Master Linux Performance: Top CLI Tools for CPU & Memory Spikes

When a VPS or dedicated server shows a sudden spike in memory or CPU usage, the first tool a sysadmin turns to is the command line. Lightweight, real‑time utilities give an instant picture of what’s consuming resources without the overhead of a full monitoring stack. This article walks through three essential commands: htop, iostat, and netstat. You’ll learn how to install them on the most common Linux distributions, read their output, and combine the data to isolate the root cause of performance problems.

Why CLI Tools Still Matter in a Cloud‑First World

Cloud dashboards provide high‑level metrics, but they run outside the host and may not reflect the exact load the hypervisor sees. CLI tools run directly on the server, giving you the raw numbers that matter during an incident. They also work over a simple SSH session, which is often the only access method available on a freshly provisioned VPS or a bare‑metal server.

Getting Started: Installing the Tools

Debian / Ubuntu (apt)

# Update package lists
sudo apt update

# Install htop
sudo apt install -y htop

# Install iostat (sysstat package)
sudo apt install -y sysstat

# Install netstat (net-tools package)
sudo apt install -y net-tools

• apt update refreshes the local package index.
• apt install -y htop installs the interactive process viewer.
• sysstat provides iostat, which reports CPU and I/O statistics.
• net-tools supplies the classic netstat utility for network socket inspection.

AlmaLinux / Rocky Linux / RHEL (dnf)

# Ensure the system is up‑to‑date
sudo dnf check-update

# Install htop
sudo dnf install -y htop

# Install iostat (sysstat package)
sudo dnf install -y sysstat

# Install netstat (net-tools package)
sudo dnf install -y net-tools

On RHEL‑based systems, the sysstat service may be disabled by default. Enable it with sudo systemctl enable --now sysstat before running iostat (see the iostat usage section).

htop – Real‑Time Process Insight

htop is a colorful, interactive replacement for top. It shows CPU, memory, swap, and load‑average graphs at a glance and lets you sort, filter, and kill processes with a few keystrokes.

Launching htop

htop

The top pane displays:

• CPU usage per core (bars and percentages).
• Memory and swap usage (bars, used/total).
• Load average (1, 5, 15‑minute).

Key shortcuts for a spike investigation

• F3 / / – Search for a process name or PID.
• F6 – Change the column sort order (e.g., %CPU or %MEM).
• F9 – Send a signal to the highlighted process.
• Space – Tag multiple processes for batch actions.

Typical workflow

1. Sort by %CPU (F6 → %CPU).
2. Identify the offending PID (e.g., php-fpm or mysqld).
3. Press F9 to send SIGTERM or SIGKILL if the process is misbehaving.
4. Observe whether the overall load drops; if not, move to I/O or network diagnostics.

iostat – Understanding CPU vs. Disk I/O

CPU spikes can sometimes be a symptom of heavy disk activity. iostat breaks down CPU utilisation and provides per‑device I/O statistics, helping you decide whether the bottleneck is compute or storage.

Enabling data collection (RHEL‑based only)

sudo systemctl enable --now sysstat

This starts the sar daemon, which collects the metrics that iostat reads.

Basic usage

# Show CPU and device stats every 5 seconds, 3 reports
iostat -xz 5 3

Options explained:

• -x – Extended statistics (utilisation, await, etc.).
• -z – Omit devices with zero activity.
• 5 3 – Interval of 5 seconds, three iterations.

Reading the output

Column	Meaning
%user	CPU time in user space.
%system	CPU time in kernel space.
%iowait	CPU idle while waiting for I/O.
util	Device utilisation (% busy).
await	Average wait time per I/O request (ms).

If %iowait is high while %user and %system are modest, the CPU is idle because the disk cannot keep up. Focus on the device with the highest util value.

netstat – Mapping Network Connections and Socket States

CPU usage can also be driven by a flood of network connections—think DDoS, misconfigured crawlers, or a runaway application opening many sockets. netstat gives you a snapshot of listening ports, established connections, and socket statistics.

Commonly used flags

• -tulnp – Show TCP/UDP listening sockets with PID/program name.
• -s – Display per‑protocol statistics.
• -p (requires root) – Attach process IDs to each line.

Example: List all listening services

sudo netstat -tulnp

Typical output:

Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name
tcp        0      0 0.0.0.0:80              0.0.0.0:*               LISTEN      1234/nginx
tcp6       0      0 :::443                  :::*                    LISTEN      1234/nginx
udp        0      0 0.0.0.0:53              0.0.0.0:*                           5678/dnsmasq

Look for unexpected services listening on high‑traffic ports.

Detecting connection storms

# Show the number of connections per remote IP (requires awk)
sudo netstat -tnp | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -nr | head -20

This pipeline extracts the remote IP from each TCP line, counts occurrences, and lists the top 20 sources. A single IP with thousands of connections may indicate an attack or a misbehaving client.

Putting It All Together: A Diagnostic Workflow

1. Check overall load with htop. Identify the process(es) consuming the most CPU or RAM.
2. If the culprit is a database or web server, run iostat to see if %iowait is also elevated. High I/O wait suggests disk contention.
3. If CPU usage is high but I/O is low, revisit the process list for looping scripts or runaway threads.
4. Run netstat -tulnp to verify that only expected services are listening. Use the connection‑storm command to spot abusive IPs.
5. Take corrective action: restart or reconfigure the offending service, adjust kernel parameters (e.g., vm.swappiness), or implement firewall rules to block malicious sources.

Document each step in your incident log; a concise record speeds up future resolutions.

Tips for Ongoing Monitoring

• Schedule iostat and netstat -s via cron and pipe results to a log file for trend analysis.
• Combine htop snapshots with ps aux --sort=-%mem to capture a full memory view before a crash.
• Use ss (part of iproute2) as a faster alternative to netstat on newer kernels.

Conclusion

Even with cloud dashboards, the three CLI tools covered here remain essential for rapid, on‑the‑spot diagnosis of memory and CPU spikes. htop gives an immediate view of process behaviour, iostat separates CPU load from disk bottlenecks, and netstat uncovers hidden network activity. By mastering these utilities on both Debian/Ubuntu and AlmaLinux/RHEL families, you’ll be ready to resolve performance incidents before they affect your users.