How to Monitor and Manage Linux Control Group Resource Utilisation Using systemd-cgtop and systemd-cgls

Modern Linux distributions rely fundamentally on Control Groups (cgroups, particularly cgroups v2) to enforce resource boundaries, allocate CPU quotas, and prevent rogue services from consuming all available memory. While standard diagnostic commands like top and htop track individual process IDs (PIDs), they do not provide visibility into the hierarchical service slices and scopes that systemd uses to orchestrate system workloads. Linux provides two specialised utilities—systemd-cgls and systemd-cgtop—designed specifically to inspect control group hierarchies and monitor real-time slice consumption.

The Relationship Between systemd and cgroups v2

systemd maps operating system tasks into three primary hierarchical branches known as slices:

• system.slice: Contains all system background daemons, systemd services (e.g. Nginx, PostgreSQL, SSHD), and OS infrastructure units.
• user.slice: Encloses active interactive user sessions, desktop environments, terminal logins, and user-level systemd processes.
• machine.slice: Isolates virtual machines and container workloads managed by tools like libvirt, Podman, and systemd-nspawn.

Monitoring at the control group tier allows system administrators to identify when an entire container or multi-threaded service cluster is exceeding memory or CPU limits, even when individual worker processes appear benign.

Inspecting the Control Group Tree with systemd-cgls

To inspect your server’s current cgroup structure and understand where active processes are rooted, use systemd-cgls:

systemd-cgls

This outputs an organised hierarchical tree displaying every slice, scope, service unit, and child process ID:

Control group /:
-.slice
├─user.slice 
│ └─user-1000.slice
│   ├─session-3.scope
│   │ ├─1234 sshd: user [priv]
│   │ └─1245 -bash
├─system.slice 
│ ├─nginx.service 
│ │ ├─2100 nginx: master process /usr/sbin/nginx
│ │ └─2101 nginx: worker process
│ └─systemd-journald.service 
│   └─450 /usr/lib/systemd/systemd-journald

To filter the view and inspect a specific service tree exclusively, pass the service unit name:

systemd-cgls /system.slice/nginx.service

Monitoring Live Resource Utilisation with systemd-cgtop

While systemd-cgls displays structural layout, systemd-cgtop provides live, real-time resource telemetry similar to top, but aggregated by control group.

systemd-cgtop

The interactive interface updates every second, displaying columns for:

Column Header	Metric Measured	Diagnostic Significance
Control Group	Hierarchical slice, service, or scope path	Identifies the exact container or systemd unit responsible
Tasks	Total number of threads and child processes	Detects thread pool exhaustion and fork-bomb behaviour
%CPU	Total CPU processing share across all child threads	Reveals cumulative multi-core processor utilisation
Memory	Resident memory currently consumed	Monitors growth toward cgroup OOM (Out-of-Memory) limits
Input/s & Output/s	Real-time disk I/O throughput in bytes per second	Isolates storage bottlenecks and excessive logging

Interactive Sorting and Filtering Shortcuts

While systemd-cgtop is running, you can adjust display preferences using single-key shortcuts:

• Press C: Sorts the list by CPU utilisation (%CPU) in descending order.
• Press M: Sorts the list by Memory consumption, isolating memory-intensive service trees.
• Press I: Sorts the list by disk I/O write operations.
• Press P: Sorts by the number of active Tasks / child processes.
• Press + / -: Increases or decreases the refresh update interval.
• Press Q: Exits the utility and returns to your terminal prompt.

Automating Audits with Non-Interactive Output

If you need to capture a snapshot of control group metrics for automated monitoring scripts or diagnostic logging, invoke systemd-cgtop with the -b (batch) and -n (iterations) flags:

systemd-cgtop -b -n 1 > /var/log/cgroup_snapshot.log

This prints a single, cleanly formatted textual table without terminal escape sequences, making it effortless to parse with tools like awk or ingest into monitoring dashboards.

Utilising systemd-cgtop and systemd-cgls gives system administrators complete, top-down control over service resource quotas, ensuring high-density Linux servers remain responsive and balanced under peak workloads.