FortiEDR
FortiEDR automates the protection against advanced threats, pre and post-execution, with real time orchestrated incident response functionality.
kwernecke
Staff
Staff
Article Id 211974
Description This article describes the basic commands when working with Linux Servers.
Scope FortiEDR 5.x
Solution

Command

Description

Example

less

Read a file

less /opt/FortiEDR/webapp/logs/webapp.log

tail -f

Read a file in LIVE

tail -f /opt/FortiEDR/webapp/logs/webapp.log

ps aux

List all running processes and info about them (including PID, path, etc.)

 

grep

Search for text string in a file

grep ERROR* /opt/FortiEDR/webapp/logs/webapp.log

grep

Search for a text string in a piped stream

ps aux | grep enSilo

     

-i

Case-insensitive (Use it to search for enSilo and ENSILO and ensilo)

ps aux | grep -i ensilo

pgrep

Get PID of a process by its name

pgrep -xf enSiloCollector (used on macOS to find the collector PID)

(xf means that it will find exactly the process name and not other similar processes, for instance: enSiloCollector --status)

touch

Create a file

touch new.txt

It can be anything, from an empty txt file to an empty zip file.

mv

Move a file

mv a.sh new_folder/a.sh

It takes the two arguments, just like the cp command.

mv

Rename a file

mv a.sh b.sh

cp

Copy a file

cp a.sh new_folder/a_copy.sh

It takes two arguments: The first is the location of the file to be copied, the second is where to copy.

rm

Remove a file

rm a.sh
rm -R new_folder (r = recursive, remove folder and all files in that folder)
rm -fr new_folder (f = force remove)

sudo

Run a command as a root user (administrator)

sudo chmod 777

sudo su

Enter sudo mode

sudo su -

df

See all storage devices and how much disk space is consumed

df -h

mount

Mount a share drive (SMB for example)

As a registered user: mount -t cifs -o user=<username> //ens-fs01/qa /mnt/share

As a guest: mount -t cifs //ens-fs01/qa /mnt/share

(requires package cifs-utils)

 

Tutorial: https://www.serverlab.ca/tutorials/linux/storage-file-systems-linux/mounting-smbcifs-shares-onto-cen...

umount

Unmount (eject) a share drive (SMB for example)

umount /mnt/share/

mkdir

Make a new directory

mkdir new_folder

rmdir

Remove a directory

rmdir new_folder

rmdir can only be used to delete an empty directory. To delete a directory containing files, use rm.

pwd

Print current directory

pwd

chmod

Change permissions of a file

chmod +x [file]

cd

Go to folder

cd /root/folder

ls

List all files in the current folder (or a specified folder)

ls /root/folder

locate

Locate a file in Linux system

locate hello

List of all the files in the Linux system containing the word "hello"

-i

Case insensitive

locate -i hello

*

If two words are remembered,  separate them using an asterisk (*)

locate -i *hello*this

Locate a file containing the words "hello" and "this"

ifconfig

Check the machine's internal IP

 

ip a

Check the machine's internal IP (alternative to ifconfig)

 

vi

Edit a file

vi /opt/ensilo/webapp/application.properties

:q

Quit the file editor

 

:wq

Save the changes, and quit the file editor

 

:q!

Quit the file editor and discard the changes

 

kill

Kill a process (by process ID)

kill -9 [PID]

systemctl status

 Check status of a service

systemctl status FortiEDR

./

Relative path (run a file in current folder)

./script.sh (execute)

/

Full path

/root/folder/script.sh (execute – full path)

find /

Search for a string within the file editor

View a file: less [file]
Then search for errors: /ERROR

lsof

List all opened files on the file system

For example, To find all open files in folder /opt:

lsof | grep /opt

rpm -qa

 Get a list of all installed packages (CentOS)

rpm -qa | grep -i FortiEDR

yum install

 Install a package

(CentOS)

yum install [package]

yum remove

 Remove a package (CentOS)

yum remove [package]

 

Contributors