they conflict. The one is a part of iproute2, and the other is independent. Wikipedia describes both; the arping I like is by Thomas Habets. – Mei Sep 16 '11 at 14:40

strace is useful in a surprisingly large number of places.

mmm, What does it do? – Alex. S. Jun 12 '09 at 22:11
strace man page - – Cristian Ciupitu Aug 4 '09 at 14:22


Iperf helps you run tests that measure maximum TCP and UDP bandwidth performance. It allows the tuning of various parameters and UDP characteristics reporting bandwidth, delay jitter, datagram loss:



MTR (My Trace Route) is also a pretty good tool. It combines the functionality of the 'traceroute' and 'ping' programs in a single network diagnostic tool. Like traceroute except it gives more network quality and network diagnostic info. Leave running to get real time stats. Reports best and worst round trip times in milliseconds... It shows latency, jitter (average/best/worst):


mtr (or IP)

  • Add more fields with "O", type "LDRS NBAW V JMXI" and hit ENTER
  • Type "n" to toggle DNS Off/On

alt text

+1 for mtr. Beats traceroute every time. – David Pashley Jun 6 '09 at 9:15
@sh-beta, or mtr -u ;) – l0c0b0x Oct 30 '09 at 21:10

Sysstat / Sar - superb historic monitoring for servers.

Network/CPU/Memory/IO/etc/etc brilliant if you need to examine why a machine went down.

For example load averages between 6am and 7am this morning:

hcooper@localhost:~$ sar -q -s 06:00:00 -e 07:30:00
Linux 2.4.27-3-686 (localhost)  06/06/09

06:05:01      runq-sz  plist-sz   ldavg-1   ldavg-5  ldavg-15
06:15:01            2       200      0.00      0.05      0.04
06:25:01            4       199      0.01      0.05      0.04
06:35:02            0       208      1.74      1.39      0.79
06:45:01            1       201      0.12      0.52      0.70
06:55:02            1       197      0.04      0.14      0.40
07:05:01            2       203      0.13      0.10      0.24
07:15:01            2       200      0.00      0.05      0.15
07:25:01            2       200      0.01      0.04      0.08
Average:            2       201      0.26      0.29      0.30

grep, awk, netcat - can't live without them

For monitoring I use NetMRG and Nagios.

Uptimed is also a nice tool to monitor uptime and avalibility.


Systemtap rocks. Systemtap provides you with very simple-to-grasp tools to write a kernel module that inspects various parts of the kernel. Pretty deep tech, but on occasion very, very useful.

Apart from that I'd say: a combination of sysstat and rrdtool for long term trend analysis.


Looks like your post was slanted towards Linux but here's one for windows even I didn't know about until recently:



Physical Address    Transport Name
=================== ==========================================================
42-35-7C-4F-85-1b   \Device\Tcpip_{72338DC1-13A4-8514-2C1B-60FC3B4559DB}
00-11-05-86-D2-C0   \Device\Tcpip_{CCD25CFB-7765-1BE2-C59B-57C05FD32B67}

getmac is a bit hopeless IMHO. Does anyone know which interface "\Device\Tcpip_{72338DC1-13A4-8514-2C1B-60FC3B4559DB}" is off the top of their head? I prefer "ipconfig /all" or even a PowerShell one-liner like "get-wmiobject win32_networkadapter | format-table name,netconnectionid,macaddress". – ThatGraemeGuy Jun 6 '09 at 16:47

couple of network tools:

tshark - real time text version of graphical network traffic analyser - wireshark. when raw output from tcpdump is just not enough for you tshark can do the trick. sample :

1041488.938623 -> TCP 2525 > 25 [SYN] Seq=0 Len=0 MSS=1460
1041488.964593 -> TCP 2525 > 25 [ACK] Seq=1 Ack=0 Win=65535 Len=0
1041488.997561 -> SMTP Command: EHLO s72f30c9a2c784
1041489.034541 -> SMTP Command: AUTH LOGIN
1041489.064026 -> SMTP Message Body
1041489.095757 -> SMTP Message Body
1041489.304390 -> SMTP Command: MAIL FROM: <>
1041489.375849 -> SMTP Command: RCPT TO: <>
1041489.409579 -> SMTP Command: DATA
1041489.470060 -> SMTP Message Body
1041489.503278 -> SMTP Message Body
1041489.529797 -> SMTP EOM:
1041492.660752 -> SMTP Command: QUIT
1041492.726452 -> TCP 2525 > 25 [FIN, ACK] Seq=2362 Ack=281 Win=65254 Len=0
1041492.734770 -> TCP 2525 > 25 [ACK] Seq=2363 Ack=282 Win=65254 Len=0

httpry real time passive http analyser. sample output:

06/06/2009 13:36:16  <       -       -       -       HTTP/1.1        204     No Content
06/06/2009 13:37:16  >       GET   /       HTTP/1.0        -       -
06/06/2009 13:37:16   <       -       -       -       HTTP/1.0        302     Found
06/06/2009 13:37:16  >       GET       /       HTTP/1.0        -       -
06/06/2009 13:37:16   <       -       -       -       HTTP/1.0        200     OK

both tools are very useful for troubleshooting some connectivity issues reported by users in remote offices / networks where you have access only to edge gateway.

and usual monitoring favorites:

  • nagios for alerting, bash or any other scripting language to write your own checks of anything you want to monitor
  • munin for plotting trend charts

I use 'ss' which is part of the iproute package (which also includes the great ip and tc commands) to get information about tcp/udp sockets. It supplies more information that the regular 'netstat' and can be used with filters, for instance:

$ ss -o state established '( dport = :www or sport = :www )'
Recv-Q Send-Q Local  Address:Port                  Peer Address:Port   
0      0            
0      0            
0      0            
0      0            
0      0            
0      0       

vnstat comes in handy - a little traffic monitor that gives output in the same way as vmstat, e.g:

> eth1
>            received:       1.40 TiB   (48.4%)
>         transmitted:       1.50 TiB   (51.6%)
>               total:       2.90 TiB   since 20.11.08
>                         rx      |     tx      |   total
>         ------------------------+-------------+------------
>         yesterday      6.15 GiB |    8.50 GiB |   14.65 GiB
>             today      6.98 GiB |    4.77 GiB |   11.75 GiB
>         ------------------------+-------------+------------
>         estimated      7.82 GiB |    5.35 GiB |   13.17 GiB

od - octal dump

strings - find printable strings in files


I already mentioned this tool in another answer on SF.

sysv-rc-conf gives an easy to use interface for manag‐ ing "/etc/rc{runlevel}.d/" symlinks.

alt text

If you have ubuntu : sudo apt-get install sysv-rc-conf


For Windows:

PATHPING is nice (and built in) for some advanced ping stats

I also like QCHECK : It's a great GUI based simple network analyzer.

File Unlocker is a life saver at times even on servers:


Windows: Nbtstat (has a variety of tricks, but -A to get the machine name of a remote IP can be really handy assuming you're in an environment where permissions will let this work)

All of the sysinternals tools, (process explorer, debug view, etc...). Particularly debug view, you'd be surprised how many server programs write interesting/useful things to the debug log and that's the only way I know to view it. Those are must-haves though.

Unix: strace/ktrace/truss Are my favorite tools (best non-obvious use, if a there's a process running that has it's stderr redirected to /dev/null and you don't want to stop it, monitor the calls to write on fd2.

lsof: (list of open files) I always forget about this one, but when you need it, you need it.

+1 for lsof - it's great – Dennis Williamson Jun 6 '09 at 16:54

Unix centric answer (simple tools) :

  • ntop (can't believe I haven't seen this yet)
  • tcpdump/snoop
  • double recommendation for sar
  • rsync (life would suck more than anything without it)

Facter is a particular favourite.

It's frequently just considered as part of the larger Puppet configuration management framework, but extremely useful in its own right; giving a consistent cross-platform way of finding out core system information. Great in shell scripts, essentially.

For example:

  facter operatingsystem => ubuntu
  facter lsbdistcodename => hardy
  facter domain =>

It's also very easy to extend with your own (or other people's) 'facts', eg:

  facter local_postgresql_port => 5434
  facter has_hardware_raid => LSI

Multitail is a must. Monitor multiple files on one screen. Can also follow file names instead of descriptors.

alt text

Nice, but how is that different than running the standard tail -f in two windows using the GNU screen utility? – Mei Jun 8 '09 at 15:32

iftop, this gives a much better output than ntop in my opinion.


fldiff is a graphical diff program


All our apps are clustered, so cssh is pretty handy.

scp - only mentioned because so few people use it, relying on FTP instead. I've always loved the ability to grab files instantly from remote hosts. Secure, quick, and doesn't need a dedicated daemon running.


pv pipe viewer. Insert it between commands in a pipeline to get an indication how fast data is moving, how long till it finishes, etc. It can also act as a rate limiter.


I try not to use too many "nonstandard" tools. That is, tools that aren't easily available between operating systems or out of a particular distribution's software repository. I work on a Macbook, and I do testing on a variety of different Linux/Unix platforms.

That said, I like ohai(1). It is the node data collection tool used by Chef. It outputs data in JSON, so it can be manipulated with a variety of JSON parsing libraries. Since I work on Chef :-), it's a "nonstandard" tool available on every system I work with.

(1) Disclosure. I work for the company that wrote Chef and Ohai.


Windows PowerShell.

Until Windows PowerShell I always was envious about the powerful Linux shells.



Although all SysInterals tools are great, the tools which helped me the most, were the monitoring tools:

Nothing's better to quickly determine, why something is not working.

(* Regmon and Filemon are integrated into Process Monitor for newer Windows versions)


Odd answer in a way as it's not a tech tool directly - but I couldn't live without EverNote. It's a centralised note taking system, it has Windows, Mac, iPhone clients and lets you clip pits of web pages (with links to the original), has catergories, records images & voice notes.

It's what I use when my brain breaks :)


Programmable Bash completion functions. Make life less error-prone. They're not that hard to write.

Some of the less obvious options to GNU grep, especially --color, -P, and -o.

My standard quick reporting one-liner:

grep something /some/logfile | sort | uniq -c | sort -n

Simple frequency analysis from a logfile:

grep something /some/log | grep -o '^... .. ..:..' | uniq -c

(adjust the second bit for how granular you want the frequency breakdown to be).


I'm going to go with a hacker tool, that might as well be useful to diagnose troubles: Cain. It can sniff a network and do a lot of attacks(arp poisoning, man in the middle,etc) on a network as well as breaking(or recovering) passwords.

What better way to know your network is secure.


One tool that I absolutely find indispensible is tcptraceroute [1] - this is a traceroute that does not use ICMP packets to perform timings, but uses TCP instead. This allows you to traceroute without regard to the typical blocking of ICMP: it works well.


A lot of the suggestion above are Network related. But for a SysAdmnin:

htop - an interactive process viewer for Linux

This is htop, an interactive process viewer for Linux. It is a text-mode application (for console or X terminals) and requires ncurses. Tested with Linux 2.4 and 2.6.

Or Human Readable Top


It's not exactly a small cli tool as such, but I can heartily recommend Zenoss Core for network and system monitoring. It has restored my faith in monitoring-and-alerting software.

Where tools like Nagios, Cacti, etc. all have steep learning curves and seem to be good at only one thing, most often you have a need for an all-in-one solution, and Zenoss Core provides that for free (and Free).

It's hard to summarize, but basically it's an application with web-interface that autodiscovers devices on your network, then monitors tons of parameters, logfiles, ports, services, software, hardware, amount-of-pages-printed, etc. If anything fails or crosses a threshold you get an alert. It's easy to get started: enable/install snmp on each device you want to monitor, install Zenoss on a server, and open the web interface.

The free Core version is good enough for small and medium businesses, while the commercial Professional and Enterprise versions provide some advanced features.

If you ever thought about Nagios, Cacti or the like, be sure to evaluate Zenoss as well.


Not the answer you're looking for? Browse other questions tagged or ask your own question.