Top 13 Essential Linux Tools for System Monitoring and Performance

1. Nethogs – Per‑process bandwidth monitoring

Nethogs is a terminal‑based network traffic monitor that shows the bandwidth used by each running process.

2. IOZone – Disk I/O performance testing

IOZone evaluates file‑system read/write performance on Linux and other operating systems.

Download URL: http://www.iozone.org/src/current/

# tar xvf iozone3_420.tar
# cd iozone3_420/src/current/
# make linux
# ./iozone -a -n 512m -g 16g -i 0 -i 1 -i 5 -f /mnt/iozone -Rb ./iozone.xls

-a: automatic mode

-n: minimum file size (KB)

-g: maximum file size (KB)

-i: select test number

-f: output file name (deleted after run)

-R: generate Excel output

-b: specify output file

3. iotop – Real‑time disk I/O monitoring

iotop displays per‑process I/O activity similar to the top command.

# yum -y install iotop

4. iptraf – Simple network status analysis

# yum -y install iptraf

5. iftop – Real‑time network traffic monitor

iftop provides a top‑like view of network traffic, more visual than iptraf.

Download URL: http://www.ex-parrot.com/~pdw/iftop/

# tar zxvf iftop-0.17.tar.gz
# cd iftop-0.17
# ./configure
# make && make install
# iftop -i eth0   # monitor interface eth0

TX: transmitted traffic

RX: received traffic

TOTAL: total traffic

Cumm: cumulative traffic since start

peak: traffic peak

rates: average over 2 s, 10 s, 40 s

6. htop – Interactive process viewer

htop is a more user‑friendly alternative to the classic top command.

# rpm -ivh http://pkgs.repoforge.org/rpmforge-release/rpmforge-release-0.5.2-2.el6.rf.x86_64.rpm   # install third‑party repo
# yum -y install htop

7. nmon – System resource monitoring

nmon is widely used on AIX and Linux for performance analysis.

Download URL: http://sourceforge.jp/projects/sfnet_nmon/releases/

# chmod +x nmon_x86_64_rhel6
# mv nmon_x86_64_rhel6 /usr/sbin/nmon
# nmon

8. multitail – Simultaneous log monitoring

multitail opens multiple windows in a single console to watch several log files at once.

# rpm -ivh http://pkgs.repoforge.org/rpmforge-release/rpmforge-release-0.5.2-2.el6.rf.x86_64.rpm   # install repo
# yum -y install multitail
# multitail -e "fail" /var/log/secure          # filter by keyword
# multitail -l "ping baidu.com"                # run a command and monitor its output
# multitail -i /var/log/messages -i /var/log/secure   # monitor multiple files

9. fail2ban – SSH brute‑force protection

fail2ban watches log files, matches patterns and bans offending IPs via iptables.

Download URL: http://www.fail2ban.org/wiki/index.php/Downloads

# cd fail2ban-0.8.11
# python setup.py install
# cp ./redhat-initd /etc/init.d/fail2ban
# service fail2ban start
# chkconfig --add fail2ban
# chkconfig fail2ban on

Typical jail configuration (ssh‑iptables):

ignoreip = 127.0.0.1/8
bantime = 600
findtime = 600
maxretry = 5
backend = auto
usedns = warn
[ssh-iptables]
enabled = true
filter = sshd
action = iptables[name=SSH, port=ssh, protocol=tcp]
logpath = /var/log/sshd.log

10. tmux – Terminal multiplexing

tmux provides persistent sessions and multiple panes, useful for keeping long‑running tasks alive over SSH.

# rpm -ivh http://pkgs.repoforge.org/rpmforge-release/rpmforge-release-0.5.2-2.el6.rf.x86_64.rpm   # install repo

11. agedu – Disk usage visualization via web

agedu scans directory sizes and can serve the results through a web interface.

Download URL: http://www.chiark.greenend.org.uk/~sgtatham/agedu/

# tar zxvf agedu-r9723.tar.gz
# cd agedu-r9723
# ./configure
# make && make install
# agedu -s /      # scan root filesystem
# agedu -w --address 192.168.0.10:80   # serve via HTTP

12. nmap – Network scanning and fingerprinting

nmap discovers hosts, open ports, and service versions.

Download URL: http://nmap.org/download.html

# tar jxvf nmap-6.40.tar.bz2
# ./configure
# make && make install
# nmap 192.168.0.10               # basic scan
# nmap -O 192.168.0.10            # OS detection
# nmap -A 192.168.0.10            # aggressive scan (OS, version, scripts)
# nmap 192.168.0.0/24            # scan an entire subnet
# Options:
#   -sS  TCP SYN scan
#   -sV  service version detection

13. httperf – Web stress testing

httperf generates high load to evaluate web server capacity and stability.

Download URL: http://code.google.com/p/httperf/downloads/list

# tar zxvf httperf-0.9.0.tar.gz
# cd httperf-0.9.0
# ./configure
# make && make install
# httperf --hog \
    --server=192.168.0.202 \
    --uri=/index.html \
    --num-conns=10000 \
    --wsess=10,10,0.1

--hog: generate as many connections as possible

--num-conns: total number of connections (e.g., 10000)

--wsess: simulate user sessions; first number = sessions, second = requests per session, third = think time (seconds)