Monitoring System Resources

# Quick system overview — uptime, users, load averages
uptime

# Number of CPU cores (divide load average by this to assess pressure)
nproc
lscpu | grep "^CPU(s):"

# Real-time CPU stats — refresh every 2 seconds, 5 iterations
vmstat 2 5

# Per-CPU breakdown — shows if load is balanced across cores
mpstat -P ALL 1 3

# top sorted by CPU — press P inside top to sort by CPU
top

# Show only CPU-intensive processes (threshold > 10% CPU)
ps aux --sort=-%cpu | awk 'NR==1 || $3 > 10'

# Human-readable memory overview — the most important command
free -h

# Refresh every 2 seconds
free -h -s 2

# Detailed memory breakdown from the kernel
cat /proc/meminfo | grep -E "MemTotal|MemFree|MemAvailable|Cached|Buffers|SwapTotal|SwapFree"

# Show per-process memory consumption — RSS = actual physical RAM used
ps aux --sort=-%mem | head -15

# Show top 10 memory-consuming processes cleanly
ps -eo pid,user,%mem,rss,comm --sort=-%mem | head -11

# Check if the OOM killer has activated (kills processes when RAM is exhausted)
dmesg | grep -i "oom\|killed process"
journalctl -k | grep -i "oom\|killed process"

# Install sysstat (provides iostat, mpstat, sar)
sudo apt install sysstat -y       # Debian/Ubuntu
sudo dnf install sysstat -y       # RHEL/Rocky

# Extended disk stats — refresh every 2 seconds
iostat -xh 2

# Show only specific device
iostat -xh 2 /dev/sda

# Find which process is causing high disk I/O (requires root)
sudo iotop -o         # -o = show only active processes

# Non-interactive iotop snapshot
sudo iotop -b -n 3 -o | head -20

# Watch disk I/O in real time via /proc
watch -n 1 cat /proc/diskstats

# ss — the modern replacement for netstat

# Show all listening TCP ports with process names
sudo ss -tlnp

# Show all established TCP connections
sudo ss -tnp state established

# Show connections to a specific port
sudo ss -tnp sport = :443

# Count connections per state (useful for detecting SYN floods)
ss -tan | awk '{print $1}' | sort | uniq -c | sort -rn

# Show socket statistics summary
ss -s

# ── Interface throughput ──────────────────────────────────────────

# Show interface statistics (RX/TX bytes, errors, drops)
ip -s link show eth0

# Watch live interface counters
watch -n 1 'ip -s link show eth0 | grep -A 4 "RX:"'

# iftop — real-time bandwidth by connection (requires install)
sudo apt install iftop -y
sudo iftop -i eth0

# nethogs — bandwidth per process
sudo apt install nethogs -y
sudo nethogs eth0

# Enable sysstat data collection (disabled by default on some distros)
sudo systemctl enable --now sysstat

# On Debian/Ubuntu — enable in the config file
sudo sed -i 's/ENABLED="false"/ENABLED="true"/' /etc/default/sysstat
sudo systemctl restart sysstat

# View today's CPU history — all samples
sar -u

# View CPU history for a specific hour window today
sar -u -s 02:00:00 -e 04:00:00

# View CPU history from a specific past day (data files in /var/log/sysstat/)
sar -u -f /var/log/sysstat/sa10       # day 10 of the current month

# Memory history for today
sar -r

# Disk activity history today
sar -d -p                              # -p = pretty device names

# Network throughput history today
sar -n DEV | grep eth0

# Run sar live — 5 samples, 2 seconds apart (like vmstat)
sar -u 2 5

# Full 4-resource check — run this sequence when a server is slow

# 1. CPU and load
uptime
vmstat 1 5

# 2. Memory
free -h
dmesg | grep -i oom | tail -5

# 3. Disk I/O
iostat -xh 2 3

# 4. Network
ss -s
ip -s link show eth0 | grep -A 2 "RX:\|TX:"

# Bonus: identify the top 5 processes consuming most resources
ps -eo pid,user,%cpu,%mem,comm --sort=-%cpu | head -6