What's changed: Initial version (topic 2.04, subtopics 2.04.1–2.04.6)
4.4Monitoring Resource Usage
Learn the tools for monitoring CPU, memory, disk I/O, and network I/O: CPU with top, htop, ps, and sar; memory with vmstat, free, and sar; disk with iostat, iotop, and sar; network with netstat, iftop, ss, and sar. Also covers lsof for open files and iptraf for network traffic.
Turning a vague complaint that "the system feels slow" into a diagnosis of which resource—CPU, memory, disk I/O, or network I/O—is the bottleneck is where an operations engineer earns their keep. Because the best tool differs by resource type, the mapping must be memorized precisely.
4.4.1Monitoring CPU and memory
- CPU: top (dynamically refreshing process list), htop (interactive, more readable top), ps (a static snapshot of process info), sar (CPU usage statistics including history).
- Memory: vmstat (virtual memory stats including swap in/out), free (a listing of free/used memory), sar (historical memory usage stats, e.g. with
-r).
4.4.2Disk I/O, network, and process detail
- Disk I/O: iostat (per-device I/O stats and wait time), iotop (per-process I/O usage in a top-style display), sar (historical disk I/O, also covering I/O wait and blocks in/out).
- Network I/O: netstat (connections, routing, and stats; ss is its modern successor), iftop (interactive per-interface bandwidth display), ss (socket statistics, faster than netstat), sar (historical network stats).
- lsof lists files a process has open (regular files, sockets, devices), used to identify "which process is holding this file/port". iptraf is an interactive real-time traffic monitor broken down by interface and connection.
The most common point: sar is the one tool that provides historical statistics across all resources—CPU, memory, disk, and network. Also standard: per-process I/O breakdown needs iotop, identifying which process holds a file/port needs lsof, and the lightweight successor to netstat for socket stats is ss—situation-to-tool mappings appear often.
Consider the diagnostic workflow in practice. When a user reports slow response, first check top or htop for a process consuming excessive CPU. If CPU looks normal, check vmstat for swap in/out (the si/so columns) to suspect memory pressure triggering swapping, which spills into disk I/O. free is handy for a quick snapshot of the free-memory trend. If disk is suspect, check per-device %util (utilization) and await (average wait time) with iostat -x; to narrow down which process is generating that I/O, switch to iotop. If network is suspect, check the connection summary with ss -s while using iftop interactively to see which host is consuming bandwidth. All of these only show the current state, so tracking a historical trend—like "what happened during last night's batch job"—relies on sar (sar -u for CPU, sar -r for memory, sar -d for disk, sar -n DEV for network). And when you need to know "which process holds port 8080", the standard move is lsof -i :8080.
| Resource | Point-in-time tools | Historical tool |
|---|---|---|
| CPU | top, htop, ps | sar -u |
| Memory | vmstat, free | sar -r |
| Disk I/O | iostat, iotop | sar -d |
| Network I/O | netstat, iftop, ss | sar -n DEV |
Trap: "iotop shows per-device disk statistics" is wrong—per-device stats are iostat's job, while iotop shows per-process I/O usage. Also, "netstat is the newest and fastest way to get socket statistics" is wrong—netstat is the older tool, and its successor ss is faster.
4.4.3Section summary
- CPU = top/htop/ps, memory = vmstat/free, disk = iostat/iotop, network = netstat/iftop/ss; all have history via sar
- Per-process I/O breakdown via iotop; identifying the process holding a file/port via lsof
Sign in to track progress — Log in.
Quick check
(just a quick review)Q1. You suspect slow disk I/O on a server and want to identify which process is generating the heavy I/O. Which command is appropriate?
Q2. You want to review, after the fact, how CPU usage changed during last night's batch run. Which command is appropriate?
Q3. You want to identify which process is currently using port 8080. Which command is appropriate?
Keep track of your progress
The full study guide is free to read. Sign up free to practice with the question bank, track what you have read, review your mistakes, and highlight passages.