Master Linux Process Monitoring: ps, dstat, top & htop Explained

1. The Four Famous Detectives

In Wen Ruian's wuxia novels, the Four Famous Detectives are the four disciples of the righteous official Zhuge Xiaohua, each with a unique skill: "Wuqing" (light‑skill and hidden weapons), "Tie Shou" (internal skill), "Zhui Ming" (leg skill), and "Leng Xue" (swordsmanship). In this article they are mapped to Linux commands:

Wuqing: ps Tie Shou: dstat Zhui Ming: top Leng Xue: htop

2. Basic Process Concepts

Before introducing the four tools, a brief overview of processes is presented (see diagram).

3. Light‑Skill Master "Wuqing" – ps

ps

displays the current process status (static). Common usage styles:

UNIX style: options start with “-”

BSD style: options without “-”

GNU style: options start with “--”

Typical option combination: aux

a – all processes with a terminal

x – processes without a terminal

u – display user‑oriented information

Key fields:

CPU% – CPU usage percentage

MEM% – memory usage percentage

VSZ – virtual memory size

RSS – resident set size

STAT – process state (R, S, D, T, Z, +, l, N, <, s)

Other useful options:

-ef – show all processes in full format

-eFH – show full format with CPU utilization, CPU number, and hierarchical view

-eo, axo – custom field list (e.g., pid, ni, priority, psr, pcpu, stat, comm, tty, ppid, rtprio)

4. Internal‑Skill Master "Tie Shou" – dstat

dstat

is a dynamic system‑resource statistics tool.

Common options:

-c, –cpu – CPU statistics

-d, –disk – Disk statistics

-g – page‑related rates

-m – memory statistics

-n – network interface statistics

-p – process statistics

-r – I/O request statistics

-s – swap statistics

--tcp, --udp, --raw, --socket – socket information

--ipc – inter‑process communication

--top-cpu, --top-io, --top-mem – top consumers of CPU, I/O, memory

5. Leg‑Skill Master "Zhui Ming" – top

top

provides a dynamic, real‑time view of Linux processes.

<code>top – 14:58:34 up 5:28, 1 user, load average: 0.01, 0.02, 0.05</code>

Key sections:

Tasks: total, running, sleeping, stopped, zombie

%Cpu(s): user, system, nice, idle, iowait, hardware interrupt, software interrupt, stolen

KiB Mem: total, free, used, buff/cache

KiB Swap: total, free, used, available

Process list columns include PID, USER, PR, NI, VIRT, RES, SHR, S, %CPU, %MEM, TIME+, COMMAND.

Sorting keys:

P – sort by CPU usage

M – sort by memory usage

T – sort by accumulated CPU time

Interactive commands:

l – show open files of selected process

t – tree view of processes

m – memory view

q – quit

s – change refresh interval

k – kill a process (options: -d # interval, -b batch mode, -n # batches)

6. Sword‑Skill Master "Leng Xue" – htop

htop

is an interactive process viewer with a colorful interface.

Common options:

-d # – delay time interval

-u UserName – show processes of a specific user

-s COLUMN – sort by a specific column

Useful sub‑commands:

l – list open files of selected process

s – trace system calls of selected process

t – hierarchical view of processes

a – bind selected process to a specific CPU core