Master Linux System Monitoring: htop, top, CPU, Memory, and Process Insights

htop/top

htop covers most metrics; use its help for details. Sort by memory, CPU, or state, filter, select fields, and view process counts.

CPU Basic Information

In Linux everything is a file; view /proc/cpuinfo for CPU count, model, and frequency.

cat /proc/cpuinfo
cat /proc/stat

Load Average

Use uptime or w to display 1‑, 5‑, and 15‑minute load averages; sar -q shows dynamic load.

$ uptime
$ w

Load average is the average number of runnable or uninterruptible processes. On a 4‑core CPU, a load above 4 indicates overload.

Dynamic Load Average

$ sar -q 1 100
Linux 3.10.0-957.21.3.el7.x86_64 (shanyue) 10/21/19 _x86_64_ (2 CPU)

16:55:52      runq-sz  plist-sz   ldavg-1   ldavg-5  ldavg-15   blocked
16:55:53            0       464      0.07      0.11      0.13         0
...

CPU Usage

htop/top shows CPU usage; idle time is displayed. CPU utilization = 1 - idle/total.

$ top
%Cpu(s):  7.4 us,  2.3 sy,  0.0 ni, 90.1 id,  0.0 wa,  0.0 hi,  0.2 si,  0.0 st

Fields: user, system, nice, idle, iowait, irq, softirq, steal.

System Calls

Use strace to trace system calls.

# Trace a specific process
strace -p 7477

# Trace a command
strace cat index.js

# Show call counts and CPU time
strace -p 7477 -c

Memory

free

shows system memory; pidstat -r or htop show per‑process memory.

$ free -h
              total        used        free      shared  buff/cache   available
Mem:          3.7G        682M        398M        2.1M        2.6G        2.7G
Swap:            0B          0B          0B

Processes

Common tasks: find PID by command name or arguments, list process states, get CPU or memory usage.

# Show process 122
ps 122

# Find PIDs by command name
pgrep -a node

# Find PIDs by command and arguments
pgrep -af ts-node

# Show process status
cat /proc/122/status

# Print parent tree with arguments
pstree 122 -sap

Process States

D – uninterruptible sleep (usually I/O) R – running or runnable S – interruptible sleep T – stopped by job control t – stopped by debugger W – paging (obsolete) X – dead Z – zombie

htop/top can display these states, useful for spotting zombies or high load.

Process Memory

ps -O rss

shows resident set size; top, htop, and pidstat -r are also useful.

# Show RSS for PID 2579
ps -O rss 2579
PID   RSS S TTY          TIME COMMAND
2579 19876 S pts/10    00:00:03 node index.js

Real‑time Process Memory

$ pidstat -sr -p 23097 1 5
Linux 3.10.0-693.2.2.el7.x86_64 (shanyue) 07/18/19 _x86_64_ (2 CPU)

18:56:07      UID       PID  minflt/s  majflt/s     VSZ    RSS   %MEM StkSize  StkRef  Command
18:56:08        0     23097      0.00      0.00  366424  95996   2.47    136      80  node
...

Page Faults

In pidstat output, minflt = minor page faults, majflt = major page faults.

$ pidstat -s -p 23097 1 5
...

Redirect Output to File

Standard output can be redirected using shell redirection operators (e.g., >).

List Open Files

$ lsof
COMMAND   PID   TID USER   FD TYPE DEVICE SIZE/OFF NODE NAME
systemd     1          root cwd DIR   253,1   4096   2 /
...

Container Namespace PID ↔ Global PID Mapping

To find the host PID from a container PID, inspect /proc/$pid/sched inside the container or use docker inspect on the host.

# Inside container, PID 122
cat /proc/122/sched
node (7477, #threads: 7)

# Host side, global PID 7477
ps -fp 7477
UID   PID  PPID C STIME TTY          TIME CMD
root 7477  7161 0 Jul10 ?        00:00:38 node index.js

To map a host PID to its container, use Docker inspection or cgroup files.

# Find container by host PID
docker ps -q | xargs docker inspect --format '{{.State.Pid}}, {{.ID}}' | grep 22932

# Or read cgroup information
cat /etc/22932/cgroup

Swap

$ vmstat -s
...

Inode

$ ls -lahi
...

Network Throughput

Bandwidth is the maximum link rate; throughput is the actual data transferred per unit time (b/s, KB/s, MB/s). PPS = packets per second.

# Show interface stats
ifconfig eth0

# Show per‑second stats
sar -n DEV 1 | grep eth0
# IFACE   rxpck/s txpck/s rxkB/s txkB/s ...

Socket Status

Use ss for modern socket inspection; netstat remains useful, especially inside containers.

Socket Information

# TCP all states, numeric, show PID
netstat -tanp
Proto Recv-Q Send-Q Local Address          Foreign Address        State       PID/Program name
tcp        0      0 127.0.0.11:35283      0.0.0.0:*              LISTEN      -
...

Non‑zero Recv‑Q or Send‑Q indicates packet backlog.

Protocol Information

# Statistics per protocol
netstat -s
ss -s
# Count established sockets
netstat -tanp | grep ESTAB | wc -l

PostgreSQL Max and Current Connections

show max_connections;
select count(*) from pg_stat_activity;

MySQL Max and Current Connections

show variables like 'max_connections';
show full processlist;