Introduction
Mastering system monitoring commands is a fundamental skill for Linux operation and maintenance. This note aims to organize and summarize commonly used monitoring commands along with their core functions and practical scenarios, facilitating quick review and learning to enhance system management and troubleshooting efficiency.
1. Comprehensive Performance Monitoring (CPU, Memory, Load)
- 1.
<span>top</span>
- •Core Function: Dynamically displays system process activity, CPU, memory, and other resource usage.
- •Basic Usage:
- •
<span>top</span>: Start real-time monitoring. - •
<span>q</span>: Exit. - • Interactive keys:
<span>1</span>(details of each CPU core),<span>M</span>(sort by memory),<span>P</span>(sort by CPU). - •Advanced/Common Scenarios:
- • End process: Press
<span>k</span>-> Enter PID -> Enter signal (default 15, can use 9 to force). - • Filter by user: Press
<span>u</span>-> Enter username. - • Batch mode (script/report):
<span>top -b -n 1 -o %CPU</span>(get a snapshot sorted by CPU).
<span>htop</span>- •Core Function:
<span>top</span>‘s enhanced version, with a more user-friendly interface and stronger interactivity. - •Basic Usage:
- •
<span>htop</span>: Start. - • Arrow keys/mouse: Select/scroll.
- • Function keys:
<span>F6</span>(sort),<span>F9</span>(send signal/kill),<span>F4</span>(filter),<span>F10</span>/<span>q</span>(exit). - •Advanced/Common Scenarios:
- • More intuitively filter, sort, and terminate processes than
<span>top</span>. - • Filter by user: Press
<span>u</span>.
<span>uptime</span>- •Core Function: Displays system uptime, number of logged-in users, and 1/5/15 minute average load (Load Average).
- •Basic Usage:
- •
<span>uptime</span>: Run directly to quickly understand system load.
<span>vmstat</span> (Virtual Memory Statistics)- •Core Function: Reports detailed statistics on virtual memory, processes, I/O, and CPU activity.
- •Basic Usage:
- •
<span>vmstat [interval seconds] [count]</span>: For example,<span>vmstat 2 5</span>(output once every 2 seconds, for a total of 5 times). - •Advanced/Common Scenarios:
- • Key columns to focus on:
<span>procs(r, b)</span>,<span>memory(swpd)</span>,<span>swap(si, so)</span>,<span>io(bi, bo)</span>,<span>cpu(us, sy, id, wa)</span>.<span>si/so</span>not equal to 0 may indicate insufficient memory,<span>wa</span>being too high may indicate an I/O bottleneck. - • View only disk:
<span>vmstat -d 2</span>. - • View specific partition:
<span>vmstat -p /dev/sda1 2</span>. - • View memory slab:
<span>sudo vmstat -m</span>.
2. Memory Monitoring
- 1.
<span>free</span>
- •Core Function: Displays the usage of physical memory and swap space.
- •Basic Usage:
- •
<span>free -h</span>: Display in human-readable format (e.g., G, M, K). - •Advanced/Common Scenarios:
- • Understanding
<span>available</span>: This column better reflects the actual available memory for applications. - • Continuous monitoring:
<span>watch -n 2 free -h</span>(refresh every 2 seconds). - • Specify units:
<span>free -g</span>(GB),<span>free -m</span>(MB).
3. Disk I/O Monitoring
- 1.
<span>iostat</span>(Input/Output Statistics)
- •Core Function: Monitors CPU usage and I/O load on devices and partitions.
- •Basic Usage:
- •
<span>iostat</span>: Display an overview of CPU and device I/O. - •
<span>iostat -x [interval seconds]</span>: Display more detailed I/O statistics, for example,<span>iostat -x 2</span>. - •Advanced/Common Scenarios:
- • Key columns to focus on (
<span>-x</span>):<span>r/s</span>,<span>w/s</span>(read/write counts per second),<span>rkB/s</span>,<span>wkB/s</span>(read/write rates),<span>await</span>(average I/O processing time),<span>%util</span>(device utilization, close to 100% may indicate saturation). - • View only CPU:
<span>iostat -c 2</span>. - • View specific device:
<span>iostat -x sda 2</span>. - • Human-readable units (new version):
<span>iostat -xh 2</span>.
<span>iotop</span>- •Core Function: Similar to
<span>top</span>, but sorts processes by disk I/O usage. - •Basic Usage:
- •
<span>sudo iotop</span>: Start real-time I/O monitoring (usually requires root). - •Advanced/Common Scenarios:
- • View only active processes:
<span>sudo iotop -o</span>. - • View cumulative I/O:
<span>sudo iotop -a</span>. - • Batch mode (script):
<span>sudo iotop -b -n 1</span>.
4. Disk Space Monitoring
- 1.
<span>df</span>(Disk Free)
- •Core Function: Reports the disk space usage of the file system.
- •Basic Usage:
- •
<span>df -h</span>: Display all mounted file systems in a human-readable format. - •
<span>df -i</span>: Display Inode usage. - •Advanced/Common Scenarios:
- • Exclude specific types:
<span>df -h -x tmpfs -x devtmpfs</span>. - • Display only specific types:
<span>df -h -t ext4 -t xfs</span>. - • Script to get available space:
<span>df --output=avail / | tail -n 1 | tr -d ' '</span>(get the available space value of the root partition).
<span>du</span> (Disk Usage)- •Core Function: Estimates the actual disk space occupied by a file or directory.
- •Basic Usage:
- •
<span>du -sh <directory/file></span>: Display the total size of the specified path. - •
<span>du -sh *</span>: Display the size of each sub-item in the current directory. - •Advanced/Common Scenarios:
- • Find Top N largest directories:
<span>du -h --max-depth=1 /path | sort -hr | head -n 5</span>. - • Calculate size excluding subdirectories:
<span>du -sh --exclude='subdir' /path</span>. - • Find large files:
<span>find . -type f -size +100M -exec du -ch {} + | sort -hr</span>.
5. Network Monitoring
- 1.
<span>ss</span>
- •Core Function: Obtains socket statistics, a modern replacement for
<span>netstat</span>, faster. - •Basic Usage:
- •
<span>sudo ss -tulnp</span>: Display TCP/UDP listening ports and corresponding processes. - •Advanced/Common Scenarios:
- • All TCP connections:
<span>ss -t -a</span>. - • Specific port connections:
<span>ss -tan state established '( dport = :80 or sport = :80 )'</span>. - • Count state connections:
<span>ss -tan state time-wait | wc -l</span>(count TIME_WAIT).
<span>netstat</span>- •Core Function: Displays network connections, routing tables, interface statistics, etc. (older but still common).
- •Basic Usage:
- •
<span>sudo netstat -tulnp</span>: Listening ports and processes. - •
<span>netstat -rn</span>: View routing table. - •
<span>netstat -i</span>: View network interface statistics (packet loss, errors, etc.).
<span>ping</span>- •Core Function: Tests network connectivity to the target host.
- •Basic Usage:
- •
<span>ping <target IP/domain></span>. - •
<span>ping -c 4 <target></span>: Send a specified number (4) of packets. - •Advanced/Common Scenarios:
- • Test MTU:
<span>ping -M do -s 1472 <target></span>(send a specified size packet without fragmentation). - • Set timeout:
<span>ping -W 1 <target></span>(wait for reply 1 second).
<span>iftop</span>- •Core Function: Real-time monitoring of network interface bandwidth usage, displaying traffic by connection (requires root).
- •Basic Usage:
- •
<span>sudo iftop</span>: Monitor the default interface. - •
<span>sudo iftop -i eth0</span>: Monitor a specified interface. - •Advanced/Common Scenarios:
- • Filter by subnet:
<span>sudo iftop -F 192.168.1.0/24</span>. - • Do not resolve hostnames/ports:
<span>sudo iftop -n</span>(only IP) /<span>sudo iftop -N</span>(hide ports).
6. Process Monitoring
- 1.
<span>ps</span>(Process Status)
- •Core Function: Displays the status of currently running processes.
- •Basic Usage (Common Combinations):
- •
<span>ps aux</span>: BSD style, displays detailed information of all processes. - •
<span>ps -ef</span>: System V style, displays complete format information of all processes. - •Advanced/Common Scenarios:
- • Find process:
<span>ps aux | grep '[p]rocess_name'</span>(use<span>[]</span>to avoid grep itself). - • Sort by resource:
<span>ps aux --sort=-%mem</span>(memory descending),<span>ps aux --sort=-%cpu</span>(CPU descending). - • Filter by user:
<span>ps -u <username> -f</span>. - • Custom output columns:
<span>ps -eo pid,user,%cpu,%mem,comm</span>. - • Find zombie processes:
<span>ps aux | awk '$8=="Z"'</span>or<span>ps aux | grep ' Z '</span>.
7. Log Monitoring
- 1.
<span>tail</span>
- •Core Function: View the end content of a file, commonly used for real-time log monitoring.
- •Basic Usage:
- •
<span>tail -f /path/to/log</span>: Real-time track file updates. - •
<span>tail -n <number of lines> /path/to/log</span>: View the last N lines of the file. - •Advanced/Common Scenarios:
- • Track and highlight keywords:
<span>tail -f log | grep --color=always -E 'error|warn'</span>. - • Track rolling logs (logrotate):
<span>tail -F /path/to/log</span>. - • View the middle part of a file:
<span>head -n 200 file | tail -n +100</span>(view lines 100-200).
<span>journalctl</span> (Systemd Journal)- •Core Function: Queries and displays systemd system logs.
- •Basic Usage:
- •
<span>journalctl -f</span>: Real-time track all logs. - •
<span>journalctl -u <service_name></span>: View logs of a specific service. - •Advanced/Common Scenarios:
- • View latest logs:
<span>journalctl -n 50</span>. - • Filter by time:
<span>journalctl --since "1 hour ago"</span>,<span>journalctl --since "YYYY-MM-DD HH:MM:SS"</span>. - • Filter by priority:
<span>journalctl -p err</span>(view only errors),<span>journalctl -p warning</span>. - • Filter by executable:
<span>journalctl /path/to/executable</span>. - • Reverse display (latest first):
<span>journalctl -r</span>. - • JSON output (for script processing):
<span>journalctl -o json-pretty</span>.
8. Command Combination Techniques Examples
- • Find Java threads with high CPU usage:
<span>ps aux | grep '[j]ava'</span>(get PID) -><span>top -H -p <PID></span>. - • Find space occupied by each user under
<span>/home</span>:<span>sudo du -sh /home/* | sort -hr</span>. - • Check abnormal external connections (exclude common ports):
<span>sudo ss -tunap | grep ESTAB | grep -Ev '(:80 |:443 |:22 )'</span>. - • Find and count the number of network connections in a certain state:
<span>ss -tan state <STATE> | wc -l</span>.
Key Reminders and Summary
- •
<span>man</span>manual is the best teacher: When unsure about options,<span>man <command></span>(for example,<span>man ps</span>). - •Combined Usage: The power of Linux lies in pipes (
<span>|</span>) and command combinations, flexibly used to solve complex problems. - •Understanding Output: Not only should you know how to use commands, but also understand the meaning of each column in the output.
- •Practice: Practice more in a safe environment to familiarize yourself with commands and scenarios.
- •Select Appropriate Tools: Choose the most suitable monitoring command based on the specific problem.