Master Linux Process Tools: ps, top, htop, dstat, and More

Process Basics

Before diving into the four "legendary detectives" of Linux commands, a quick overview of process concepts is presented, illustrated with a diagram showing process states and relationships.

Light‑skill Master "Wuqing" – ps

ps

displays static snapshots of current processes. It supports three option styles: UNIX (prefixed with -), BSD (no prefix), and GNU (double --). A common combination is ps aux, where: a: all processes with a terminal x: processes without a terminal u: user‑oriented output

Key fields include CPU%, MEM%, VSZ (virtual size), RSS (resident set), and STAT (process state codes such as R, S, D, T, Z, +, l, N, <, s).

Common options: -ef: show all processes in full format

Custom output can be defined with -eo or axo, specifying fields like pid, ni, priority, psr, pcpu, stat, comm, tty, ppid, rtprio.

Inner‑skill Master "Tiehand" – dstat

dstat

provides dynamic system resource statistics. Basic syntax: dstat [-afv] [options] [delay [count]]. Frequently used options: -c, --cpu: CPU statistics -C #,#,…,total: specific CPUs or total -d, --disk: disk I/O -D sda,sdb,…: selected disks -g: paging activity -m: memory usage -n: network interfaces -p: process statistics -r: I/O requests -s: swap usage

Additional flags display TCP/UDP sockets, raw sockets, IPC info, and top‑consuming resources ( --top-cpu, --top-io, --top-mem).

Leg‑skill Master "Zhuiming" – top

top

offers a live, interactive view of processes. Example header:

top – 14:58:34 up 5:28, 1 user, load average: 0.01, 0.02, 0.05

Key sections:

Tasks summary (total, running, sleeping, stopped, zombie)

CPU usage breakdown (%us, %sy, %ni, %id, %wa, %hi, %si, %st)

Memory statistics (total, free, used, buff/cache)

Swap statistics

Process list columns include PID, USER, PR, NI, VIRT, RES, SHR, S, %CPU, %MEM, TIME+, COMMAND. Sorting shortcuts: P (CPU), M (memory), T (time). Interactive commands: t (tasks & CPU), m (memory), q (quit), s (change refresh interval), k (kill process), with options like -d # (delay), -b (batch mode), -n # (iterations).

Sword‑skill Master "Lengxue" – htop

htop

is an enhanced, interactive process viewer. Basic usage: htop [-dus]. It supports function keys for help (F1) and various display options. Common options: -d #: delay interval -u UserName: filter by user -s COLUMN: sort by column

Additional commands: l: list open files of a process s: trace system calls t: tree view of processes a: bind process to a specific CPU core

The guide concludes with a brief invitation for feedback.