Monitoring and Performance

The core commands for understanding what a Linux system is doing right now - CPU load, memory use, disk space, and which specific process is responsible.

Administration Updated August 28, 2026

  • administration
  • monitoring
  • performance

Before reaching for anything more sophisticated, these commands answer "what is this machine actually doing" in under a minute.

Load average and uptime

uptime

14:32:01 up 12 days,  3:42,  2 users,  load average: 0.52, 0.61, 0.58

The three numbers are the average number of processes wanting CPU time - running or waiting to run - over the last 1, 5, and 15 minutes. A load average is only meaningful relative to how many CPU cores exist: a load of 4.0 is idle headroom on a 16-core machine and completely saturated on a 4-core one.

nproc   # how many cores does this machine have?

top and htop

top

Shows live, sorted resource usage. htop (not installed by default on most distros, but almost always worth installing) gives the same information with color, mouse support, and easier sorting/filtering - strongly preferred for anything beyond a quick glance.

htop

Inside top, press M to sort by memory, P to sort by CPU, k to kill a process by PID directly.

Memory

free -h

               total        used        free      shared  buff/cache   available
Mem:            15Gi       4.2Gi       1.1Gi       412Mi        10Gi        10Gi
Swap:          2.0Gi          0B       2.0Gi

The available column, not free, is the number that actually matters - Linux aggressively uses "free" RAM for disk cache (buff/cache), which gets reclaimed instantly if an application needs it. A small free value with a large available value is completely normal and not a sign of memory pressure.

Disk space

df -h

Filesystem      Size  Used Avail Use% Mounted on
/dev/sda2       230G   62G  156G  29% /
/dev/sdb1       1.8T  890G  858G  51% /data

See Disk Partitioning and Filesystem Types for what these devices and mount points represent. When df shows a filesystem nearly full, find what's filling it with:

du -sh /var/log/* | sort -rh | head -10

du -sh summarizes size per argument; sorting the output finds the biggest offenders quickly rather than digging through a tree by hand.

Finding the process responsible

ps aux --sort=-%cpu | head -10   # top CPU consumers
ps aux --sort=-%mem | head -10   # top memory consumers

See Process Lifecycle for what the columns in ps output mean, and Signals for actually acting on a runaway process once you've identified it.

I/O and network-level checks

iostat -x 2      # disk I/O stats, refreshed every 2 seconds (needs sysstat package)
vmstat 2         # CPU, memory, and I/O summary together
ss -tlnp         # what's listening on which ports

See Troubleshooting Connectivity for ss used in a network-diagnosis context specifically.

When to go beyond these commands

For historical trends rather than a live snapshot - "was memory usage climbing all week, or did something just start" - these point-in-time tools aren't enough on their own. That's the gap dedicated monitoring systems (Prometheus with node_exporter, Netdata, Grafana dashboards) are built to fill, recording metrics over time instead of just showing the current moment.