How to Check CPU Usage on Linux: top, htop, mpstat and sar

Applies to: Ubuntu 26.04 and 24.04, Debian 13 and AlmaLinux 10; procps-ng 4.0.4 (top, ps, vmstat), sysstat 12.6 to 12.7 (mpstat, sar, pidstat) and htop 3.3 to 3.4

To check CPU usage on Linux, run top and read the %Cpu(s) line at the top. us plus sy is the share of CPU time spent on work; id is idle. The process list below it is sorted by CPU use, so the program using the most CPU is at the top. Press 1 to see each CPU core separately and q to quit.

%Cpu(s):  0.0 us,  0.0 sy,  0.0 ni,100.0 id,  0.0 wa,  0.0 hi,  0.0 si,  0.0 st

That line is from our lab test machine while it was idle. All the sample output in this article comes from a small test VM, so the numbers say nothing about any Ucartz server; only the layout matters.

What the CPU fields mean

These definitions are from the top manual (procps-ng 4.0.4). Each value is a percentage of CPU time:

• us: user programs (your web server, PHP, database, scripts).
• sy: the kernel.
• ni: user programs running with a lower priority (nice).
• id: idle. CPU usage is roughly 100 minus id.
• wa: waiting for disk or other I/O. A high wa with low us means storage, not the CPU, is the bottleneck.
• hi and si: hardware and software interrupts (heavy network traffic often shows up in si).
• st: steal, “time stolen from this vm by the hypervisor”. It is only above zero on virtual machines. If st stays high on a VPS while your programs want CPU, the VM is getting less CPU time than it asks for; send the output to support with a ticket.

1. top: live view (installed everywhere)

top

• Press 1 to switch between one combined line and one line per CPU core.
• Press P (capital) to sort by %CPU, M to sort by memory.
• In the process list, %CPU can go above 100 on a multi-core server: 200% means a process is using two full cores.

For a single reading in a script or a support ticket, run top in batch mode with two updates one second apart and keep the second, which measures that one-second interval:

top -bn2 -d1 | grep '%Cpu' | tail -1

See top command usage and examples for more options.

2. htop: easier to read

# Ubuntu and Debian
sudo apt install htop
# AlmaLinux 10 (htop is in EPEL)
sudo dnf install epel-release
sudo dnf install htop

htop draws one bar per CPU core above the process list. Useful keys, according to the htop manual: P sorts by CPU, M by memory, F6 chooses the sort column, F4 filters by name, t or F5 shows a process tree, and F10 or q quits. We tested htop 3.4.1 (Ubuntu 26.04), 3.3.0 (Ubuntu 24.04) and 3.3.0 from EPEL (AlmaLinux 10).

3. mpstat: CPU usage over a period

mpstat comes with the sysstat package (sudo apt install sysstat or sudo dnf install sysstat). mpstat 1 5 prints the average of all cores every second, five times, then an average. Our lab sample used a 2-second interval:

$ mpstat 2 3
12:26:27     CPU    %usr   %nice    %sys %iowait    %irq   %soft  %steal  %guest  %gnice   %idle
12:26:29     all    0.50    0.00    0.50    0.00    0.50    0.00    0.00    0.00    0.00   98.50
(lab sample, one line shown)

Add -P ALL for one line per core: mpstat -P ALL 1 5. This is how you spot a single-threaded program that keeps one core at 100% while the server average looks low.

4. vmstat: CPU, memory and I/O together

$ vmstat 2 3
procs -----------memory---------- ---swap-- -----io---- -system-- -------cpu-------
 r  b   swpd   free   buff  cache   si   so    bi    bo   in   cs us sy id wa st gu
 3  0   6348 1258900 149576 2227976    0    0    14   197   76    1  1  1 95  0  3  0
(lab sample, first line shown)

The first line is an average since boot; the following lines show each interval (here 2 seconds; vmstat 1 5 gives one-second steps). The us sy id wa st columns match the top fields above. Column r is the number of processes running or waiting for a CPU: if it stays above the number of cores, the CPU is the bottleneck. More in understanding vmstat.

5. Which process is using the CPU

ps -eo pid,user,comm,%cpu,%mem --sort=-%cpu | head

Note that %cpu in ps is the CPU time a process has used divided by how long it has been running, so it is an average over its lifetime, not the current value. For the current value per process, use top, htop or pidstat from sysstat:

pidstat -u 1 5

It lists every process that used CPU in each one-second interval. For more ways to rank processes, see find top running processes by memory and CPU usage.

6. CPU usage history with sar

top and mpstat only show the present. To see what the CPU did at 3 a.m., the sysstat collector must be running. It takes a sample every 10 minutes (the sysstat-collect.timer runs at *:00/10). Whether it is on after installing sysstat depends on the system:

• Ubuntu 26.04: on (ENABLED="true" in /etc/default/sysstat).
• Ubuntu 24.04 and Debian 13: off (ENABLED="false"). Change it to "true", then run sudo systemctl enable --now sysstat.
• AlmaLinux 10: sysstat and sysstat-collect.timer are enabled when the package is installed.

Then read today’s CPU history with:

sar -u

It prints one line per sample with the columns CPU %user %nice %system %iowait %steal %idle. For another day, point it at that day’s file, for example sar -u -f /var/log/sysstat/sa09 for the 9th on Ubuntu and Debian, or /var/log/sa/sa09 on AlmaLinux. Ubuntu 24.04 keeps 7 days by default (HISTORY=7 in /etc/sysstat/sysstat); AlmaLinux 10 keeps 28. Our older guide install and configure sar on Ubuntu and Debian has more on sar.

7. CPU load average

uptime
cat /proc/loadavg

The three numbers are the load averages over 1, 5 and 15 minutes: the average number of processes running or waiting to run (on Linux this also counts processes waiting for disk). Compare them with the number of cores from nproc: a load of 4 is a full load on a 4-core server and an overload on a 2-core one. Understanding Linux CPU load explains it in detail.

8. CPU information: model and number of cores

$ nproc
1
$ lscpu
CPU(s):                               1
Thread(s) per core:                   1
Hypervisor vendor:                    KVM
Virtualization type:                  full
(lab sample, selected lines)

lscpu also shows the model name, sockets, caches and flags; grep -m1 "model name" /proc/cpuinfo prints just the model. On a VPS, Hypervisor vendor shows the virtualisation type. See also determine the number of CPUs and find the CPU frequency.

When is CPU usage too high?

Short spikes to 100% are normal, for example while a backup compresses files or a page cache warms up. Look closer when the CPU stays busy for minutes, the load average stays above the core count, or websites slow down at the same time. Find the process with top or pidstat first; if it is MySQL or MariaDB, see how to fix MySQL high CPU usage. To be alerted automatically, set up monitoring such as Zabbix Agent 2 or Nagios with NRPE. If you want an engineer to look at a slow server, our Hire an Expert service is billed from $8 per 15 minutes, with no contract.

Official documentation: top(1), htop(1) and ps(1).