How to Check CPU Usage in Linux (Top, htop, vmstat & More)

Checking CPU usage in Linux is essential for monitoring system performance and identifying resource-heavy processes. Tools like top, htop, and vmstat provide real-time insights, while others like sar help analyze historical CPU usage. In this guide, we will cover the most useful commands to monitor CPU utilization effectively.

Monitor CPU Usage Cheat Sheet (Commands & Use Cases)

1. Check CPU Usage in Linux Using top Command (Real-Time Monitoring)

The top command is the most widely used tool to monitor CPU usage in Linux. It provides a real-time view of system processes and overall CPU utilization.

Run:

top

Focus on the %Cpu(s) line:

• %us → user processes
• %sy → system processes
• %id → idle CPU
• %wa → I/O wait (indicates disk bottlenecks)

Useful shortcuts:

• Shift + P → sort by CPU usage
• 1 → view per-core CPU usage
• k → kill process
• q → quit

Use this when you want to quickly identify high CPU usage or monitor processes in real time.

2. Monitor CPU Usage Using htop Command (Interactive View)

The htop command is an enhanced version of top with a more user-friendly interface and better visualization.

Install if needed:

sudo apt install htop

Run:

htop

It shows CPU usage per core with colored bars and allows easy navigation.

Key actions:

• F6 → sort by CPU usage
• F3 → search process
• F9 → kill process

Use this when you want an interactive and easier way to monitor CPU usage and manage processes.

3. Check CPU Usage Using vmstat Command (Quick Snapshot)

The vmstat command provides a lightweight snapshot of CPU and system performance.

Run:

vmstat 1

Important CPU fields:

• us → user CPU usage
• sy → system CPU usage
• id → idle CPU
• wa → I/O wait

Example:

procs -----------memory---------- ---swap-- -----io---- -system-- ------cpu-----
 r  b   swpd   free   buff  cache   si   so    bi    bo   in   cs us sy id wa st
 1  0      0 500000  20000 150000    0    0     1     2  100  200 10  5 80  5  0

Use this when you need a quick, low-overhead way to check CPU usage, especially on servers.

4. Check CPU Usage Per Core Using mpstat Command

The mpstat command is used to monitor CPU usage across individual cores, which is especially useful in multi-core systems.

Install mpstat (if not available):

sudo apt install sysstat      # Debian/Ubuntu
sudo yum install sysstat      # RHEL/CentOS

Run:

mpstat -P ALL 1

This displays CPU usage for all cores every second.

Key fields:

• %usr → user CPU usage
• %sys → system CPU usage
• %idle → idle CPU
• %iowait → waiting on disk I/O

You can also check a specific core:

mpstat -P 0 1

Use this when:

• One core is overloaded while others are idle
• Diagnosing uneven CPU distribution
• Analyzing performance in multi-core environments

5. Monitor CPU Usage History Using sar Command

The sar command is used to monitor CPU usage over time and analyze historical performance.

Install sar (if not available):

sudo apt install sar      # Debian/Ubuntu
sudo yum install sar      # RHEL/CentOS

Run:

sar -u 1 5

This shows CPU usage every second (5 times).

Key metrics:

• %user → user processes
• %system → kernel processes
• %iowait → waiting for I/O
• %idle → idle CPU

To view historical data:

sar -u -f /var/log/sysstat/saXX

Replace XX with the date.

Use this when:

• You want to analyze past CPU usage
• Troubleshooting performance spikes
• Monitoring long-running systems

6. Find CPU Usage Per Process Using ps Command

The ps command helps identify which processes are consuming the most CPU.

Run:

ps -eo pid,ppid,%cpu,cmd --sort=-%cpu | head

This lists the top CPU-consuming processes.

Example output:

PID   PPID %CPU CMD
1234     1 45.2 java
2345     1 30.1 python
3456     1 15.0 nginx

You can also use this logic inside a simple shell script to monitor CPU usage across different processes

Check CPU Usage Using iostat Command (CPU + I/O Analysis)

The iostat command is primarily used to monitor disk I/O, but it also provides valuable CPU usage statistics. It is especially useful when diagnosing performance issues caused by high I/O wait.

Install iostat (if not available):

sudo apt install sysstat      # Debian/Ubuntu
sudo yum install sysstat      # RHEL/CentOS

Run:

iostat -c 1

This displays CPU usage every second.

Key CPU fields:

• %user → CPU usage by user processes
• %system → CPU usage by kernel processes
• %iowait → CPU waiting for disk I/O (very important)
• %idle → idle CPU

Example output:

avg-cpu:  %user   %nice %system %iowait  %steal   %idle
           10.25    0.00    5.10    8.50    0.00   76.15

When to use iostat:

• When CPU usage is high but system feels slow
• To check if CPU is waiting on disk (high %iowait)
• To correlate CPU performance with disk activity

👉 If %iowait is high, the issue is likely disk-related, not CPU.

The iostat command is a key tool for identifying whether performance issues are caused by CPU load or disk bottlenecks.

Troubleshooting High CPU Usage in Linux

High CPU usage in production should be handled carefully. The goal is to first confirm whether the problem is really CPU saturation, then identify whether it is caused by one process, uneven core usage, kernel activity, I/O wait, or load spikes from too many runnable tasks.

Step 1: Confirm overall CPU pressure

Start by checking whether the system is actually under CPU stress:

top

or:

uptime

What to check:

• High %us usually means user-space processes are consuming CPU
• High %sy indicates more kernel or system-level CPU activity
• High load average with low idle CPU suggests real CPU pressure
• Load average much higher than available CPU cores usually means the system is overloaded

You can check the number of CPU cores with:

nproc

Example:

• If load average is 16 on a 4-core system, the server is under heavy pressure
• If load average is 2 on an 8-core system, CPU may not be the real issue

Step 2: Check whether one process or many processes are responsible

Identify the top CPU-consuming processes:

ps -eo pid,ppid,user,%cpu,%mem,cmd --sort=-%cpu | head -20

This helps answer:

• Is one process consuming most of the CPU?
• Are multiple worker processes together causing the load?
• Is the issue tied to an application, cron job, Java process, Python process, or database?

If required, monitor continuously:

top -o %CPU

Step 3: Check per-core imbalance

Sometimes overall CPU usage looks normal, but one or two cores are saturated. This is common with single-threaded applications. If you are new to the concept of CPU, Core, Processors etc then you can read CPU, processors, core, threads - Explained in layman's terms

mpstat -P ALL 1 5

What to look for:

• One core constantly near 100% while others remain mostly idle
• Uneven CPU distribution across cores

This usually indicates:

• single-threaded workload
• CPU affinity pinning
• poor parallelism in the application

If one core is saturated, scaling the application horizontally or increasing total cores may not solve the immediate issue unless the application can actually use multiple cores.

Step 4: Distinguish CPU usage from I/O wait

A system may appear slow even when CPU is not the root problem. Check whether the CPU is spending time waiting on disk I/O.

vmstat 1 5

or:

iostat -c 1 5

What to check:

• High wa in vmstat
• High %iowait in iostat

If I/O wait is high:

• CPU is waiting for storage
• the bottleneck is likely disk, filesystem, or attached storage
• application slowness may not improve by tuning CPU alone

Then identify which processes are causing heavy disk activity:

sudo iotop -o

This is especially useful for:

• database flushes
• backup jobs
• log-heavy services
• large file processing tasks

Step 5: Check for excessive context switching or run queue growth

A server may show high CPU-related stress because too many threads or processes are competing for CPU.

vmstat 1 5

Look at:

• r → number of runnable processes waiting for CPU
• cs → context switches
• in → interrupts

Warning signs:

• r consistently higher than available CPU cores
• very high context switching
• sudden interrupt spikes

This can happen due to:

• thread storms
• too many workers
• busy polling
• network interrupt overload
• badly tuned application concurrency

Step 6: Check historical CPU trends, not just current state

A one-time snapshot is often misleading in production. You need to know whether the spike is temporary, recurring, or long-lasting.

sar -u 1 5

To review historical data:

sar -u -f /var/log/sysstat/sa$(date +%d)

Use historical data to answer:

• Did the spike start recently?
• Does it happen at the same time every day?
• Is it linked to cron jobs, reporting tasks, backups, or ETL jobs?

This is extremely important in production because many CPU incidents are scheduled workload issues rather than random failures.

Step 7: Correlate CPU spike with application and service activity

Once you identify the top process, correlate it with the actual service:

ps -fp <PID>

If it is managed by systemd:

systemctl status <service-name>

Step 8: Take safe remediation actions

Only after identifying the cause should you act.

Possible actions:

• stop or reschedule a non-critical batch job
• reduce worker/thread count
• move heavy processing to off-peak hours
• fix retry loops in the application
• optimize queries if database-related
• tune storage if high I/O wait is the root cause
• scale out or scale up if sustained CPU pressure is legitimate

If you must terminate a process, start gracefully:

kill -15 <PID>

Use force kill only if necessary:

kill -9 <PID>

In production, always prefer graceful termination to avoid data corruption or incomplete transactions.

Step 9: Verify recovery after the fix

After remediation, confirm that the system has stabilized:

top

mpstat -P ALL 1 5

vmstat 1 5

sar -u 1 5

Verify:

• CPU idle time has improved
• run queue is lower
• I/O wait is normal
• critical application response is healthy
• the same process is not immediately consuming CPU again

If CPU usage rises again quickly, the action treated the symptom, not the root cause.

Summary

Monitoring CPU usage in Linux is essential for understanding system performance and identifying bottlenecks. Commands like top and htop help with real-time monitoring, while tools such as vmstat, mpstat, and iostat provide deeper insights into CPU behavior and system load.

For advanced analysis, sar allows you to track CPU usage over time, and ps helps identify processes consuming the most CPU. In scenarios where high CPU usage is caused by disk activity, tools like iostat and iotop can help diagnose I/O-related bottlenecks.

By combining these tools, you can effectively monitor, analyze, and troubleshoot CPU performance issues across different Linux environments.

Official Documentation

Refer to the following official resources for detailed command usage and advanced options:

• top command manual
• htop command manual
• vmstat command manual
• mpstat command manual
• sar command manual
• iostat command manual
• ps command manual
• iotop command manual

These references provide complete details on command options, output interpretation, and advanced usage for effective CPU monitoring in Linux.