Linux diagnostic commands, what they are for and how to read the output
Opselis
lscpu, vmstat, iostat, free, ss and journalctl. What each command shows, why you run it and how to read CPU, steal time, disk and listening ports.
Host diagnostics is a set of commands that show CPU, memory, disk, network and the service log. They answer whether the application is slow because of the processor, swap, disk await, hypervisor steal, or a full PHP worker. Without that picture you add RAM and keep the same symptom. The tools ship with GNU/Linux (procps, util-linux, iproute2, systemd). iostat is in the sysstat package.
What each command is for
lscpu and cat /proc/cpuinfo: model, core count, clock, flags (look for aes). So you know whether this is EPYC / Xeon Gold, or an E5 from 2013 sold as 16 vCPU. uptime: load. Read it with the CPU count. Load 16 on 4 cores is a queue. vmstat 1 10: columns r (run queue), b (blocked), si/so (swap), wa (iowait), st (steal). Steal of a few percent on a VPS means the hypervisor takes the quantum. free -h: total, used, buff/cache, swap. Cache is not a lack of RAM. Swap growing under Magento at peak is a signal for more memory or another host. iostat -x 1: util and await per disk. Util 100% and await in tens of ms knocks out the database and the indexer. df -hT and df -i: space and inodes. ss -tulpn: what listens and on which address. journalctl -u php-fpm -S today: restarts, OOM, timeouts. dmesg -T: disk and NIC errors.
How the reading works
Most numbers come from /proc: stat, meminfo, diskstats. vmstat and iostat with a 1 s interval skip the average since boot on the first line. Look from the second. ss reads the kernel socket table. A public MySQL bind (0.0.0.0:3306) is visible at once. top -o %CPU shows whether CPU is php-fpm, mysqld, or bots in workers.
How to set it up and run it
On Debian and Ubuntu: apt install sysstat procps iproute2. A one-shot dump on a “slow” ticket: lscpu, free -h, vmstat 1 10, iostat -x 1 (stop after 10 lines), ss -tulpn, df -hT, journalctl -u php-fpm -S today. Save the output in the ticket. A Grafana alert (CPU, disk await, steal if node-exporter) does not replace that dump in an incident, it only calls you earlier.
On a VPS the st column in vmstat matters more than the vendor CPU chart. Old CPU reading: cheap VPS and CPU. Host operations: IT administration.