10 Essential Linux Commands to Diagnose Server Performance in the First Minute

Why the first minute matters

Detecting a performance issue early on a Linux server gives you a narrow window to gather the most telling metrics before the problem escalates. By focusing on error indicators and resource saturation, you can narrow the investigation scope and avoid chasing irrelevant symptoms.

Command checklist

The following ten commands, all part of the sysstat package, form a systematic approach (Utilization → Saturation → Error) for CPU, memory, disk, and network analysis. uptime Shows the system load averages for the past 1, 5, and 15 minutes, indicating how many tasks are waiting for CPU time. dmesg | tail Displays the most recent kernel messages, helping you spot OOM kills, hardware errors, or network anomalies. vmstat 1 Provides per‑second snapshots of processes, memory, swap, I/O, and CPU usage. Key fields:

r – runnable tasks (more than CPU count means saturation)

free – free memory in KB

si/so – pages swapped in/out (non‑zero indicates memory pressure)

us, sy, id, wa, st – CPU time distribution (user, system, idle, I/O wait, steal) mpstat -P ALL 1 Shows each CPU’s utilization; a single CPU with high usage may reveal a single‑threaded bottleneck. pidstat 1 Similar to top but logs per‑process statistics at regular intervals, making it easy to track CPU‑hungry processes over time. iostat -xz 1 Reports block‑device statistics. Important metrics:

r/s, w/s – read/write operations per second

await – average I/O response time (high values signal saturation)

avgqu‑sz – average queue length ( >1 indicates backlog)

%util – device utilization ( >60 % often problematic) free -m Shows total, used, and free memory, plus buffers and cache. The “-/+ buffers/cache” line gives a more accurate view of memory actually in use. sar -n DEV 1 Monitors network interface throughput (rxkB/s, txkB/s) and interface utilization (%ifutil). sar -n TCP,ETCP 1 Provides TCP‑level counters such as active connections, passive connections, and retransmissions, useful for assessing server load and network health. top Combines many of the above metrics in a real‑time view, but its scrolling output can hide intermittent spikes; for that reason, vmstat or pidstat are often preferable for capturing trends.

Putting it together

Start with uptime and dmesg to gauge overall load and recent kernel events. Follow with vmstat and mpstat to check CPU saturation, then iostat and free for disk and memory pressure. Finally, use sar and top to verify network behavior and identify the specific processes consuming resources.