An essential part of running and administering an Ubuntu system involves monitoring the overall system health regarding memory, swap, storage, and processor usage. This includes knowing how to inspect and manage the system and user processes running in the background. This chapter will outline some tools and utilities that can be used to monitor system resources and processes on an Ubuntu system.
Even when an Ubuntu system appears idle, many system processes will run silently in the background to keep the operating system functioning. For example, when you execute a command or launch an app, user processes are started, running until the associated task is completed.
To obtain a list of active user processes you are currently running within the context of a single terminal or command-prompt session, use the ps command as follows:
$ ps PID TTY TIME CMD 10395 pts/1 00:00:00 bash 13218 pts/1 00:00:00 psCode language: plaintext (plaintext)
The output from the ps command shows that two user processes are running within the context of the current terminal window or command prompt session, the bash shell into which the command was entered, and the ps command itself.
To list all active processes running for the current user, use the ps command with the -a flag. This command will list all running processes that are associated with the user regardless of where they are running (for example, processes running in other terminal windows):
$ ps -a PID TTY TIME CMD 5442 tty2 00:00:00 gnome-session-b 6350 pts/0 00:00:00 sudo 6354 pts/0 00:00:00 su 6355 pts/0 00:00:00 bash 9849 pts/2 00:00:00 nano 9850 pts/1 00:00:00 psCode language: plaintext (plaintext)
As shown in the above output, the user is running processes related to the GNOME desktop, the shell session, the nano text editor, and the ps command.
To list the processes for a specific user, run ps with the -u flag followed by the user name:
# ps -u john PID TTY TIME CMD 914 ? 00:00:00 systemd 915 ? 00:00:00 (sd-pam) 970 ? 00:00:00 gnome-keyring-d 974 tty1 00:00:00 gdm-x-session . .Code language: plaintext (plaintext)
Note that each process is assigned a unique process ID which can be used to stop the process by sending it a termination (TERM) signal via the kill command. For example:
$ kill 13217Code language: plaintext (plaintext)
The advantage of ending a process with the TERM signal is that it allows the process to exit gracefully, potentially saving any data that might otherwise be lost.
If the standard termination signal does not terminate the process, repeat the kill command with the -9 option. This command sends a KILL signal which should cause even frozen processes to exit but does not give the process a chance to exit gracefully, possibly resulting in data loss:
$ kill -9 13217Code language: plaintext (plaintext)
To list all of the processes running on a system (including all user and system processes), execute the following command:
$ ps -ax PID TTY STAT TIME COMMAND 1 ? Ss 0:22 /usr/lib/systemd/systemd rhgb --switched-root 2 ? S 0:00 [kthreadd] 3 ? I< 0:00 [rcu_gp] 4 ? I< 0:00 [rcu_par_gp] 5 ? I< 0:00 [netns]Code language: plaintext (plaintext)
To list all processes and include information about process ownership, CPU, and memory use, execute the ps command with the -aux option:
$ ps -aux USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND root 2 0.0 0.0 0 0 ? S 09:59 0:00 [kthreadd] root 3 0.0 0.0 0 0 ? I< 09:59 0:00 [rcu_gp] root 4 0.0 0.0 0 0 ? I< 09:59 0:00 [rcu_par_gp] root 5 0.0 0.0 0 0 ? I< 09:59 0:00 [netns] root 7 0.0 0.0 0 0 ? I< 09:59 0:00 [kworker/0:0H-events_highpri] root 9 0.0 0.0 0 0 ? I< 09:59 0:00 [kworker/0:1H-events_highpri] . . demo 9788 0.1 1.4 763248 50480 ? Ssl 15:05 0:00 /usr/libexec/gnome-terminal-serv demo 9814 0.0 0.1 224108 5664 pts/2 Ss 15:05 0:00 bash demo 9849 0.0 0.0 222412 3588 pts/2 S+ 15:06 0:00 nano demo 9873 0.0 0.1 233416 6280 pts/1 R+ 15:08 0:00 ps -auxCode language: plaintext (plaintext)
A Linux process can start its own sub-processes (referred to as spawning), resulting in a hierarchical parent-child relationship between processes. To view the process tree, use the ps command and include the -H option. Below is part of the tree output for a ps -aH command execution:
$ ps -aH PID TTY TIME CMD 10036 pts/3 00:00:00 ps 6350 pts/0 00:00:00 sudo 6354 pts/0 00:00:00 su 6355 pts/0 00:00:00 bash 5442 tty2 00:00:00 gnome-session-bCode language: plaintext (plaintext)
Process information may also be viewed via the System Monitor tool from the GNOME desktop. This tool can either be launched by searching for “System Monitor” within the desktop environment or from the command line as follows:
$ gnome-system-monitorCode language: plaintext (plaintext)
Once the System Monitor has launched, select the Processes button located in the toolbar to list the processes running on the system, as shown in Figure 37-1 below:
To change the processes listed (for example, to list all processes or just your own processes), use the menu as illustrated in Figure 37-2:
To filter the list of processes, click on the search button in the title bar and enter the process name into the search field:
To display additional information about a specific process, select it from the list and click on the button located in the bottom right-hand corner (marked A in Figure 37-4) of the dialog:
A dialog similar to that marked B in the above figure will appear when the button is clicked. Select a process from the list and click the End Process button (C) to terminate it.
To monitor CPU, memory, swap, and network usage, click on the Resources button in the title bar to display the screen shown in Figure 37-5:
Similarly, a summary of storage space used on the system can be viewed by selecting the File Systems toolbar button:
Real-time System Monitoring with top
As the chapter “An Overview of the Cockpit Web Interface” outlined, the Cockpit web interface can perform basic system monitoring. The previous section also explained how the GNOME System Monitor tool could be used to monitor processes and system resources. This chapter also explored how the ps command can provide a snapshot of the processes running on an Ubuntu system. However, the ps command does not provide a real-time view of the processes and resource usage on the system. The top command is an ideal tool for real-time monitoring of system resources and processes from the command prompt.
When running, top will list the processes running on the system ranked by system resource usage (with the most demanding process in the top position). The upper section of the screen displays memory and swap usage information together with CPU data for all CPU cores. All of this output is constantly updated, allowing the system to be monitored in real-time:
To limit the information displayed to the processes belonging to a specific user, start top with the -u option followed by the user name:
$ top -u johnCode language: plaintext (plaintext)
For a complete listing of the features available in top, press the keyboard ‘h’ key or refer to the man page:
$ man topCode language: plaintext (plaintext)
Command-Line Disk and Swap Space Monitoring
Disk space can be monitored from within Cockpit and using the GNOME System Monitor. To identify disk usage from the command line, however, the df command provides a helpful and quick overview:
To review current swap space and memory usage, run the free command:
# free total used free shared buff/cache available Mem: 3823720 879916 1561108 226220 1382696 2476300Code language: plaintext (plaintext)
To continuously monitor memory and swap levels, use the free command with the -s option, specifying the delay in seconds between each update (keeping in mind that the top tool may provide a better way to view this data in real-time):
$ free -s 1 Mem: 3823720 879472 1561532 226220 1382716 2476744 Swap: 2097148 0 2097148 total used free shared buff/cache available Mem: 3823720 879140 1559940 228144 1384640 2475152 Swap: 2097148 0 2097148 . .Code language: plaintext (plaintext)
To monitor disk I/O from the command line, consider using the iotop command, which can be installed as follows:
# apt install iotopCode language: plaintext (plaintext)
Once installed and executed (iotop must be run with system administrator privileges), the tool will display a real-time list of disk I/O on a per-process basis:
Even a system that appears to be doing nothing will have many system processes running in the background. Activities performed by users on the system will result in additional processes being started. Processes can also spawn their own child processes. Each process will use some system resources, including memory, swap space, processor cycles, disk storage, and network bandwidth. This chapter has explored a set of tools that can be used to monitor both process and system resources on a running system and, when necessary, kill errant processes that may be impacting the performance of a system.