Master Linux System Monitoring: htop, top, pidstat and More

htop/top

htop covers most metrics; see its help for details. Sort by memory, CPU, or state to locate high‑resource processes, especially when load average is high.

CPU Basic Information

All Linux resources are files; view /proc/cpuinfo for details. Use the following commands to inspect CPU count, model, and frequency:

cat /proc/cpuinfo<br/>cat /proc/stat

Load Average

Use uptime or w to display 1‑, 5‑, and 15‑minute load averages. sar -q shows dynamic load.

$ uptime<br/>19:28:49 up 290 days, 20:25,  1 user,  load average: 2.39, 2.64, 1.55<br/>$ w<br/>19:29:50 up 290 days, 20:26,  1 user,  load average: 2.58, 2.63, 1.61

Load average is the average number of processes in runnable or uninterruptible state; on a 4‑core CPU, a value above 4 indicates overload.

Dynamic Load Average

$ sar -q 1 100<br/>Linux 3.10.0-957.21.3.el7.x86_64 (shanyue) 10/21/19 _x86_64_ (2 CPU)<br/><br/>16:55:52  runq-sz  plist-sz  ldavg-1  ldavg-5  ldavg-15  blocked<br/>16:55:53          0       464      0.07      0.11      0.13          0<br/>...

CPU Usage

Use htop or top to view CPU usage; idle time is shown directly.

$ top<br/>%Cpu(s):  7.4 us,  2.3 sy,  0.0 ni, 90.1 id,  0.0 wa,  0.0 hi,  0.2 si,  0.0 st

Fields: user (us), system (sy), nice (ni), idle (id), iowait (wa), irq (hi), softirq (si), steal (st).

System Calls

Use strace to trace system calls.

# View system calls of a process<br/>$ strace -p 7477<br/><br># Show which calls a command uses<br/>$ strace cat index.js<br/><br># Show call counts and CPU time<br/>$ strace -p 7477 -c

Memory

Use free -h for overall memory, pidstat -r or htop for per‑process memory.

$ free -h<br/>total        used        free      shared  buff/cache   available<br/>Mem:          3.7G       682M       398M       2.1M       2.6G       2.7G<br/>Swap:          0B         0B         0B

Processes

Common questions: find a process by command name or arguments, list process states, get CPU or memory usage.

# Find PID by command name<br/>$ pgrep -a node<br/>26464 node /code/node_modules/.bin/ts-node index.ts<br/>30549 node server.js<br/><br># Show process details<br/>$ ps 122<br/><br># Show parent tree<br/>$ pstree 122 -sap

Process States

D (uninterruptible sleep), R (running), S (interruptible sleep), T (stopped), t (traced), W (paging, obsolete), X (dead), Z (zombie).

Use top to see state counts, e.g.,

Tasks: 214 total, 1 running, 210 sleeping, 0 stopped, 3 zombie

.

Process Memory

# Show RSS for PID 2579<br/>$ ps -O rss 2579<br/>PID   RSS S TTY          TIME COMMAND<br/>2579 19876 S pts/10 00:00:03 node index.js

Real‑time Process Memory

# pidstat -sr -p 23097 1 5<br/>Linux 3.10.0-693.2.2.el7.x86_64 (shanyue) 07/18/19 _x86_64_ (2 CPU)<br/><br/>18:56:07  UID   PID  minflt/s  majflt/s  VSZ    RSS  %MEM StkSize StkRef Command<br/>18:56:08   0 23097   0.00      0.00   366424 95996 2.47   136     80   node

Page Faults

In pidstat -s, minflt and majflt represent minor and major page faults.

Swap

$ vmstat -s

Inode

$ ls -lahi

Network Throughput

Bandwidth is the maximum link rate; throughput is the actual data transferred per unit time (b/s, KB/s, MB/s). PPS (packets per second) measures packet rate.

# Show interface stats<br/>$ ifconfig eth0<br/>$ sar -n DEV 1 | grep eth0<br/>eth0 8.00 2.00 0.69 1.90 0.00 0.00 0.00

Socket Status

Prefer ss; netstat is still useful, especially in containers where ss may be missing.

$ netstat -tanp<br/>Proto Recv-Q Send-Q Local Address          Foreign Address        State       PID/Program name<br/>tcp        0      0 127.0.0.11:35283       0.0.0.0:*              LISTEN      -<br/>tcp        0      0 192.168.112.2:37344    172.18.0.1:6379        ESTABLISHED 78/node

Non‑zero Recv‑Q or Send‑Q indicates packet backlog.

Protocol Statistics

$ netstat -s<br/>$ ss -s

PostgreSQL Connections

show max_connections;<br/>select count(*) from pg_stat_activity;

MySQL Connections

show variables like 'max_connections';<br/>show full processlist;

Container PID Mapping

To map a container PID to the host PID, inspect /proc/$pid/sched inside the container; the host PID appears in the output.

# Inside container (PID 122)<br/>$ cat /proc/122/sched<br/>node (7477, #threads: 7)

On the host, the global PID is 7477:

# Host lookup<br/>$ ps -fp 7477<br/>UID   PID  PPID C STIME TTY          TIME CMD<br/>root 7477 7161  0 Jul10 ?        00:00:38 node index.js

To find the container owning a host PID, use

docker ps -q | xargs docker inspect --format '{{.State.Pid}},{{.ID}}'

and grep for the PID, or examine the cgroup filesystem.

Docker PID‑to‑Container Mapping

# List containers with their host PIDs<br/>$ docker ps -q | xargs docker inspect --format '{{.State.Pid}},{{.ID}}' | grep 22932<br/># Or check cgroup file<br/>$ cat /etc/22932/cgroup