Understanding Basic Output:
- avg-cpu section: CPU utilization breakdown since boot
- %user: Time spent running user applications (non-kernel code)
- %nice: Time spent on low-priority (nice'd) processes
- %system: Time spent in kernel space
- %iowait: Time CPU was idle waiting for I/O (HIGH values indicate disk bottleneck)
- %steal: Time "stolen" by hypervisor for other VMs (virtualization overhead)
- %idle: Time CPU spent idle with no I/O wait
- tps: Transfers (I/O operations) per second
- kB_read/s: Kilobytes read per second
- kB_wrtn/s: Kilobytes written per second
- kB_dscd/s: Kilobytes discarded per second (SSD TRIM operations)
- Total counters: Cumulative KB read/written/discarded since boot
Extended Metrics Explained:
- r/s, w/s: Read/write requests per second (IOPS)
- rkB/s, wkB/s: Kilobytes read/written per second (throughput)
- rrqm/s, wrqm/s: Read/write requests merged per second (I/O scheduler efficiency)
- %rrqm, %wrqm: Percentage of requests merged before dispatch to device
- r_await, w_await: Average time (ms) for read/write requests (includes queue + service time)
- aqu-sz: Average queue size (requests waiting for device)
- rareq-sz, wareq-sz: Average request size in kilobytes
- svctm: Average service time in milliseconds (DEPRECATED metric)
- %util: Device utilization percentage (>80% suggests saturation)
Interval Monitoring:
- Syntax: iostat [options] interval [count]
- First report: Shows averages since boot (historical baseline)
- Subsequent reports: Show statistics for just that interval (current activity)
- Interval only: Runs continuously until Ctrl+C
- Interval + count: Runs specified number of times then exits
- Real-time analysis: Watch %util, await, and IOPS during load tests
- Performance testing: Start iostat before running benchmarks
- Pattern detection: Identify periodic spikes or sustained high load
Device-Specific Monitoring:
- Specific devices: List device names (sda, sdb, nvme0n1) after options
- -p flag: Show partition statistics in addition to whole device
- Partition detail: See which partitions are most active on a disk
- Focus monitoring: Eliminate noise from unused devices
- Database optimization: Monitor partition where database files reside
- Multi-disk systems: Compare performance across different storage tiers
- Performance comparison: SATA (sda) vs NVMe side-by-side
- Troubleshooting: Identify which specific partition causing I/O issues
Human-Readable Format:
- -h flag: Automatic unit scaling (k, M, G) for easy reading
- -m flag: Force megabytes per second (MB/s) instead of kilobytes
- -k flag: Force kilobytes (default, useful to override -m)
- Throughput clarity: "18.9M" much clearer than "18,900 kB/s"
- Quick assessment: Instantly see if you're doing MB/s or GB/s
- Reports and dashboards: More presentation-friendly output
- Request sizes: Also shown in human-readable format (56.6k vs 56,600 bytes)
- Comparison: Easier to spot differences between devices
CPU Statistics Focus:
- Clean output: No device statistics, only CPU utilization
- iowait tracking: Watch %iowait rise during I/O-intensive operations
- System vs user: High %system suggests kernel overhead (I/O, context switches)
- Pattern recognition: Track CPU load patterns over time
- Combine with top: Use iostat -c for overview, top for process detail
- Virtualization: Monitor %steal to detect resource contention in VMs
- Baseline establishment: Run during known-good times to establish normal ranges
- Correlation: Rising %iowait correlates with disk bottlenecks
Device-Focused Monitoring:
- No CPU data: Screen real estate dedicated to disk statistics
- Multi-disk comparison: Easily compare performance across drives
- Bottleneck identification: sdc shows 99.85% utilization - saturated!
- Performance tiers: See which disks handle which loads
- Storage arrays: Monitor all disks in RAID or storage pool
- Capacity planning: Identify which disks need upgrade/replacement
- Load distribution: Check if load is balanced across disks
- -dx combination: Extended device statistics without CPU clutter
Timestamped Monitoring:
- -t flag: Adds timestamp to each report iteration
- Format: MM/DD/YYYY HH:MM:SS AM/PM
- Log correlation: Match iostat spikes with application logs, database logs
- Incident investigation: "At 2:15:40 PM, %util jumped to 67.89%"
- Historical analysis: Review saved iostat logs with timestamps
- Performance patterns: Identify time-of-day patterns (backups at 2 AM, etc.)
- Scheduled tasks: Correlate cron jobs with I/O spikes
- Multi-system analysis: Compare timestamps across different servers
Network Filesystem Monitoring:
- -n flag: Shows NFS mounts in addition to local devices
- NFS naming: Displays as server:/export/path or hostname:/path
- High await: Network latency causes higher r_await and w_await values
- No merging: rrqm/s and wrqm/s are zero (merging happens on NFS server)
- Network bottleneck: If await values high (>50ms), check network performance
- Server vs network: Compare multiple NFS mounts to isolate issues
- Client-side view: These stats are from client perspective, not server
- Troubleshooting: High IOPS + high await = either slow server or network congestion
JSON Output Benefits:
- Machine-readable: Easy parsing with jq, Python, or any language
- Monitoring systems: Feed directly to Prometheus, Grafana, Datadog, etc.
- Structured data: No regex parsing needed, proper data types (numbers not strings)
- Automation-friendly: Scripts can easily extract specific metrics
- Historical storage: Store in time-series databases for long-term analysis
- API integration: Easy to incorporate into REST APIs or microservices
- Dashboard creation: Parse and visualize with web frontends
- Alerting: Extract %util or await values to trigger alerts