Master Linux Performance Monitoring: Top, Free, and vmstat Commands Explained

Top Command Overview

The top utility displays a dynamic, real‑time view of running processes, similar to Windows Task Manager, and is the primary tool for monitoring CPU, memory and process state on Linux.

Command format : top [options] Key options :

-b Batch mode (suitable for scripting)

-c Show the full command line

-I Ignore idle processes

-s Secure mode (no interactive commands)

-S Cumulative mode (shows per‑process CPU time)

-i<seconds> Set refresh interval

-u<user> Show only processes owned by the specified user

-p<pid> Show only the specified process

-n<count> Number of iterations before exiting

Typical interactive shortcuts (press while top is running):

1 Toggle per‑CPU statistics

b Highlight the currently running process

x Highlight the current sort column

Shift+> / Shift+< Change the sort column (e.g., to %MEM)

Sample output (truncated for brevity):

[root@TG1704 log]# top
14:06:23 up 70 days, 16:44, 2 users, load average: 1.25, 1.32, 1.35
Tasks: 206 total, 1 running, 205 sleeping, 0 stopped, 0 zombie
Cpu(s): 5.9%us, 3.4%sy, 0.0%ni, 90.4%id, 0.0%wa, 0.0%hi, 0.2%si, 0.0%st
Mem: 32949016k total, 14411180k used, 18537836k free, 169884k buffers
Swap: 32764556k total, 0k used, 32764556k free, 3612636k cached
PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND
28894 root 22 0 1501m 405m 10m S 52.2 1.3 2534:16 java
...

The first five lines constitute the summary area, showing overall system load, task counts, CPU utilisation percentages, memory totals and swap usage. Subsequent rows list each process with fields such as PID, user, priority, nice value, virtual/resident/shared memory, state, CPU % and memory %.

Free Command Overview

The free command reports the amount of physical and swap memory that is used and available, optionally displaying buffers and cache.

Command format : free [options] Important options :

-b Show values in bytes

-k Show values in kilobytes (default)

-m Show values in megabytes

-g Show values in gigabytes

-o Omit the buffers/cache line

-s <seconds> Refresh continuously at the given interval

-t Add a total line that sums RAM and swap

-V Display version information

Sample usage :

free
free -g
free -m

Sample output (partial):

[root@SF1150 service]# free
              total       used       free     shared    buffers     cached
Mem:      32940112   30841684    2098428          0    4545340   11363424
-/+ buffers/cache:   14932920   18007192
Swap:     32764556    1944984   30819572

Key columns:

total – total size of RAM or swap

used – memory currently allocated (including buffers/cache for the first line)

free – memory not used at all

buffers – memory used for block device buffers

cached – page cache (disk‑cached file data)

When assessing memory from an application perspective, the "‑/+ buffers/cache" line is more relevant because buffers and cache can be reclaimed quickly.

vmstat Command Overview

vmstat

(Virtual Memory Statistics) provides a snapshot of overall system activity, including processes, memory, paging, block I/O, traps and CPU usage. It is lightweight and suitable for long‑running monitoring.

Command formats (several variants are accepted):

vmstat [-a] [-n] [-S unit] [delay [count]]
vmstat [-s] [-n] [-S unit]
vmstat [-m] [-n] [delay [count]]
vmstat [-d] [-n] [delay [count]]
vmstat [-p device] [-n] [delay [count]]
vmstat -f
vmstat -V

Common options :

-a Show active and inactive memory

-f Display the number of forks since boot

-m Show slab (kernel memory cache) information

-n Print column headings only once

-s Show detailed memory statistics

-d Display per‑device I/O statistics

-p <device> Show statistics for a specific block device

-S <unit> Force output unit (k, K, m, M)

delay Refresh interval in seconds (default: one snapshot)

count Number of snapshots to produce (default: infinite when delay is set)

Example: basic usage vmstat Typical output (first line shows headings, second line the values):

procs -----------memory---------- ---swap-- -----io---- --system-- -----cpu------
 r  b   swpd   free  inact active   si   so    bi    bo   in   cs us sy id wa st
 0  0      0 3029752 387728 513076    0    0     0     0 1005   34  0  0 100  0  0

Important fields:

r – number of processes waiting for CPU time

b – processes blocked for I/O

swpd – virtual memory used (swap)

free – idle memory

inact / active – inactive and active memory (shown with -a)

si / so – swap‑in and swap‑out rates (KB/s)

bi / bo – blocks received from / sent to block devices

us / sy / id / wa / st – CPU time spent in user, system, idle, I/O wait and stolen (virtualized) states

Typical interpretation: a consistently high r value (e.g., >4) with low id (<40 %) indicates CPU saturation; non‑zero si/so suggests memory pressure; high bi/bo together with a large b queue points to I/O bottlenecks.

Additional examples illustrate how to monitor a specific device ( vmstat -p /dev/sda1), view slab caches ( vmstat -m), or obtain cumulative statistics ( vmstat -s).

Understanding these tools and their output enables administrators to diagnose performance problems, plan capacity, and tune the Linux kernel for optimal operation.