Which Linux Metrics Should You Check in the First Minute of a Performance Issue?

1. uptime

$ uptime

This command quickly shows the system's load averages for the past 1, 5, and 15 minutes, indicating how many tasks are waiting for CPU or I/O. A sudden spike in the 1‑minute value compared to the 15‑minute average can signal a recent issue.

2. dmesg | tail

$ dmesg | tail

Displays the most recent kernel messages, helping you spot errors such as out‑of‑memory kills or TCP flooding that may affect performance.

3. vmstat 1

$ vmstat 1

Shows virtual memory and CPU statistics every second. Key fields include r (runnable tasks), free (free memory in KB), si/so (swap activity), and CPU time breakdown ( us, sy, id, wa, st ). High wa indicates I/O wait, while a large r relative to CPU count signals CPU saturation.

4. mpstat -P ALL 1

$ mpstat -P ALL 1

Prints per‑CPU utilization every second, allowing you to see whether a single core is overloaded, which often points to a single‑threaded workload.

5. pidstat 1

$ pidstat 1

Provides per‑process CPU usage at regular intervals. The %CPU column is expressed as a percentage of all CPUs, so values over 100% indicate multi‑core consumption (e.g., 1591% ≈ 16 cores).

6. iostat -xz 1

$ iostat -xz 1

Shows block‑device statistics. Important metrics are r/s, w/s, rkB/s, wkB/s (I/O rates), await (average request latency), avgqu‑sz (average queue length), and %util (device utilization). High await or %util above 60% often indicates a storage bottleneck.

7. free -m

$ free -m

Displays memory usage in megabytes. Pay attention to buffers and cached columns; the "-/+ buffers/cache" line gives a more accurate view of memory actually used by applications.

8. sar -n DEV 1

$ sar -n DEV 1

Monitors network interface throughput. rxkB/s and txkB/s show receive and transmit rates, while %ifutil indicates interface utilization.

9. sar -n TCP,ETCP 1

$ sar -n TCP,ETCP 1

Provides TCP statistics such as active/s (outbound connections), passive/s (inbound connections), and retrans/s (retransmissions). Sudden increases can reveal network or server overload.

10. top

$ top

Combines many of the above metrics in a dynamic view, showing per‑process CPU and memory usage, overall load averages, and system‑wide statistics. Use it to verify whether the snapshot from other tools matches the current state.