Quick Guide to Linux System Performance Diagnosis with Common Commands

Uptime

The uptime command shows the current system time, how long the system has been running, the number of logged‑in users, and the load averages for the past 1, 5, and 15 minutes.

11:14:26 up 16 min, 1 user, load average: 21.37, 18.64, 16.25

High load averages relative to the number of CPU cores indicate potential performance bottlenecks.

dmesg / journalctl

Use dmesg | tail or journalctl -k | tail to view the most recent kernel messages, which often contain errors or warnings that affect system performance.

dmesg | tail
[   12.216869] vmwgfx 0000:00:0f.0: [drm] Available shader model: SM_5.
[   12.225954] [drm] Initialized vmwgfx 2.20.0 20211206 for 0000:00:0f.0 on minor 0

vmstat

vmstat 1

reports virtual memory statistics, process counts, CPU activity, and I/O statistics at one‑second intervals.

procs -----------memory---------- ---swap-- -----io---- -system-- ------cpu-----
r  b   swpd   free   buff  cache   si   so    bi    bo   in   cs us sy id wa st
69  0      0 7700836   4204 1441648    0    0   369   101  569 1819 11 35 45  8  0

Key columns: r (runnable processes), b (blocked), us (user CPU), sy (system CPU), id (idle), and wa (I/O wait).

mpstat

Install sysstat and run mpstat -P ALL 1 to see per‑CPU utilization broken down into user, nice, system, iowait, irq, soft, steal, guest, and idle percentages.

CPU   %usr %nice %sys %iowait %irq %soft %steal %guest %gnice %idle
all   12.89 0.00 14.84 50.00 6.25 4.30 0.00 0.00 0.00 11.72

High %iowait suggests the CPU is waiting for disk I/O; high %sys points to kernel‑mode activity.

pidstat

pidstat 3

displays CPU usage per process, including user and system time, which helps identify the processes that consume the most CPU.

UID   PID   %usr %system %guest %wait %CPU Command
0    14    0.00  1.99   0.00   1.66  1.99 rcu_sched
0    33    0.00  0.66   0.00   0.00  0.66 ksoftirqd/3

A process with a high %CPU in user mode may indicate a single‑thread bottleneck.

iostat

iostat -xz

provides extended I/O statistics for each block device, including read/write rates, average request size, queue length, await time, and utilization.

Device            r/s   w/s   rkB/s   wkB/s  await  %util
nvme0n1        101.86 23.92 4143.65  729.07 33.62 64.21

When %util approaches 100 % and await is much larger than svctm, the device is saturated.

free

The free -m command shows memory usage in megabytes, including total, used, free, buffers/cache, and the available column, which reflects memory that can be allocated without swapping.

total   used   free  shared  buff/cache  available
Mem:           15730   7564   6440     52        1725       7754
Swap:           2067      0   2067

Low available memory may cause OOM (out‑of‑memory) events.

sar (network and socket statistics)

sar -n DEV 1

reports per‑interface packet and byte rates, while sar -n EDEV 1 shows error counters. sar -n SOCK 1 displays the number of TCP, UDP, and RAW sockets in use.

IFACE   rxpck/s txpck/s  rxkB/s  txkB/s %ifutil
lo        17.54    17.54   0.98    0.98   0.00
ens160    50.88    58.77   3.79    4.07   0.00

High rxpck/s or txpck/s may indicate heavy network traffic; non‑zero error columns point to hardware or driver issues.

top

Running top gives a real‑time view of processes, CPU load, memory usage, and per‑CPU statistics. Press t or m to toggle a visual display of CPU and memory bars.

top - 11:46:44 up 8 min, 1 user, load average: 6.52, 17.45, 10.38
Tasks: 449 total,   1 running, 448 sleeping,   0 stopped,   0 zombie
%Cpu(s): 0.9 us, 1.1 sy, 0.0 ni, 96.8 id, 0.0 wa, 0.6 hi, 0.5 si, 0.0 st

Identify processes with high %CPU or %MEM to focus further investigation.

Putting It All Together

Start with uptime to get a quick load snapshot, then drill down with vmstat and mpstat for CPU and I/O details. Use pidstat to pinpoint offending processes, iostat for storage bottlenecks, free for memory pressure, and sar for network health. Finally, verify findings with top for a live overview.