System monitoring in Linux and Unix environments encompasses real-time observation and historical analysis of system resources — CPU, memory, disk, network, and processes. From basic utilities like top and ps that ship with every distribution, to modern interactive tools like htop and btop, monitoring helps identify bottlenecks, diagnose failures, and optimize performance. Understanding load average (runnable + uninterruptible processes over 1, 5, and 15 minutes) differs from instantaneous CPU usage — the former reveals sustained pressure, the latter shows a snapshot. A key insight: iowait is not CPU time lost to waiting — it's idle time during which at least one I/O operation was pending, meaning high iowait with low CPU usage often indicates disk or network bottlenecks, not CPU saturation.
What This Cheat Sheet Covers
This topic spans 15 focused tables and 100 indexed concepts, 99 flashcards. Below is a complete table-by-table outline of this topic, spanning foundational concepts through advanced details.
A jump-to index of every table row in this cheat sheet.
An interactive map of every table and concept in this topic.
Table 1: Core Process Monitoring Commands
The first tools every sysadmin reaches for: real-time process viewers, snapshot tools, and utilities to find, filter, and inspect running processes. Mastering these covers the majority of day-to-day monitoring work without installing anything extra.
| Command | Example | Description | |
|---|---|---|---|
top | • Real-time process viewer showing CPU, memory, load average • ships with all Unix-like systems • interactive keys M (sort by memory), P (CPU), k (kill), r (renice). | ||
htop | • Enhanced color-coded interactive monitor • displays CPU cores individually, process tree ( F5), filtering (F4), sorting (F6)• requires installation but vastly more usable than top. | ||
ps auxps -ef | • Snapshot of running processes • aux shows all users BSD-style, -ef shows full format Unix-style• not real-time — use for scripting and quick checks | ||
atop 5 | • System-wide resource monitor updated every N seconds • logs historical data to /var/log/atop/• shows per-process disk I/O, network, CPU, memory • highlights saturated resources in red | ||
btop | • Modern C++ successor to bashtop/bpytop • mouse support, themes, graphs for CPU/memory/disk/network • lightweight and highly responsive • best visual presentation of all CLI tools | ||
glances | • Python-based cross-platform monitor with auto-adapting display • exports to CSV, InfluxDB, Prometheus • web mode ( glances -w) for remote access• color-coded warnings and alerts | ||
pgrep -u root sshd | • Find PIDs matching process name and criteria (user, terminal, parent) • -l shows names, -f matches full command line• safer than ps |• grep. | ||
watch -n 2 df -hwatch -d free -h | • Runs a command repeatedly (default every 2 sec) filling the screen • -n sets interval, -d highlights differences between updates• essential for monitoring any command over time | ||
pstree -p | • Displays processes as tree hierarchy • -p shows PIDs, -u shows user transitions• useful for understanding parent-child relationships and daemon spawning | ||
pidof nginx | • Returns PIDs of running instances of a program name • simpler than pgrep for exact name matches• single-purpose tool |