Stage 2 · Tools
Process & System Management
Disk & Memory Monitoring
df, du, free, lsof, and scripting resource monitoring and alerts.
Disk Usage with df
df reports filesystem disk space usage. It shows total, used, and available space for mounted filesystems. Essential for monitoring disk health and triggering cleanup scripts.
# Human-readable output
df -h
# Show specific filesystem
df -h /var/log
# Show only local filesystems
df -hT -t ext4 -t xfs
# Check specific mount point
df -h / | awk 'NR==2 {print $5}' | tr -d '%'df -h shows sizes in human-readable format (KB, MB, GB). The -T flag shows filesystem type. Use awk to extract specific fields for scripting.
Directory Sizes with du
du estimates file and directory space usage. It is essential for finding large files, understanding storage consumption, and cleaning up disk space.
# Directory size
du -sh /var/log
# Top 10 largest directories
du -h --max-depth=1 / 2>/dev/null | sort -rh | head -10
# Find large files
find / -type f -size +100M -exec ls -lh {} \; 2>/dev/null | sort -k5 -rh
# Size of current directory by subdirectory
du -sh */ | sort -rh
# Exclude certain paths
du -sh --exclude='proc' --exclude='sys' /du -sh shows total size in human-readable format. --max-depth controls recursion depth. Combine with sort to find the largest consumers.
find / -type f -size +100M -exec ls -lh {} \; 2>/dev/null finds all files larger than 100MB. Sort the output to identify the biggest disk consumers.
Memory Monitoring
free shows physical and swap memory usage. vmstat provides virtual memory statistics. These tools help identify memory pressure and leaks.
# Memory usage
free -h
# Detailed memory info
cat /proc/meminfo
# Swap usage
free -h | awk '/Swap:/ {print $3/$2 * 100 "% used"}'
# Per-process memory
ps aux --sort=-%mem | head -10
# vmstat (memory, CPU, IO)
vmstat 1 5 # 5 samples, 1 second apartfree -h shows total, used, and available memory. The 'available' column is what matters — it includes memory that can be freed by the kernel. ps aux --sort=-%mem shows memory hogs.
Open Files with lsof
lsof lists open files — regular files, directories, sockets, pipes, and device files. It is essential for debugging file descriptor leaks, finding which process uses a port, and understanding resource usage.
# List all open files
lsof | head -20
# Find who uses a port
lsof -i :8080
# Find open files in a directory
lsof +D /var/log
# Count open files per process
lsof -p PID | wc -l
# Find deleted files still held open
lsof | grep "(deleted)"
# Network connections
lsof -i -P -n | grep ESTABLISHEDlsof is invaluable for debugging: 'why is this file busy?', 'which process is using port 3000?', 'what files does this process have open?'. Use +D for recursive directory search.
Monitoring Scripts
Combine these tools into automated monitoring scripts that alert you before problems become critical.
#!/usr/bin/env bash
set -euo pipefail
THRESHOLD=80
ALERT_EMAIL="admin@example.com"
check_disk() {
local usage
usage=$(df / | awk 'NR==2 {print $5}' | tr -d '%')
if (( usage > THRESHOLD )); then
echo "Disk usage at {usage}% on $(hostname)" | \
mail -s "DISK ALERT: $(hostname)" "$ALERT_EMAIL"
# Auto-cleanup
find /var/log -name "*.gz" -mtime +30 -delete
find /tmp -type f -mtime +7 -delete
fi
}
check_diskThis script checks disk usage, sends an alert email if above threshold, and performs automatic cleanup. Run it every hour via cron for proactive monitoring.
#!/usr/bin/env bash
set -euo pipefail
PROCESS_NAME="my_app"
THRESHOLD_MB=500
get_memory() {
ps -C "$PROCESS_NAME" -o rss= 2>/dev/null | \
awk '{sum+=$1} END {print sum/1024}'
}
CURRENT=$(get_memory)
if (( $(echo "$CURRENT > $THRESHOLD_MB" | bc -l) )); then
echo "WARNING: $PROCESS_NAME using {CURRENT}MB RAM"
echo "Restarting $PROCESS_NAME..."
systemctl restart "$PROCESS_NAME"
fiThis script monitors a process's memory usage and restarts it if it exceeds a threshold. This is a simple memory leak mitigation strategy.
Linux uses free memory for disk caching. The 'free' column is misleadingly low. The 'available' column shows memory actually available to applications. Always use 'available' for monitoring.
Mark this lesson complete to store local progress and unlock a cleaner resume path the next time you visit.