Mastering dstat: Real‑Time System Monitoring on Linux

What is dstat?

dstat is a comprehensive system‑information tool that consolidates the functionality of vmstat, iostat, netstat, nfsstat and ifstat. Compared with the sysstat suite, dstat provides a coloured, real‑time display that refreshes every second while still allowing custom intervals (e.g., dstat 3 for a three‑second collection period).

Installation

Two common ways to install dstat on a Red Hat‑based system:

Using the package manager: yum install -y dstat Downloading the RPM directly from the official repository and installing it:

wget http://dag.wieers.com/rpm/packages/dstat/dstat-0.6.7-1.rh7.rf.noarch.rpm
rpm -ivh dstat-0.6.7-1.rh7.rf.noarch.rpm

Basic Usage

After installation, running dstat without arguments displays a default set of columns ( -cdngy) showing CPU, disk, network, paging and system statistics, refreshed once per second. You can change the refresh interval and number of lines, for example dstat 5 (one line every 5 seconds) or dstat 5 10 (ten lines, 5 seconds apart).

Common Options

Key options include: -c: CPU usage (user, system, idle, wait, interrupt, soft‑interrupt). -C <list>: Show per‑CPU statistics when multiple CPUs are present. -d: Disk read/write throughput. -n: Network traffic. -l: System load. -m: Memory usage. -g: Paging activity. -p: Process statistics. -s: Swap usage. -r: I/O request statistics. -y: General system status. --ipc: IPC resources (message queues, signals, etc.). --socket: TCP/UDP socket states. -a: Alias for the default set -cdngy. -v: Verbose mode, equivalent to -pmgdsc -D total. --output <file>: Write the output in CSV format to <file> for later analysis.

Understanding the Columns

Below are brief explanations of several frequently‑seen columns (partial list):

Procs : r – runnable processes; b – processes blocked in uninterruptible I/O.

Memory : swpd – swapped memory (KB); free – free physical memory; buff – buffer cache; cache – page cache.

Swap : si – memory swapped in; so – memory swapped out.

Disk IO : bi – bytes read per second; bo – bytes written per second.

System : in – interrupts per second; cs – context switches per second.

CPU : usr – user‑mode CPU %; sys – kernel‑mode CPU %; wai – I/O wait %; idl – idle %.

Example Commands

Monitor swap, processes, sockets and filesystem while showing timestamps: # dstat -tsp --socket --fs Export the same data to a CSV file for spreadsheet analysis:

# dstat -tsp --socket --fs --output /tmp/dstat.csv

Plugins and Extended Functionality

Running dstat --list displays all built‑in options (labelled “internal”) and the plugins located in /usr/share/dstat. Plugins add monitoring for battery status, MySQL, InnoDB, NFS, Redis, and many other services. Some plugins require additional libraries (e.g., Python MySQL connectors) before they become usable.

Conclusion

dstat offers a powerful, extensible way to observe real‑time system performance on Linux. By mastering its basic syntax, common options, and plugin ecosystem, administrators can quickly diagnose bottlenecks, log data for later review, and integrate the output into monitoring dashboards or reports.