Master Linux Performance Monitoring: Top, Free, and Vmstat Commands Explained

The article offers a detailed tutorial on three essential Linux performance monitoring commands— top , free , and vmstat —including their usage, parameters, example outputs, and how to interpret the results for system optimization.

1. top command

Purpose: Real‑time process and resource monitoring, similar to Windows Task Manager.

Command format: top [options] Key features: dynamic display, interactive key controls, customizable view.

Common options:

-b Batch mode

-c Show full command line

-I Ignore idle processes

-s Secure mode

-S Cumulative mode

-i<time> Set refresh interval

-u<user> Show processes of a specific user

-p<pid> Show a specific process

-n<count> Number of iterations

Example usage: top Sample output (truncated):

[root@TG1704 log]# top - 14:06:23 up 70 days, 16:44,  2 users,  load average: 1.25, 1.32, 1.35
Tasks: 206 total,   1 running, 205 sleeping,   0 stopped,   0 zombie
Cpu(s):  5.9%us,  3.4%sy,  0.0%ni, 90.4%id,  0.0%wa,  0.0%hi,  0.2%si,  0.0%st
Mem:  32949016k total, 14411180k used, 18537836k free,   169884k buffers
Swap: 32764556k total,        0k used, 32764556k free,  3612636k cached

Interpretation of the first five lines:

Line 1 – Current time, uptime, number of users, and load averages (1‑, 5‑, 15‑minute).

Line 2 – Task summary: total, running, sleeping, stopped, zombie processes.

Line 3 – CPU usage breakdown: user (%us), system (%sy), nice (%ni), idle (%id), I/O wait (%wa), hardware IRQ (%hi), software IRQ (%si), stolen (%st).

Line 4 – Memory usage: total, used, free, buffers.

Line 5 – Swap usage: total, used, free, cached.

Subsequent lines list each process with fields such as PID, USER, PR, NI, VIRT, RES, SHR, S, %CPU, %MEM, TIME+, COMMAND.

Additional tips:

Press 1 to view per‑CPU statistics.

Press b to toggle highlighting of the current running process.

Press x to highlight the sorted column.

Use Shift+> or Shift+< to change the sort column (e.g., sort by %MEM).

2. free command

Purpose: Show memory usage (physical, swap, buffers, cache) in a concise format.

Command format: free [options] Common options:

-b Show values in bytes

-k Show values in kilobytes (default)

-m Show values in megabytes

-g Show values in gigabytes

-o Omit the buffer/cache line

-s <seconds> Continuously monitor memory

-t Show total memory line

-V Display version information

Example usage:

free

free -g

free -m

Sample output:

total       used       free     shared    buffers     cached
Mem:      32940112   30841684    2098428          0    4545340   11363424
-/+ buffers/cache:   14932920   18007192
Swap:     32764556    1944984   30819572

The second line ( -/+ buffers/cache) shows memory actually available to applications (buffers and cache are considered free from an application perspective). The article explains the difference between the OS view (including buffers/cache as used) and the application view (excluding them).

Additional examples:

free -t

free -s 10

Explanation of fields:

total : total physical memory.

used : memory currently used.

free : memory not used at all.

shared : memory used by multiple processes.

buffers : memory used by kernel buffers.

cached : memory used for page cache.

Formula for available memory (application view): free + buffers + cached. The article also discusses when swap becomes active and how to interpret swap usage.

3. vmstat command

Purpose: Report virtual memory statistics, process, CPU, and I/O activity.

Command format:

vmstat [-a] [-n] [-S unit] [delay [count]]
vmstat [-s] [-n] [-S unit]
vmstat [-m] [-n] [delay [count]]
vmstat [-d] [-n] [delay [count]]
vmstat [-p device] [-n] [delay [count]]
vmstat [-f]
vmstat [-V]

Key options:

-a Show active and inactive memory.

-f Show total number of forks since boot.

-m Show slabinfo.

-d Show disk statistics.

-p <device> Show statistics for a specific block device.

-s Show memory‑related statistics.

-S <unit> Choose display unit (k, K, m, M).

-V Version.

Example usage: vmstat Typical output (first line is a header, second line is the snapshot):

procs -----------memory---------- ---swap-- -----io---- --system-- -----cpu------
 r  b   swpd   free   buff  cache   si   so    bi    bo   in   cs us sy id wa st
 0  0      0 3029752 4545340 11363424   0    0     0     0 100   0  5  0 95  0  0

Field explanations:

procs : r – runnable processes; b – processes blocked for I/O.

memory : swpd – virtual memory used; free – idle memory; buff – buffer memory; cache – page cache.

swap : si – pages swapped in per second; so – pages swapped out per second.

io : bi – blocks received from a block device; bo – blocks sent to a block device.

system : in – interrupts per second; cs – context switches per second.

cpu : us – user time; sy – system time; id – idle time; wa – I/O wait; st – stolen time.

Additional examples: vmstat 5 5 Collects five samples at five‑second intervals. vmstat -a 2 5 Shows active/inactive memory with a 2‑second delay, five times. vmstat -f Displays total number of forks since boot (e.g., 12744849 forks). vmstat -s Shows a detailed list of memory statistics (total, used, free, buffers, cached, swap, etc.). vmstat -d Displays per‑device I/O statistics (reads, writes, sectors, etc.). vmstat -p /dev/sda1 Shows read/write counts for the specified block device. vmstat -m Shows slab allocator information (object caches, sizes, number of objects).

The article also discusses how to interpret high load (r > 4, id < 40), memory pressure (si/so > 0), and I/O bottlenecks (high bi/bo with b > 3), and warns about thrashing when paging activity dominates CPU time.

© Article reproduced from "高效运维" (original author retains copyright).