Process inspection starts with ps (for example, ps aux --sort=-%mem for top memory users and ps -ejH for hierarchy) and pstree -p for a tree view. pgrep returns PIDs matching a name, pkill kills by name or attribute (regex, UID), and killall kills by exact name match. nohup runs commands immune to SIGHUP so they continue after logout, while screen and tmux are terminal multiplexers that keep sessions alive across disconnections. htop offers an interactive, colorful process view with search and tree features beyond top. nice -n 10 command starts a command with lower CPU priority, and renice newvalue -p PID adjusts the priority of a running process. strace -p PID attaches to a running process and prints syscalls (used cautiously due to performance impact). watch command runs a command repeatedly (default every 2 seconds) for live monitoring, and uptime shows time since boot, user count, and load averages (interpreted as high when equal to or above nproc cores).
Memory is summarized with free -h, with detailed stats in /proc/meminfo. Active swap is shown by swapon -s or cat /proc/swaps, and swap behavior is governed by vm.swappiness (0 to 100, with higher values meaning more aggressive swapping). When memory pressure exhausts RAM, the OOM killer terminates processes, evidenced in dmesg | grep -i oom. A process's likelihood of being killed is its oom_score (0 to 1000), and it can be protected with echo -1000 > /proc/PID/oom_score_adj. Kernel memory overcommit is controlled via vm.overcommit_memory, where 2 enforces strict accounting (which can break some applications). sync && echo 3 > /proc/sys/vm/drop_caches clears the page cache, dentries, and inodes for benchmarking. The /proc filesystem exposes per-process information: /proc/PID/status for state and resources, /proc/PID/cmdline for command-line arguments, /proc/PID/environ for environment variables, /proc/PID/maps for memory mappings, /proc/PID/fd/ for open file descriptors, and readlink -f /proc/PID/exe for the binary path. lsof | grep deleted lists files that have been unlinked but are still held open and recoverable via /proc/PID/fd/.
Performance monitoring spans many tools. vmstat 1 streams process, memory, CPU, and IO statistics every second. iostat -xz 1 (sysstat) shows extended per-device IO statistics including latency and utilization. sar -u shows historical CPU utilization when sysstat data collection is enabled. mpstat reports per-CPU breakdown; pidstat -p PID 1 shows per-process CPU, memory, and IO stats. stress-ng --cpu 4 --timeout 60s stress-tests with four workers for a minute, and perf record -g command profiles with call graphs, viewable in perf report. ncdu /path is an interactive TUI for browsing disk usage, while iotop shows per-process IO. Network monitoring is covered by iftop (per-connection bandwidth), vnstat and vnstat -d (hourly/daily/monthly totals), and iperf3 (bandwidth testing, run as iperf3 -s on one end and iperf3 -c server on the other). glances -w starts a web interface, and Prometheus node_exporter (default port 9100) exposes metrics for scraping. collectl and nmon are alternative comprehensive monitors. Hardware inventory tools include lscpu, lspci, lsusb, lshw -short, dmidecode -t memory, and cat /etc/os-release or lsb_release -a for OS info. CPU vulnerabilities can be reviewed via grep . /sys/devices/system/cpu/vulnerabilities/*.
Docker containers are managed from the CLI. docker build -t repo/name:tag . builds and tags an image, and docker push uploads it after login. docker run starts a container; docker logs -f follows its logs; docker exec -it container /bin/bash opens an interactive shell; and docker cp container:/path /host/path copies files out. docker stats streams live CPU, memory, and IO usage per container; docker inspect dumps JSON configuration; docker system df reports storage usage; and docker system prune and docker image prune remove unused data and untagged images. Multi-container setups use Compose files started with docker compose up -d. System time is managed with timedatectl: status shows local time, RTC, NTP, and timezone; set-timezone Region/City changes the timezone; and timesync-status reports systemd-timesyncd state. With chrony, chronyc sources lists configured time sources and chronyc tracking shows offset and frequency correction. Other convenience commands include ulimit -a for shell resource limits, cat /proc/loadavg for load averages and process counts, and wall "message" to broadcast to all logged-in users.