Linux Performance Monitoring

dstat — detailed guide + 10 practical examples

dstat is a “one-line dashboard” for system statistics. It combines the best parts of tools like vmstat, iostat, netstat, and ifstat into a single, continuously updating view. It's great for spotting CPU, disk, and network bottlenecks at the same time.

What dstat is good for

  • Correlating bottlenecks: see CPU + disk + network together (often the “aha” moment).
  • Quick triage: “is this CPU-bound, I/O-bound, or network-bound?”
  • Live incident views: run it during deploys, backups, DB maintenance, or batch jobs.
  • CSV logging: write stats to a file for later graphs/analysis.

Install & first run

Package name is usually dstat (many distros ship it; some replaced it with dool).

Install (common distros)
# Debian/Ubuntu
sudo apt update
sudo apt install dstat

# RHEL/CentOS/Fedora (varies by version)
sudo dnf install dstat   # or: sudo yum install dstat

# Arch
sudo pacman -S dstat

Start it with: dstat. If you want a friendly “all-in-one” view, try: dstat -cdngy (CPU + disk + net + paging + system).

Tip: If your distro doesn’t have dstat, look for dool (a maintained fork with similar flags).
Heads-up: Some options require root to see full per-disk or per-interface detail (depends on permissions and distro).

How to read the columns

dstat prints groups of columns. You pick which groups to show with flags (or use a preset like -a for “all”).

The magic is watching two things spike together (e.g., disk write + CPU iowait; or net recv + softirq CPU).

10 examples you can copy/paste

1) Basic live view

live

Default view updates every second.

Command
dstat

Use when: you want a quick “pulse check” while something runs.

2) “All” stats at once

wide

Shows many common groups together (may be wide).

Command
dstat -a

Use when: you’re not sure which subsystem is the bottleneck yet.

3) CPU + disk + network + paging + system

triage

A popular “incident” combo.

Command
dstat -cdngy

Use when: you want the most common correlation view without overwhelming output.

4) Show per-CPU utilization

detail

Break out CPU stats by core (can be wide).

Command
dstat -C total,0,1

Use when: one core is pegged (single-thread hot spot) and you want to see it clearly.

5) Per-disk I/O

storage

Show activity per block device.

Command
dstat -dD total,sda,nvme0n1

Use when: you have multiple disks and need to know which one is hot.

6) Per-interface network traffic

network

See send/recv by interface.

Command
dstat -nN total,eth0,wlan0

Use when: you suspect one NIC is saturated or the wrong interface is being used.

7) Top CPU consumers (process stats)

top

Show the most CPU-hungry processes each interval.

Command
dstat --top-cpu

Use when: CPU is high and you want the “who” without switching tools.

8) Top I/O consumers

top

Show the processes doing the most disk I/O.

Command
dstat --top-io

Use when: the system feels “stuck” and disk wait is climbing.

9) Log to CSV for later graphing

log

Write stats to a CSV file (handy for spreadsheets or scripts).

Command
dstat -cdngy --output /tmp/dstat.csv 5 120

Use when: you want to capture 10 minutes of data at 5-second intervals.

10) Run for a fixed number of samples

batch

Interval then count: SECONDS COUNT.

Command
dstat 2 30

Use when: you want a quick 60-second capture at 2-second resolution.

Notes & gotchas