Master Linux Performance in 60 Seconds: 10 Essential Commands

Netflix’s Performance Engineering team explains how to get a rapid, high‑level view of a Linux server’s health within the first 60 seconds of logging in, using only standard command‑line utilities that are typically pre‑installed or available via the sysstat package.

1. uptime

This command prints the system’s average load for the past 1, 5, and 15 minutes, giving a quick sense of how many processes are runnable or waiting for I/O. A large gap between the 1‑minute and 15‑minute values can indicate a transient spike that has already subsided.

2. dmesg | tail

Shows the last ten kernel messages, useful for spotting OOM kills, driver errors, or TCP drops that may be causing performance degradation. The output often reveals low‑level issues that higher‑level tools miss.

3. vmstat 1

Provides a per‑second snapshot of virtual memory statistics. Important columns include:

r : number of processes waiting for CPU time; values greater than the number of CPUs indicate CPU saturation.

free : free memory in kilobytes; low values may point to memory pressure.

si/so : swap‑in and swap‑out rates; non‑zero values suggest insufficient RAM.

us, sy, id, wa, st : CPU time breakdown (user, system, idle, I/O wait, stolen). High wa indicates I/O bottlenecks; high sy (>20 %) may mean kernel overhead.

4. mpstat -P ALL 1

Displays per‑CPU utilization and time breakdown, helping to identify imbalanced workloads or single‑threaded processes that keep one core busy while others sit idle.

5. pidstat 1

Similar to top but provides a rolling per‑process summary. It is handy for copying output into investigation logs. In the example, two Java processes consume a combined 159 % of CPU, indicating they are using roughly 16 cores.

6. iostat -xz 1

Shows block‑device statistics. Key fields:

r/s, w/s, rkB/s, wkB/s : read/write request rates and throughput.

await : average I/O latency (ms), including queue time; high values suggest device saturation.

avgqu‑sz : average queue length; >1 indicates queuing.

%util : device utilization percentage; >60 % often signals a bottleneck, >90‑100 % means the device is fully busy.

7. free -m

Displays memory usage in megabytes, separating buffers, cache, and truly free memory. The “-/+ buffers/cache” line gives a more accurate view of memory available to applications. On systems with ZFS, cache memory is not reflected in free, which can be confusing.

8. sar -n DEV 1

Monitors network interface throughput (rxkB/s, txkB/s) and utilization. In the example, eth0 receives 22 MB/s (≈176 Mbit/s) on a 1 Gbit/s link. The tool also reports %ifutil, though it may be inaccurate on some kernels.

9. sar -n TCP,ETCP 1

Shows TCP metrics such as active/s (outgoing connections per second), passive/s (incoming connections per second), and retrans/s (retransmissions per second). These numbers help gauge overall server load and detect network‑related issues.

10. top

Provides a real‑time, interactive view of CPU, memory, and process activity. While convenient, top does not show trends over time; tools like vmstat or pidstat are better for spotting intermittent spikes.

After the initial overview, deeper analysis can be performed with dozens of additional tools covered in Brendan Gregg’s Linux performance tutorial from Velocity 2015, which includes over 40 commands for observability, benchmarking, tuning, and tracing.