Master Linux System Monitoring: Top, Htop, Vmstat, Dstat, Glances & Sar Explained

top – Real‑time system status

The top command continuously displays processor usage, memory consumption, running processes and load averages, acting like an enhanced Windows Task Manager for Linux.

Syntax

top [options]

Common options

-d <seconds>

– change the refresh interval -c – show the full command line for each process -s – safe mode; disables interactive commands -i – hide idle or zombie processes -n <count> – display the output a fixed number of times then exit -b – batch mode for non‑interactive output

Examples

# top

# top -c

# top -b

# top -c -d 5

# top -n 5

htop – Interactive process viewer

htop

is a colorful, ncurses‑based alternative to top that supports mouse interaction, horizontal/vertical scrolling, and easier process management.

Syntax

htop [options]

Non‑interactive options

-C

– use a monochrome color scheme -d <tenths‑of‑seconds> – set the refresh delay -s <user> – sort by a specific column -u <user> – show processes of a single user -p <pid> – display only the specified process -h – display help -v – display version

Interactive keys

Space

– tag a process U – untag all processes l – toggle display of open files u – filter by user M – sort by memory usage P – sort by CPU usage T – sort by running time

Enter a PID number – jump to that process

Examples

# htop

# htop -C

# htop -d 3

# htop -u linuxcool_user

vmstat – Virtual memory statistics

vmstat

reports virtual memory usage together with process, I/O, and CPU statistics, providing a quick overview of overall system health.

Syntax

vmstat [options] [delay] [count]

Common options

-a

– show active pages -f – display the number of processes created since boot -m – show slab allocator information -n – print header only once -s – display memory and swap statistics in a table -d – report disk statistics -p <partition> – show statistics for a specific block device -S – scale output units

Examples

# vmstat -a

# vmstat -f

# vmstat -m

# vmstat -n

# vmstat -s

# vmstat -p /dev/sda1

# vmstat 1

# vmstat 2 3

Field interpretation

procs : r – runnable processes; b – processes blocked for I/O

memory : swpd – used swap; free – free memory; buff – buffer cache; cache – page cache

swap : si – swap‑in rate; so – swap‑out rate

io : bi – blocks received; bo – blocks sent

system : in – interrupts per second; cs – context switches per second

cpu : us – user time; sy – system time; id – idle; wa – I/O wait; st – stolen time

dstat – All‑in‑one performance monitor

dstat

replaces several classic tools (vmstat, iostat, netstat, etc.) and presents CPU, disk, network, memory, and system statistics in a colorful, continuously updating display.

Syntax

dstat [options]

Common options

-c

– CPU usage (user, system, idle, wait, interrupt, soft‑interrupt) -d – disk read/write throughput -n – network activity -l – system load averages -m – memory usage -g – paging statistics -p – process statistics -s – swap usage -r – I/O request statistics -y – overall system status --ipc – IPC resources (message queues, semaphores, etc.) --socket – TCP/UDP socket states

Examples

# dstat

# dstat 3

# dstat -c

# dstat -d

# dstat -n

glances – High‑level multi‑system overview

glances

is a Python‑based monitoring tool that aggregates CPU, load, memory, network, disk I/O, filesystem usage, and process information, with optional thresholds that colour‑code critical values.

Syntax

glances [options]

Common options

-b

– show network bandwidth in bytes per second -s – run as a server (daemon mode) -B <address> – bind server to a specific IP or hostname -c <host> – connect to a remote glances server -t <seconds> – set screen refresh interval (default 2 s, range 1‑32767)

Examples

# glances -s -B 192.168.10.2 &

# glances -c 192.168.10.2

# glances -b

# glances -t 6

sar – System Activity Reporter

sar

collects and reports a wide range of system performance metrics, including CPU, memory, I/O, paging, network, and per‑CPU statistics.

Syntax

sar [options] [interval] [count]

Frequently used options

-A

– all reports combined -R – memory statistics -b – I/O and transfer rates -B – paging statistics -d – per‑disk utilization -e – set end time for reporting -f <file> – read data from a file -i <seconds> – interval between reports -P – per‑CPU statistics -u – CPU utilization -v – inode, file and other kernel table stats -w – swap space usage -x – extended process statistics -r – memory utilization

Examples

# sar -R

# sar -b

# sar -u

# sar -d

# sar -i 1 -f 5