Frequently Asked Question

What do vmstat, iostat, mpstat, and pidstat each tell me?

These four are the workhorses of the sysstat package (vmstat is in procps-ng but conceptually belongs with them). Each samples a kernel counter and prints rates over a fixed interval. vmstat 2 is the all-rounder: run queue length, free memory, swap-in/swap-out, block I/O, context switches, and a CPU breakdown, every two seconds. iostat -xz 2 zooms in on per-device disk activity: reads and writes per second, throughput, queue depth, average service time, and %util. mpstat -P ALL 2 zooms in on per-CPU usage, letting you spot a single-threaded workload pinning one core while the rest idle. pidstat 2 zooms in on per-process usage and can be filtered to one command with -C.

The discipline that matters is to run them with an interval (2 or 5 seconds) rather than a one-shot snapshot. The first line of vmstat and iostat is averaged since boot and almost always meaningless; the subsequent lines are the truth. Captured side-by-side in three terminal panes, they triangulate most performance problems within a minute.