Company News

Linux Server Monitoring: Built-In Tools, Netdata, Prometheus and Alerts

Discover essential tools, commands, and enterprise-grade solutions for real-time server monitoring on RHEL, Ubuntu, Debian, AlmaLinux, and CloudLinux. Learn how to monitor CPU, memory, disk I/O, and network performance like a pro.

Short answer: For a quick look, use the built-in tools: htop for processes, free -m for memory, iostat -x 1 for disk, ss -tulnp for network ports and df -h for space. For history and alerts, install sysstat (sar) on every server, and add Netdata for a live dashboard or Prometheus with Grafana for many servers. Whatever you choose, make sure someone gets an alert before the disk fills or the server runs out of memory.

What to monitor

Area Watch for Quick command
CPU and load Load average above the number of cores for long periods uptime, htop
Memory Little available memory and growing swap use free -m
Disk space Partitions above 85 to 90 percent df -h
Disk I/O High %util and long wait times iostat -x 1
Network Unexpected traffic or connection counts ss -s, iftop
Services Web, database, mail or SSH stopped systemctl --failed

Built-in and lightweight tools

# AlmaLinux, Rocky Linux, CloudLinux (htop, iftop and nethogs come from EPEL)
dnf install -y epel-release
dnf install -y htop sysstat iotop iftop nethogs

# Debian and Ubuntu
apt install -y htop sysstat iotop iftop nethogs
Tool Use it to
htop See which processes use CPU and memory right now
vmstat 1 Watch memory, swap and CPU wait every second
iostat -x 1 Find a busy or slow disk
iotop -o See which processes read and write the disk
iftop / nethogs See network traffic by connection or by process
sar Look back at CPU, memory, disk and network use earlier in the day

Keep history with sysstat

When a problem happened at 3 a.m., live tools cannot help. sysstat records statistics every ten minutes so you can look back:

systemctl enable --now sysstat

sar -u            # CPU use today
sar -r            # memory
sar -d -p         # disks
sar -n DEV        # network interfaces
sar -q -f /var/log/sa/sa15   # load on the 15th (Debian: /var/log/sysstat/)

Live dashboards with Netdata

Netdata collects thousands of metrics per second with little overhead and shows them in a browser. Install it with the official script, after reading it:

wget -O /tmp/netdata-kickstart.sh https://get.netdata.cloud/kickstart.sh
less /tmp/netdata-kickstart.sh
sh /tmp/netdata-kickstart.sh

The dashboard listens on port 19999. Do not leave it open to the internet: allow it only from your IP address in the firewall, or reach it through an SSH tunnel with ssh -L 19999:localhost:19999 root@your-server.

Many servers: Prometheus and Grafana

For several servers, run node_exporter on each one and a central Prometheus server that collects the metrics. Grafana draws the dashboards, and Alertmanager sends alerts by email or chat. It takes more work to set up, but scales well and keeps long-term history. Protect the exporter port (9100) with the firewall so only Prometheus can reach it.

CloudLinux servers

CloudLinux records resource use per account. lveinfo shows which accounts hit their limits, and CloudLinux Manager in WHM shows the same in the browser:

lveinfo --period=1d --by-fault=mem --display-username   # accounts that hit the memory limit today
kcarectl --info                                          # KernelCare live patch status, if installed

Set up alerts

  • ✓ Disk space above 85 percent on any partition.
  • ✓ Memory nearly full, or swap growing steadily.
  • ✓ Load above the number of cores for more than 10 to 15 minutes.
  • ✓ Key services stopped: web server, database, mail, SSH.
  • ✓ The server or website not reachable from outside, using an external uptime check.

Send alerts to at least two people, and test them. An alert that nobody receives is no better than no monitoring.

Troubleshooting quick reference

Symptom First commands
Server slow, high load htop, then iostat -x 1 to tell CPU from disk
Out of memory, processes killed free -m, dmesg -T | grep -i oom
Disk full df -h, then du -xh / --max-depth=2 | sort -h | tail
Unexpected traffic iftop -n, ss -tn state established | wc -l

Need help with this?

Want someone watching your server around the clock? Our server management team monitors and responds for you.

See server management plansContact @CustomerPanel

Frequently asked questions

What is the simplest way to monitor a Linux server?

Install sysstat for history and set up an external uptime check with email alerts. Add Netdata if you want live dashboards.

Is Netdata safe to install?

Yes, from its official installer, but keep its dashboard port closed to the internet or reach it through an SSH tunnel.

How do I see what happened on my server last night?

Use sar from the sysstat package, which records CPU, memory, disk and network use through the day.

Do I need Prometheus and Grafana?

Only for several servers or long-term history. For one server, sysstat and Netdata are usually enough.

Can UnderHost monitor my server for me?

Yes. Our server management plans include monitoring and response; see the plan page for what each level covers.


Sources