System Monitoring and Logs

What You'll Learn

When something goes wrong on Linux, the answer is usually in the logs or resource usage. This guide teaches you how to monitor CPU, memory, disk, and read system logs to diagnose problems.

Checking System Resources

CPU and Processes — top / htop

top                           # Live process viewer (q to quit)
htop                          # Colorful version with mouse support
# Install htop: sudo apt install htop

Memory — free

free -h                       # Show RAM and swap usage in human-readable format

Key columns:

• total: Total physical RAM.
• used: Currently used memory.
• available: Memory available for new programs (this is the important number).

Disk Space — df

df -h                         # Show disk usage of all mounted filesystems
df -ih                        # Show inode usage (run out of inodes = can't create files)

Finding What's Using Disk — du

du -sh /*                     # Size of each top-level directory
du -sh /home/*                # Size of each user's home folder
# Find large files:
find / -type f -size +100M    # Files larger than 100MB

System Uptime and Load — uptime

uptime                        # How long the system has been running + load average

The "load average" shows the average number of processes waiting for CPU over 1, 5, and 15 minutes. If it's higher than your CPU core count, the system is overloaded.

Reading System Logs

journalctl — The Modern Way

sudo journalctl                       # View all logs (space to page, q to quit)
sudo journalctl -u nginx              # Logs for a specific service
sudo journalctl -f                    # Follow live log output (like tail -f)
journalctl --since "1 hour ago"       # Logs from the last hour
journalctl --since "today"            # Today's logs
journalctl -p err                     # Show only errors and above

Traditional Log Files — /var/log/

ls /var/log/                        # See available log files
sudo tail -f /var/log/syslog        # Live-tail the system log (Debian/Ubuntu)
sudo tail -f /var/log/messages      # System log on Fedora/RHEL
sudo cat /var/log/auth.log          # Authentication attempts (login, sudo)

Common Log Files

Common Diagnostic Commands

# Is a service running?
sudo systemctl status nginx

# What's using my CPU?
top -o %CPU

# What's eating my disk?
du -sh /* | sort -rh | head

# Who is logged in?
who
w

# Check network connections
ss -tlnp                        # Listening ports
ss -tnp                         # All active TCP connections

Practice Exercise

# Run each command and understand the output:
uptime                          # How loaded is your system?
free -h                         # How much RAM is available?
df -h                           # How much disk space is left?
journalctl --since "1 hour ago" | tail   # Recent log entries
ps aux | head -20               # Top 20 processes

Troubleshooting

• Disk full: Run du -sh /* | sort -rh | head to find the largest directories.
• System slow: Check top for high CPU or free -h for low memory.
• Service crashed: Run sudo journalctl -u service-name --since "1 hour ago".

Congratulations!

You've completed all 10 beginner tutorials. You now understand:

• The Linux file system structure
• Essential commands for everyday use
• File permissions and ownership
• Installing and managing software
• Terminal text editors (Nano & Vim)
• Users, groups, and sudo
• Process management and services
• Networking basics
• Shell scripting for automation
• System monitoring and log analysis

Continue exploring our advanced tutorials and command reference.

Ready for a real project? Build your own Spotify on a Raspberry Pi →