Master Linux Server Performance: Essential Monitoring Tools & How to Use Them

CPU and Memory Monitoring

Linux servers expose many parameters that are crucial for both operations staff and developers when troubleshooting abnormal program behavior. Simple tools like top read data from

/proc

and

/sys

to show load averages, task states, and detailed CPU usage categories (us, sy, ni, id, wa, hi, si, st).

The first line of

top

displays 1‑, 5‑, and 15‑minute load averages; values exceeding the number of CPU cores indicate saturation. The second line lists task counts (running, sleeping, stopped, zombie). Subsequent columns break down CPU time by user, system, nice, idle, iowait, hardware interrupt, soft‑interrupt, and steal (relevant for virtualized environments).

High

us

suggests a specific process is consuming CPU, which can be identified with

top

and further investigated using

perf

. Elevated

sy

often points to heavy I/O or kernel activity. Excessive

ni

indicates manually lowered priority. Large

wa

means slow I/O, while high

hi

/

si

can signal hardware or driver problems. A noticeable

st

value may reveal CPU over‑commitment in a VM.

The memory section of

top

shows total, used, free, buffers, and cached memory.

Buffers

cache raw disk metadata, whereas

Cached

stores file data.

Avail Mem

approximates free + buffers + cached and indicates how much memory is available without swapping. Frequent swap activity signals memory pressure.

Other Command‑Line Tools

vmstat provides a snapshot of processes, memory, paging, block I/O, and CPU activity. Columns such as

r

(runnable processes),

b

(uninterruptible sleep),

swpd

(used swap),

bi

/

bo

(blocks in/out),

in

(interrupts), and

cs

(context switches) help assess overall load.

pidstat focuses on a single process, reporting per‑thread CPU usage, page faults (minor

minflt/s

, major

majflt/s

), stack size, and context‑switch rates. Options like

-t

show thread‑level details,

-r

displays memory faults,

-s

shows stack usage,

-u

reports CPU percentages, and

-w

reports voluntary and involuntary switches.

For per‑CPU load balancing on SMP systems, mpstat (e.g.,

mpstat -P ALL 1

) reveals each core’s utilization.

Disk I/O Monitoring

iostat (e.g.,

iostat -xz 1

) and sar -d report device‑level metrics: average queue length (

avgqu-sz

), average wait (

await

), service time (

svctm

), and utilization (

%util

). Values >1 for queue length or >60 % utilization indicate potential bottlenecks.

iotop shows real‑time per‑process disk throughput, while lsof can identify which processes hold open files or devices, useful for diagnosing un‑unmountable partitions.

Network Monitoring

netstat (e.g.,

netstat -s

) displays cumulative protocol statistics since boot; paired with

watch

or differential checks it can reveal current network health. Common flags include

-antp

for all TCP connections and

-nltp

for listening sockets.

sar with

-n TCP,ETCP 1

or

-n UDP 1

reports per‑second TCP/UDP activity, including connection attempts, retransmissions, and error rates, helping assess network reliability.

tcpdump captures raw packets for offline analysis with Wireshark. Using filters (e.g., host, port, protocol) limits capture size and impact on the system.

These tools together form a comprehensive toolbox for Linux performance monitoring, enabling quick identification of CPU, memory, disk, and network issues.