Master Linux Process Monitoring: ps, dstat, top, and htop Explained

1. The Four Famous Detectives

The original "Four Famous Detectives" are characters from a wuxia novel, each representing a unique skill. In this article they are re‑imagined as Linux commands: ps – "Wuqing" (light‑skill weapon master) dstat – "Tie Shou" (internal‑skill master) top – "Zhui Ming" (leg‑skill master) htop – "Leng Xue" (sword‑skill master)

2. Basic Process Knowledge

Before diving into the commands, a brief overview of Linux processes is presented (see diagram).

3. Light‑Skill Weapon Master “Wuqing” – ps

ps

displays the current process status (static). It supports three option styles:

UNIX style – options prefixed with “-”

BSD style – options without “-”

GNU style – options prefixed with “--”

Common combination: ps aux a : processes attached to a terminal

x : processes without a terminal

u : display user‑oriented information

Key fields:

CPU% : CPU usage percentage

MEM% : memory usage percentage

VSZ : virtual memory size

RSS : resident set size

STAT : process state (R, S, D, T, Z, +, l, N, <, s)

Other useful options: -ef: show all processes in full format -eFH: full format with hierarchy -eo or axo: custom output fields (e.g., pid, ni, priority, psr, pcpu, stat, comm, tty, ppid, rtprio)

4. Internal‑Skill Master “Tie Shou” – dstat

dstat – dynamic system resource statistics

Common options: -c, --cpu: CPU statistics -d, --disk: disk statistics -g: page‑related rates -m: memory statistics -n: network interface statistics -p: process statistics -r: I/O request statistics -s: swap statistics

Additional filters: --tcp, --udp, --raw, --socket, --ipc, --top-cpu, --top-io, --top-mem.

5. Leg‑Skill Master “Zhui Ming” – top

top – dynamic real‑time process viewer

Typical header line:

top – 14:58:34 up 5:28, 1 user, load average: 0.01, 0.02, 0.05

Key sections:

Tasks: total, running, sleeping, stopped, zombie

CPU usage breakdown (%us, %sy, %ni, %id, %wa, %hi, %si, %st)

Memory summary (total, free, used, buff/cache)

Swap summary (total, free, used, avail)

Process list columns: PID, USER, PR, NI, VIRT, RES, SHR, S, %CPU, %MEM, TIME+, COMMAND.

Sorting keys: P (CPU%), M (MEM%), T (CPU time).

Interactive commands: l: show open files of selected process t: show tasks and CPU info m: memory info q: quit s: change refresh interval k: kill a process

Options for refresh interval and batch mode: -d #, -b, -n #.

6. Sword‑Skill Master “Leng Xue” – htop

htop – interactive process viewer

Key options: -d #: delay time -u USER: show processes of a specific user -s COLUMN: sort by a column

Useful sub‑commands: l: list open files of a process s: trace system calls t: hierarchical view of processes a: bind a process to a CPU core

Display customization can include bars, text, graphs, or LEDs.