Master Linux Performance Monitoring: Essential Commands Explained

1. uptime command

This command quickly shows the system load averages for the past 1, 5, and 15 minutes, indicating how many processes are waiting for CPU or blocked in uninterruptible I/O (state D). A high 1‑minute load compared to the 15‑minute average suggests a recent spike that needs investigation.

2. dmesg command

Displays the last 10 lines of the kernel ring buffer, revealing events such as OOM kills or TCP packet loss, which are useful clues when diagnosing performance problems.

3. vmstat command

Running vmstat 1 prints core system metrics each second. Important columns include:

r : number of processes waiting for CPU (higher than CPU cores indicates saturation).

free : available memory in kilobytes.

si and so : swap in/out rates; non‑zero values mean the system is using swap.

us, sy, id, wa, st : CPU time spent in user, system, idle, I/O wait, and stolen (hypervisor) states.

High user+system time shows CPU busy executing instructions, while high wa points to I/O bottlenecks.

4. mpstat command

Shows per‑CPU utilization; a single CPU with unusually high usage often indicates a single‑threaded workload.

5. pidstat command

Continuously reports per‑process CPU usage. In the example, two Java processes consume nearly 1600% CPU, meaning they are using about 16 CPU cores.

6. iostat command

Provides I/O statistics such as r/s, w/s, rkB/s, wkB/s (operations and throughput), await (average I/O wait time in ms), avgqu-sz (average queue length), and %util (device utilization). Values above 60% utilization or high await suggest possible I/O saturation.

7. free command

Shows memory usage; the -m flag reports in megabytes. The “-/+ buffers/cache” line reflects memory actually available to applications, as Linux uses free RAM for caching.

8. sar command

Used for network and TCP statistics. It can display device throughput (e.g., ~22 MB/s on eth0) and TCP metrics such as active/s, passive/s, and retrans/s, helping to identify network saturation or excessive connection attempts.

9. top command

Aggregates information from several previous commands, offering a real‑time snapshot of load, memory, and CPU usage with sortable columns. Because it updates continuously, pausing the refresh may be necessary to capture transient details.