Monitor CPU, memory, disk and logs on a Linux server

When a site slows down or a service stops, a few built-in commands usually show why within a minute. Here is what to run and how to read it.

Load and CPU

uptime
nproc

uptime shows the load average over 1, 5 and 15 minutes. Compare it with the number of vCPUs from nproc: a load that stays above that number means work is queuing.

For a live view, install htop:

sudo apt install -y htop      # Ubuntu / Debian
sudo dnf install -y htop      # AlmaLinux / Rocky (needs epel-release)
htop

Press F6 to sort by CPU or memory and F10 to quit. In top, the st (steal) value shows time the virtual CPU waited for the host; the wa value shows time waiting for disk.

Memory

free -h

Read the available column, not free. Linux uses spare RAM as disk cache and gives it back when programs need it. Low available memory plus heavy swap use means the server needs more RAM or a lighter workload.

Find the biggest users:

ps aux --sort=-%mem | head -n 10

Check whether the kernel killed something for lack of memory:

sudo journalctl -k | grep -i "out of memory"

Disk space and disk activity

df -h
df -i
sudo du -xh --max-depth=1 /var | sort -h

df -h shows space per filesystem; df -i shows inodes, which can run out when there are millions of tiny files. du shows which folders are largest. For disk activity, vmstat 1 5 prints five one-second samples; a high wa column means processes are waiting on disk.

Network and open ports

sudo ss -tulpn
ss -s

The first lists every listening port and the program behind it. The second summarises connections. For traffic totals over time see Understanding bandwidth.

Services and logs

systemctl --failed
sudo journalctl -p err -b
sudo journalctl -u nginx --since "1 hour ago"
sudo journalctl -f

These show failed services, errors since the last boot, recent logs for one service and a live stream of new log lines.

Troubleshooting

• High load but low CPU use: processes are waiting on disk (wa in top). Look for heavy backups, database queries or swap use.
• Memory keeps creeping up: an app may leak memory. Restart it, then watch ps over a day. See Add a swap file for a short-term cushion.
• Disk at 100%: follow Free up disk space on Linux.

Next steps

• Schedule tasks with cron