Server monitoring basics: vmstat, iostat and sar
You learn to read CPU, memory, disk and process metrics, look back in time with sar and set up simple threshold alerts.
Level 201 · 16 lessons · 15 practice labs
Lessons
Reading the numbers
- What the load average really measures
- CPU time: user, system, iowait and steal
- Memory: free, cache and "available"
- A quick picture of the system with vmstat
- Short task: guess the bottleneck from five snapshots
Disk and processes
- Disk utilisation and latency with iostat
- Per-process metrics with pidstat
- Who is writing to disk: iotop
- Short task: find the process hammering the disk
History and alerts
- Seeing yesterday's load with sar
- Measuring normal: building a baseline
- A simple threshold alert with a script
- One-screen status with glances and btop
- Short task: a one-week baseline report
Wrap-up
- A monitoring checklist: what and how often
- Capstone: tell the story of a server that slows down at night from sar data
Practice labs
- Interpret load average against core count: From load average and core count on three servers determine which one is truly overloaded.
- Tell cache from real memory shortage: Read available memory correctly and use swap activity to show which server is really short.
- Derive the bottleneck type from vmstat: Match four vmstat recordings to CPU, memory, I/O wait and context-switch bottlenecks and write the reasoning.
- Find the busiest disk: Measure utilisation and wait time of the disks with iostat and submit the name of the busiest device.
- Catch the process writing most to disk: Find the process loading the disk with iotop and determine through /proc which file it writes.
- Track one process's resource use over time: Record a service's CPU, memory and I/O at thread level with pidstat and find which thread the spike comes from.
- Read yesterday's CPU use with sar: From recorded sar data find yesterday's busiest hour and the average CPU use in it.
- Find the unusual day in a week of data: Compare memory and swap use across a week of sar recordings and identify the day and time range that deviates.
- Explain a night slowdown from historical data: Combine CPU, disk and network sar data on one time axis to prove which resource caused the slowdown at three in the morning.
- Write a threshold check for disk usage: Prepare a small script that logs a warning when any file system passes eighty-five percent.
- Set up a check that probes a service regularly: Set up a scheduled check that requests the web service every minute, records the response time and alerts on two failures in a row.
- Make a noisy alert meaningful: Fix a CPU alert that fires on every blip with a duration condition and hysteresis, comparing false alarms on historical data.
- Read server health on one screen: Interpret the warning colours on the glances screen and write down the two resources needing attention.
- Write a script that produces a daily health report: Prepare a report that summarises load, memory, disk and failed services on one page and writes it to a file every morning.
- Derive a capacity forecast from a growth trend: Compute the growth rate from a week of disk and memory data, estimate when the threshold will be crossed and report with a recommendation.
About this course
You learn to read CPU, memory, disk and process metrics, look back in time with sar and set up simple threshold alerts.
What you will learn
- Reading the numbers
- Disk and processes
- History and alerts
- Wrap-up
Prerequisites
Finishing the level 101 courses of the same path, or knowing those topics, is enough.
Lab environment
Lessons run in your own Kali Linux terminal that opens in the browser. Nothing to install; the lab starts clean in every lesson.
Frequently asked questions
- Is this course right for my level?
- The course is at level 201; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.