How to Monitor CPU, RAM, Disk and Network Usage on Linux
Monitoring server resources is essential for maintaining application performance, planning capacity, and detecting problems before they cause outages. Linux provides a rich set of built-in tools for observing CPU, memory, disk, and network utilization.
CPU Monitoring
Understanding CPU Metrics
CPU utilization is measured as a percentage of available processing capacity. Key metrics: - user: percentage of CPU used by application processes - system: percentage of CPU used by the kernel - idle: percentage of CPU not being used - iowait: percentage of CPU time waiting for I/O operations (high values indicate disk bottleneck)
A healthy server typically shows 60 to 80% CPU utilization during peak periods. Sustained 100% utilization indicates insufficient CPU capacity.
Using top and htop
top displays real-time CPU usage by process. Press 1 to see per-core utilization. Watch for: - Load average (1, 5, 15 minute averages): should not exceed the number of CPU cores consistently - Individual processes consuming excessive CPU - High iowait values indicating disk bottlenecks
Using mpstat
mpstat -P ALL 1 shows per-CPU core utilization, updated every second. This helps identify whether load is evenly distributed across cores or concentrated on specific cores.
Memory Monitoring
Using free
free -h is the primary memory monitoring command. Key values: - total: total installed physical RAM - used: memory actively in use by processes - buff/cache: memory used for buffers and page cache (reclaimable when needed) - available: memory available for new applications (includes reclaimable cache)
The critical metric is available memory, not free memory. Linux uses available memory for caching to improve performance, but this cache is released when applications need it.
Swap usage is the key warning sign. Any swap usage suggests the system is under memory pressure. Investigate immediately if swap usage grows.
Per-Process Memory
ps aux --sort=-%mem | head -10 shows the top 10 memory-consuming processes.
For detailed memory analysis: pmap -x PID shows the memory map of a specific process.
Using vmstat
vmstat 1 provides a compact view of memory, CPU, and I/O activity: - si/so (swap in/out): should be zero or near-zero on a healthy system - free: available free memory - buff/cache: buffer and cache memory - us/sy/id/wa: CPU breakdown (user, system, idle, iowait)
Disk Monitoring
Disk Space
df -h shows disk space usage per filesystem. Key indicators: - Use% above 80%: consider cleanup or expansion - Use% above 90%: urgent action required - Use% at 100%: services may fail
Disk Usage by Directory
du -sh /path shows the total size of a directory. To find which directories are consuming the most space: du -sh /var/* | sort -rh | head -10
Disk I/O Performance
iostat -x 1 shows disk I/O statistics: - %util: disk utilization (above 80% indicates potential bottleneck) - await: average response time in ms (should be under 10ms for SSD, under 1ms for NVMe) - r/s, w/s: IOPS for reads and writes - rkB/s, wkB/s: throughput in KB/s
For real-time I/O monitoring: iotop shows per-process disk I/O usage (requires root).
Network Monitoring
Interface Statistics
ip -s link show displays network interface statistics including packet counts, errors, and drops.
Connection Monitoring
ss -s shows a summary of socket connections: - TCP established: number of active connections - TCP time-wait: connections in cleanup state (high values may indicate connection churn)
ss -tnp shows established TCP connections with process information.
Bandwidth Monitoring
nload provides real-time bandwidth monitoring for network interfaces. Install with: sudo apt install nload
For historical data: vnstat tracks bandwidth usage over time and can generate daily, monthly, and yearly reports.
Automated Monitoring
For production servers, implement automated monitoring with alerting: - Set up monitoring agents that collect and report metrics - Configure alerts for resource thresholds (CPU > 85%, memory > 90%, disk > 80%) - Use centralized monitoring to view all servers from a single dashboard - Store historical metrics for capacity planning
Key Thresholds to Watch
- CPU: alert if sustained above 85% for more than 5 minutes
- Memory: alert if available memory drops below 10% of total
- Disk: alert if usage exceeds 80%
- Swap: alert on any swap usage
- Disk I/O: alert if %util stays above 90% consistently
- Network errors: alert on increasing packet errors or drops
Proactive monitoring catches issues before they become outages. Set up alerts and review dashboards regularly. ## Key Takeaways
- Core Linux tools — top, free, df, iostat, and ss — give you immediate visibility into CPU, memory, disk, and network usage without installing anything extra
- Set clear alert thresholds: CPU above 85%, memory below 10% free, disk usage above 80%, any swap activity, and disk %util above 90%
- Automated monitoring with alerting (Prometheus, vnstat, centralized dashboards) catches problems before they become outages
- Review metrics regularly to support capacity planning — trend data over weeks and months is more valuable than any single snapshot