Essential Linux Performance Monitoring: Top, vmstat, iostat, netstat & More

CPU and Memory Monitoring

Linux servers expose a wealth of runtime metrics that are crucial for both operations staff and developers when diagnosing abnormal program behavior. Simple command‑line tools read data from /proc and /sys to present these metrics.

top shows real‑time process and system statistics. The first line displays 1‑, 5‑, and 15‑minute load averages; values exceeding the number of CPU cores indicate CPU saturation. The second line lists task states (running, sleeping, stopped, zombie). Subsequent columns break down CPU usage into us (user), sy (system), ni (nice), id (idle), wa (iowait), hi (hardware IRQ), si (software IRQ), and st (steal time for virtualized environments). High us points to CPU‑intensive processes, sy often reflects heavy I/O, wa signals slow storage, and st can reveal over‑committed virtual CPUs.

The memory section of top reports total, used, free, buffers, and cached memory. Buffers cache raw disk metadata, while Cached stores file data. Avail Mem approximates memory available without swapping. Frequent swap activity indicates memory pressure.

Additional CPU/Memory Tools

vmstat provides a compact snapshot of processes, memory, paging, block I/O, and CPU activity. Columns include r (runnable processes), b (blocked/uninterruptible), swpd (used swap), buff, cache, bi / bo (blocks in/out), in (interrupts/sec), and cs (context switches/sec). Monitoring cs helps decide whether a parallel build flag (e.g., -j) is causing excessive switching.

pidstat offers per‑process statistics. Useful options include: -t – display thread‑level details. -r – show page faults ( minflt/s minor, majflt/s major). -s – report stack size ( StkSize) and usage ( StkRef). -u – CPU usage breakdown. -w – context‑switch counts, both voluntary ( cswch/s) and involuntary ( nvcswch/s). -C "pattern" -l – filter by command name pattern and show full command line.

pidstat -w -t -C "ailaw" -l

Disk I/O Monitoring

iostat (with -xz 1) reports per‑device statistics such as avgqu-s (average queue length), await (average request latency), svctm (service time), and %util (device utilization). Values >1 for avgqu-s or >60 % for %util suggest saturation.

sar can also collect disk metrics and, with -n TCP,ETCP 1 or -n UDP 1, network statistics.

Network Monitoring

netstat displays socket states and protocol counters. Useful flags include -antp (all TCP connections with program name) and -nltp (listening TCP sockets).

sar -n provides per‑second counts of active/passive TCP connections, retransmissions, and UDP errors, helping assess reliability.

tcpdump captures packet traces for offline analysis with Wireshark. It supports size‑limited rotation via -C / -W and can filter by host, port, protocol, etc. Captured packets include timestamps, which are essential for reproducing timing‑related issues.

Additional Tips

For per‑CPU load balancing on SMP systems, mpstat -P ALL 1 shows each core’s utilization. To filter processes by user, top -u username works, while a custom ps loop such as

while :; do ps -eo user,pid,ni,pri,pcpu,psr,comm | grep 'ailawd'; sleep 1; done

can provide continuous monitoring. Visualizing process hierarchies with ps axjf helps trace parent‑child relationships.