Master Linux Process Monitoring: From ps to htop Explained

1. The Four Famous Detectives

In the original novel, the four detectives are each a master of a special skill. The article maps each to a Linux command: “Wuqing” → ps, “TieShou” → dstat, “ZhuiMing” → top, “LengXue” → htop.

2. Basic Process Concepts

A brief overview of process states and the fields displayed by monitoring commands, illustrated by a diagram.

3. Light‑skill Expert “Wuqing” – ps

ps

shows a static snapshot of current processes. It supports three option styles: UNIX (preceded by “‑”), BSD (no prefix), and GNU (double “‑”).

Common combination aux:

a – all processes with a terminal

x – processes without a terminal

u – display user‑oriented information

Typical output fields and meanings:

CPU% – CPU usage percentage

MEM% – memory usage percentage

VSZ – virtual memory size

RSS – resident set size

STAT – process state code (R running, S sleeping, D uninterruptible, T stopped, Z zombie, + foreground, l multithreaded, N low priority, < high priority, s session leader)

Other useful combos: -ef – show all processes with full format -eFH – full format plus CPU utilization (C) and CPU number (PSR) -eo or axo – custom field list, e.g.,

pid, ni, priority, psr, pcpu, stat, comm, tty, ppid, rtprio

4. Inner‑skill Master “TieShou” – dstat

dstat

is a dynamic system‑resource statistics tool.

Syntax: dstat [-afv] [options] [delay [count]] Frequently used options: -c, --cpu – CPU statistics -C #,#,…,total – specific CPUs or total -d, --disk – disk statistics -D sda,sdb,…,total – selected disks -g – paging statistics -m – memory statistics -n – network interface statistics -p – process statistics -r – I/O request statistics -s – swap statistics

Filters and top‑display options: --tcp – show TCP sockets --udp – show UDP connections --raw – show raw sockets --socket – socket information --ipc – inter‑process communication --top-cpu – process with highest CPU usage --top-io – process with highest I/O --top-mem – process with highest memory usage

5. Leg‑power Expert “ZhuiMing” – top

top

provides a real‑time, dynamic view of processes.

Typical header line example:

top – 14:58:34 up 5:28, 1 user, load average: 0.01, 0.02, 0.05

Time – current time

up – system uptime

user – number of logged‑in users

load average – 1‑, 5‑, 15‑minute load

Task summary line:

Tasks: 353 total, 2 running, 351 sleeping, 0 stopped, 0 zombie

CPU usage breakdown:

%Cpu(s): 0.0 us, 0.7 sy, 0.0 ni, 99.3 id, 0.0 wa, 0.0 hi, 0.0 si, 0.0 st

us – user space

sy – system space

ni – nice

id – idle

wa – I/O wait

hi – hardware interrupts

si – software interrupts

st – stolen (virtualization)

Memory statistics:

KiB Mem : 1001332 total, 681052 free, 139844 used, 180436 buff/cache

KiB Swap: 2098172 total, 2098172 free, 0 used. 698100 avail Mem

Sample process line and column meanings:

PID USER   PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND

PID – process ID

USER – owner

PR – priority

NI – nice value

VIRT – virtual memory size

RES – resident memory

SHR – shared memory

S – state (R, S, D, T, Z, …)

%CPU – CPU usage

%MEM – memory usage

TIME+ – cumulative CPU time

COMMAND – command name

Sorting keys: P (CPU%), M (MEM%), T (cumulative CPU time). Interactive commands include l (list open files), t (tree view), etc.

6. Sword‑skill Expert “LengXue” – htop

htop

is an interactive, colorful process viewer.

Invocation: htop [-dus] Key bindings (F1–F10) provide help, setup, search, etc.

Useful options: -d # – set refresh delay (seconds) -u UserName – show only processes of a specific user -s COLUMN – sort by a given column

Common sub‑commands: l – list files opened by a process s – trace system calls t – display processes in a tree view a – set CPU affinity for a process

The article concludes that these four commands together cover essential Linux process management for developers and system administrators.