In this section, we will look at how to monitor and analyze several types of processes in a Linux system. To achieve our objectives, we shall examine several excellent tools.
lsof and fuser
In linux, everything is considered as files including block special files, internet sockets, UNIX domain sockets, pipes, and many others. While working in Linux/Unix system there might be several files and folders which are being used by the users which need to be considered. Consider adding and using a USB drive as an example. You attempt to unmount the drive after finishing your work on it. The error “Device or Resource Busy” may appear in this situation, in which case you must close any open files. lsof stands for a list of open files. It shows you which files are still being used. Let’s run the command.
You can see the details information about each process. For the USB example, to unmount the drive you to kill the open processes first.
Another way to visualize the open processes is done by fuser which stands for file user.
$fuser -v .
here, we can see that these processes are using the
/home/ohid directory. You can use any of these two ways to track down the open files. You can also pass the user parameter.
You may have heard of single-thread and multi-thread processing. Threads are very similar to the process in linux. The term “thread” refers to the set of supposed to perform within a process, which might range from a single thread to several threads. The process is in charge of allocating the memory and resources that will be used by the thread. It is frequently referred to as a lightweight process since it may access shared data while maintaining its own stack. The application’s performance will increase as it runs in parallel. Because threads and processes share the same address space, communication between them is minimal.
Assume you open Google Chrome and LibreOffice at the same time. Each software initiates its own process in order to function effectively. When you type text inside the libre writer, it is now edited and saved simultaneously. Threads are the two concurrent processes of saving and editing at the same time. Threads are found within the process. Each process has the option of being single-threaded or multi-threaded.
To view the threads of a process, run the following command,
$ ps m
In this instance, we can observe that two distinct PIDs are connected to two distinct processes. A ‘–‘ symbol indicates where threads are situated below the process. Thus, there are three threads involved in the first process and six threads in the second process.
Monitoring of the CPU
To monitor the CPU, we will use the uptime command here. The command uptime displays the current time, uptime, the number of active users, and the average system load over the last 1, 5, and 15 minutes. Depending on your chosen parameters, it can also filter the information that is presented all at once. Let’s run the command below.
We can see the system’s uptime and the current time in the output. We can also observe that there is only one active user right now. The average CPU load is then displayed. What is it then? Assume you have a CPU with one core. One way to think of the CPU’s core is as a single-lane road. When completely utilized, the load would be 100%. Thus, the typical load would be 1. However, there is so much traffic during rush hour that the load would be, say, 200% or 2. Additionally, the load would be zero if there was no traffic on the route.
The presence of load 1 does not imply that your system is operating at maximum capacity. CPUs today have several cores. If the load on a CPU with four cores is 1. It is therefore only operating at 25% of its potential. By using the
'cat /proc/cpuinfo' command, you can learn more about your CPU cores.
Monitoring of the I/O
With a useful program called iostat, we can also track disk consumption in addition to CPU utilization. It does not always come in default with the system and you may need to install it if it does not. To install it, run the command.
$ sudo apt install sysstat
Now that, you have iostat, run the command.
It first shows some information about the CPU. Then, there are two parts. Information about the first part is discussed below.
- %user: Display the percentage of the CPU used while a user was conducting an operation (application)
- %nice: Display with a nice priority the percentage of the CPU that was used for user-level operations. CPU use by the user with nice priority.
- %system: Show the system-level CPU consumption as a percentage of the total CPU time (kernel).
- %iowait: Indicate the percentage of time the CPU or CPUs were not in use when a disk I/O request was pending.
- %steal: Indicate the percentage of time the virtual CPU or virtual CPUs were forced to wait while the hypervisor was tending to another virtual processor.
- %idle: Indicate the percentage of time the CPU or CPUs were not in use and that no disk I/O requests were pending.
In the next part, it shows information about disk utilization:
- tps: Indicate how many transfers were sent to the device per second. An I/O request to the device is a transfer. One I/O request to the device might include many logical requests. A transfer’s size is unknown.
- kB_read/s: Indicate the amount of data read from the device expressed in kilobytes per second.
- kB_wrtn/s: Indicate the amount of data written from the device expressed in kilobytes per second.
- kB_read: The total amount of read kilobytes.
- kB_wrtn: The total amount of kilobytes written.
Monitoring of the Memory
You can also monitor the memory usage by the vmstat tool. Run the command below.
In the output, we can see couple of fields such as procs, memory, swap, io, system and cpu.
- r: Number of running processes
- b: Number of processes in uninterruptible sleep
- swpd: Amount of virtual memory used
- free: Amount of free memory
- buff: Amount of memory used as buffers
- cache: Amount of memory used as cache
- si: Amount of memory swapped in from disk
- so: Amount of memory swapped out to disk
- bi: Amount of blocks received in from a block device
- bo: Amount of blocks sent out to a block device
- in: Number of interrupts per second
- cs: Number of context switches per second
- us: Time spent in user time
- sy: Time spent in kernel time
- id: Time spent idle
- wa: Time spent waiting for IO