top                          # interactive mode
top -b -n 1                   # batch mode, single snapshot (good for scripting)
top -p 1234                    # watch a specific PID
top -u myuser                  # filter by user
top -d 0.5                     # refresh every 0.5s

top - 14:23:01 up 10 days,  3:12,  2 users,  load average: 0.45, 0.61, 0.72
Tasks: 312 total,   3 running,  308 sleeping,   1 zombie
%Cpu(s):  8.3 us,  2.1 sy,  0.0 ni, 88.4 id,  1.2 wa,  0.0 hi,  0.0 si
MiB Mem :  15987.2 total,   1023.4 free,  12845.1 used,   2118.7 buff/cache
MiB Swap:   2048.0 total,   512.0 free,   1536.0 used.   1456.3 avail Mem

htop                         # interactive
htop -p 1234,5678            # watch specific PIDs
htop -u myuser               # filter by user
htop -d 5                    # 0.5s refresh
htop -t                      # tree view by default

mpstat                       # all CPUs summary since boot
mpstat -P ALL 1 5            # per-CPU stats, 1s interval, 5 times
mpstat -P 0,1,2 1           # specific CPUs only
mpstat -I ALL 1              # include interrupt stats

CPU    %usr   %sys   %iowait  %irq   %soft  %idle
all    23.4    4.1     18.2    0.1    0.3    53.9
  0    45.2    8.3     32.1    0.2    0.5    13.7   # CPU 0 hot
  1     1.2    0.2      0.1    0.0    0.1    98.4   # CPU 1 idle

vmstat 1                     # update every 1 second
vmstat 1 10                  # 1s interval, 10 samples
vmstat -s                    # memory stats summary
vmstat -d                    # disk stats
vmstat -t 1                  # include timestamp

pidstat 1                    # CPU stats for all active processes
pidstat -u 1                 # CPU usage per process
pidstat -d 1                 # disk I/O per process
pidstat -r 1                 # memory stats per process
pidstat -w 1                 # context switches per process
pidstat -p 1234 1            # watch specific PID
pidstat -t 1                 # include threads

# CPU profiling - sample call stack at 99Hz for 10s
perf record -F 99 -ag -- sleep 10
perf report

# Profile a specific command
perf stat -d ./my-program

# Count events system-wide
perf stat -a sleep 5

# Flame graph (with Brendan Gregg's scripts)
perf record -F 99 -ag -p 1234 -- sleep 30
perf script | stackcollapse-perf.pl | flamegraph.pl > flame.svg

# Top functions by CPU
perf top

# Trace syscalls
perf trace -p 1234

# Count cache misses
perf stat -e cache-misses,cache-references ./my-program

free -h                      # human-readable (KB/MB/GB)
free -m                      # megabytes
free -s 1                    # update every 1 second
free -t                      # include total row

              total        used        free      shared  buff/cache   available
Mem:          15987        12845        1023         312        2118        2847
Swap:          2048        1536         512

vmstat -s                    # memory event counters since boot
cat /proc/meminfo             # raw kernel memory breakdown
cat /proc/slabinfo            # kernel slab allocator stats

smem -r                     # sort by RSS descending
smem -s pss -r              # sort by PSS descending
smem -u                     # per-user summary
smem -t                     # show totals
smem -P nginx               # filter by process name

pmap 1234                    # basic memory map
pmap -x 1234                # extended (RSS, dirty pages)
pmap -d 1234                # show device format
pmap -x 1234 | tail -1     # just the totals line

iostat -x 1                 # extended stats, 1s interval
iostat -xz 1                # extended, skip idle devices
iostat -x 1 10              # 10 samples
iostat -p sda 1             # specific device
iostat -t -x 1              # with timestamp

iotop                        # interactive, requires root
iotop -o                    # only show processes doing I/O
iotop -b -n 5               # batch mode, 5 iterations
iotop -p 1234               # watch specific PID
iotop -a                    # accumulated I/O totals

df -h                       # human readable
df -hT                      # include filesystem type
df -i                       # inode usage (not space!)
df -h /var                  # specific mount point

du -sh *                    # size of each item in current dir
du -sh /var/log/*           # size breakdown in /var/log
du -h --max-depth=1 /       # top-level directory sizes

# Find top 10 largest directories
du -xh / | sort -rh | head -10

# Largest files anywhere on system
find / -xdev -type f -printf "%s %p\n" | sort -rn | head -20

# What files does a process have open?
lsof -p 1234

# Who has a file open?
lsof /var/log/app.log

# What process is using a port?
lsof -i :8080
lsof -i TCP:443

# All network connections
lsof -i

# Files open by a user
lsof -u myuser

# Deleted files still held open (space not reclaimed!)
lsof +L1

# Count open file descriptors per process
lsof -n | awk '{print $2}' | sort | uniq -c | sort -rn | head

ss -tulnp                   # listening TCP+UDP sockets with PID
ss -tan                     # all TCP connections (numeric)
ss -s                       # socket summary stats
ss -tp                      # TCP with process info
ss -o state established     # only ESTABLISHED connections
ss -o state time-wait       # only TIME_WAIT
ss dst 10.0.0.1             # connections to a specific IP
ss sport = :8080            # connections from source port 8080

# Count connections by state
ss -tan | awk '{print $1}' | sort | uniq -c

netstat -tulnp              # listening sockets with PID
netstat -an                 # all connections numeric
netstat -s                  # protocol statistics (retransmits etc)
netstat -rn                 # routing table
netstat -i                  # interface stats

iftop                        # interactive, auto-selects interface
iftop -i eth0               # specific interface
iftop -n                    # no DNS resolution
iftop -P                    # show ports
iftop -B                    # show bytes (not bits)
iftop -f "host 10.0.0.1"   # filter by host

nethogs                      # all interfaces
nethogs eth0                 # specific interface
nethogs -d 2               # 2s refresh interval
nethogs -b                  # tracemode (non-interactive)

# Capture all traffic on eth0
tcpdump -i eth0

# Capture specific port
tcpdump -i eth0 port 8080

# Capture to file for Wireshark analysis
tcpdump -i eth0 -w capture.pcap

# Read pcap file
tcpdump -r capture.pcap

# Filter by host and port
tcpdump -i eth0 host 10.0.0.1 and port 443

# Show HTTP GET requests
tcpdump -i eth0 -A 'tcp port 80 and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)'

# DNS queries
tcpdump -i any port 53

# Count packets by source IP
tcpdump -i eth0 -nn -q | awk '{print $3}' | cut -d. -f1-4 | sort | uniq -c | sort -rn

ping -c 10 8.8.8.8          # 10 pings to Google DNS
ping -i 0.2 8.8.8.8          # fast ping (0.2s interval)

mtr 8.8.8.8                  # interactive traceroute
mtr --report -c 50 8.8.8.8  # 50 packets, report mode (good for sharing)
mtr -n 8.8.8.8               # no DNS resolution

ps aux                       # all processes, all users (BSD style)
ps -ef                      # full format (UNIX style)
ps -ef --forest             # tree view showing parent/child
ps aux --sort=-%cpu        # sort by CPU descending
ps aux --sort=-%mem        # sort by memory descending
ps -p 1234 -o pid,cmd,rss  # custom output columns
ps -u myuser               # by user

# Find a process by name
ps aux | grep nginx
pgrep -la nginx             # cleaner alternative

# Attach to running process
strace -p 1234

# Trace a new command
strace ls /tmp

# Follow child processes too
strace -f -p 1234

# Filter to specific syscalls
strace -e trace=open,read,write -p 1234
strace -e trace=network -p 1234
strace -e trace=file -p 1234

# Show timing info
strace -T -p 1234             # time spent in each syscall
strace -t -p 1234             # wall clock timestamps

# Summary: count syscalls and time
strace -c ./my-program

# Write output to file
strace -o /tmp/strace.log -p 1234

ltrace ./my-program          # trace library calls
ltrace -p 1234              # attach to running process
ltrace -c ./my-program       # summary count
ltrace -e malloc+free ./app  # only malloc/free calls

# How many FDs does a process have?
ls /proc/1234/fd | wc -l

# What is the FD limit?
cat /proc/1234/limits | grep "open files"

# Check process memory maps
cat /proc/1234/maps

# Process environment variables
cat /proc/1234/environ | tr '\0' '\n'

# Actual binary path (useful for containers)
ls -la /proc/1234/exe

# Files opened by process name
bpftrace -e 'tracepoint:syscalls:sys_enter_openat /comm == "nginx"/ { printf("%s\n", str(args->filename)); }'

# Syscall count per process
bpftrace -e 'tracepoint:raw_syscalls:sys_enter { @[comm] = count(); }'

# Disk I/O latency histogram
bpftrace -e 'kprobe:blk_account_io_start { @start[arg0] = nsecs; }
kprobe:blk_account_io_done /@start[arg0]/ {
  @usecs = hist((nsecs - @start[arg0]) / 1000); delete(@start[arg0]); }'

# TCP connect latency
bpftrace -e 'kprobe:tcp_v4_connect { @start[tid] = nsecs; }
kretprobe:tcp_v4_connect /@start[tid]/ {
  @ms = hist((nsecs - @start[tid]) / 1000000); delete(@start[tid]); }'

# List available tracepoints
bpftrace -l 'tracepoint:syscalls:*'

runqlat                      # run queue latency — are tasks waiting for CPU?
biolatency -D              # disk I/O latency per device
tcpretrans                   # watch TCP retransmits live
cachestat 1                  # page cache stats every second
memleak -p 1234             # watch for memory leaks in PID
profile -F 99 -af 30        # CPU flame graph for 30s

cd /sys/kernel/debug/tracing

# List available tracers
cat available_tracers

# Function call tracing
echo function > current_tracer
echo 1 > tracing_on
cat trace
echo 0 > tracing_on

# Trace a specific function
echo my_function > set_ftrace_filter
echo function > current_tracer

# Easier with trace-cmd (wrapper)
trace-cmd record -e sched_switch -p function sleep 5
trace-cmd report

# CPU usage every 1s, 5 samples
sar -u 1 5

# Memory stats
sar -r 1 5

# Disk I/O
sar -d 1 5

# Network stats
sar -n DEV 1 5

# TCP stats
sar -n TCP 1 5

# Load average and run queue
sar -q 1 5

# Historical data from today's log
sar -u -f /var/log/sysstat/sa$(date +%d)

# Historical data from specific time range
sar -u -s 09:00:00 -e 10:00:00

dstat                        # default: cpu, disk, net, paging, system
dstat -cdngy               # cpu, disk, net, paging, system
dstat --top-cpu             # show top CPU process
dstat --top-io              # show top I/O process
dstat --top-mem             # show top memory process
dstat -t 1 60               # with timestamp, 1s interval, 60s
dstat --output /tmp/dstat.csv 1  # export to CSV for analysis

glances                      # interactive TUI
glances -w                  # web server mode (port 61208)
glances -s                  # server mode (for remote monitoring)
glances -c remote-host      # connect to remote glances server
glances --export csv        # export metrics to CSV

atop                         # interactive
atop -r /var/log/atop/atop_20240426  # replay saved log
atop -A                     # show all resources
atop -w /tmp/atop.log 1 60  # write log, 1s interval, 60s

kill -15 1234               # graceful terminate (default)
kill -9 1234                # force kill
kill -HUP 1234              # reload config
killall nginx                # kill all processes named nginx
pkill -f "my-app"           # kill by full command line match
kill -0 1234                # check if process exists (no signal sent)