10 Essential Linux Performance Monitoring Commands Every Sysadmin Should Know

top – Real‑time system monitor

The top command provides a live view of CPU, memory, and process usage. Example output shows system load, task counts, CPU percentages, memory statistics, and a list of processes with their resource consumption.

# Execute the command
 top

top - 15:12:35 up 1 day,  2:43,  2 users,  load average: 0.05, 0.02, 0.00
Tasks: 139 total,   1 running, 137 sleeping,   1 stopped,   0 zombie
%Cpu(s):  3.1 us,  1.0 sy,  0.0 ni, 95.7 id,  0.0 wa,  0.0 hi,  0.2 si,  0.0 st
MiB Mem :  3920.2 total,  1842.2 free,   878.3 used,  1199.7 buff/cache
MiB Swap:  2048.0 total,  2048.0 free,     0.0 used.  2854.8 avail Mem

  PID USER      PR  NI    VIRT    RES    SHR S  %CPU %MEM     TIME+ COMMAND
  978 user      20   0  996676  53488  27552 S   1.3  1.3   0:49.10 gnome-shell
 1232 user      20   0  601728   9036   4528 S   0.8  0.2   0:02.43 x-terminal-em

vmstat – Virtual memory statistics

vmstat

reports overall CPU, memory, and I/O activity, optionally refreshing at a set interval. The example runs the command every second for five samples.

# Refresh every second, 5 times
 vmstat 1 5

procs -----------memory---------- ---swap-- -----io---- -system-- ------cpu-----
 r  b   swpd   free   buff  cache   si   so    bi    bo   in   cs us sy id wa st
 1  0     0 188412  24924  879360    0    0     0     1    3    5  0  1 99  0  0
 0  0     0 188372  24924  879380    0    0     0     1  340  376  1  0 98  0  0
 0  0     0 188372  24924  879380    0    0     0     0  308  354  1  0 99  0  0

lsof – List open files

The lsof utility enumerates all open files and the processes that hold them, helping locate which program is accessing a particular file.

# Show first few open files
 lsof | head

COMMAND   PID USER   FD   TYPE DEVICE SIZE/OFF   NODE NAME
systemd     1 root   cwd   DIR  252,0    4096      2 /
systemd     1 root   rtd   DIR  252,0    4096      2 /
systemd     1 root   txt   REG  252,0 1571656 13238332 /usr/lib/systemd/systemd
systemd     1 root   mem   REG  252,0  271920 13238338 /usr/lib/liblzma.so.5.2.4

iotop – Disk I/O monitor

iotop

displays real‑time disk read/write activity per process, useful for identifying I/O bottlenecks.

# Run with root privileges
 sudo iotop

Total DISK READ: 0.00 B/s | Total DISK WRITE: 28.50 K/s
  PID PRIO USER   DISK READ DISK WRITE> SWAPIN   IO>   COMMAND
 1490 be/4 root        0.00 B/s   14.25 K/s   0.00 %   0.00 % systemd-journald
 2865 be/4 user        0.00 B/s   14.25 K/s   0.00 %   0.00 % firefox

iostat – Storage device I/O performance

iostat -d -x 1 3

reports per‑device throughput and CPU utilization, refreshing three times at one‑second intervals.

# Execute the command
 iostat -d -x 1 3

Device            rrqm/s wrqm/s   r/s   w/s  rkB/s  wkB/s avgrq-sz avgqu-sz await svctm  util
sda                0.00   0.00  0.00  2.00   0.00   8.00     8.00     0.01   0.50   0.50   0.10

htop – Interactive process monitor

htop

offers a more user‑friendly, color‑rich interface compared to top, supporting keyboard navigation.

# Launch htop
 htop

PID USER   PRI  NI  VIRT   RES   SHR S CPU% MEM%   TIME+  Command
 2345 user   20   0 118.5m 16.2m 11.5m S  0.0  0.4   0:01.74 vim
 3356 user   20   0  717M  142M  69M S  6.5  3.6  11:23.10 firefox

netstat – Network connection status

netstat -an

lists all listening and established sockets, helping troubleshoot network connectivity.

# Show all connections
 netstat -an

Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address          Foreign Address        State
tcp        0      0 0.0.0.0:22             0.0.0.0:*              LISTEN
tcp        0      0 127.0.0.1:631          0.0.0.0:*              LISTEN
tcp6       0      0 :::22                  :::*                   LISTEN

iftop – Real‑time bandwidth monitor

iftop

shows live bandwidth usage between hosts, requiring root privileges.

# Run with sudo
 sudo iftop

192.168.1.1 => 192.168.1.2   15Kb  45Kb  60Kb
            192.168.1.2 => 192.168.1.1   10Kb  30Kb  55Kb

tcpdump – Packet capture

tcpdump

captures network packets for detailed protocol analysis.

# Capture on interface eth0
 sudo tcpdump -i eth0

10:09:52.123456 IP 192.168.1.100.52675 > 192.168.1.1.http: Flags [S], seq 0, win 29200
10:09:52.123789 IP 192.168.1.1.http > 192.168.1.100.52675: Flags [S.], ack 1, win 14480

nethogs – Bandwidth per process

nethogs

groups network traffic by the owning process, making it easy to see which applications consume bandwidth.

# Run with sudo
 sudo nethogs

NetHogs version 0.8.5

  PID USER   PROGRAM          DEV        SENT      RECEIVED
12345 root   sshd              eth0   0.08 KB/s   12.53 KB/s

These ten commands together form a lightweight yet powerful toolbox for Linux system administrators, enabling rapid identification of performance bottlenecks across CPU, memory, storage, and network layers.