Linux System Monitoring: vmstat, top, iostat, sar, journalctl
Working playbook for diagnosing a slow Linux server. The 60-second triage sequence (uptime, dmesg -T, vmstat 1 5, free -h, df -h + df -i), reading load average against nproc CPU count, what each %CPU breakdown means in top (us/sy/id/wa, with iowait being the disk-pressure tell), the eight vmstat numbers that matter (r runnable, b blocked, swpd / si / so swap activity, bi / bo block I/O), available vs free memory (Linux file caching makes free deceptively small), iostat -x for per-device IOPS / await / %util, dmesg -T for kernel-level errors and OOM-killer activity, journalctl -u SERVICE -f as the systemd tail -f, sar / sysstat for historical data so you can answer 'was it slow at 3 AM yesterday', ss / lsof / strace / pmap for per-process deep dives. Pitfalls: looking at free not available, one vmstat sample is meaningless, high load isn't always CPU.