“The server is slow” is not a diagnosis — it is a symptom with exactly four possible causes: CPU, memory, disk I/O, or network. Ubuntu ships every tool you need to identify which one in under a minute. This guide is the triage workflow we use at LFA IT, from the first look to continuous monitoring.
Sixty-second triage
uptime # load average — the headline number free -h # memory and swap df -h # any disk full? ps aux --sort=-%cpu | head # top CPU consumers ps aux --sort=-%mem | head # top memory consumers
Reading load average: the three numbers are 1-, 5- and 15-minute averages of runnable processes. Rule of thumb: sustained load above your CPU core count (nproc) means saturation. Load 4 on a 2-core VPS is trouble; on 8 cores it is a Tuesday.
Reading free -h: Linux uses spare RAM for disk cache — that is healthy. Watch the available column, not free. Heavy swap in use plus low available memory means it is time for swap tuning or a bigger plan.
Live views: top and htop
top # built-in; press M to sort by memory, P by CPU, 1 for per-core sudo apt install htop -y htop # friendlier: colors, tree view, F9 to kill
Disk I/O: the invisible bottleneck
A server can crawl with idle CPU when processes are stuck waiting for the disk — look for high wa (iowait) in top, then:
sudo apt install sysstat -y iostat -xz 1 # %util near 100 = disk saturated sudo iotop -o # which process is doing the I/O
Network: connections and bandwidth
ss -tlnp # what is listening, and which process ss -s # connection counts summary sudo apt install vnstat -y # per-interface bandwidth history vnstat -d
An unexpected listener on a strange port is also a security signal — cross-check against your UFW rules.
What was happening an hour ago?
The sysstat package records history — enable it and query the past with sar:
sudo sed -i 's/ENABLED="false"/ENABLED="true"/' /etc/default/sysstat sudo systemctl restart sysstat sar -u 1 3 # CPU now; sar -u -f /var/log/sysstat/saXX for history sar -r # memory history
Continuous monitoring
For anything production-grade you want alerting, not spot checks: Netdata (one-command install, beautiful dashboards), or Prometheus + Grafana for fleets. Every managed server at LFA IT ships with 24/7 monitoring and alerting included — we usually know before the customer does.
Related Ubuntu guides
- How to Add Swap Space on Ubuntu: Fix Out-of-Memory Errors on Your VPS
- How to Check and Free Up Disk Space on Ubuntu Server
- How to Manage Services on Ubuntu with systemctl: The Complete systemd Guide
- Initial Ubuntu 24.04 Server Setup Guide: Secure Your New VPS in 10 Steps
Prefer to have experts handle it?
LFA IT provides fully managed Ubuntu VPS and dedicated servers — initial setup, security hardening, monitoring and 24/7 support, so you can focus on your business. Explore our hosting and server management services or open a support ticket and our engineers will take it from there.
