Master Linux Process Monitoring: ps, dstat, top & htop Explained

Four Famous Detectives as Linux Commands

The classic "Four Great Detectives" from Wen Ruian's wuxia novels are reimagined as Linux commands: Wuqing (ps), Tieshou (dstat), Zhuiming (top), and Lengxue (htop). Each command embodies a distinct monitoring ability.

Process Basics

Before diving into the tools, a brief overview of Linux processes is provided (see the diagram).

ps – Process Status

ps displays a snapshot of current processes. It supports three option styles:

UNIX style (options prefixed with -)

BSD style (options without a prefix)

GNU style (options prefixed with --)

Common combination: aux

a – all processes with a terminal

x – processes without a terminal

u – user-oriented output

Key fields:

CPU% – CPU usage percentage

MEM% – memory usage percentage

VSZ – virtual memory size

RSS – resident set size

STAT – process state

STAT codes:

R – running

S – interruptible sleep

D – uninterruptible sleep

T – stopped

Z – zombie

+ – foreground process

l – multithreaded

N – low priority

< – high priority

s – session leader

Common combination: -ef

-e – show all processes

-f – full‑format listing

Common combination: -eFH

-F – full format

C – CPU utilization

PSR – CPU number

-H – hierarchical view

Custom output: -eo or axo

Fields can be selected with -o field1,field2,…. Frequently used fields include pid, ni, priority, psr, pcpu, stat, comm, tty, ppid, rtprio.

pid – process ID

ni – nice value

priority – scheduling priority

psr – CPU the process runs on

pcpu – CPU usage

stat – state code

comm – command name

tty – controlling terminal

ppid – parent PID

rtprio – real‑time priority

dstat – Dynamic System Statistics

dstat provides real‑time statistics of system resources.

-c, –cpu – CPU info

-C #,#,… – specific CPUs or total

-d, –disk – disk info

-D sda,sdb,… – selected disks

-g – page‑related rates

-m – memory stats

-n – network interface stats

-p – process stats

-r – I/O request stats

-s – swap stats

Additional socket options:

--tcp – TCP sockets

--udp – UDP connections

--raw – raw sockets

--socket – sockets

--ipc – inter‑process communication

--top-cpu – top CPU consumers

--top-io – top I/O consumers

--top-mem – top memory consumers

top – Interactive Process Viewer

top shows a dynamic, real‑time view of processes.

top – 14:58:34 up 5:28, 1 user, load average: 0.01, 0.02, 0.05

Current time, uptime, logged‑in users, load averages

Tasks: 353 total, 2 running, 351 sleeping, 0 stopped, 0 zombie

Task summary: total, running, sleeping, stopped, zombie

%Cpu(s): 0.0 us, 0.7 sy, 0.0 ni, 99.3 id, 0.0 wa, 0.0 hi, 0.0 si, 0.0 st

CPU usage breakdown (user, system, nice, idle, iowait, hardware interrupt, software interrupt, stolen)

KiB Mem : 1001332 total, 681052 free, 139844 used, 180436 buff/cache

Memory: total, free, used, buffers/cache

KiB Swap: 2098172 total, 2098172 free, 0 used. 698100 avail Mem

Swap: total, free, used, available memory

Column meanings:

PID – process ID

USER – owner

PR – priority

NI – nice value

VIRT – virtual memory size

RES – resident memory size

SHR – shared memory

S – state

%CPU – CPU usage

%MEM – memory usage

TIME+ – cumulative CPU time

COMMAND – command line

Sorting keys: P (CPU), M (memory), T (time). Interactive keys include q (quit), s (change delay), k (kill), etc.

htop – Enhanced Interactive Process Viewer

htop is a more feature‑rich, interactive alternative to top.

-d # – set delay interval

-u UserName – show processes of a specific user

-s COLUMN – sort by a column

Common subcommands:

l – list open files of a process

s – trace system calls of a process

t – display processes in a tree view

a – bind a process to a specific CPU core