Linux System Monitoring Tools: CPU, Memory, Disk I/O, and Network Performance

Linux servers expose a wealth of runtime metrics that are crucial for both operations staff and developers when troubleshooting abnormal program behavior; this article presents a collection of simple command‑line utilities that read data from /proc and /sys to reveal those metrics.

CPU and Memory (top) – The top display shows load averages, task states, and per‑CPU usage categories (us, sy, ni, id, wa, hi, si, st). High values in each column suggest specific problems, such as CPU saturation (user), I/O bottlenecks (iowait), kernel overhead (system), or virtual‑machine over‑commit (steal). The lower rows report physical and virtual memory usage, distinguishing Buffers, Cached, and Available memory, and explain why swap activity is not always a failure.

vmstat – Provides a compact view of runnable processes (r), uninterruptible sleep (b), virtual memory usage (swpd), I/O blocks (bi/bo), interrupts (in), and context switches (cs). The author notes that varying the -j compile flag for make does not noticeably affect context‑switch rates unless the flag is set excessively high.

pidstat – Offers per‑process statistics, including page faults ( minflt/s , majflt/s ), stack usage, CPU usage, and thread‑level context switches. Useful options are -t for thread details, -r for memory faults, -s for stack, -u for CPU, and -w for switches. The -C filter and -l long format simplify monitoring specific programs.

Other utilities – mpstat -P ALL 1 shows per‑core load balance, while ps axjf displays a detailed process tree. Filtering top by user (e.g., top -u taozj ) isolates a single user's workload.

Disk I/O (iostat, sar) – iostat -xz 1 and sar -d 1 report average queue length ( avgqu-sz ), await time, service time ( svctm ), and utilization ( %util ). Values above thresholds indicate device saturation, though modern kernels may mask the impact with asynchronous I/O and caching.

Network (netstat, sar, tcpdump) – netstat -s and netstat -antp list protocol statistics and listening sockets. sar -n TCP,ETCP 1 and sar -n UDP 1 provide per‑second counts of active/passive connections, retransmissions, and error packets. tcpdump captures raw packets for offline analysis with Wireshark; options like -C and -W limit file size and rotate captures.

Overall, the article emphasizes that while these tools are powerful for real‑time monitoring, they should be combined with longer‑term logging and careful interpretation to pinpoint performance bottlenecks.