Skip to content

system-information-and-disk-triage.md

Latest commit

 

History

History
124 lines (85 loc) · 2.22 KB

system-information-and-disk-triage.md

File metadata and controls

124 lines (85 loc) · 2.22 KB
Raw

System Information and Disk Triage

This note summarizes first-pass Linux system inspection with top, free, df, du, and time.

Process Overview with top

Run:

top

Useful fields:

  • PID: process ID
  • USER: process owner
  • %CPU: current CPU usage
  • %MEM: memory share
  • TIME+: accumulated CPU time
  • COMMAND: command name or process command

Common interactive keys:

  • q: quit
  • P: sort by CPU
  • M: sort by memory
  • k: kill a process by PID after confirmation

Filter by user:

top -u username

For non-interactive snapshots, prefer:

ps aux --sort=-%cpu | head
ps aux --sort=-%mem | head

Memory Overview with free

free -h

Important columns:

  • total: installed memory
  • used: memory in use
  • free: currently unused memory
  • available: a better estimate of memory available for new work
  • buff/cache: memory used for buffers and page cache

In most troubleshooting, available is more useful than free.

Filesystem Overview with df

df -h
df -hT
df -i

Use:

  • df -h for readable capacity.
  • df -hT to include filesystem type.
  • df -i to detect inode exhaustion.

Low byte capacity and low inode capacity are different problems. A system can fail to create new files even when it still has free bytes.

Directory Usage with du

Measure one directory:

du -sh /path/to/target

Rank direct children:

du -h --max-depth=1 /path/to/target | sort -hr

Find large files:

find /path/to/target -type f -exec du -h {} + | sort -hr | head -n 20

Disk Triage Workflow

df -hT
df -i
du -h --max-depth=1 /path/to/mount | sort -hr
find /path/to/mount -type f -exec du -h {} + | sort -hr | head -n 20

The layers are:

  • df finds the stressed filesystem.
  • df -i checks whether inode count is the real problem.
  • du finds the responsible subtree.
  • find plus du identifies large individual files.

Timing a Command

Use time to measure a command:

time grep -R "ERROR" logs/

Typical output includes:

  • real elapsed time
  • user CPU time
  • system CPU time

This is useful when comparing two command forms, such as a broad recursive search versus a narrower targeted search.