Memory Analysis and System Performance Tuning: A Command Line Reference Guide

Master memory analysis and system performance tuning using essential Linux command-line tools like free, vmstat, iostat, and perf curated in The Art of Command Line repository.

The Art of Command Line by Josh Levy is a curated collection of Linux-centric tips maintained in a single README.md file. Rather than a traditional codebase, this repository serves as a living cheat-sheet for memory analysis and system performance tuning, with its System debugging section containing battle-tested one-liners for diagnosing memory pressure, CPU bottlenecks, and I/O latency. The guide explains critical nuances—such as the distinction between "cached" memory and truly free memory—that prevent misinterpretation of system metrics.

Core Memory Analysis Commands

The foundation of memory analysis in the command line starts with understanding actual utilization versus cached buffers. According to the repository's README.md, the free command provides the most immediate view of system memory states.

Check total, used, and available memory:

# Display human-readable memory statistics, highlighting cached vs free

free -h

This output reveals how much memory is genuinely available for applications versus what the kernel has cached for disk operations. For continuous monitoring, vmstat samples kernel memory statistics at regular intervals.

Monitor memory and swap in real time:

# Show continuous memory and swap statistics (updates every 2 seconds)

vmstat 2

When investigating memory leaks, combine ps with sorting to identify the top consumers of resident memory.

Locate memory-intensive processes:

# Find processes using the most resident memory (RSS)

ps aux --sort=-%mem | head -n 10

Real-Time Process Monitoring with top and htop

For interactive debugging, the repository recommends both classic and modern process viewers. While top is universally available on Linux systems, htop provides an enhanced color-rich interface with better visual parsing of CPU and memory graphs.

Launch classic process monitoring:

# Standard text interface showing CPU%, MEM%, and process states

top

Use the enhanced interactive viewer:

# Color-rich display with scrollable process list (install via package manager)

htop

Both tools refresh dynamically, allowing you to spot runaway processes or memory spikes as they occur.

Disk I/O and Historical Performance Metrics

System performance tuning requires visibility beyond memory into disk throughput and historical trends. The iostat command, part of the sysstat package, reports per-device I/O statistics critical for identifying storage bottlenecks.

Analyze disk I/O patterns:

# Report extended CPU usage and device throughput every 5 seconds

iostat -xz 5

For longitudinal analysis—comparing current performance against baseline—the sar (System Activity Reporter) command archives historical data.

Generate historical snapshots:

# Install sysstat package first; then enable data collection

sar -r 1 3   # Memory usage snapshots (1-second intervals, 3 samples)

sar -u 1 3   # CPU utilization snapshots

These commands write to binary log files (/var/log/sysstat/) that administrators can query to correlate performance degradation with specific time windows.

Advanced Debugging with strace and perf

When standard metrics fail to explain performance issues, the repository advocates for system call tracing and hardware profiling. The strace utility intercepts and records system calls made by a process, revealing inefficient file operations or network delays.

Trace file-related system calls:

# Attach to a running process and filter for file operations

strace -e trace=file -p <pid>

For CPU-bound performance tuning, the perf subsystem provides hardware-level profiling without code modification.

Profile script execution:

# Record CPU cycles and call graphs while executing a script

perf record -g -- ./my_script.sh

# Generate a readable report from the recorded data

perf report

This approach identifies hot paths and cache misses that standard monitoring tools cannot detect.

Building Custom Performance Dashboards

The repository encourages combining these tools into composite one-liners for rapid status assessment. By grouping multiple commands, you create a terminal-based dashboard showing memory, CPU, and disk I/O simultaneously.

Create a unified system summary:

{
  echo "=== Memory ==="
  free -h | awk '/Mem/ {print "Used:",$3,"Free:",$4}'
  echo "=== CPU ==="
  top -b -n1 | head -n 5
  echo "=== Disk I/O ==="
  iostat -dx 1 2 | tail -n +4 | head -n 5
}

This pattern leverages shell grouping to execute related diagnostics sequentially, making it ideal for inclusion in monitoring scripts or runbooks.

Summary

The Art of Command Line structures its performance tuning advice in README.md as modular, copy-pasteable snippets. Key takeaways include:

• Use free -h to distinguish between cached and truly available memory, avoiding false alarms about low free memory.
• Combine vmstat with ps sorting to correlate system-wide memory pressure with specific process consumption.
• Employ iostat and sar for both real-time and historical I/O analysis, essential for capacity planning.
• Leverage strace and perf for deep-dive debugging when high-level metrics indicate anomalies but root cause remains unclear.
• Contribute improvements via pull requests to README.md or its multilingual variants (README-zh.md, README-de.md, etc.), following the guidelines in CONTRIBUTING.md.

Frequently Asked Questions

What is the difference between cached memory and free memory in Linux?

Cached memory represents disk data that the kernel has stored in RAM for faster access, while free memory is completely unused. According to the repository's explanation in the README.md System debugging section, Linux prioritizes keeping recent disk reads in memory, meaning free memory often appears low even on healthy systems. The free -h command displays both values separately, and the "available" column provides the true metric for how much memory applications can allocate without forcing cache eviction.

How do I identify which process is causing a memory leak?

Start with ps aux --sort=-%mem | head -n 10 to identify the top resident memory consumers. For confirmation, attach strace -e trace=memory -p <pid> to monitor allocation patterns, or use perf record -g if the leak correlates with specific execution paths. The repository recommends this two-step approach: broad identification via ps, followed by targeted tracing of the suspected process.

Should I use top or htop for system performance monitoring?

Use top when working on minimal systems where package installation is restricted, as it is included in virtually every Linux distribution. Use htop for daily analysis on development or production machines where its color coding, scrollable process list, and visual CPU/memory bars accelerate troubleshooting. Both tools read from /proc filesystem statistics, so their data accuracy is identical; the difference lies solely in interface usability.

How can I contribute new performance tuning tips to the repository?

Submit additions or corrections as pull requests to jlevy/the-art-of-command-line, targeting the README.md file in the System debugging section. Follow the existing format of concise one-liners with brief explanatory comments. The CONTRIBUTING.md file specifies that tips should be universally applicable across standard Linux distributions and avoid niche tools requiring complex compilation. Multilingual contributions should mirror the English structure in corresponding README-*.md files listed in the repository root.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}