How to Diagnose Linux Memory, CPU, Network, and Disk Bottlenecks with Command‑Line Tools

Memory Bottleneck

The free command shows physical memory, swap usage, and kernel buffers. Use free -h -s 3 to display the statistics every three seconds.

[1014154@cc69dd4c5-4tdb5 ~]$ free
              total        used        free      shared  buff/cache   available
Mem:      119623656    43052220    45611364     4313760    30960072    70574408
Swap:            0          0          0
[1014154@cc69dd4c5-4tdb5 ~]$ free -h -s 3
              total        used        free      shared  buff/cache   available
Mem:           114G         41G         43G        4.1G          29G         67G
Swap:            0B         0B          0B

Mem

: overall memory usage. Swap: swap space usage. total: total physical memory and swap size. used: memory already allocated. free: memory not allocated. shared: shared memory size. buff/cache: memory used by buffers and cache. available: memory available for applications (≈ free + buff + cache).

Swap Space

Swap is a disk area used when physical memory is exhausted. It relieves memory pressure but incurs disk I/O latency.

CPU Bottleneck

Use vmstat (Virtual Memory Statistics) to monitor CPU, memory, and swap activity. Example: vmstat 5 3 reports every five seconds for three intervals.

[1014154@cc69dd4c5-4tdb5 ~]$ vmstat 5 3
procs -----------memory---------- ---swap-- -----io---- -system-- ------cpu-----
 r  b   swpd   free   buff  cache   si   so    bi    bo   in   cs us sy id wa st
 8  0      0 45453212 374768 30763728    0    0    14    99    1    1 11 10 78  0  1
10  0      0 45489232 374768 30763360    0    0     2  1275 95118 97908 13 11 75  0  1
 6  0      0 45452908 374768 30765148    0    0     0  3996 89924 92073 12 10 78  0  1

r

: runnable processes (need CPU). b: blocked processes (waiting for I/O or memory). swpd: swapped memory size. free: idle physical memory. buff: buffer memory. cache: cached memory. si / so: swap in/out rates. us / sy: user and system CPU percentages. id: idle CPU percentage. wa: I/O wait percentage.

If si or so stay non‑zero, the system lacks memory.

CPU Load Details

Use top to view overall CPU usage and per‑process statistics. Press Shift+H to show Java threads, Shift+M to sort by memory, Shift+P to sort by CPU, and 1 to display each core.

top - 15:24:11 up 8 days,  7:52,  1 user,  load average: 5.73, 6.85, 7.33
Tasks:  17 total,   1 running,  16 sleeping,   0 stopped,   0 zombie
%Cpu(s): 13.9 us,  9.2 sy,  0.0 ni, 76.1 id,  0.1 wa,  0.0 hi,  0.1 si,  0.7 st

Key fields: us: user‑mode CPU. sy: kernel‑mode CPU. id: idle CPU. wa: time spent waiting for I/O.

High wa indicates I/O bottleneck; low id (<10 %) signals CPU saturation.

Network Bottleneck

Monitor packet statistics with watch -n 2 more /proc/net/dev. Focus on drop and total packet counts.

Inter-|   Receive                                                |  Transmit
 face |bytes    packets errs drop fifo frame compressed multicast|bytes    packets errs drop fifo colls carrier compressed
    lo:   10025     130    0    0    0     0          0          0    10025     130    0    0    0     0       0          0
  ens33: 759098071  569661    0    0    0     0          0          0 19335572  225551    0    0    0     0       0          0

Use traceroute to see hop‑by‑hop latency, and netstat -i or cat /proc/net/snmp to view error counters and retransmission rates ( RetransSegs/OutSegs).

Disk Bottleneck

Check free space with df -hl and used space with du -sh.

Filesystem               Size  Used Avail Use% Mounted on
/dev/mapper/centos_aubin-root 27G  5.6G   22G  21% /
/dev/sda1               1014M 211M  804M  21% /boot

Use iostat for overall I/O statistics and iostat -x 1 3 for detailed per‑device metrics. Important fields: %iowait: CPU time waiting for I/O. await: average I/O request latency (ms). %util: device utilization; values near 100 % indicate saturation.

When I/O bottlenecks appear, locate the offending process with iotop or iotop -p <pid>.

Application Bottleneck

Find a process ID with ps -ef | grep java, then inspect its threads:

ps -Lp 98344 cu
USER   PID   LWP %CPU NLWP %MEM    VSZ   RSS TTY      STAT START   TIME COMMAND
root 98344 98344  0.0   10  4.1 2422552 59060 pts/0   Sl+  11:09   0:00 java

Identify the most CPU‑intensive thread by sorting on the %CPU column, convert the thread ID to hexadecimal ( printf '%x\n 98345), and view its stack with jstack 98344 | grep -A 10 18029.

Search logs for errors across the filesystem:

find / -type f -name "*.log" | xargs grep "ERROR"

Check for deadlocks with jstack -l <pid>, and count threads with ps -efL | grep <pid> | wc -l.

Common Commands Summary

Memory : free, vmstat, sar -r CPU : top, ps -Lp, sar -u, sar -q Network : watch -n 2 more /proc/net/dev, traceroute, netstat -i, cat /proc/net/snmp Disk : df -hl, du -sh, iostat, iotop Application : ps -ef, jstack, jstat, jmap,

gcore