A slow VPS is not diagnosed by running one command or by treating a high load average as proof of CPU trouble. Start by defining the symptom and its time window, capture a baseline, then measure CPU, memory, storage I/O and networking. Use the least invasive tool that can answer the current question: sysstat for a broad time series, perf for CPU and software-event attribution, and BCC or bpftrace when latency, kernel paths or blocking require eBPF tracing.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
This workflow lets you investigate production safely. Each change is tied to an observation, recorded with its conditions, and followed by a re-measurement so you can keep or roll back the change based on evidence.
As an Amazon Associate I earn from qualifying purchases.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →What VPS performance debugging is actually trying to find
“The VPS is slow” describes an outcome, not a cause. A web request may be waiting on a saturated vCPU, reclaiming memory, queuing behind storage, or retransmitting packets. A batch job can be delayed by a noisy neighbor, a blocked process, or a single device reaching its latency limit. The first objective is to turn the complaint into a measurable question.
- What is slow: request latency, SSH login, a scheduled job, database queries, file operations, or packet delivery?
- When did it begin, and does it follow a daily or weekly pattern?
- Is the symptom reproducible, intermittent, or limited to one process?
- What changed immediately beforehand: a deployment, kernel update, traffic increase, data growth, backup, or configuration edit?
Record the distribution and kernel versions, VPS size, workload conditions and time zone. Keep the first command output as a baseline instead of tuning immediately. Without a baseline, a later “improvement” may simply reflect a lighter workload.
#1 Best Overall
Start with a low-risk baseline
Run the following while the symptom is occurring, and save the output with timestamps. The commands are read-only and normally suitable for a production shell.
date -Is— marks the observation window in an unambiguous format.uptime— records uptime and the one-, five- and fifteen-minute load averages.top— shows runnable tasks, CPU state, memory summary and the busiest processes. Press1to expand per-CPU views andqto exit.vmstat 1 10— captures ten one-second samples of run-queue pressure, memory activity, swap, I/O and CPU states.iostat -xz 1 10— captures extended device statistics. The Linux kernel documentation specifically recommendsiostat -xfor detailed input/output-device utilization and performance.sar -n DEV 1 10— samples network throughput and interface errors when the sysstat package is installed.
A load average is a count of tasks that are runnable or waiting in uninterruptible state; it is not a CPU percentage. Correlate it with the run queue, CPU idle time, I/O wait, memory pressure and device latency before deciding what is saturated.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Apply the USE method before choosing a deep tool
Brendan Gregg’s USE method checks three things for every resource: Utilization (how busy it is), Saturation (work waiting for it), and Errors. This prevents the common mistake of profiling CPU when storage is actually queuing, or tuning memory when the network interface is dropping packets.
| Resource | Utilization evidence | Saturation evidence | Error evidence |
|---|---|---|---|
| CPU | mpstat -P ALL 1, CPU user/system percentages in vmstat |
Run-queue column in vmstat; runnable tasks in top |
Usually application or hardware logs rather than a single CPU counter |
| Memory | Used memory and reclaim activity from free, vmstat |
Swap-in/out, direct reclaim, stalled processes | Out-of-memory-killer messages in the kernel log |
| Block I/O | Device busy percentage and throughput in iostat -x |
Average request size, queue depth and await time | Device or filesystem errors in kernel and system logs |
| Network | Receive/transmit rate in sar -n DEV or interface counters |
Socket queues, connection backlog and retransmissions | Drops, overruns, carrier errors and TCP retransmits |
Do not treat an absent counter as proof that the resource is healthy. VPS providers can hide hardware counters, limit tracing, or expose virtual devices with different metrics. Document what the guest can observe.
Measure each bottleneck class
CPU and run-queue pressure
Use mpstat -P ALL 1 to see whether one virtual CPU is busy while others are idle. In top, inspect the process state and the split among user, system, idle and I/O-wait time. A large run queue with little idle time indicates contention; a high I/O-wait percentage points toward storage rather than computation.
Rank #2
- Hardware, kernel, and application internals, and how they perform
- Methodologies for rapid performance analysis of complex systems
- Optimizing CPU, memory, file system, disk, and networking usage
- Sophisticated profiling and tracing with perf, Ftrace, and BPF (BCC and bpftrace)
- Performance challenges associated with cloud computing hypervisors
pidstat -u 1 attributes CPU consumption to processes, while pidstat -w 1 shows voluntary and involuntary context switches. A single process consuming a full vCPU can explain latency even when the VPS has several virtual CPUs. Conversely, many runnable processes with modest individual usage may indicate oversubscription or lock contention.
Recommended Free Tools
Memory pressure and reclaim
Run free -h for a human-readable summary, then watch vmstat 1. The si and so columns show swap in and swap out; sustained nonzero values during the incident mean the workload is moving pages between memory and storage. The r column is the runnable queue, while wa is time waiting for I/O.
Inspect the largest consumers with ps -eo pid,ppid,comm,%mem,rss --sort=-rss | head. Check the kernel log for out-of-memory events. Do not equate filesystem cache with unusable memory: Linux uses free RAM for cache and can reclaim it. The actionable signals are reclaim, swap activity, allocation stalls and an application whose resident set keeps growing.
Filesystem and block I/O
Use iostat -xz 1 during the slowdown. Look at each device’s utilization, await time, queue-related fields and read/write throughput rather than one number in isolation. High device utilization with rising await and queue values indicates that requests are waiting; low throughput does not rule out a latency bottleneck when requests are small or synchronous.
Use pidstat -d 1 to identify processes issuing reads and writes. Confirm which filesystem contains the hot path with df -hT and check capacity and inode exhaustion. A full filesystem, copy-on-write snapshot, log rotation or backup can create I/O waits that look like CPU slowness.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallNetwork throughput, queues and errors
sar -n DEV 1 provides a short time series by interface. For counters, run ip -s link and compare drops, errors and overruns before and during the incident. ss -s summarizes socket states; a growing listen backlog or large receive queues can explain connection latency even when bandwidth is modest.
When TCP behavior is suspect, inspect retransmissions and connection timing with the available socket and kernel statistics. A VPS may not expose physical-interface details, so separate guest-visible packet loss from loss elsewhere in the provider’s network. Record the remote endpoint, protocol and time window when reporting a provider-side problem.
Choose the right tool for the question
| Tool | Best use | Depth and time resolution | Operational considerations |
|---|---|---|---|
sysstat: sar, iostat, vmstat, mpstat, pidstat |
Unknown bottleneck; baseline and historical context | System and per-process time series, usually low overhead | Usually packaged for distributions; some history requires the sysstat collector to be enabled |
perf |
CPU counters, software events and sampled call stacks | Deeper attribution from live views or recorded samples | Needs kernel support and often elevated permissions; virtual machines may restrict hardware counters |
| ftrace | Kernel functions and tracepoints after a kernel path is suspected | Fine-grained kernel event timing | Requires trace filesystem access and careful filtering to limit volume |
| BCC | Complex, ready-made eBPF tools and custom daemons | Kernel and application events with process, file or network context | Requires compatible kernel features, packages and privileges |
| bpftrace | One-liners and short scripts for a focused question | Targeted event and latency measurements | Fast to iterate, but syntax, helper availability and permissions vary by distribution |
| Flame graphs | Visualizing sampled stack traces | Aggregated CPU or blocked-time profile | Useful only after collecting representative stacks; a graph does not prove causation by itself |
Use perf to attribute CPU and software events
The Linux kernel documentation describes perf as an analysis tool for Linux 2.6-and-later systems that abstracts CPU-hardware differences and provides a command-line interface. Begin with counters, then move to sampling.
perf stat -p PID -- sleep 10measures counters for an existing process during ten seconds. ReplacePIDwith the suspected process.perf top -p PIDprovides a live, system-wide or process-focused profile. Pressqto stop.perf record -g -p PID -- sleep 30records sampled call stacks for thirty seconds. Keep the workload and incident window in your notes.perf reportaggregates the recorded samples so you can identify functions and call paths consuming CPU.
Use a sample interval long enough to represent the symptom but short enough to avoid collecting irrelevant activity. If symbols are missing, install the distribution’s matching debug-symbol packages where permitted. A failed hardware-counter command on a VPS may reflect hypervisor policy rather than an absent workload; try software events and record the restriction.
Free tools Windows power users keep installed
One-click scans. No signup required.
Escalate to eBPF tracing for latency and blocking
Use eBPF when aggregate counters cannot answer a focused question such as “which filesystem operations exceed 20 milliseconds?”, “which tasks wait on the run queue?”, “which process retransmits TCP segments?”, or “where is this service blocked off CPU?”
BCC and bpftrace are complementary front ends. Brendan Gregg’s eBPF guidance recommends BCC for complex tools and daemons, and bpftrace for one-liners and short scripts. Select a ready-made BCC tool when it already expresses the question; use bpftrace for a narrowly scoped experiment that you can explain and remove.
For example, tools such as opensnoop can show which processes open files, while latency-oriented tools can attach to filesystem, scheduler or TCP events. Filter by process ID, command name, device or threshold where possible. Broad tracing across every process creates more output and makes interpretation harder.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteInstall and validate the toolchain on the target VPS
The official workshop installation example for Ubuntu is:
sudo apt-get update
sudo apt-get install sysstat bpfcc-tools bpftrace gccPackage names differ across distributions, and some providers use kernels without the required configuration. Validate on the VPS where the incident occurs instead of assuming a laptop or staging host is equivalent.
- Confirm the kernel and distribution with
uname -aand the distribution release file. - Check that the commands exist:
command -v iostat perf opensnoop bpftrace. - Run a harmless BCC probe, such as
sudo opensnoop, for a few seconds, then stop it withCtrl-C. - Run a simple bpftrace probe supplied by your distribution documentation, again for a short, filtered interval.
- If a probe fails, record the exact error, kernel version and privilege level. Do not infer that the underlying resource is healthy from a permissions or feature error.
Tracing commonly requires root or specific capabilities. On a managed VPS you may lack those privileges; request provider metrics or use the read-only sysstat and application-level evidence that is available.
Best Value
- Used Book in Good Condition
A production-safe investigation loop
- Define one symptom. Write the affected operation, start and end time, affected hosts and an objective measure such as p95 latency or job duration.
- Capture the baseline. Save
uptime,top,vmstat,iostat, network counters and application logs before changing settings. - Classify with USE. Check utilization, saturation and errors for CPU, memory, storage and network.
- Select the least invasive next tool. Use
pidstatfor process attribution,perffor CPU paths, or a focused eBPF probe for latency and blocking. - Change one variable. Examples include reverting one deployment, reducing one worker pool, moving one log path, or adjusting one cache limit. Record the exact configuration and restart scope.
- Reproduce or wait for the same workload. Preserve command output, workload volume, kernel and distribution versions, and the observation window.
- Keep or roll back based on measurement. If the target metric does not improve, restore the previous setting and test a different hypothesis.
Run short samples first. Avoid unfiltered tracing, repeated restarts and simultaneous tuning of CPU, memory and I/O settings; those actions destroy the evidence needed to identify cause.
Common symptom patterns and next moves
High load average but low CPU utilization
Inspect vmstat for I/O wait and blocked tasks, then use iostat -xz. Tasks in uninterruptible sleep commonly indicate storage or another kernel wait. Check device latency and queue behavior before changing CPU limits.
One process uses a full virtual CPU
Confirm with pidstat -u 1, then record a short perf record -g profile. The report can distinguish application code, system calls and library work. Optimize or limit the specific process only after confirming that it is responsible for the user-visible symptom.
Memory appears full and the service pauses
Watch swap and reclaim in vmstat, inspect resident memory by process and check for out-of-memory events. If swap activity coincides with pauses, identify the growing process and its allocation pattern rather than deleting caches blindly.
Requests are slow but host counters look normal
Measure application wait categories and trace a focused filesystem, scheduler or TCP question. Off-CPU time can dominate request latency while CPU utilization remains low. BCC or bpftrace can expose where threads sleep, block or wait in queues when ordinary utilization charts cannot.
Only network-facing operations fail
Compare interface drops and errors, socket states and retransmission evidence during the exact window. Test more than one destination when possible. A clean guest interface does not exclude upstream loss, so preserve timestamps and endpoint details for the VPS provider.
What to retain in an incident record
- UTC timestamps, affected process IDs and the exact user-visible symptom.
- Kernel, distribution, VPS size and whether the host is shared or dedicated, if known.
- Raw output from
vmstat,iostat -xz,mpstat,pidstatand network counters. - Any
perfdata or eBPF script, including filters and run duration. - The single configuration change, its rollout scope and before/after workload conditions.
- Permission or kernel-feature limitations that prevented a proposed measurement.
This record makes a later regression comparable and prevents a temporary recovery from being mistaken for a verified fix.
Quick Recap
Key principles to keep
- A high load average identifies contention, not the resource causing it.
- Start with a question and a baseline, then escalate from low-overhead time series to targeted profiling and tracing.
iostat -xis the kernel documentation’s concrete starting point for detailed device performance.perfis the standard Linux interface for counter measurement and sampled profiling.- BCC and bpftrace serve different eBPF workflows: complex tools and daemons versus one-liners and short scripts.
- VPS kernels, packages and privileges vary; validate every tool on the production target and document limitations.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
