To use sar, sadc (system activity data collector) needs to be running. Check its status or start it with rcsysstat {start|status}.
sar can generate extensive reports on almost all important system activities, among them CPU, memory, IRQ usage, IO, or networking. With its many options, it is too complex to explain further here. Refer to the man page for extensive documentation with examples.
The utility free examines RAM usage. Details of both free and used memory and swap areas are shown:
tux@mercury:~> free total used free shared buffers cached Mem: 515584 501704 13880 0 73040 334592 -/+ buffers/cache: 94072 421512 Swap: 658656 0 658656
The options -b,-k,-m,-g show output in bytes, KB, MB, or GB, respectively. The parameter -d delay ensures that the display is refreshed every delay seconds. For example, free -d 1.5 produces an update every 1.5 seconds.
It can be useful to determine what processes or users are currently accessing certain files. Suppose, for example, you want to unmount a file system mounted at /mnt. umount returns "device is busy." The command fuser can then be used to determine what processes are accessing the device:
tux@mercury:~> fuser -v /mnt/* USER PID ACCESS COMMAND /mnt/notes.txt tux 26597 f.... less
Following termination of the less process, which was running on another terminal, the file system can successfully be unmounted.
The Linux kernel keeps certain messages in a ring buffer. To view these messages, enter the command dmesg:
$ dmesg [...] end_request: I/O error, dev fd0, sector 0 subfs: unsuccessful attempt to mount media (256) e100: eth0: e100_watchdog: link up, 100Mbps, half-duplex NET: Registered protocol family 17 IA-32 Microcode Update Driver: v1.14 <tigran@veritas.com> microcode: CPU0 updated from revision 0xe to 0x2e, date = 08112004 IA-32 Microcode Update Driver v1.14 unregistered bootsplash: status on console 0 changed to on NET: Registered protocol family 10 Disabled Privacy Extensions on device c0326ea0(lo) IPv6 over IPv4 tunneling driver powernow: This module only works with AMD K7 CPUs bootsplash: status on console 0 changed to on
Older events are logged in the files /var/log/messages and /var/log/warn.
To view a list of all the files open for the process with process ID PID, use -p. For example, to view all the files used by the current shell, enter:
tux@mercury:~> lsof -p $$ COMMAND PID USER FD TYPE DEVICE SIZE NODE NAME bash 5552 tux cwd DIR 3,3 1512 117619 /home/tux bash 5552 tux rtd DIR 3,3 584 2 / bash 5552 tux txt REG 3,3 498816 13047 /bin/bash bash 5552 tux mem REG 0,0 0 [heap] (stat: No such bash 5552 tux mem REG 3,3 217016 115687 /var/run/nscd/passwd bash 5552 tux mem REG 3,3 208464 11867 /usr/lib/locale/en_GB. bash 5552 tux mem REG 3,3 882134 11868 /usr/lib/locale/en_GB. bash 5552 tux mem REG 3,3 1386997 8837 /lib/libc-2.3.6.so bash 5552 tux mem REG 3,3 13836 8843 /lib/libdl-2.3.6.so bash 5552 tux mem REG 3,3 290856 12204 /lib/libncurses.so.5.5 bash 5552 tux mem REG 3,3 26936 13004 /lib/libhistory.so.5.1 bash 5552 tux mem REG 3,3 190200 13006 /lib/libreadline.so.5. bash 5552 tux mem REG 3,3 54 11842 /usr/lib/locale/en_GB. bash 5552 tux mem REG 3,3 2375 11663 /usr/lib/locale/en_GB. bash 5552 tux mem REG 3,3 290 11736 /usr/lib/locale/en_GB. bash 5552 tux mem REG 3,3 52 11831 /usr/lib/locale/en_GB. bash 5552 tux mem REG 3,3 34 11862 /usr/lib/locale/en_GB. bash 5552 tux mem REG 3,3 62 11839 /usr/lib/locale/en_GB. bash 5552 tux mem REG 3,3 127 11664 /usr/lib/locale/en_GB. bash 5552 tux mem REG 3,3 56 11735 /usr/lib/locale/en_GB. bash 5552 tux mem REG 3,3 23 11866 /usr/lib/locale/en_GB. bash 5552 tux mem REG 3,3 21544 9109 /usr/lib/gconv/gconv-m bash 5552 tux mem REG 3,3 366 9720 /usr/lib/locale/en_GB. bash 5552 tux mem REG 3,3 97165 8828 /lib/ld-2.3.6.so bash 5552 tux 0u CHR 136,5 7 /dev/pts/5 bash 5552 tux 1u CHR 136,5 7 /dev/pts/5 bash 5552 tux 2u CHR 136,5 7 /dev/pts/5 bash 5552 tux 255u CHR 136,5 7 /dev/pts/5
The special shell variable $$, whose value is the process ID of the shell, has been used.
The command lsof lists all the files currently open when used without any parameters. Because there are often thousands of open files, listing all of them is rarely useful. However, the list of all files can be combined with search functions to generate useful lists. For example, list all used character devices:
tux@mercury:~> lsof | grep CHR bash 3838 tux 0u CHR 136,0 2 /dev/pts/0 bash 3838 tux 1u CHR 136,0 2 /dev/pts/0 bash 3838 tux 2u CHR 136,0 2 /dev/pts/0 bash 3838 tux 255u CHR 136,0 2 /dev/pts/0 bash 5552 tux 0u CHR 136,5 7 /dev/pts/5 bash 5552 tux 1u CHR 136,5 7 /dev/pts/5 bash 5552 tux 2u CHR 136,5 7 /dev/pts/5 bash 5552 tux 255u CHR 136,5 7 /dev/pts/5 X 5646 root mem CHR 1,1 1006 /dev/mem lsof 5673 tux 0u CHR 136,5 7 /dev/pts/5 lsof 5673 tux 2u CHR 136,5 7 /dev/pts/5 grep 5674 tux 1u CHR 136,5 7 /dev/pts/5 grep 5674 tux 2u CHR 136,5 7 /dev/pts/5
udevmonitor listens to the kernel uevents and events sent out by a udev rule and prints the device path (DEVPATH) of the event to the console. This is a sequence of events while connecting a USB memory stick:
UEVENT[1138806687] add@/devices/pci0000:00/0000:00:1d.7/usb4/4-2/4-2.2 UEVENT[1138806687] add@/devices/pci0000:00/0000:00:1d.7/usb4/4-2/4-2.2/4-2.2 UEVENT[1138806687] add@/class/scsi_host/host4 UEVENT[1138806687] add@/class/usb_device/usbdev4.10 UDEV [1138806687] add@/devices/pci0000:00/0000:00:1d.7/usb4/4-2/4-2.2 UDEV [1138806687] add@/devices/pci0000:00/0000:00:1d.7/usb4/4-2/4-2.2/4-2.2 UDEV [1138806687] add@/class/scsi_host/host4 UDEV [1138806687] add@/class/usb_device/usbdev4.10 UEVENT[1138806692] add@/devices/pci0000:00/0000:00:1d.7/usb4/4-2/4-2.2/4-2.2 UEVENT[1138806692] add@/block/sdb UEVENT[1138806692] add@/class/scsi_generic/sg1 UEVENT[1138806692] add@/class/scsi_device/4:0:0:0 UDEV [1138806693] add@/devices/pci0000:00/0000:00:1d.7/usb4/4-2/4-2.2/4-2.2 UDEV [1138806693] add@/class/scsi_generic/sg1 UDEV [1138806693] add@/class/scsi_device/4:0:0:0 UDEV [1138806693] add@/block/sdb UEVENT[1138806694] add@/block/sdb/sdb1 UDEV [1138806694] add@/block/sdb/sdb1 UEVENT[1138806694] mount@/block/sdb/sdb1 UEVENT[1138806697] umount@/block/sdb/sdb1
xrestop provides statistics for each connected X11 client's server-side resource. The output is very similar to Section 10.6.4, Processes: top.
xrestop - Display: localhost:0 Monitoring 40 clients. XErrors: 0 Pixmaps: 42013K total, Other: 206K total, All: 42219K total res-base Wins GCs Fnts Pxms Misc Pxm mem Other Total PID Identifier 3e00000 385 36 1 751 107 18161K 13K 18175K ? NOVELL: SU 4600000 391 122 1 1182 889 4566K 33K 4600K ? amaroK - S 1600000 35 11 0 76 142 3811K 4K 3816K ? KDE Deskto 3400000 52 31 1 69 74 2816K 4K 2820K ? Linux Shel 2c00000 50 25 1 43 50 2374K 3K 2378K ? Linux Shel 2e00000 50 10 1 36 42 2341K 3K 2344K ? Linux Shel 2600000 37 24 1 34 50 1772K 3K 1775K ? Root - Kon 4800000 37 24 1 34 49 1772K 3K 1775K ? Root - Kon 2a00000 209 33 1 323 238 1111K 12K 1123K ? Trekstor25 1800000 182 32 1 302 285 1039K 12K 1052K ? kicker 1400000 157 121 1 231 477 777K 18K 796K ? kwin 3c00000 175 36 1 248 168 510K 9K 520K ? de.comp.la 3a00000 326 42 1 579 444 486K 20K 506K ? [opensuse- 0a00000 85 38 1 317 224 102K 9K 111K ? Kopete 4e00000 25 17 1 60 66 63K 3K 66K ? YaST Contr 2400000 11 10 0 56 51 53K 1K 55K 22061 suseplugge 0e00000 20 12 1 50 92 50K 3K 54K 22016 kded 3200000 6 41 5 72 84 40K 8K 48K ? EMACS 2200000 54 9 1 30 31 42K 3K 45K ? SUSEWatche 4400000 2 11 1 30 34 34K 2K 36K 16489 kdesu 1a00000 255 7 0 42 11 19K 6K 26K ? KMix 3800000 2 14 1 34 37 21K 2K 24K 22242 knotify 1e00000 10 7 0 42 9 15K 624B 15K ? KPowersave 3600000 106 6 1 30 9 7K 3K 11K 22236 konqueror 2000000 10 5 0 21 34 9K 1K 10K ? klipper 3000000 21 7 0 11 9 7K 888B 8K ? KDE Wallet