Master Linux Performance Monitoring: Top, Free, and Vmstat Commands Explained

1. top command

top is a widely used Linux performance analysis tool that displays real‑time resource usage of processes, similar to the Windows Task Manager.

It runs in the foreground and continuously refreshes the display; users can interact with it via keyboard shortcuts.

top provides a live view of CPU status, showing the most CPU‑intensive tasks and allowing sorting by CPU usage.

Command format:

<code>top [options]</code>

Command function: displays information about running processes, including PID, memory usage, CPU usage, and more.

Command parameters:

-b batch mode

-c show full command line

-I ignore idle processes

-s secure mode

-S cumulative mode

-i<time> set update interval

-u<user> show processes of a specific user

-p<pid> monitor a specific process

-n<count> number of iterations

Usage example:

<code>[root@TG1704 log]# top</code>

Sample output (truncated):

<code>top - 14:06:23 up 70 days, 16:44, 2 users, load average: 1.25, 1.32, 1.35</code><code>Tasks: 206 total, 1 running, 205 sleeping, 0 stopped, 0 zombie</code><code>%Cpu(s): 5.9%us, 3.4%sy, 0.0%ni, 90.4%id, 0.0%wa, 0.0%hi, 0.2%si, 0.0%st</code><code>Mem: 32949016k total, 14411180k used, 18537836k free, 169884k buffers</code><code>Swap: 32764556k total, 0k used, 32764556k free, 3612636k cached</code>

Explanation of the first five lines:

Line 1: system time, uptime, number of users, load averages.

Line 2: task summary (running, sleeping, stopped, zombie).

Line 3: CPU usage breakdown (user, system, nice, idle, iowait, hardware IRQ, software IRQ, steal).

Line 4: memory usage (total, used, free, buffers).

Line 5: swap usage (total, used, free, cached).

Other tips:

Press

1

to monitor each logical CPU.

Press

b

to toggle highlighting of the current process.

Press

x

to toggle column highlighting for sorting.

Use

Shift+>

or

Shift+<

to change the sort column (e.g., sort by %MEM).

2. free command

free displays the amount of free and used physical memory, swap space, and kernel buffers on a Linux system.

Command format:

<code>free [options]</code>

Command function: shows memory usage, including total, used, free, shared, buffers, and cached memory.

Command parameters:

-b display values in bytes

-k display values in kilobytes

-m display values in megabytes

-g display values in gigabytes

-o omit the buffers/cache column

-s <seconds> continuously monitor memory usage

-t show total memory line

-V display version information

Usage example:

<code>free</code><code>free -g</code><code>free -m</code>

Sample output:

<code>              total       used       free     shared    buffers     cached</code><code>Mem:      32940112   30841684    2098428          0    4545340   11363424</code><code>-/+ buffers/cache:   14932920   18007192</code><code>Swap:     32764556    1944984   30819572</code>

Explanation of fields:

total : total physical memory.

used : memory currently used.

free : memory not used by the kernel.

shared : memory used by multiple processes.

buffers : memory used for block device buffers.

cached : memory used for page cache.

-/+ buffers/cache : shows memory used and free from the perspective of applications (buffers and cache are considered free).

From the OS perspective, buffers and cache are counted as used; from the application perspective, they are available, so available memory ≈ free + buffers + cached.

When swap usage increases, it indicates the kernel is moving pages to swap, which may affect performance.

3. vmstat command

vmstat (Virtual Memory Statistics) reports information about processes, memory, paging, block I/O, traps, and CPU activity.

Command format:

<code>vmstat [-a] [-n] [-S unit] [delay [count]]</code><code>vmstat -s</code><code>vmstat -m</code><code>vmstat -d</code><code>vmstat -p &lt;disk&gt;</code><code>vmstat -f</code><code>vmstat -V</code>

Command function: provides a low‑overhead view of overall system performance; it cannot drill down to individual process details.

Command parameters:

-a show active and inactive memory

-f display number of forks since boot

-m display slabinfo

-n show field names only once

-s display memory‑related statistics

-d display disk statistics

-p <disk> display statistics for a specific disk

-S <unit> set output unit (k, K, m, M)

-V display version

Usage example:

<code>vmstat</code>

Sample output (first line shows headers, second line shows values):

<code>procs -----------memory---------- ---swap-- -----io---- --system-- -----cpu------</code><code> r  b   swpd   free  inact active   si   so    bi    bo   in   cs us sy id wa st</code><code> 0  0      0 3029752 387728 513076    0    0     0     0 1005   34  0  0 100  0  0</code>

Field explanations:

procs : r = running processes, b = processes blocked for I/O.

memory : swpd = virtual memory used, free = idle memory, inact = inactive memory (with -a), active = active memory.

swap : si = memory swapped in per second, so = memory swapped out per second.

io : bi = blocks received per second, bo = blocks sent per second.

system : in = interrupts per second, cs = context switches per second.

cpu : us = user time, sy = system time, id = idle time, wa = I/O wait, st = stolen time.

Additional examples:

vmstat -a 2 5

– show active/inactive memory every 2 seconds for 5 samples.

vmstat -f

– display total number of forks since boot.

vmstat -s

– detailed memory statistics.

vmstat -d

– disk I/O statistics.

vmstat -p /dev/sda1

– I/O stats for a specific disk.

vmstat -m

– slab cache information.

Interpreting the data: high r values, low id, or high si/so indicate CPU or memory pressure; frequent disk I/O with high b values suggests I/O bottlenecks.