Linux System Monitoring Reference Guide
Comparison of htop, iftop, nload, and atop
htop
Overview
htop is an interactive process monitoring tool used to analyze CPU, memory, and running processes in real time. It is an enhanced alternative to the traditional top command.
Unlike top, htop provides:
- A colorful interface
- Mouse support
- Process tree visualization
- Easier process management
It is widely used during server performance troubleshooting and system resource analysis.
Installation
Ubuntu / Debian
sudo apt install htop
RHEL / CentOS / Rocky
sudo dnf install htop
Basic Command
htop
Interface Components
Section | Description |
CPU meters | Shows CPU core usage |
Memory meter | Displays RAM usage |
Swap meter | Shows swap consumption |
Process list | Running processes |
Command line | Command used by each process |
Key Controls
Key | Function |
F2 | Setup configuration |
F3 | Search process |
F4 | Filter processes |
F5 | Tree view |
F6 | Sort processes |
F9 | Kill process |
F10 | Exit |
Example Usage
Sort Processes by CPU
PressΒ (on the keyboard):
F6 β CPU%
Kill High CPU Process
Select process then press (on the keyboard):
F9
Choose signal:
SIGTERM
Case Study
Scenario
During deployment of a web application server, users complain about slow response times.
Investigation
Run:
htop
Observation:
- CPU usage at 95%
- Process consuming CPU: python3
Resolution
Identify PID:
PID: 3452
Terminate process:
kill -9 3452
Best Use Cases
- System performance monitoring
- CPU troubleshooting
- Memory consumption tracking
- Process management
iftop
Overview
iftop is a network bandwidth monitoring tool. It shows real-time network traffic usage by connection.
Think of it as top for network traffic.
It helps administrators detect:
- Bandwidth hogs
- Suspicious traffic
- Network bottlenecks
Installation
Ubuntu / Debian
sudo apt install iftop
RHEL / CentOS
sudo dnf install iftop
Basic Command
sudo iftop
Specify Interface
sudo iftop -i eth0
Display Elements
Column | Meaning |
Source | Sending IP |
Destination | Receiving IP |
TX | Data transmitted |
RX | Data received |
2s | Traffic average over 2 seconds |
10s | Traffic average over 10 seconds |
40s | Traffic average over 40 seconds |
Example Usage
Monitor traffic on interface
sudo iftop -i ens33
Show port numbers
Press (on the keyboard):
p
Pause display
PressΒ (on the keyboard):
PΒ
Case Study
Scenario
During a data center migration, the server link becomes congested.
Investigation
Run:
sudo iftop -i eth0
Observation:
192.168.10.5 => 52.216.100.23Β 120MB/s
This reveals that a backup server is sending large data to AWS S3.
Resolution
Throttle backup job.
Best Use Cases
- Detect abnormal network traffic
- Monitor server bandwidth
- Troubleshoot network congestion
- Security monitoring
nload
Overview
nload is a simple console-based network monitoring tool that shows incoming and outgoing traffic in graphical format.
Unlike iftop, it does not show connections, but focuses on total bandwidth usage.
Installation
Ubuntu / Debian
sudo apt install nload
RHEL / CentOS
sudo dnf install nload
Basic Command
nload
Monitor Specific Interface
nload eth0
Interface Display
Two main graphs:
| Graph | Description |
| Incoming | Download traffic |
| Outgoing | Upload traffic |
Metrics shown:
- Current traffic
- Average traffic
- Maximum traffic
- Total data transferred
Example Usage
Monitor Network Utilization
nload ens33
Display:
Incoming: 2.35 Mbit/s
Outgoing: 1.12 Mbit/s
Case Study
Scenario
A corporate firewall server experiences periodic network spikes.
Investigation
Run:
nload eth1
Observation:
Traffic spike at 9 PM daily
Conclusion:
- Automatic backup scheduled.
Best Use Cases
- Quick bandwidth monitoring
- Visual network traffic analysis
- Monitoring internet gateways
atop
Overview
atop is an advanced system and process monitor capable of recording historical system performance data.
It tracks:
- CPU
- Memory
- Disk I/O
- Network usage
- Processes
Unlike htop, it can store logs for later analysis.
Installation
Ubuntu / Debian
sudo apt install atop
RHEL / CentOS
sudo dnf install atop
Start atop
sudo atop
Key Metrics Displayed
Section | Description |
CPU | CPU usage |
MEM | Memory usage |
SWP | Swap usage |
DSK | Disk activity |
NET | Network traffic |
Example Usage
Monitor system
atop
View historical logs
atop -r /var/log/atop/atop_20260310
Case Study
Scenario
A production database server experiences performance issues at midnight.
Investigation
Use historical logs:
atop -r /var/log/atop/atop_20260310
Navigate time using:
t
Observation:
- Disk I/O spike at midnight
- Process: mysqldump
Conclusion:
- Backup job causing heavy I/O.
Best Use Cases
- Historical performance analysis
- Server capacity planning
- Disk I/O troubleshooting
- Enterprise production monitoring
Comparison Summary
Feature | htop | iftop | nload | atop |
CPU monitoring | β | β | β | β |
Memory monitoring | β | β | β | β |
Process management | β | β | β | β |
Network traffic | β | β | β | β |
Per connection traffic | β | β | β | β |
Historical logging | β | β | β | β |
Graphical terminal interface | β | β | β | β |
Recommended Usage in Projects
Scenario | Recommended Tool |
Investigating high CPU | htop |
Detecting network bandwidth hog | iftop |
Monitoring internet gateway | nload |
Performance analysis over time | atop |
Practical Workflow for Administrators
When troubleshooting a slow production server, a recommended workflow is:
Step 1 β Check CPU and processes
htop
Step 2 β Inspect network activity
iftop
Step 3 β Observe overall bandwidth
nload
Step 4 β Analyze historical performance
atop
If you want, I can also generate a downloadable professional reference booklet (PDF or DOCX) titled:
“Linux System Monitoring Toolkit for Infrastructure Administrators”
including:
- diagrams
- troubleshooting workflow
- real enterprise scenarios
- command cheat sheets.
