Master Linux System Monitoring: Top, Free, Vmstat, Iostat & More Explained

1.1 top

The top command monitors system runtime status in real time and can sort by CPU, memory, and execution time.

1.1.2 Parameters

Command line options:

Usage:

top -hv | -bcisSHM -d delay -n iterations [-u user | -U user] -p pid[,pid...]

-b : batch mode (suitable for piping output to other programs or files)

-c : display command line of running tasks

-d : set delay interval

-h : help

-H : show threads

-i : show idle processes

-n : number of iterations (usually used with -b)

-u / -U : monitor processes of a specific user

-p : monitor specific processes (comma‑separated PIDs)

-s : safe mode

-S : cumulative time mode

-v : display version and exit

-M : auto‑display memory units (k/M/G)

1.1.3 Global Commands

Enter/Space : refresh display

? / h : help

= : remove all task display limits

A : toggle alternate display mode

B : toggle bold display

d / s : change refresh interval

G : select another window/group

I : toggle Irix/Solaris mode

u / U : monitor specific user processes

k : kill process

q : quit top

r : reset process nice value

W : save current settings

Z : change color scheme

1.2 free

The free command is the most common tool for monitoring system memory usage.

1.2.2 Parameters

-m : display memory in megabytes (default is kilobytes)

-b : display memory in bytes

-s : monitor memory usage over a specified interval

1.2.3 Result Explanation

total : total physical memory

Used : amount used

Free : amount free

shared : total memory shared among processes

buffers/cached : size of disk cache

1.3 vmstat

Vmstat monitors process status, memory, virtual memory, disk I/O, context switches, and CPU information.

1.3.2 Parameters

vmstat [-a] [-n] [-S unit] [delay [count]]

-a : display active and inactive memory

-m : display slabinfo

-n : show field names only once at start

-s : display memory‑related statistics and various system activity counts

delay : refresh interval (if omitted, only one result is shown)

count : number of refreshes (if omitted with delay, runs indefinitely)

-d : show disk statistics

-S : use specified unit (k, K, m, M)

-V : display version

-p : show statistics for a specific disk partition

-D : show overall disk information

1.3.3 Result Explanation

Shows sections such as Procs (R: runnable processes, B: blocked processes), Memory (Swap, Free, Buff, Cache), I/O (Si, So, Bi, Bo), System (interrupts, context switches), and CPU usage percentages (Us, Sy, Id, Wa).

1.4 iostat

Iostat monitors disk I/O statistics and also provides CPU usage.

1.4.2 Parameters

iostat [ -c | -d ] [ -k | -m ] [ -t ] [ -V ] [ -x ] [ device [...] | ALL ] [ -p [ device | ALL ] ] [ interval [ count ] ]

-c : display only CPU statistics (mutually exclusive with -d)

-d : display only disk statistics

-k : display per‑second values in kilobytes

-p : show statistics for specified device or all devices (mutually exclusive with -x)

-t : print timestamp with each output

-V : version and help

-x : display extended statistics for a specific device

interval : time between reports

count : number of reports

1.4.3 Result Explanation

Shows I/O request rates (rrqm/s, wrqm/s, r/s, w/s, rsec/s, wsec/s, rkB/s, wkB/s), average request size, average queue length, await time, service time, and %util indicating device utilization.

1.5 mpstat

Mpstat monitors CPU statistics, providing per‑CPU and overall usage on multi‑core systems.

1.5.2 Parameters

mpstat [-P {|ALL}] [interval [count]]

-P {|ALL} : select CPU(s) to monitor (0‑N‑1 or ALL)

interval : sampling interval

count : number of samples (used with interval)

1.5.3 Result Explanation

Displays percentages for user, nice, system, iowait, irq, softirq, idle, and interrupts per second.

1.6 sar

Sar provides comprehensive system activity reports covering CPU, memory, disk I/O, network, and more.

1.6.2 Parameters

Common format: sar [options] [-A] [-o file] interval [count] -A : all reports

-u : CPU utilization

-v : process, inode, file, lock table status

-p : per‑CPU usage

-d : disk usage

-r : memory usage

-n : network status (DEV, EDEV, SOCK, FULL)

-q : run queue size (load average)

-B : memory paging

-R : process activity

-g : serial I/O

-b : buffer usage

-a : file read/write

-c : system calls

-y : terminal device activity

-W : swap activity

1.6.3 Result Explanation

Shows CPU percentages (%user, %nice, %system, %iowait, %steal, %idle), memory metrics (kbmemfree, kbmemused, %memused, kbbuffers, kbcached, kbcommit, %commit), paging rates (pgpgin/s, pgpgout/s, fault/s, majflt/s, pgfree/s, pgscank/s, pgscand/s, pgsteal/s, %vmeff), I/O and transfer rates (tps, rtps, wtps, bread/s, bwrtn/s, rrqm/s, wrqm/s, r/s, w/s, rsec/s, wsec/s, avgrq‑sz, avgqu‑sz, await, svctm, %util), network statistics (Iface, MTU, RX‑OK/TX‑OK, RX‑ERR/TX‑ERR, RX‑DRP/TX‑DRP, RX‑OVR/TX‑OVR, flags), and load averages.

1.7 netstat

Netstat displays network connections, listening ports, routing tables, and interface statistics.

1.7.2 Parameters

-a : all connections (including listening)

-t : TCP only

-u : UDP only

-n : show numeric addresses

-l : listening services only

-p : show program name/PID

-r : routing table

-e : extended info (UID, etc.)

-s : protocol statistics

-c : continuous display at intervals

-v : verbose

-I : interface info

1.7.3 Result Explanation

Columns include Iface, MTU, RX‑OK/TX‑OK, RX‑ERR/TX‑ERR, RX‑DRP/TX‑DRP, RX‑OVR/TX‑OVR, and flags (B, L, M, N, O, P, R, U). Connection list shows Recv‑Q, Send‑Q, Local Address, Foreign Address, and State (LISTEN, ESTABLISHED, TIME_WAIT, etc.).

1.8 uptime

Uptime reports the current time, how long the system has been running, number of logged‑in users, and the 1‑, 5‑, and 15‑minute load averages.

1.8.2 Parameters

-V : version

1.8.3 Result Explanation

If the load average consistently exceeds the number of CPU cores, the system is likely overloaded.

1.9 ps

Ps lists running processes, their status, resource usage, and hierarchy.

1.9.2 Parameters

-A / -e : all processes

-a : all processes on a terminal

-d : all processes without session leaders

-x : processes without controlling terminal

-p PID : select by PID

-u USER : select by user

-f : full format

-l : long format

-j : job format

-o : custom format

-m : show threads

-H : hierarchical view

1.9.3 Result Explanation

Columns include USER, UID, PID, PPID, SID, %CPU, %MEM, VSZ, RSS, TTY, STAT (R, S, I, Z, D, T, etc.), START, TIME, COMMAND, NI, PRI, WCHAN, FLAGS.

1.10 watch

Watch repeatedly runs a command at a specified interval, highlighting changes.

1.10.2 Parameters

-d : highlight differences

-n : interval in seconds

Example: watch -d -n 1 netstat -ant monitors network connections every second.

1.11 strace

Strace traces system calls and signals of a process, showing arguments, return values, and timing.

1.11.2 Parameters

-p PID : trace a specific process

-f : follow forked children

-F : follow vfork (unless -f is also used)

-o file : write output to file

-ff : separate output per child process

-r : relative timestamps

-t / -tt / -ttt : timestamps (seconds, microseconds, relative)

-v : verbose (show all syscalls)

-s N : max string length (default 32)

-c : summary statistics

-e expr : filter expression

-d : debug output

-i : show syscall entry points

-q : suppress detach messages

-T : show time per call

-V : version

-x / -xx : hex output for strings

1.11.3 Result Explanation

Example: strace -ff -F -o ls.log ls -l traces the execution of ls -l, with failures indicated by a return value of -1.

1.12 lsof

Lsof lists open files and the processes that opened them; in Linux, everything is a file.

1.12.2 Parameters

-a : list processes with open files

-c : list files opened by a specific process

-g : list by GID

-d : list processes using a specific file descriptor

+d : list files opened under a directory

+D : recursively list files opened under a directory

-n : list NFS files

-i : list processes matching network criteria

-p : list files opened by a specific PID

-u : list files opened by a user

-U : list only socket files

-h : help

-v : version

1.12.3 Result Explanation

Columns include COMMAND, PID, USER, FD (file descriptor), TYPE, DEVICE, SIZE, NODE, and NAME.