Monitor CPU, memory and disk usage

When a server feels slow, the cause is usually one of three things: a process using too much CPU or memory, a disk that has filled up, or swapping because RAM ran out. This guide shows the quick checks, the interactive tools htop and ncdu, and how to read what you find.

Before you begin

An Ubuntu 24.04 VPS with SSH access as a sudo user, such as alex.
A few minutes while the server is under its normal load, so the numbers mean something.
Nothing to install yet. The first commands use tools that ship with Ubuntu.

Step 1: Take a quick snapshot

Three commands give you a fast picture. uptime shows the load average, free -h shows memory, and df -h shows disk space.

uptime
free -h
df -h /

 10:42:15 up 12 days,  3:10,  1 user,  load average: 0.08, 0.12, 0.10

               total        used        free      shared  buff/cache   available
Mem:           1.9Gi       612Mi       208Mi        12Mi       1.2Gi       1.3Gi
Swap:          2.0Gi          0B       2.0Gi

Filesystem      Size  Used Avail Use% Mounted on
/dev/vda1        25G  9.1G   15G  38% /

Read the numbers this way:

Load average is the number of processes waiting to run. Compare it with the CPU count from nproc. A load consistently above the CPU count means work is queueing.
available memory is what matters. buff/cache is memory the system can reclaim, so a large value there is normal.
Use% for the disk should stay well below about 85 percent. Above 90 percent, act soon.

Step 2: Install htop and ncdu

htop is a live process viewer. ncdu shows disk usage by folder, interactively.

sudo apt update
sudo apt install -y htop ncdu

Step 3: Watch live processes with htop

Start htop. The top section has a bar for each CPU core, plus bars for memory and swap. The table below lists processes, sorted by CPU use by default.

htop

Useful keys:

F3 searches, F4 filters, F6 changes the sort column (such as MEM%).
F10 or q quits.

Careful: F9 sends a signal to the selected process, and the default signal stops it. Only use it on processes you recognize.

Step 4: Find the biggest memory users without htop

This plain-text alternative sorts processes by memory. %MEM is the share of total RAM.

ps aux --sort=-%mem | head -n 6

USER        PID %CPU %MEM    VSZ   RSS TTY      STAT START   TIME COMMAND
mysql      1184  0.8 24.1 1348212 470500 ?      Ssl  Oct20  41:12 /usr/sbin/mariadbd
www-data   1422  0.1  6.3  412988 122880 ?      S    Oct20   3:05 php-fpm: pool www

Step 5: Find what fills the disk

When df shows a full disk, find the folders responsible. du measures folder sizes. The -x option stays on one filesystem, -h prints human-readable sizes, and sort -rh lists the largest first. Errors about unreadable folders are discarded to the null device.

sudo du -xh / 2>/dev/null | sort -rh | head -n 15

For an interactive view, run ncdu on the same folder tree. Use the arrow keys to move, Enter to open a folder, and q to quit:

sudo ncdu -x /

Careful: ncdu can delete files with the d key. Only delete what you understand. Never remove files inside database data folders, and never delete anything under /var/lib by hand.

Some clean-ups are safe. The apt package cache is one of them, and sudo apt clean empties it. Check the size first:

sudo du -sh /var/cache/apt
sudo apt clean

Step 6: Check for swapping and I/O waits

If the server is slow but CPU is not busy, it may be waiting on disk. The wa column in vmstat shows time spent waiting for I/O, and si and so show memory moving to and from swap. Sample five times, five seconds apart:

vmstat 5 5

procs -----------memory---------- ---swap-- -----io---- -system-- -------cpu-------
 r  b   swpd   free   buff  cache   si   so    bi    bo   in   cs us sy id wa st
 1  0      0 208412  12044 1228800    0    0     3    21  210  380  2  1 97  0  0

Sustained values above zero in si or so mean memory is short. Sustained high wa means the disk is the bottleneck. The MariaDB tuning guide covers the first case.

Troubleshooting

High load but low CPU use: processes are waiting for the disk. Check wa in vmstat and look for a backup or log job running at the same time.
Swap is heavily used: reduce memory use by lowering database or application limits, or move to a larger plan. Check the kernel log for kills with sudo journalctl -k | grep -i "out of memory".
Disk full with space still shown free: you may be out of inodes, which are file slots. Check with df -i.
htop is not installed: run sudo apt install -y htop, or use top, which is always present.

Next steps

Take a snapshot like this when things are healthy, so you know what normal looks like. Uptime checks such as LightServe Beacon can alert you before users notice a problem.