Free tools Windows power users keep installed
One-click scans. No signup required.
A Linux VPS can show high CPU, high load, and heavy disk writes at the same time for very different reasons. The reliable way to diagnose the incident is to collect CPU, memory, device, per-process, and pressure data during the same short interval. Then determine whether the guest is executing work, waiting for storage, being delayed by the hypervisor, or running a scheduled task such as a backup, database checkpoint, log rotation, or swap activity.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
Start with a synchronized snapshot, identify the device and process responsible, confirm actual contention with Pressure Stall Information (PSI), and only then change the workload. Killing the process with the largest write total can corrupt a database, interrupt a backup, or hide the real provider-side bottleneck.
As an Amazon Associate I earn from qualifying purchases.
What a CPU-and-disk spike actually tells you
CPU utilization, load average, I/O wait, and disk-write throughput are different measurements. A single percentage cannot explain the incident. Collect them together and interpret their relationships.
| Signal | What it measures | Useful interpretation |
|---|---|---|
| CPU user/system time | Time CPUs spend executing application or kernel code | High values with little idle time indicate computation or kernel work is actively running. |
| I/O wait | Time a CPU is idle while waiting for I/O completion | High wait with blocked tasks points toward storage or another I/O device, but it is not itself a throughput measurement. |
| Load average | Runnable tasks plus tasks in uninterruptible sleep, averaged over time | Load can rise while CPU use stays low when processes are stuck in I/O sleep; it is not a CPU percentage. |
| Steal time | Time a virtual CPU wanted to run but the hypervisor scheduled another guest | Persistently high steal suggests host CPU contention. Guest tools cannot prove the provider’s host-level cause. |
| Device utilization, await, and queue | How busy a block device is and how long requests wait | High await or a growing queue with modest guest throughput can indicate a saturated or throttled virtual disk. |
| PSI | Time tasks are actually delayed by CPU, memory, or I/O pressure | Rising some or sustained I/O full pressure confirms that work is stalled, not merely that a device looks busy. |
Linux kernel documentation defines the PSI some line as the share of time when at least some tasks are stalled on a resource. The full line records intervals when all non-idle tasks are stalled simultaneously. Both expose rolling avg10, avg60, and avg300 windows, measured over 10, 60, and 300 seconds.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
Capture one synchronized snapshot
Run the following during the spike, preferably from a second shell or a monitoring session so that the observation itself does not stop the workload. The commands sample for roughly ten seconds; increase the interval count if the event is intermittent.
uptime
vmstat 1 10
iostat -xz 1 10
mpstat -P ALL 1 10
pidstat -dur 1 10
sudo iotop -oPa -d 1 -n 10
cat /proc/pressure/cpu
cat /proc/pressure/ioSave the complete output with a timestamp. Microsoft’s Linux VM guidance recommends combining top, htop, mpstat, pidstat, and vmstat for CPU investigation and iostat, iotop, and vmstat for disk investigation. The important principle is to compare relationships among metrics rather than treating one utilization value as a verdict.
If a command is missing, install the package that provides it through your distribution’s normal repositories before the next incident. Do not substitute a later, unsynchronized command for a missing sample; the timing relationship is part of the evidence.
Decide whether the CPUs are executing or waiting
Read per-CPU execution with mpstat or top
Run mpstat -P ALL 1 and inspect user, system, iowait, idle, and steal columns for every virtual CPU. High user time means applications are executing instructions. High system time indicates kernel work, such as filesystem, networking, or syscall processing. High iowait combined with blocked tasks supports an I/O explanation. High steal means the guest is ready to run but is not receiving host CPU time.
Check each CPU rather than only the aggregate line. One saturated vCPU can make a single-threaded service slow while the average across many vCPUs appears moderate. Conversely, uniformly high steal across all vCPUs is stronger evidence of host contention than a brief increase on one vCPU. Ask the provider to correlate steal with host metrics; the guest cannot identify which neighboring tenant or host policy caused it.
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
Understand load average
uptime reports one-, five-, and 15-minute load averages. Linux includes tasks in uninterruptible sleep, commonly shown as state D, so a storage queue can raise load while CPU execution remains low. Compare load with runnable and blocked counts in vmstat, CPU idle and iowait in mpstat, and PSI rather than comparing load to a percentage.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Use vmstat to connect processes, memory, and paging
vmstat reports process, memory, paging, block-I/O, trap, and CPU activity in one interval view. The first line after the header is an average since boot; the following lines represent the requested intervals. For a one-second sample, focus on the repeated lines after the initial line.
r: runnable processes waiting for CPU time. A high value with high user/system CPU indicates CPU pressure; a high value with high steal indicates hypervisor delay.b: processes blocked in I/O wait. Risingbduring a write burst supports a storage or filesystem bottleneck.siandso: memory swapped in and out per interval. Sustained nonzero values during disk writes can mean paging is generating the traffic.biandbo: block input and output activity reported by the kernel. Treat them as guest block-layer activity, not as an exact measurement of physical-device writes.wa: CPU time waiting for I/O. Interpret it with blocked-task counts, device latency, and PSI.
When si or so rises, run free -h, swapon --show, and inspect /proc/pressure/memory. Paging can create write bursts and then amplify latency because application reads and writes compete with swap traffic. Do not disable swap blindly: first establish whether memory pressure, an undersized VPS, or a process leak is the cause.
Find the device and its queue behavior
Interpret iostat -xz
Run iostat -xz 1 10. The first report covers time since boot; subsequent reports cover each one-second interval. Use the interval rows that overlap the spike, and identify the device carrying the VPS filesystem. Device names vary by virtualization platform, so do not assume the root disk is always a particular name.
Compare these fields across intervals:
- Read and write rates: show the guest’s observed request volume. A low rate does not rule out a slow or throttled device.
- Request size and merged requests: reveal whether the block layer is combining operations. Application write calls, block-layer writes, and hardware writes are not interchangeable quantities.
await: average request completion time, including time spent queued. A rising value while throughput remains modest is a latency warning.- Queue-related fields: show whether requests are accumulating before completion.
%util: time the device reports itself servicing requests. High utilization means the virtual device is busy, but utilization alone does not identify the writer or prove provider throttling.
The kernel exposes counters in /proc/diskstats and /sys/block/<device>/stat; tools such as iostat and sar commonly read them. Virtual block devices may queue or merge operations before the provider’s storage layer sees them, which is why guest write counts can differ from hardware traffic.
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
Distinguish throughput from latency
A high-throughput workload can be healthy if await and PSI remain low. A low-throughput workload can be unhealthy when requests wait in a long queue. For comparisons between two incidents or VPS plans, record write rate, request size, await, queue behavior, utilization, CPU steal, and PSI over the same interval. This prevents a fast batch job from being mistaken for a latency or throttling problem.
Identify the process or thread writing
Scriptable sampling with pidstat
Use pidstat -d 1 for a repeatable per-task view. The command reports read and write rates by process; adding -t can expose individual threads when a multithreaded service hides the busy worker in an aggregate total. Repeat the sample long enough to catch periodic writers.
Interactive inspection with iotop
sudo iotop -oPa -d 1 -n 10 shows active processes or threads and filters out idle entries. It displays both total process-to-kernel I/O and current I/O reaching underlying hardware. Those values can differ because the kernel queues and merges requests. Run it with sufficient privileges. If task or I/O accounting is unavailable in the kernel, iotop can produce an incomplete view; treat a blank result as a measurement limitation, not proof that no process is writing.
Inspect the winning PID without changing its state
After a PID appears consistently, collect identity and service information:
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
ps -fp PID
readlink -f /proc/PID/exe
sudo tr ' ' ' ' < /proc/PID/cmdline; echo
sudo lsof -p PID
systemctl status UNIT
journalctl -u UNIT --since '-15 min'Replace PID and UNIT with the observed values. The executable path, command line, open files, and unit logs often reveal whether the writer is a database, backup utility, logger, package manager, or security process. If the process is launched by a shell script, inspect the parent process and the script’s schedule rather than stopping the child immediately.
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
Use PSI to confirm that users are actually stalled
Read the pressure files during and after the event:
cat /proc/pressure/cpu
cat /proc/pressure/io
cat /proc/pressure/memoryRising CPU some pressure means at least some runnable work is waiting for CPU. Rising I/O some pressure means tasks are stalled on I/O; sustained I/O full pressure means all non-idle tasks were stalled simultaneously for part of the window and is a severe saturation signal. Memory PSI can distinguish swap or reclaim pressure from a pure storage queue.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallUse the 10-second average to see a current spike, the 60-second average to see whether it is persisting, and the 300-second average to identify a broader degradation. A busy device with near-zero I/O PSI may be processing asynchronous writes without blocking important tasks. Conversely, modest device throughput with rising I/O PSI indicates that latency, queueing, or a limit—not raw bandwidth—is hurting the workload.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Correlate the writer with the event’s cause
Scheduled jobs and backups
Check all systemd timers with systemctl list-timers --all, then inspect cron locations appropriate to the distribution, including system-wide schedules and user crontabs. Compare each job’s start time with the saved iostat and pidstat timestamps. Provider-managed snapshots may run outside the guest’s scheduler, so ask whether snapshot windows overlap the incident.
Logs and log rotation
A rapidly growing log can create sustained writes, while rotation can create a short burst from compression and renaming. Identify the service producing the file, inspect its configured log level and rate limits, and review the rotation schedule. Do not delete or truncate an active log during an incident unless you have a retention and descriptor-handling plan; a service may continue writing to an unlinked file and the evidence can be lost.
Databases
Database checkpoints, write-ahead-log or journal flushes, compaction, index maintenance, and temporary files can all produce bursts. Use the database’s own activity view and logs to distinguish a normal checkpoint from an abnormal queue. Correlate database timestamps with per-process writes and device await instead of assuming that the process with the largest total is the one causing the current latency.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minuteSwap and memory reclaim
If vmstat shows swap-in or swap-out at the same time as memory PSI and disk writes, address memory pressure first. Look for a recently changed workload, a leaking process, an oversized cache, or a VPS with insufficient RAM. Increasing disk performance alone will not remove a paging storm.
Decide whether the VPS provider may be throttling storage
Guest measurements cannot see the provider’s host queue, per-tenant quota, burst bucket, or physical storage tier. A useful escalation pattern is persistent high I/O wait or I/O PSI, elevated await and queue depth, and only modest guest write throughput. That combination is consistent with a saturated or throttled virtual block device, but it is not conclusive from inside the VPS.
Preserve interval output that includes:
- UTC timestamps and the VPS identifier or instance size;
mpstatCPU user, system, iowait, idle, and steal values;vmstatblocked tasks, swap activity, and block output;iostat -xzwrite rate, request size, await, queue-related fields, and utilization for the affected device;pidstatoriotopoutput identifying the writing process;- CPU, I/O, and memory PSI readings before, during, and after the event;
- the schedule or log entry that proves whether an in-guest job was active.
Ask the provider to correlate those timestamps with host-side throttling, noisy-neighbor contention, snapshot activity, and documented I/O limits. Do not claim throttling solely because %util is high or because load exceeds the number of vCPUs.
Apply the least disruptive fix
| Evidence | Likely control | Risk to consider |
|---|---|---|
| A scheduled backup or snapshot overlaps every spike | Pause or reschedule it outside the application’s peak window; reduce concurrency if supported. | Changing the schedule can reduce recovery-point coverage. |
| Debug logging dominates per-process writes | Lower the log level, add appropriate rate limits, and verify rotation and retention. | Over-aggressive filtering can remove evidence needed for security or troubleshooting. |
| Database checkpoint, WAL, or compaction activity matches the burst | Use the database’s documented tuning and maintenance controls; schedule heavy maintenance deliberately. | Disabling durability or forcing an unsafe flush policy can cause data loss. |
| Swap traffic and memory PSI rise with writes | Reduce memory pressure, fix leaks, or move to a larger-memory VPS. | Disabling swap does not solve an undersized workload and can trigger OOM kills. |
| High await/PSI with modest guest throughput and no in-guest writer | Escalate timestamped evidence and review a storage tier with documented capacity. | Moving tiers or hosts has cost and migration risk; confirm the provider’s limits first. |
| One process is unexpectedly writing and its service can be safely paused | Stop the schedule or use the service’s graceful pause mechanism after evidence is captured. | Do not kill a database, journal, backup, or security process as a first response. |
A repeatable incident runbook
- Mark the time. Record the timezone, affected application, user-visible symptom, and whether the event is continuous or periodic.
- Capture the synchronized snapshot. Run the command set and save raw output rather than copying only selected lines.
- Classify CPU state. Compare user/system execution, iowait, idle, steal, runnable tasks, and blocked tasks.
- Check memory and swap. Confirm or exclude reclaim and paging with
free -h,swapon --show,vmstat, and memory PSI. - Locate the device bottleneck. Use interval rows from
iostat -xzto find high await, queue growth, or utilization on the filesystem device. - Attribute the writer. Sample with
pidstatoriotop, then inspect the PID, open files, parent process, service unit, and logs. - Confirm contention. Read CPU and I/O PSI and compare the 10-, 60-, and 300-second averages.
- Correlate schedules. Check timers, cron, database maintenance, backups, rotation, package updates, and provider snapshots.
- Choose a reversible control. Pause a job, reduce logging, or reschedule maintenance before making destructive changes.
- Escalate with evidence. If guest throughput is modest but wait, queues, and PSI remain high, send the timestamped bundle to the VPS provider and request host-side correlation.
Common diagnostic mistakes
- Calling load “CPU usage.” Load includes blocked I/O tasks, so it can be high while CPUs are mostly idle.
- Reading only the first
iostatline. That line includes time since boot; use subsequent interval reports for the incident. - Blaming the process with the largest lifetime total. A total can be large even when current activity is low. Use repeated per-task samples during the spike.
- Treating
iotoptotals as physical-device traffic. Kernel queues and merged requests make process-to-kernel and hardware-reaching rates different. - Assuming high device utilization proves throttling. Utilization must be compared with await, queue behavior, throughput, PSI, and provider limits.
- Stopping the writer before collecting evidence. You may interrupt a required database flush, backup, journal, or security operation and lose the ability to explain the event.
- Ignoring steal time. A guest can show low CPU execution and high latency because the hypervisor is not providing requested CPU time.
- Sampling metrics at different times. A process list taken minutes after
iostatcannot reliably establish causation.
What a convincing diagnosis looks like
A defensible incident record connects four layers: the workload, the process, the device, and the user-visible stall. For example, a timer starts a backup; pidstat identifies the backup process; iostat shows rising await and queue depth on the filesystem device; and I/O PSI rises while application requests block. That chain supports rescheduling or tuning the backup. If no guest process accounts for the writes, steal is low, and I/O PSI and await remain high at modest throughput, the same record supports a provider investigation rather than an application code change.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Keep the raw samples, the service logs, and the schedule entry together. Repeating the same collection after a change lets you determine whether latency, pressure, and user impact actually improved instead of merely observing that the original spike disappeared.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
