Five command-line tools that cover CPU, memory, disk, and network monitoring on Linux.

1. top and htop - The Kings of Process Monitoring

top

top is a classic tool that provides a dynamic real-time view of running processes. By default, it sorts processes by CPU usage, refreshing the view every few seconds.

top

Key things to know about top:

  • First line: Information about uptime, number of logged-in users, load average (system load - number of processes waiting for CPU).
  • CPU line: Percentage of CPU usage by users (us), system (sy), nice (processes with altered priority), idle (CPU inactivity), wa (waiting for I/O).
  • Memory lines: Information about physical RAM (Mem) and SWAP memory (Swap).
  • Process table: List of processes with PID, user, CPU usage, memory, and uptime.

htop

htop is an enhanced, interactive version of top, offering a much more user-friendly interface and additional features.

htop

Advantages of htop:

  • Colorful interface: Easier to read.
  • Progress bars: Graphical representation of CPU and memory usage.
  • Interactivity: Ability to scroll, sort (F6), filter (F4), and kill processes (F9) directly within the interface.
  • Tree view: (F5) Shows processes in a hierarchical structure.

2. vmstat - Quick Diagnosis of Memory and I/O

vmstat (virtual memory statistics) is a tool for a quick overview of virtual memory activity, processes, block I/O operations, traps, and CPU activity. It is ideal for finding “bottlenecks.”

vmstat 1 5

The command above will display 5 reports, every 1 second.

Key vmstat columns:

  • Procs: r (runnable), b (blocked, waiting for I/O).
  • Memory: swpd (SWAP used), free (free memory), buff (buffer), cache (cache).
  • Swap: si (swap-in, memory from disk to RAM), so (swap-out, memory from RAM to disk). High si/so values indicate memory problems!
  • IO: bi (blocks received), bo (blocks sent) – disk activity.
  • CPU: us (user), sy (system), id (idle), wa (waiting for I/O). High wa indicates an I/O bottleneck!

3. iostat - Disk Performance Analysis

When you suspect a slow disk is the problem, iostat (input/output statistics) is your tool.

iostat -x 1 5

The command above will display 5 reports, every 1 second, with extended statistics.

Key iostat -x columns:

  • %util: Percentage of time the I/O device was busy. Values close to 100% mean disk overload!
  • await: The average time (in ms) an I/O operation waited in the queue + its execution time. High await is a problem!
  • %iowait (from vmstat): The time the CPU spent waiting for I/O operations to complete. High values indicate a disk bottleneck.

4. ss (Socket Statistics) - Analyzing Network Connections

ss is a newer, more modern successor to netstat, used to display information about open sockets. It is much faster and offers more detail.

ss -tuln

The command above will display open TCP (t) and UDP (u) ports, in listening mode (l), with port numbers instead of service names (n).

Examples of ss usage:

  • ss -s: Summary of connection statistics.
  • ss -tnp: Active TCP connections, show process PIDs.
  • ss -lp 'sport = :ssh': Show processes listening on the SSH port.

5. nmon - All-in-one, Interactive Powerhouse

nmon (Nigel’s Monitor) is an interactive tool that combines the functionality of many others. It displays CPU usage, memory, disks, network, and much more, in a single, refreshing view.

nmon

Advantages of nmon:

  • All-in-one: You don’t have to switch between different tools.
  • Interactivity: Keys like c (CPU), m (memory), d (disks), n (network) switch views.
  • Data export: Ability to export data to a file in a format that can later be imported into a spreadsheet for analysis.

Together these tools cover the main subsystems: CPU, memory, disk I/O, and network. Pick the right one for the bottleneck you are investigating.