Diagnosing a Slow Production Server with Linux Commands (top, vmstat, free, df, iostat, sar)

top

Use top to view the overall server status. The first line shows system time, uptime, number of logged‑in users, and load averages (1‑, 5‑, 15‑minute). The second line lists total, running, sleeping, stopped and zombie processes. The third line gives CPU usage percentages (user, system, nice, idle). The fourth line displays physical memory (total, free, used, cached). The fifth line shows swap memory (total, free, used, cached). The sixth line lists each process with its PID and COMMAND; Java processes often appear near the top. Press 1 to see per‑CPU utilization.

vmstat

The vmstat command provides a snapshot of CPU and memory activity. Run it with an interval and count, e.g., vmstat -n 3 2 (sample every 3 seconds, two times). Focus on the procs and cpu sections:

r : number of processes waiting for CPU time (should not exceed twice the number of cores).

b : processes blocked for I/O.

us : user‑mode CPU usage percentage.

sy : kernel‑mode CPU usage percentage.

us + sy : total CPU usage; values above 80 % may indicate CPU saturation.

free

Memory usage is inspected with free. The most readable form is free -m, which shows values in megabytes. If used memory exceeds 70 % of total, the system is still comfortable; below 20 % suggests ample headroom, while a sudden drop may signal a problem.

df

Disk space is checked with df or df -h. Insufficient disk space can cause unexpected failures such as SVN commits that never complete.

iostat

For disk I/O analysis, install sysstat (if iostat is missing) and run iostat -xdk 3 2. Key metrics to watch:

rkB/s : kilobytes read per second.

wkB/s : kilobytes written per second.

svctm : average service time per I/O request (ms).

util : percentage of time the device was busy; values near 100 % indicate a saturated disk.

sar

Network I/O can be observed with sar -n DEV 3 2, which samples every 3 seconds twice. Important fields include:

IFACE : network interface name.

rxpck/s / txpck/s : packets received/transmitted per second.

rxKB/s / txKB/s : kilobytes received/transmitted per second.

rxcmp/s / txcmp/s : compressed packets per second.

rxmcst/s : multicast packets received per second.

By following this step‑by‑step checklist—from overall system load, CPU, memory, swap, disk space, disk I/O, to network I/O—you can confidently answer interview questions about diagnosing a slow production server.