Performance monitoring is a daily sysadmin task. A server may be slow due to CPU saturation, memory pressure, disk I/O bottlenecks, or network congestion. The key is knowing which tool to reach for and how to interpret what it tells you. This guide covers the essential Linux performance monitoring toolkit.
The Four Resources to Monitor
- CPU — is it overloaded? Is the right process consuming it?
- Memory — is RAM full? Is the system swapping?
- Disk I/O — are reads/writes saturating the disk?
- Network — is bandwidth saturated? Are there errors?
top — The Classic Process Monitor
topThe header shows key system stats:
- load average: 1, 5, 15-minute load. Values above your CPU core count indicate overload.
- %us: user-space CPU, %sy: kernel CPU, %wa: waiting for I/O (high = disk bottleneck), %id: idle
- Mem: total, free, used, buff/cache
top -b -n 1 # Single-shot batch output
top -b -n 1 -o %CPU | head -20 # Sort by CPU, top 20htop — Interactive Process Viewer
sudo apt install htop -y # or: sudo dnf install htop
htophtop shows per-core CPU bars, memory bar, swap bar, and a sortable process table. Key shortcuts: F6 sort, F4 filter, F9 send signal, F5 tree view, Space tag process.
vmstat — Virtual Memory Statistics
vmstat 2 5 # Report every 2 seconds, 5 times
vmstat -s # Summary statistics
vmstat -d # Disk statisticsKey columns to watch:
r— processes waiting for CPU time (high = CPU bottleneck)b— processes in uninterruptible sleep (high = I/O bottleneck)si/so— swap in/out (non-zero = memory pressure)wa— CPU time waiting for I/O (should be below 5%)us/sy— user/system CPU usage
# Sample output interpretation:
# procs -----------memory---------- ---swap-- -----io---- -system-- ------cpu-----
# r b swpd free buff cache si so bi bo in cs us sy id wa st
# 2 0 0 512000 32000 640000 0 0 20 50 500 1000 25 5 68 2 0iostat — I/O Statistics
sudo apt install sysstat -y # Install sysstat package
iostat # CPU and I/O summary
iostat -x 2 5 # Extended I/O stats, every 2s, 5 reports
iostat -d sda 2 # Watch specific diskKey columns in iostat -x:
r/s,w/s— reads/writes per secondrkB/s,wkB/s— read/write throughput (KB/s)await— average I/O wait time in milliseconds (under 10ms = healthy SSD)%util— disk utilization (near 100% = saturated disk)
free — Memory Usage
free -h # Human-readable memory stats
free -h -s 2 # Update every 2 seconds
# Example output:
# total used free shared buff/cache available
# Mem: 7.8Gi 2.1Gi 3.2Gi 50Mi 2.5Gi 5.4Gi
# Swap: 2.0Gi 0B 2.0GiThe available column is what matters — it shows how much memory can be given to new processes without swapping. buff/cache is used by the kernel for caching but will be freed when needed.
sar — System Activity Reporter
sar -u 2 5 # CPU utilization every 2s
sar -r 2 5 # Memory every 2s
sar -b 2 5 # I/O every 2s
sar -n DEV 2 5 # Network interface stats
sar -f /var/log/sa/sa20 # Historical data from a specific daysar requires the sysstat service to be running to collect historical data.
lsof and ss for Network Performance
ss -s # Socket summary statistics
ss -tnp | grep ESTABLISHED | wc -l # Count active connections
lsof -i -n -P | grep ESTABLISHED # Active connections with process infoChecking System Load History
uptime # Current load averages
cat /proc/loadavg # Load averages (raw)
w # Who is logged in + load averageA Quick Diagnostic Workflow
# 1. Check overall load
uptime
# 2. Check CPU and processes
top -b -n 1 | head -20
# 3. Check memory and swap
free -h
vmstat 1 5 | grep -v "^proc"
# 4. Check disk I/O
iostat -x 1 3
# 5. Check for disk full
df -h
# 6. Check network connections
ss -sSummary
Performance monitoring is about quickly identifying which resource is the bottleneck. Start with top or htop for a general overview. Use vmstat for memory pressure and I/O wait, iostat for disk-level detail, and free for memory. Combine these tools and you can diagnose most Linux performance problems in minutes.