Hands-on guide series
Linux Performance and Troubleshooting: A Hands-On Guide
A seven-part, hands-on guide to finding why a Linux server is slow: the USE method with top and vmstat, CPU saturation with mpstat and pidstat, memory and the OOM killer, disk IO with iostat and iotop, network throughput with ss and tcpdump, a sixty-second triage playbook, and inodes, lsof and file limits. Every command tested on a live Ubuntu 24.04 server.
What you will build
Security is layers, not a switch. Each part closes a different category of attack, from the automated sweep that finds a brand-new server, to the day one gets in anyway. Read them in order, or jump to what you need.
- 1
The USE Method: Read Load with top and vmstatRead Linux performance with the USE method on Ubuntu 24.04: uptime and load versus cores, the top CPU fields, and the vmstat run queue, shown idle and loaded.11 min - 2
CPU Saturation: mpstat, pidstat and perfDiagnose CPU saturation on Ubuntu 24.04: per-core utilisation with mpstat, the hot process with pidstat, and what perf stat can measure on a virtualised guest.7 min - 3
Memory Usage: free, swap and the OOM KillerRead Linux memory usage on Ubuntu 24.04: the available column in free, swap and swappiness, per-process RSS and PSS, and a real OOM kill in a bounded cgroup.7 min - 4
Disk IO: iostat, iotop and the CulpritRead disk IO on Ubuntu 24.04 with iostat: utilisation, await and throughput, then find the process with iotop and pidstat and split latency from throughput.6 min - 5
Network Throughput: ss, tcpdump and Socket StatesRead network throughput and socket state on Ubuntu 24.04: ss for LISTEN, ESTAB and TIME-WAIT, ss -i for TCP internals, a bounded transfer, and tcpdump to a file.6 min - 6
The Server Is Slow: A 60-Second Triage PlaybookWhen the server is slow, work a fixed sequence on Ubuntu 24.04: uptime, dmesg, vmstat, top, mpstat, iostat, pidstat and free, tracing one bottleneck end to end.7 min - 7
Inode Exhaustion, du, lsof and File LimitsThe full disk that still has free space on Ubuntu 24.04: inode exhaustion via df -i, big directories with du, deleted files held by lsof, and the ulimit cap.7 min