Master Linux Process Tools: ps, top, dstat, and htop Explained

The article introduces a playful analogy that links four famous characters from a Chinese wuxia novel to four essential Linux process‑monitoring commands, helping readers remember each tool’s purpose:

1. The Four Great Detectives

Wuqing (ps) : static process snapshot.

TieShou (dstat) : dynamic system‑resource statistics.

ZhuiMing (top) : real‑time process list.

LengXue (htop) : interactive, colorful process viewer.

2. Process Fundamentals

A brief overview of process concepts is provided with a diagram of process states (running, sleeping, zombie, etc.).

3. Using ps

ps

displays current processes (non‑dynamic). Three option styles are described (UNIX, BSD, GNU) and common combinations such as aux are explained, detailing each field (CPU%, MEM%, VSZ, RSS, STAT, etc.). Additional useful formats include -ef and custom field lists with -eo or axo, listing fields like pid, ni, priority, psr, pcpu, stat, comm, ppid, rtprio.

4. Using dstat

dstat

provides live system‑resource statistics. Common options are listed, e.g., -c/--cpu, -d/--disk, -g (page), -m (memory), -n (network), -p (process), -r (io), -s (swap), plus filters for TCP/UDP sockets and top‑resource consumers ( --top-cpu, --top-io, --top-mem).

5. Using top

top

shows a dynamic, sortable process list. The article explains the header line (time, uptime, users, load average) and the task summary (total, running, sleeping, stopped, zombie). It details CPU usage breakdown (%us, %sy, %ni, %id, %wa, %hi, %si, %st) and memory statistics (total, free, used, buff/cache). Field meanings (PID, USER, PR, NI, VIRT, RES, SHR, S, %CPU, %MEM, TIME+, COMMAND) are enumerated, as well as sorting shortcuts (P for CPU, M for memory, T for time). Keyboard shortcuts for changing display (u, s, t, a, etc.) are also covered.

6. Using htop

htop

is presented as a more powerful, interactive alternative to top. The help screen (F1) and function keys (F1‑F10) are mentioned. Options such as -d # (delay), -u UserName (filter by user), and -s COLUMN (sort) are described. Common sub‑commands (l, s, t, a) for file list, system‑call tracing, hierarchical view, and CPU binding are listed. The article notes that display elements can be customized as bars, text, graphs, or LEDs.

7. Visual Aids

Numerous screenshots illustrate each command’s output and key sections, reinforcing the textual explanations.

Overall, the guide offers a comprehensive reference for Linux administrators and developers who need to monitor processes and system resources efficiently.