Master Linux Process Monitoring: ps, dstat, top & htop Explained

The Four Famous Detectives

In Wen Ruan‑an’s wuxia novels, the Four Famous Detectives are the four elite disciples of the righteous official Zhuge Xiaohua, each mastering a unique skill: the light‑skill weapon master Wuqing , the internal‑skill master Tieshou , the leg‑skill master Zhuiming , and the sword‑skill master Lengxue .

In this article, these characters are represented by Linux commands:

Wuqing – ps Tieshou – dstat Zhuiming – top Lengxue –

htop

1. Process‑Related Fundamentals

Before diving into the four commands, a brief overview of Linux process concepts is provided (see diagram).

2. Light‑Skill Weapon Master “Wuqing” – ps

The ps command displays a snapshot of current processes. It supports three option styles:

UNIX style – options prefixed with - BSD style – options without a prefix

GNU style – options prefixed with -- Common option combination aux: a: all processes with a terminal x: processes without a terminal u: display user‑oriented information

Additional fields displayed by aux include: CPU%: CPU usage percentage MEM%: memory usage percentage VSZ: virtual memory size RSS: resident set size

Process state codes ( STAT) such as R (running), S (sleeping), D (uninterruptible sleep), T (stopped), Z (zombie), + (foreground), l (multithreaded), N (low priority), < (high priority), s (session leader).

Common option combination – -ef

-e

: show all processes -f: full‑format listing

Common option combination – -eFH

-F

: full‑format with additional fields C: CPU utilization PSR: CPU on which the process runs

Common option combination – -eo, axo

Custom field list: field1,field2,… . Frequently used fields: pid, ni, priority, psr, pcpu, stat, comm, tty, ppid, rtprio .

3. Iron‑Hand Master “Tieshou” – dstat

dstat

is a dynamic system‑resource statistics tool. dstat [-afv] [options..] [delay [count]] Key options: -c, --cpu: CPU statistics -C #,#,…,total: specific CPUs or total -d, --disk: disk statistics -D sda,sdb,…,total: selected disks -g: page‑related rates -m: memory statistics -n: network interface statistics -p: process statistics -r: I/O request statistics -s: swap statistics

Additional network options: --tcp: show TCP sockets --udp: show UDP connections --raw: show raw sockets --socket: sockets --ipc: inter‑process communication info

Top‑resource options: --top-cpu: processes with highest CPU usage --top-io: processes with highest I/O usage --top-mem: processes with highest memory usage

4. Leg‑Skill Master “Zhuiming” – top

top

provides a dynamic, real‑time view of Linux processes.

top – 14:58:34 up 5:28, 1 user, load average: 0.01, 0.02, 0.05

Key fields in the header line:

Current time

Uptime

Number of logged‑in users

Load averages

Task summary line example:

Tasks: 353 total, 2 running, 351 sleeping, 0 stopped, 0 zombie

CPU usage line example:

%Cpu(s): 0.0 us, 0.7 sy, 0.0 ni, 99.3 id, 0.0 wa, 0.0 hi, 0.0 si, 0.0 st

Memory usage line example:

KiB Mem : 1001332 total, 681052 free, 139844 used, 180436 buff/cache

Swap usage line example:

KiB Swap: 2098172 total, 2098172 free, 0 used. 698100 avail Mem

Process list header:

PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND

Example process line:

3077 root 20 0 146276 2256 1420 R 1.7 0.2 0:02.91 top

Sorting options within top: P: sort by CPU usage M: sort by memory usage T: sort by cumulative CPU time

Additional interactive commands: u: display uptime information (via l command) t: show tasks and CPU info (via t command) m: display memory info (via m command) q: quit s: change refresh interval k: kill a specific process

5. Sword‑Skill Master “Lengxue” – htop

htop

is an interactive process viewer with a richer UI. htop [-dus] Key function keys (F1–F10) provide help, setup, and various display options.

Common options: -d #: set delay interval -u UserName: show processes of a specific user -s COLUMN: sort by a specific column

Useful sub‑commands: l: list open files of selected process s: trace system calls of selected process t: display process tree a: bind selected process to a specific CPU core

Display elements can be added as [Bar], [Text], [Graph] or [LED].

Conclusion

By associating each Linux monitoring command with a character from the Four Famous Detectives, this article provides a memorable framework for understanding and using ps, dstat, top, and htop to monitor processes, CPU, memory, disk, and network resources on Linux systems.