Master Linux Server Performance: Essential Monitoring Tools & How to Use Them

CPU and Memory Monitoring

Linux servers expose many parameters that are crucial for both operations staff and developers when troubleshooting abnormal program behavior. Simple tools like top read data from /proc and /sys to show load averages, task states, and detailed CPU usage categories (us, sy, ni, id, wa, hi, si, st).

The first line of top displays 1‑, 5‑, and 15‑minute load averages; values exceeding the number of CPU cores indicate saturation. The second line lists task counts (running, sleeping, stopped, zombie). Subsequent columns break down CPU time by user, system, nice, idle, iowait, hardware interrupt, soft‑interrupt, and steal (relevant for virtualized environments).

High us suggests a specific process is consuming CPU, which can be identified with top and further investigated using perf. Elevated sy often points to heavy I/O or kernel activity. Excessive ni indicates manually lowered priority. Large wa means slow I/O, while high hi / si can signal hardware or driver problems. A noticeable st value may reveal CPU over‑commitment in a VM.

The memory section of top shows total, used, free, buffers, and cached memory. Buffers cache raw disk metadata, whereas Cached stores file data. Avail Mem approximates free + buffers + cached and indicates how much memory is available without swapping. Frequent swap activity signals memory pressure.

Other Command‑Line Tools

vmstat provides a snapshot of processes, memory, paging, block I/O, and CPU activity. Columns such as r (runnable processes), b (uninterruptible sleep), swpd (used swap), bi / bo (blocks in/out), in (interrupts), and cs (context switches) help assess overall load.

pidstat focuses on a single process, reporting per‑thread CPU usage, page faults (minor minflt/s, major majflt/s), stack size, and context‑switch rates. Options like -t show thread‑level details, -r displays memory faults, -s shows stack usage, -u reports CPU percentages, and -w reports voluntary and involuntary switches.

For per‑CPU load balancing on SMP systems, mpstat (e.g., mpstat -P ALL 1) reveals each core’s utilization.

Disk I/O Monitoring

iostat (e.g., iostat -xz 1) and sar -d report device‑level metrics: average queue length ( avgqu-sz), average wait ( await), service time ( svctm), and utilization ( %util). Values >1 for queue length or >60 % utilization indicate potential bottlenecks.

iotop shows real‑time per‑process disk throughput, while lsof can identify which processes hold open files or devices, useful for diagnosing un‑unmountable partitions.

Network Monitoring

netstat (e.g., netstat -s) displays cumulative protocol statistics since boot; paired with watch or differential checks it can reveal current network health. Common flags include -antp for all TCP connections and -nltp for listening sockets.

sar with -n TCP,ETCP 1 or -n UDP 1 reports per‑second TCP/UDP activity, including connection attempts, retransmissions, and error rates, helping assess network reliability.

tcpdump captures raw packets for offline analysis with Wireshark. Using filters (e.g., host, port, protocol) limits capture size and impact on the system.

These tools together form a comprehensive toolbox for Linux performance monitoring, enabling quick identification of CPU, memory, disk, and network issues.