Linux System Monitoring: top, htop, vmstat, and iostat Explained

A slow Linux system tells you something is wrong, but not what. Is it CPU? Memory? Disk I/O? Network? Each problem has a different fix, and each fix requires the right diagnostic tool.

This guide covers the essential Linux monitoring commands — what they show, how to read them, and how to use them to find the actual bottleneck.

The First Question: What Kind of Problem Is This?

Before opening any tool, narrow it down:

• System feels sluggish overall → start with top or htop
• Commands are slow but CPU isn't pegged → likely memory pressure or disk I/O (vmstat, iostat)
• A specific process is misbehaving → top -p <PID> or watch ps
• Network feels slow → nethogs, iftop, ss
• Disk operations are slow → iostat, iotop

top — The Quick Overview

top gives you a real-time view of what's consuming CPU and memory.

top

Reading the header

top - 14:32:05 up 2 days, 3:12,  2 users,  load average: 0.45, 0.38, 0.31
Tasks: 183 total,   1 running, 182 sleeping,   0 stopped,   0 zombie
%Cpu(s):  3.2 us,  1.1 sy,  0.0 ni, 95.0 id,  0.5 wa,  0.0 hi,  0.2 si
MiB Mem :   7844.0 total,   2103.4 free,   3891.2 used,   1849.4 buff/cache
MiB Swap:   2048.0 total,   2048.0 free,      0.0 used.   3652.1 avail Mem

Load average (0.45, 0.38, 0.31) — 1, 5, and 15-minute averages. Compare to your CPU count:

• On a 4-core machine, load of 1.0 means 25% saturation — healthy
• Load of 4.0 means fully saturated — okay briefly, concerning if sustained
• Load above your core count means processes are waiting for CPU

CPU breakdown:

• us — user processes (your apps)
• sy — kernel (system calls, overhead)
• id — idle (how much headroom you have)
• wa — waiting on I/O (disk or network) — high wa means disk is the bottleneck
• hi/si — hardware/software interrupts

What to look for in top

• High %wa? Disk I/O problem — check with iostat
• High %sy? Too many system calls — often network or disk issues
• Low id and high us? CPU-bound — find the process consuming it
• Swap in use? Memory pressure — check with free and find memory hogs

Useful top shortcuts

Key	Action
M	Sort by memory
P	Sort by CPU (default)
k	Kill a process
u	Filter by user
1	Show per-CPU breakdown
q	Quit

htop — top with Better UX

htop shows the same information as top but with color bars and mouse support.

# Install if needed
sudo apt install htop       # Ubuntu/Debian
sudo dnf install htop       # Fedora/RHEL

htop

The CPU and memory bars are color-coded:

• Green — user processes (normal)
• Red — kernel/system (overhead)
• Blue — nice'd processes (lower priority)
• Yellow — I/O wait (disk waits)

htop is faster to read under pressure. Use top when htop isn't available; prefer htop when it is.

free — Memory at a Glance

free -h    # human-readable (MB, GB)
free -m    # megabytes
free -s 2  # refresh every 2 seconds

Output:

              total        used        free      shared  buff/cache   available
Mem:           7.7G        3.8G        2.1G        234M        1.8G        3.6G
Swap:          2.0G          0B        2.0G

Don't panic at "used" being high. Linux uses free memory for disk cache (buff/cache), which is released when applications need it. The number that matters is available — that's how much your programs can actually claim.

Column	What it means
total	Total installed RAM
used	RAM in active use
free	Completely unused RAM
buff/cache	Used for disk cache (reclaimed when needed)
available	Estimated memory available for new processes
Swap used	How much swap is in use — non-zero means memory pressure

Red flags:

• available near zero → system is close to OOM (out of memory)
• Swap in heavy use → RAM is exhausted, system will be slow

vmstat — CPU, Memory, and I/O at Once

vmstat shows a combined view of CPU, memory, swap, I/O, and system activity.

vmstat 2       # update every 2 seconds
vmstat 2 10    # 10 samples, 2 seconds apart

Output:

procs -----------memory---------- ---swap-- -----io---- -system-- ------cpu-----
 r  b   swpd   free   buff  cache   si   so    bi    bo   in   cs us sy id wa st
 1  0      0 2156744 112384 1892408    0    0     8    24  248  511  4  2 93  1  0

Column	Meaning
r	Processes waiting for CPU (run queue)
b	Processes in uninterruptible sleep (I/O wait)
swpd	Swap in use (KB)
free	Free memory (KB)
si / so	Swap in / swap out (KB/s) — non-zero is bad
bi / bo	Block reads / writes (KB/s)
us / sy / id / wa	CPU: user / system / idle / wait
cs	Context switches per second
in	Interrupts per second

What to watch:

• r consistently > CPU count → CPU saturation
• b > 0 → processes stuck waiting for I/O
• si/so > 0 → active swapping (memory exhaustion)
• High wa in CPU columns → disk is the bottleneck

iostat — Disk I/O Details

iostat shows disk read/write rates and how busy your storage devices are.

# Install if needed (part of sysstat package)
sudo apt install sysstat
sudo dnf install sysstat

iostat              # single snapshot
iostat -x 2        # extended stats, update every 2 seconds
iostat -x 2 5      # 5 samples

Output (extended mode):

Device     r/s   w/s  rMB/s  wMB/s  r_await  w_await  %util
sda       12.4  23.1    0.5    1.2     2.34     5.67   18.2
sdb        0.0   0.0    0.0    0.0     0.00     0.00    0.0

Column	Meaning
r/s / w/s	Read/write operations per second
rMB/s / wMB/s	Read/write throughput in MB/s
r_await / w_await	Average wait time for read/write (milliseconds)
%util	Percentage of time device was busy

What's normal:

• HDD: await under 10ms, %util under 70%
• SSD: await under 1ms, %util can sustain higher

Red flags:

• %util near 100% → disk is saturated
• await > 20ms on SSD → I/O queue backup
• Reads/writes much higher than expected → unexpected background activity

iotop — Which Process Is Using Disk

iostat shows disk usage totals; iotop shows which processes are responsible.

sudo apt install iotop
sudo iotop          # live view (needs root)
sudo iotop -a       # accumulated I/O since start
sudo iotop -o       # only show processes doing I/O

Like top but for disk I/O — shows bytes read/written per process per second. Essential when iostat shows disk saturation and you need to find the culprit.

df and du — Disk Space

df -h              # disk space by filesystem
df -h /var         # space on the filesystem containing /var
du -sh /var/log/   # total size of /var/log
du -sh /var/log/*  # size of each item in /var/log
du -sh * | sort -h # sorted by size, human-readable

Full disk kills services. When df shows 100% on /, most services stop writing logs and may crash. Common culprit: /var/log filling up.

# Find the largest directories under /var
du -h /var --max-depth=2 | sort -h | tail -20

Monitoring Network Usage

nethogs — per-process network usage

sudo apt install nethogs
sudo nethogs eth0    # shows bandwidth per process

iftop — per-connection network usage

sudo apt install iftop
sudo iftop -i eth0  # shows traffic by remote host

ss — active connections and listening ports

ss -tuln            # TCP/UDP listening ports, numeric
ss -tunap           # include process names
ss -s               # summary stats

Setting Up Continuous Monitoring with sar

sar (System Activity Reporter) from the sysstat package collects metrics continuously and lets you look back in time.

sudo apt install sysstat

# Enable data collection
sudo systemctl enable --now sysstat

# View historical CPU usage
sar -u             # today's CPU usage
sar -u 1 5         # live: 5 samples, 1 second apart
sar -u -f /var/log/sysstat/sa20  # data from the 20th

# View historical memory
sar -r

# View historical disk I/O
sar -d

After installing sysstat, it collects data every 10 minutes and keeps history. sar is invaluable for post-mortem analysis — "what was the system doing at 3am when the alert fired?"

A Monitoring Checklist for Slow Systems

1. top — is CPU or memory the immediate issue?
2. free -h — is memory available, or is swap active?
3. vmstat 2 — is there an I/O wait problem?
4. iostat -x 2 — which disk, and how saturated?
5. iotop — which process is doing the I/O?
6. df -h — is any filesystem full?
7. ss -tunap — any unusual connections?

Work through this in order and you'll identify most performance problems in under 5 minutes.

Full System Monitoring Guide

For setting up monitoring dashboards, configuring alerts, and using more advanced tools like dstat, nmon, and Prometheus, see the Linux System Monitoring Guide.

Get The Practical Linux Handbook
Read a free sample
All Linux topics