Monitoring Linux Process Usage: A Comprehensive Guide

Linux provides a variety of tools for monitoring CPU activity. The following are some of the most popular methods:

- top command: This command displays a list of all the running processes, including CPU load and memory usage. It also shows high CPU and memory utilisation.

- mpstat command: This command is part of the sysstat package and displays CPU usage for each processor or processor core.

- sar command: This command is a utility for managing system resources and can be used to track CPU performance.

- iostat command: This command displays average CPU usage and input/output load.

- htop: This is an advanced version of the top command, with additional features such as a user-friendly interface and shortcut keys.

- iotop: This command is similar to top and htop, but it also includes an accounting function to monitor disk I/O and processes.

- nmon: This tool monitors all Linux resources, including CPU, memory, disk usage, network, and more.

Linux top command: displays a list of all the running and active real-time processes, including CPU and memory usage

The `top` command in Linux is a built-in tool that displays a list of all running and active real-time processes, including CPU and memory usage. It provides an overview of system performance by showing:

• A dynamic list of all the processes that are currently running, which changes as background tasks start and complete.
• Users, tasks, CPU load, and memory usage.
• The process ID (PID), CPU and memory usage percentages, process start time, total CPU time used, and the command that launched each process.

To use the `top` command, simply open a terminal window and enter `top`. To exit, press `q`. While `top` is running, you can use the following keyboard shortcuts:

• ``M`` to sort the task list by memory usage.
• ``P`` to sort the task list by processor usage.
• ``N`` to sort the task list by process ID.
• ``T`` to sort the task list by run time.
• ``h`` to display the help window.

The `top` command also supports additional options to filter and customise the output:

• The `-i` option hides all idle processes.
• The `-o` flag shows the top memory-consuming processes.
• The `-p` option allows you to specify a process ID to monitor.

For example, to display only the top 10 memory-consuming processes, you can use the command:

> top -o %MEM | head -n 16

The `top` command is a powerful tool for system administrators to monitor and manage system performance in Linux.

VmStat: displays statistics of virtual memory, kernel threads, disks, system processes, and CPU activity

VmStat is a Linux command-line tool that reports various system information, including virtual memory, paging, processes, IO, CPU, and disk scheduling. The command helps identify performance bottlenecks and diagnose system problems.

The basic syntax for the vmstat command is:

`vmstat [options][delay [count]]`

• Options: Various switches to customise the output.
• Delay: Defines the time interval between updates.
• Count: The number of updates printed after the given delay interval.

The first report generated by the vmstat command is an average of the requested information since the last system reboot. Subsequent reports use measurements of delay and count.

The basic output of the vmstat command is divided into six sections:

• Procs: The number of runnable processes (r) and the number of processes in uninterruptible sleep (b).
• Memory: Total virtual memory (swpd), total free memory (free), total memory used as buffers (buff), and total cache memory (cache).
• Swap: The rate of swapping-in memory from disk (si) and the rate of swapping-out memory to disk (so).
• IO: Blocks received from a block device per second (bi) and blocks sent to a block device per second (bo).
• System: The number of system interrupts per second (in) and the number of context switches per second (cs).
• CPU: The percentage of CPU time spent on non-kernel processes (us), kernel processes (sy), idle time (id), waiting for input/output (wa), and stolen by a virtual machine (st).

The vmstat command also offers several options to customise the output:

• -a: Displays active and inactive memory.
• -f: Displays the number of forks since boot.
• -s: Displays various memory statistics, CPU and IO event counters.
• -d: Gives read/write stats for various disks.
• -t: Adds a timestamp to the report.
• -S: Switches output units between kilobytes and megabytes.

For example, to update the statistics every 5 seconds and change the display units to megabytes, use the command:

`vmstat -S m 5`

Vmstat is a valuable tool for monitoring system performance and resource utilisation in Linux. By providing detailed insights into virtual memory, kernel threads, disks, system processes, and CPU activity, administrators can identify potential issues and optimise system performance.

Lsof: lists all the open files and processes, including disk files, network sockets, and pipes

Lsof is a command-line utility that lists all the open files and processes, including disk files, network sockets, and pipes. It is a powerful tool that provides insights into the files currently open on a Linux system. The command stands for "List Open Files" and can be easily remembered as "ls + of", where "ls" stands for list and "of" stands for open files.

Lsof provides detailed information about the files opened by various processes, including their process IDs, users, file descriptors, sizes, and more. It can be used to list all open files on the system, files opened by a specific user, files under a specific directory, files opened by a particular process or process ID, and more.

• To list all open files on the system, simply run `lsof` without any options.
• To list files opened by a specific user, use the `-u` option followed by the username, e.g., `lsof -u username.
• To list all open files under a specific directory, use the `+D` option, e.g., `lsof +D /directory/path`.
• To list all network connections, use the `-i` option, e.g., `lsof -i`.
• To list all open files by a specific process ID, use the `-p` option followed by the process ID, e.g., `lsof -p 1234`.
• To kill all processes that belong to a particular user, use the `-t` option to list the process IDs and then pass them to the `kill` command, e.g., `kill -9 \`lsof -t -u username\``.

Lsof also supports repeat mode, which can be enabled using the `-r` or `+r` options. This will list files based on given parameters, delay for a specified number of seconds, and then list the files again.

Tcpdump: captures or filters TCP/IP packets received or transferred on a specific interface over a network

Tcpdump is a command-line network packet analyser or packet sniffer that captures or filters TCP/IP packets received or transferred on a specific interface over a network. It is one of the most widely used tools for this purpose and is available on almost all major Linux distributions.

The basic syntax for using tcpdump is:

Bash

Tcpdump -i

Where `-i` specifies the network interface to capture packets from.

Tcpdump provides an option to save captured packets to a file for later analysis:

Bash

Tcpdump -i -w

You can also filter packets based on various criteria such as source or destination IP address, port number, protocol type, etc. For example, to capture only TCP packets from a specific IP address:

Bash

Tcpdump -i host and tcp

Tcpdump also allows you to read and analyse previously captured packets from a file:

Bash

Tcpdump -r

Netstat: monitors incoming and outgoing network packet statistics and interface statistics

Netstat is a command-line tool for monitoring network connections, both incoming and outgoing. It is available on all Unix-like operating systems and Windows OS. Netstat allows you to display statistics about your Ethernet interface and can be used to monitor and troubleshoot networking problems for systems or apps.

To use Netstat, open a command prompt by pressing the Windows key + R, then type "cmd". Alternatively, simply type "cmd" into the search bar in the bottom left of the desktop.

In the command prompt, type "netstat" to list all current network connections, both inbound and outbound. You can also use the following commands:

• "netstat -a" to display all active and inactive connections.
• "netstat -e" to show network adapter statistics, including the number of bytes and packets received and sent.
• "netstat -f" to show the fully qualified domain name (FQDN) for foreign addresses.
• "netstat -n" to display addresses and ports in numerical form.
• "netstat -o" to show active TCP connections and the corresponding process identifier for each connection.
• "netstat -p" to display connections per protocol (TCP, UDP, TCPv6, or UDPv6).
• "netstat -q" to list all connections with listening and bound non-listening ports.
• "netstat -r" to display the current network routing table.
• "netstat -s" to show network statistics for available protocols, including TCP, UDP, ICMP, and IP (versions 4 and 6).
• "netstat -t" to generate a list of the current connection offload state, which refers to the TCP Chimney Offload feature.
• "netstat -x" to produce a list of NetworkDirect connections, shared endpoints, and listeners.

Netstat also allows you to combine parameters to display various information. For example, "-e" and "-s" can be used together to see statistics for each available protocol. Additionally, the "-o" parameter can be combined with "-a", "-n", and "-p".

The "netstat -p" command can be appended with an "s" parameter to display statistics from additional protocols, including "icmp", "ip", "icmpv6", and "ipv6".

To see all available parameters and help, use the "netstat /?" command.

Frequently asked questions