20 Essential Linux Command-Line Tools for System Performance Monitoring

Monitoring and troubleshooting Linux system performance is a challenging daily task for system and network administrators. Drawing on five years of Linux administration experience, this guide presents 20 essential command-line tools that work across all Linux distributions to help identify and resolve performance issues.

1. top — Linux process monitoring

The top command provides a real‑time view of running processes, displaying CPU usage, memory consumption, swap, cache, and more, allowing administrators to spot resource‑intensive processes.

# top

2. vmstat — Virtual memory statistics

The vmstat command (available via the sysstat package) reports virtual memory, processes, I/O, CPU activity, and more.

# vmstat
procs -----------memory---------- ---swap-- -----io---- --system-- -----cpu-----
r  b   swpd   free  inact active   si   so    bi    bo   in   cs us sy id wa st
1  0    0   810420  97380 70628    0    0   115    4   89   79  1  6 90  3  0

3. lsof — List open files lsof lists open files and the processes using them, covering regular files, sockets, pipes, and devices.

# lsof
COMMAND   PID USER   FD   TYPE DEVICE SIZE/OFF NODE NAME
init        1 root  cwd  DIR   104,2   4096   2 /
...

4. tcpdump — Network packet analyzer tcpdump captures and filters network packets, useful for detailed protocol analysis.

# tcpdump -i eth0
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 96 bytes
...

5. netstat — Network statistics netstat displays network connections, routing tables, interface statistics, masquerade connections, and multicast memberships. # netstat -tulnp 6. htop — Interactive process monitor htop offers an enhanced, color‑coded interface for process management, with scrolling and mouse support.

# htop

7. iotop — Disk I/O monitor iotop shows real‑time disk I/O usage per process, helping locate heavy read/write activity. # iotop 8. iostat — I/O statistics iostat reports CPU utilization and I/O statistics for devices and partitions.

# iostat
Linux 2.6.18-238.9.1.el5 (tecmint.com) 09/13/2012
avg-cpu: %user %nice %system %iowait %steal %idle
2.60   3.65   1.04   4.29   0.00  88.42
Device: tps Blk_read/s Blk_wrtn/s Blk_read Blk_wrtn
...

9. IPTraf — Real‑time IP LAN monitor

IPTraf provides detailed IP traffic statistics, including TCP flags, ICMP details, and interface activity.

10. psacct / acct — User activity accounting

These tools track each user's resource consumption and command usage, useful for auditing and capacity planning.

11. Monit — Service and process monitoring

Monit is an open‑source web‑based utility that monitors processes, files, directories, permissions, and services such as Apache, MySQL, and Nginx.

12. NetHogs — Per‑process network bandwidth

NetHogs displays real‑time network bandwidth usage per process, similar to top but for network traffic.

13. iftop — Network bandwidth monitor

iftop shows a continuously updated list of network bandwidth usage per host, complementing CPU‑focused tools like top.

14. Monitorix — System and network monitoring

Monitorix is a lightweight web‑based monitoring tool that collects and graphs system load, memory, disk, services, mail, MySQL, and more.

15. Arpwatch — Ethernet activity monitor

Arpwatch logs changes in Ethernet MAC/IP address pairs and can email administrators when anomalies such as ARP attacks are detected.

16. Suricata — Network security monitoring

Suricata is a high‑performance open‑source IDS/IPS that inspects network traffic on Linux, FreeBSD, and Windows.

17. VnStat PHP — Bandwidth monitoring web front‑end

VnStat PHP provides a web interface for the vnstat tool, showing hourly, daily, and monthly traffic summaries.

18. Nagios — Network/server monitoring

Nagios is a widely used open‑source monitoring system that alerts administrators to server and network issues before they affect business processes.

19. Nmon — Linux performance monitor

Nmon (Nigel's performance Monitor) reports CPU, memory, disk, network, NFS, and kernel statistics in both live and data‑capture modes.

20. Collectl — Integrated performance collector

Collectl gathers comprehensive system resource data, including CPU, memory, network, NFS, and TCP sockets, for analysis.

These tools form a solid toolbox for Linux administrators to monitor system health, diagnose bottlenecks, and maintain reliable services.