How to Diagnose a Slow Production Server with Essential Linux Commands

Overview

When a production server becomes slow, a systematic analysis from overall system health down to network I/O helps you pinpoint bottlenecks and answer interview questions with confidence.

Inspecting Overall System with top

The top command provides a quick snapshot of CPU, memory, and process statistics. Key lines to read:

Line 1 – system time, uptime, number of logged‑in terminals, and load averages (1‑, 5‑, 15‑minute).

Line 2 – total processes, running, sleeping, stopped, and zombie processes.

Line 3 – CPU usage percentages for user, system, priority‑changed, and idle.

Line 4 – physical memory total, free, used, and cached.

Line 5 – virtual memory total, free, used, and buffered.

Line 6 – PID and COMMAND columns; the top processes are often Java processes.

Press 1 to expand per‑CPU utilization.

Analyzing CPU with vmstat

Use vmstat -n 3 2 to sample every 3 seconds, two times. Focus on the procs and cpu fields.

r : runnable processes waiting for CPU time. Keep the run queue below twice the number of CPU cores.

b : processes blocked on I/O (disk, network, etc.).

CPU sub‑fields:

us : user‑space CPU usage percentage. Persistent values > 50 % suggest application‑level optimization.

sy : kernel‑space CPU usage percentage.

us + sy : total CPU usage; values above 80 % may indicate CPU saturation.

Checking Memory with free

The free family of commands shows memory usage. The author recommends free -m because it displays values in megabytes, which are easy to read and accurate.

Interpretation:

If used memory exceeds 70 % of total, memory is still sufficient.

If free memory drops below 20 %, consider adding RAM.

Verifying Disk Space with df

Disk space shortages often cause unexpected failures. Use df or df -h to view available space in blocks or human‑readable format.

Analyzing Disk I/O with iostat

If iostat is missing, install the sysstat package ( yum install -y sysstat). Then run iostat -xdk 3 2 to sample every 3 seconds, twice.

Key metrics to watch:

rkB/s : kilobytes read per second.

wkB/s : kilobytes written per second.

svctm : average service time per I/O request (ms).

util : percentage of time the device was busy; values near 100 % indicate a saturated disk.

Monitoring Network I/O with sar

Network statistics can be collected with sar -n DEV 3 2, which samples every 3 seconds, two times.

Important fields:

IFACE : network interface name.

rxpck/s / txpck/s : packets received/sent.

rxKB/s / txKB/s : kilobytes received/sent.

rxcmp/s / txcmp/s : compressed packets.

rxmcst/s : multicast packets received.

Conclusion

By following this checklist—from top for a high‑level view, through vmstat, free, df, iostat, and finally sar for network metrics—you can systematically identify the root cause of a slow production server and discuss your diagnostic process confidently in interviews.