Master Linux Process Monitoring: ps, dstat, top & htop Explained

Four Great Detectives

The "Four Great Detectives" originally appear in Wen Ruian's wuxia novels as the four elite apprentices of the righteous official Zhuge Xiaohua, each possessing a unique skill: the light‑skill weapon master “Wuqing”, the internal‑skill master “Tiehand”, the leg‑skill master “Zhuiming”, and the sword‑skill master “Lengxue”. In this article these characters are represented by Linux commands.

Wuqing: ps Tiehand: dstat Zhuiming: top Lengxue: htop

Process‑related fundamentals

Before introducing the four detectives, a brief overview of process‑related fundamentals is provided.

Light‑skill master “Wuqing” – ps

ps displays the current process status (static).

Options have three styles:

UNIX style – options start with “‑”.

BSD style – options have no leading “‑”.

GNU style – options start with “‑‑”.

Common combination: aux

a – all processes with a terminal.

x – processes without a terminal.

u – display information oriented by user.

Typical fields:

CPU% – CPU usage percentage.

MEM% – memory usage percentage.

VSZ – virtual memory size.

RSS – resident set size.

STAT – process state (R running, S sleeping, D uninterruptible, T stopped, Z zombie, + foreground, l multithreaded, N low priority, < high priority, s session leader).

Common combination: -ef

-e – show all processes.

-f – full‑format listing.

Common combination: -eFH

-F – full‑format listing.

C – CPU utilization percentage.

PSR – CPU on which the process runs.

-H – hierarchical display.

Common combination: -eo, axo

Custom fields can be specified after “o”, separated by commas. Frequently used fields: pid, ni, priority, psr, pcpu, stat, comm, tty, ppid, rtprio.

Internal‑skill master “Tiehand” – dstat

dstat is a dynamic system resource statistics command.

Typical usage: dstat [-afv] [options..] [delay [count]] Common options:

-c, –cpu – show CPU information.

-C #,#,…,total – show specific CPUs or total.

-d, –disk – show disk information.

-D sda,sdb,…,total – show specified disks.

-g – show page‑related rates.

-m – show memory statistics.

-n – show network interface statistics.

-p – show process‑related statistics.

-r – show I/O request statistics.

-s – show swap statistics.

Additional flags:

--tcp – show TCP sockets.

--udp – show UDP connections.

--raw – show raw sockets.

--socket – show sockets.

--ipc – show inter‑process communication.

--top-cpu – processes with highest CPU usage.

--top-io – processes with highest I/O usage.

--top-mem – processes with highest memory usage.

Leg‑skill master “Zhuiming” – top

top lists Linux processes dynamically.

top – 14:58:34 up 5:28, 1 user, load average: 0.01, 0.02, 0.05

Key fields:

Current time, uptime, number of users, load average.

Tasks: 353 total, 2 running, 351 sleeping, 0 stopped, 0 zombie

CPU usage line:

%Cpu(s): 0.0 us, 0.7 sy, 0.0 ni, 99.3 id, 0.0 wa, 0.0 hi, 0.0 si, 0.0 st

Memory line:

KiB Mem : 1001332 total, 681052 free, 139844 used, 180436 buff/cache

Swap line:

KiB Swap: 2098172 total, 2098172 free, 0 used. 698100 avail Mem

Typical column headers:

PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND

Sorting options within top:

P – sort by CPU %.

M – sort by memory %.

T – sort by cumulative CPU time.

Other interactive commands:

l – list open files of a process.

s – trace system calls.

t – display process hierarchy.

a – bind process to a specific CPU core.

Additional options:

-d # – set refresh interval (default 3 s).

-b – batch mode.

-n # – number of iterations.

Sword‑skill master “Lengxue” – htop

htop is an interactive process viewer.

Typical invocation: htop [-dus] Key options:

-d # – set delay interval.

-u UserName – show only processes of the specified user.

-s COLUMN – sort by the given column.

Common sub‑commands:

l – display files opened by the selected process.

s – trace system calls of the selected process.

t – show processes in a tree view.

a – bind selected process to a specific CPU core.

Source: https://www.cnblogs.com/sanyuanempire/p/6168534.html