Use repeated CPU samples to find out whether a slowdown comes from a busy process inside your Linux server, a CPU limit applied to its cgroup, I/O wait, or virtual-machine steal time. Guest-level tools can show when virtual CPU time is unavailable, but they cannot identify which other tenant or virtual machine is responsible. If the pattern persists, take timestamped evidence to your hosting provider.
Collect samples while the slowdown is happening
Start sampling during the latency window, and keep the outputs and timestamps alongside the time users noticed the problem. A single snapshot can catch a short burst but cannot show whether CPU pressure is sustained. Use more than one view: overall CPU states, per-CPU activity, and processes answer different questions.
As an Amazon Associate I earn from qualifying purchases.
Use top to inspect CPU states and processes
Run top for a dynamic view of system summaries and processes. Note the CPU-state summary and sort the process list by CPU use. Use its per-CPU display if the total average looks moderate but a particular core may be saturated. The displayed process CPU percentage is measured over the elapsed time since the last screen update; depending on the display mode, a multithreaded process can exceed 100%.
Recommended Free Tools
A process near the top of one screen is a lead, not yet proof of sustained load. Watch repeated updates, and inspect the process’s command, user, and threads before deciding what is responsible.
#1 Best Overall
- MT-VIKI 1568UL is our latest all-in-one console to manage up to 8 computers. Features a 15.6" LCD monitor with 1920x1080@60Hz resolution. Combines monitor, keyboard, and touchpad into a single 1U rackmount drawer to save up to 85% of valuable cabinet space. Built-in USB 2.0 in front panel for external mice or keyboard.
- Adjustable Depth & 2 Set Rack Rails: Includes two sets of Rack Rails. Short Rack Rails: Fit 18.9"–23.6" (480-600mm) deep network racks (Note: check cable clearance for depths under 600mm). Long Rack Rails: Fit 23.6"–31.5" (600-800mm) deep standard racks. Measure your rack depth before purchase to ensure a perfect fit.
- External Monitor Support & Flexible Operation--Features an VGA console output for connecting an external monitor, allowing convenient server access without opening the rack. Supports front panel buttons, touchpad, hotkeys, and OSD menu control. Support password prodected: provides 2-level password security (administrator and user), up to 8 authorized users and an administrator view and control the computers.
- ALL-IN-ONE Design, Lightweight Aluminum & Steel Build: Upgraded with an aluminum interior for less weight and a rugged steel drawer shell for industrial durability. Easy to install. Features a built-in handle and lock for secure operation. Physical Dimensions: 18.9" x 23.6" x 1.77" (480mm x 600mm x 45mm).
- Built for Professional Environments – Ideal for server rooms, data centers, industrial control systems, and security monitoring centers where multiple computers need centralized management or when technicians need direct access to connected systems without an external monitor.
Use vmstat for repeated system-wide readings
Run vmstat 1 to request repeated reports at one-second intervals, or choose an interval and count suited to the incident. The first report is an average since boot; subsequent reports reflect the requested sampling interval. Interpret the CPU fields separately rather than treating them as one generic utilization figure.
Use mpstat when per-CPU detail matters
If the sysstat package is installed, run mpstat -P ALL 1 to see per-processor activity and a global average at one-second intervals. Its %steal field is useful on virtualized systems. Per-CPU results can reveal uneven pressure that a machine-wide average hides.
Preserve the samples through your existing monitoring or logging method if you need to review them after the incident. The commands show measurements; they do not by themselves configure long-term retention.
Tell CPU execution apart from waiting
CPU summary fields describe different states. In particular, I/O wait and steal time are not the same as time spent executing application code.
Rank #2
- HASSLE-FREE ACCESS: The KVM console design provides an LCD monitor for all-in-one control with a space-saving design when you need to access your server, then easily tuck the rackmount console away, when not in use.
- LCD MONITOR: The KVM console features 19" LCD display and supports video resolutions up to 1280 x 1024
- GREAT COMPATIBILITY: The B021-000-19 is compatible with most PS/2 and USB KVM switches, making it easy to integrate with an existing system.
- USB PASS-THROUGH: The unit features a USB 2. 0 pass-through port for connection of a USB peripheral, such as a flash drive, CAC card reader, etc. .
- TAA-Compliant for GSA Schedule Purchases and 1-Year
| Field or state | What it indicates | What to investigate |
|---|---|---|
us / user time |
Time executing user-space code. | Inspect repeatedly busy processes and their workloads. |
sy / system time |
Time executing kernel code. | Look for system-side work that coincides with the slowdown. |
id / idle |
Time the CPU is idle. | Compare with the latency window and the other CPU states. |
wa / I/O wait |
Time the CPU is idle while I/O is outstanding. | Investigate I/O-related delays rather than assuming another tenant is consuming CPU. |
st / %steal |
Virtual CPU time unavailable while the hypervisor services another virtual processor. | Compare repeated readings with reported latency; if persistent, include them in a provider escalation. |
These fields help distinguish guest execution from waiting, but none alone establishes the cause of an application slowdown. Compare repeated readings during the affected period with the server’s normal behavior and relevant application latency data.
Check whether a process or cgroup explains the load
If a process consistently uses CPU, inspect its command, user, threads, and workload. Thread-level views can help when one thread or a multithreaded process is driving pressure; per-CPU readings help when the load is concentrated on only part of the machine.
For a service or container managed with cgroups, inspect its membership, configured limits, and the applicable cgroup counters. On cgroup v2, cpu.stat reports CPU usage fields. When the CPU controller is enabled, it can also report fair-scheduler bandwidth fields such as nr_throttled and throttled_usec. The available fields and their meaning depend on the active cgroup setup and controller configuration.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Check the hierarchy, including ancestor groups: an ancestor bandwidth limit can affect a descendant. Where available, cpu.stat.local reports throttling on the cgroup’s own runqueues, including throttling inherited from ancestor bandwidth limits.
Rank #3
- Compatible to: This Mounting Bracket is designed for the TAA compliant Universal VESA LCD Monitor in 19-inch network cabinet or server rack.
- Sturdy Structure: The LCD mounting bracket is made of cold rolled steel and supports 100mm & 75mm VESA mounted LCD panels.
- Adjustable Depth: This adjustable depth design enables an LCD panel to be mounted into the AV rack cabinet at various depths; allowing the rack or cabinet door to be closed.
- Multi-use: Besides using in 19" network cabinet or server rack, the LCD monitor can be mounted onto wall by adding this bracket onto a wall mount bracket or rack.
- Usage is not throttling. Usage counters describe CPU time consumed; throttling counters describe effects of a CPU bandwidth limit.
- A limit is not proof of an unrelated tenant. Review the service’s own configured limits and parent groups before blaming contention elsewhere.
- Configuration varies. Linux cgroup interfaces and the running cgroup setup can differ by kernel and system manager, so verify which hierarchy and controllers are active on the server.
Interpret steal time without over-attributing it
Linux tools expose steal time as st or %steal in virtualized environments. It represents virtual CPU time unavailable to the guest while the hypervisor services another virtual processor. A persistent rise that coincides with reported latency is a reason to investigate beyond the guest, especially when process use and local cgroup throttling do not explain the delay.
Steal time does not name the process, customer, or other virtual machine using the host. It is evidence about CPU time unavailable at the hypervisor layer, not proof that a particular noisy neighbor caused the incident. AWS CloudWatch’s agent documentation uses cpu_time_steal as one provider-specific metric name; that is an example of metric collection, not a requirement to use AWS or CloudWatch.
Understand what cgroups and CPU sets can—and cannot—control
Cgroups organize processes into hierarchical groups whose resource use can be monitored and, where configured, limited. CPU sets constrain the CPU and memory-node placement available to a task group. These are controls for workloads the administrator can manage; on an ordinary shared server they do not reveal or control another customer’s processes on the host.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesKubernetes placement guidance is a separate case, not a remedy available to every shared-hosting customer. AWS EKS documentation discusses CPU requests in relation to some CPU-sharing concerns and node taints and tolerations for workload placement. Those measures apply to Kubernetes administration and do not isolate every shared-resource boundary.
Rank #4
- 8 Port Rackmount KVM Console, is integrated 8 port kvm switch, touchpad, keyboard and 17.3'' LCD monitor, ideal to manage up to 8 computer/servers. Fits 1U 19'' rack. Come with a USB 2.0 Port for external Mice or keyboard.
- Product Dimension (W×D×H):18.9×23.6×1.77 inches [480x600x45mm]. [Mount depth]: 23.6- 31.8" [60-81cm]，Mounts into 19”-wide rack. The monitor is adjustable, the max angle is 110°
- External Monitor Support & Flexible Operation--Features an HDMI console output for connecting an external monitor, allowing convenient server access without opening the rack. This Rack KVM Switch support Three Switching Ways: OSD menu + Keyboard Hotkey+ Button. There are 2 OSD menu: Screen OSD and KVM OSD, also supports external USB mouse.
- Come with Handle & Lock. [All-IN-ONE Design] You just need to place the KVM directly into 1U rackmount and tighten the screws. Designed for data centers, enterprise IT, government, and educational institutions, delivering a secure, scalable, and efficient server management solution.
- [Security & Durability] 2 Level Password Security, only authorised users can view and control computers; This KVM console is upgraded with alumium for less wight, and the draw shell is made by steel for sturdy. Compatible with Dos/Windows, Linux, Unix, Mac OS8.6/9/10, Unix and SUN Solaris 8/9.
Escalate with a useful evidence bundle
If guest-local process activity and cgroup throttling do not explain a persistent incident, send your provider evidence tied to the affected times. Ask for host-level investigation rather than claiming that a particular tenant is at fault.
- Timestamped
vmstatormpstatsamples covering both affected and, if available, normal periods. - The CPU states that changed, especially sustained
stor%steal, and any relevant per-CPU imbalance. - The latency windows users experienced, plus relevant application metrics.
- Instance or service details and any process or cgroup findings that help rule in or rule out guest-local causes.
- Questions about whether the provider sees host contention, whether the plan has a CPU cap or burst policy, and what allocation or isolation options are available.
Provider responses and plan terms vary. Ask for the applicable allocation details rather than assuming that a label such as “shared,” “dedicated,” or “burstable” means the same thing across providers.
Compare hosting changes against the evidence
If the provider investigation points to an allocation or isolation issue, compare options using the details that affect your workload, not a general promise to eliminate noisy neighbors.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →| What to compare | What to verify with the provider |
|---|---|
| CPU allocation | Whether CPU is shared, capped, burstable, or dedicated, and what allocation is documented. |
| Investigation and reporting | What the provider can investigate or report about host contention and how incidents are handled. |
| Isolation | Which workload and resource boundaries the option actually isolates. |
| Change cost | Current price and the migration effort or risk for your workload. |
Confirm current terms directly with the provider before changing plans. Guest metrics can support an allocation discussion, but they cannot establish another tenant’s identity or guarantee that a plan change will resolve every performance problem.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
