System Monitoring Commands
Effective system administration starts with visibility. Whether you are troubleshooting a slow application or performing routine capacity checks, the ability to inspect CPU, memory, disk, and network resources in real time is a fundamental skill. This guide walks through the most practical monitoring commands on Linux, organized by resource type so you can move quickly from broad symptoms to root causes.
top: Watching Processes in Real Time
The top command remains the go-to tool for live process monitoring. It refreshes continuously and surfaces the most resource-hungry tasks at the top of the list:
top
When reading the summary area, pay attention to these CPU fields:
- %us: CPU time spent in user space
- %sy: CPU time spent in kernel space
- %id: Idle CPU percentage
- %wa: Time spent waiting for I/O; a consistently high value often points to a disk bottleneck
uptime: Checking System Load
For a quick pulse check, uptime reports how long the system has been running along with load averages:
uptime
# 14:32:01 up 10 days, 3:21, 2 users, load average: 0.52, 0.48, 0.45
The three load figures correspond to the last 1, 5, and 15 minutes. Compare them against your CPU core count. On a four-core machine, a load average that persistently exceeds 4 suggests the processor is saturated and tasks are queuing up.
Memory Monitoring
free: Understanding Available Memory
Use free with the -h flag for human-readable output:
free -h
Focus on the available column rather than free alone. Linux repurposes idle RAM for page caches (buff/cache), so a low free number does not necessarily mean you are out of memory. The available figure better reflects what is truly ready for new processes.
vmstat: Spotting Swap Pressure
To observe memory behavior over time, sample with vmstat:
vmstat 2 5
This collects data every two seconds for five iterations. If the si (swap-in) and so (swap-out) columns stay non-zero, the system is actively paging to disk, which usually means physical memory has become a bottleneck.
Disk Monitoring
df and du: Locating Space Consumers
df shows filesystem-level usage, while du measures directory sizes:
df -h
du -sh /var/log
When a disk-full alert fires, combine the two: use df to confirm which partition is full, then use du to drill down into the largest directories.
iostat: Evaluating Disk Utilization
For deeper I/O insight, run iostat with extended statistics:
iostat -x 1
The %util column indicates how busy the device is; values approaching 100% suggest saturation. The await column shows the average wait time for I/O requests, where higher numbers reflect poorer disk responsiveness.
Network Monitoring
ss: Inspecting Sockets and Ports
ss is the modern replacement for netstat and is generally faster:
ss -tulnp
Common flags include:
-t: Show TCP connections-u: Show UDP connections-l: Display only listening sockets-n: Resolve addresses and ports numerically-p: Identify the process owning each socket
ping and traceroute: Isolating Network Issues
When connectivity is suspect, start with ping to verify that a host is reachable. If packets are dropped or latency is high, follow up with traceroute to map the path packets take and identify the specific hop where degradation occurs.
Process-Level Analysis
ps: Ranking Top Resource Consumers
To list the heaviest processes by CPU usage:
ps aux --sort=-%cpu | head -10
Swap -%cpu for -%mem if you want to rank by memory consumption instead.
pidstat: Monitoring a Specific Process
For continuous observation of a single process, pidstat is ideal:
pidstat -p 1234 1 5
This prints CPU and memory statistics for PID 1234 once per second, five times in total, making it useful for spotting trends in resource usage.
Conclusion
The core strategy is to work from the general to the specific. Begin with top, uptime, and free to establish overall system health and identify whether CPU, memory, disk, or network is the likely bottleneck. Then switch to iostat, vmstat, pidstat, and related tools to pinpoint the exact process or device responsible. Regular practice turns these commands into muscle memory, allowing you to respond quickly and diagnose efficiently when incidents occur.