Bash System Monitoring — Complete Guide to Linux Performance Analysis

Every system administrator needs to know what’s running, how much memory is in use, when disk space is running low, and how to stop hung processes — Bash provides simple commands for all of this.

What You’ll Learn

• View running processes with ps and top
• Check disk usage with df and du
• Monitor memory with free
• Terminate unresponsive processes with kill
• Understand system load and uptime

Why System Monitoring Matters

A server running out of disk space stops saving data. A memory leak makes everything slow. A hung process blocks other users. Durga Antivirus Pro runs monitoring scripts every minute to check that scan engines are alive, log partitions aren’t full, and memory is below 90%. DodaZIP monitors compression job processes — if a zip job hangs, automated scripts kill it before it blocks the queue for everyone.

Learning Path

    flowchart LR
  A[Permissions & Users] --> B[System Monitoring<br/>You are here]
  B --> C[Networking]
  C --> D[Compression]
  

How System Monitoring Works

Think of your computer as a factory floor:

• Processes are workers doing jobs (each has a unique badge number = PID)
• CPU is the processing power available to workers
• Memory (RAM) is the desk space where workers keep materials they’re actively using
• Disk is the warehouse storage
• Load average tells you how many workers are waiting in line for CPU time

    flowchart TD
  A[System Monitoring] --> B[Processes<br/>ps, top]
  A --> C[Disk<br/>df, du]
  A --> D[Memory<br/>free]
  A --> E[System<br/>uptime]
  B --> F[Kill hung processes]
  C --> G[Find disk hogs]
  D --> H[Check RAM usage]
  

Process Status (ps)

ps (process status) takes a snapshot of running processes at this moment. It’s like a security camera freeze-frame.

# All processes running on the system
ps aux

Breaking down ps aux:

• a — show all users’ processes (not just yours)
• u — show detailed information (CPU%, memory%, user)
• x — show processes without a terminal (background daemons)

# Processes for the current user
ps -u $USER

# Find a specific process (pipe to grep)
ps aux | grep nginx

# Process tree showing parent-child relationships
ps axjf

# Custom output sorted by memory usage
ps -e -o pid,ppid,cmd,%mem,%cpu --sort=-%mem

Understanding ps Output Columns

What is a zombie process? A zombie (state Z) is a process that has finished executing but its parent hasn’t “collected” its exit code yet. Zombies can’t be killed — you must fix or restart the parent process.

top — Live Process Viewer

While ps is a snapshot, top is a live dashboard that refreshes every 3 seconds.

# Start top
top

Inside top, press these keys:

The top line shows: uptime, users, load average. The next lines show CPU usage (us=user, sy=system, id=idle), memory total/used/free, and swap.

Disk Space (df)

df (disk free) shows how much space is available on each mounted filesystem.

# All filesystems in human-readable format
df -h
# Filesystem      Size  Used Avail Use% Mounted on
# /dev/sda1       100G   45G   55G  45% /
# /dev/sdb1       500G  200G  300G  40% /data

# Specific mount point
df -h /home

# Show filesystem type (ext4, xfs, etc.)
df -T

Why -h matters: Without it, sizes are in bytes. df -h gives you GB/MB like a normal person.

Directory Usage (du)

du (disk usage) measures how much space a directory and its contents consume. Unlike df (which shows partition-level), du drills down into folders.

# Summary of current directory
du -sh
# 1.2G    .

# Size of each item in current directory
du -sh *
# 500M    Documents
# 200M    Downloads
# 12K     projects

# Sorted by size (largest first)
du -sh * | sort -rh

# Size of a specific path
du -sh /var/log

The -s flag means “summary” (don’t show every subdirectory). -h means human-readable.

Memory Usage (free)

# Human-readable memory info
free -h
#               total   used   free   shared  buff/cache  available
# Mem:          16G     5.3G   8.2G   245M    2.5G        10.1G
# Swap:         2.0G    0.0    2.0G

Reading this:

• total — physical RAM installed
• used — memory actively used by processes
• free — completely unused memory (usually small — Linux uses free memory for caching)
• buff/cache — memory used for disk cache (counts as “used” but available if apps need it)
• available — the real free memory = free + reclaimable cache

Key insight: Don’t panic if free shows low “free” memory. Linux uses spare RAM for caching. The available column is what matters.

kill — Terminating Processes

When a program freezes or a process is consuming too many resources, kill sends a signal to shut it down.

# Graceful shutdown (SIGTERM) — process can clean up
kill 1234

# Force kill (SIGKILL) — immediate, no cleanup
kill -9 1234

# Default graceful signal
kill -15 1234    # Same as kill 1234

# Kill by process name
pkill nginx

# Kill all instances of a program
killall chrome

Signal Reference

Never skip to SIGKILL: Always try kill (SIGTERM) first. SIGKILL doesn’t let the process save state or close files, which can corrupt data.

Uptime and Load Average

uptime
# 14:23:15 up 12 days, 3:45, 2 users, load average: 0.08, 0.12, 0.10

• up 12 days — the system hasn’t been rebooted in 12 days
• load average — three numbers: 1-minute, 5-minute, 15-minute averages of processes waiting for CPU

Interpreting load: For a 4-core system:

• Load of 0.5 = CPU is 87.5% idle
• Load of 2.0 = half the cores are busy
• Load of 4.0 = all cores fully saturated
• Load of 8.0 = processes are waiting in line (system is overloaded)

Common Mistakes

1. Killing with SIGKILL first

Always try kill (SIGTERM) first. SIGKILL doesn’t let the process clean up — files can be corrupted, data can be lost.

2. Confusing df and du

df shows partition-level usage. du shows directory-level usage. If a file is deleted but held open by a process, du won’t show it but df will still report the space as used.

3. Killing the wrong PID

Always verify with ps aux | grep process_name before running kill. Killing the wrong process (like the database or web server) can crash the whole application.

4. Not filtering top by user

On shared systems, top shows everyone’s processes. Press u and type a username to see only relevant processes.

5. Ignoring zombie processes

Zombie processes can’t be killed. They’re dead processes whose parent hasn’t read their exit status. You must fix or restart the parent process.

6. Panicking about low “free” memory

Linux uses free RAM for disk caching. The available column in free -h is the true free memory. A server showing 200MB “free” but 10GB “available” is perfectly healthy.

Practice Questions

1. What is the difference between ps and top? ps gives a snapshot of processes at a moment. top gives a live, updating view.

2. What is the difference between df and du? df shows filesystem-level free space (partitions). du shows directory-level usage. df catches space used by deleted but still-open files; du doesn’t.

3. How do you find which process is using the most memory? ps aux --sort=-%mem | head -5 or press M inside top.

4. What does kill -9 do? Sends SIGKILL — forces immediate termination. The process cannot clean up, close files, or save state. Use only when SIGTERM fails.

5. What is load average and what does 1.5 mean on a 2-core system? The average number of processes waiting for CPU. 1.5 on 2 cores means 75% CPU utilization — one core is fully busy, the other is half busy.

Challenge: Write a script that checks disk usage on the root partition every 10 seconds. If usage exceeds 80%, print a warning. If it exceeds 95%, send an alert and list the 5 largest directories in /var/log.

FAQ

Try It Yourself

Open your terminal and run these monitoring commands:

# Take a process snapshot
ps aux

# Find out who you are and what processes you own
ps -u $USER

# Live dashboard (press q to quit)
top

# Check disk space on root
df -h /

# See what's using space in your home directory
du -sh ~/* | sort -rh | head -10

# Check memory
free -h

# Uptime and load
uptime

For a more detailed view, install htop (an improved top) with sudo apt install htop or sudo dnf install htop. It adds color, mouse support, and easier process management.

What’s Next

What’s Next

Congratulations on completing this Bash System tutorial! Here’s where to go from here:

• Practice daily — Consistency is more important than long study sessions
• Build a project — Apply what you learned by building something real
• Explore related topics — Check out other tutorials in the same category
• Join the community — Discuss with other learners and share your progress

Remember: every expert was once a beginner. Keep coding!