Using unhide to check hidden process - http://www.ubuntugeek.com/unhide-the-opensource-forensic-tool.html fuser, check which user using the file or directory - http://www.thegeekstuff.com/2012/02/linux-fuser-command/ htop, look much better than top - http://nerds-central.blogspot.com/2011/06/right-no-i-am-loving-htop-it-is-linux.html http://www.thegeekstuff.com/2011/09/linux-htop-examples Tutorial of both lsof and pstack - http://myhowto.org/solving-problems/5-exploring-system-internals-with-lsof-and-strace/#strace_run Tutorial of SAR - http://www.thegeekstuff.com/2011/03/sar-examples . In Solaris, you can check SAR from previous days using "sar -f /var/adm/sa/sa30 " ( last 30th ) If we like to see the detail from "ps" command: solaris: /usr/ucb/ps -awwx , or, use pargs, but need sudo to that user - http://javarevisited.blogspot.com.au/2015/01/solaris-command-to-show-long-argument-of-running-process.html linux: ps -aef --cols [XXXX] prstat - use prstat instead of ps in solaris http://developers.sun.com/solaris/articles/prstat.html How to check physical memory on solaris? /usr/sbin/prtconf | grep Memory http://www.dbapool.com/faqs/Q_116.html Other forensics tools - http://www.forensicfocus.com/computer-forensics-software-intro.php Sun monitoring tools collections - http://blogs.sun.com/toddjobson/entry/solaris_performance_monitoring_tools http://tech.varghees.com/2011/01/21/commonly-used-system-monitoring-commands-in-linux/ time, basic unix util - http://www.thegeekstuff.com/2013/10/time-command-format http://www.baptiste-wicht.com/2013/12/zabbix-low-level-discovery-cores-cpus-hard-disk/ 10 commands for system monitoring - http://techblog.netflix.com/2015/11/linux-performance-analysis-in-60s.html http://www.infoq.com/cn/news/2015/12/linux-performance https://linuxcommando.blogspot.com/2020/04/inxi-swiss-army-knife-for-displaying.html Top explain - https://dzone.com/articles/different-cpu-times-unixlinux-top