Linux System Monitoring Tools

These tools are great for looking at what's happening now if you're logged into the server.<p>They're complemented by monitoring products like:<p>Self hosted:<p>- Nagios (already mentioned in the post)<p>- Cacti / Munin<p>Hosted:<p>- <a href="http://www.serverdensity.com" rel="nofollow">http://www.serverdensity.com</a> (tool my company produces)<p>- <a href="http://www.cloudkick.com" rel="nofollow">http://www.cloudkick.com</a> (monitoring + cloud infrastructure management)<p>- <a href="http://www.scoutapp.com" rel="nofollow">http://www.scoutapp.com</a><p>these give you similar metrics plus various other things like alerting, graphs, mobile apps, etc.

I suggest dstat over vmstat, it has color coded output and abbreviates units automatically. It's easy to add columns or monitor specific devices or interfaces.<p><a href="http://dag.wieers.com/home-made/dstat/" rel="nofollow">http://dag.wieers.com/home-made/dstat/</a><p>I suggest OpenNMS as a cacti and nagios alternative. It eliminates most of the manual configuration. It can automatically detect nodes and services and if you give it SNMP information it can monitor specifics of each machine. I've used it to monitor hundreds of machines but it can be resource intensive.<p><a href="http://www.opennms.org/" rel="nofollow">http://www.opennms.org/</a><p>iftop is also a nice lightweight alternative to iptraf and helps track down bandwidth heavy processes and connections.<p><a href="http://ex-parrot.com/pdw/iftop/" rel="nofollow">http://ex-parrot.com/pdw/iftop/</a>

Does anybody actually use top, rather than htop? It's the first thing I install on every system I build.<p>Something I've become very fond of recently is Monit, which doesn't appear to be on the list. I've found it very reassuring to have Monit set-up and watching the processes on my server.

Another one I find quite useful is iotop:<p><a href="http://guichaz.free.fr/iotop/" rel="nofollow">http://guichaz.free.fr/iotop/</a><p>Very handy to quickly see what process is causing that disk thrashing, for example.

For people that care about security, I would add those monitoring tools:<p>-OSSEC - log + file system security monitoring (<a href="http://ossec.net" rel="nofollow">http://ossec.net</a>)<p>-Snort - Network-based IDS (<a href="http://snort.org" rel="nofollow">http://snort.org</a>)<p>-Sucuri (not free) - web site monitoring (<a href="http://sucuri.net" rel="nofollow">http://sucuri.net</a>)

I have also seen Munin, which provides robust monitoring.

ps_mem.py - Determine how much RAM is currently being used per program, is useful when top command failed to report actual memory shared due to copy-on-write among multiple processes.<p><a href="http://www.pixelbeat.org/scripts/ps_mem.py" rel="nofollow">http://www.pixelbeat.org/scripts/ps_mem.py</a><p><a href="http://wiki.apache.org/spamassassin/TopSharedMemoryBug" rel="nofollow">http://wiki.apache.org/spamassassin/TopSharedMemoryBug</a>

In addition to tcpdump, I'd like to add the command 'tshark'. Tshark usually comes bundled with wireshark and allows you to use the same search capabilities as wireshark from the command line. I find it much easier to use than tcpdump especially if you already have experience with wireshark.

I often use basic command line tools (vm/io/snmpstat, fiddle with /proc with cat/cut) and chart the results along the way, in realtime, with this little tool: <a href="http://freshmeat.net/projects/trend" rel="nofollow">http://freshmeat.net/projects/trend</a>

Wait, you don't just look at the load average?