Linux CPU Usage_ Commands to Monitor Processes and Cores
How to Check CPU Usage in Linux

High CPU usage can slow down applications, increase response times, and make a Linux server less responsive. Before looking for the cause, you need to determine how much CPU the system is actually using and which processes are consuming the available processing time.

Linux provides several command-line tools for checking CPU utilization from different perspectives. Some show overall CPU activity, while others help identify busy processes, compare individual CPU cores, or observe how utilization changes over time. This guide explains how to check CPU usage in Linux and interpret the metrics that matter during troubleshooting.



Understanding CPU Usage in Linux


CPU usage represents the amount of processor time spent performing different types of work. Linux divides that time into several categories, so a single utilization percentage does not always explain why a system is busy.

The most useful CPU metrics include:

● User (us) — time spent running user-space applications and processes.
● System (sy) — time spent executing kernel operations.
● Idle (id) — CPU time when the processor has no work to perform.
● I/O wait (wa) — time the CPU is idle while the system has outstanding I/O requests.
● Steal (st) — CPU time a vm could have used but that was taken by the hypervisor to run other vm.

On a VPS, steal time is particularly useful because consistently elevated %st can indicate contention for physical CPU resources on the host. High %wa, meanwhile, should not automatically be interpreted as a CPU bottleneck: the system may be waiting on storage rather than running out of processing capacity.

CPU utilization is also different from load average. CPU usage measures how processor time is being spent, while load average reflects the number of tasks that are runnable or waiting in uninterruptible sleep. For that reason, a Linux system can have a high load average without all CPU cores being fully utilized.



Check CPU Usage with the top Command


The top command is one of the quickest ways to check CPU usage on a Linux system. It provides a continuously updated view of system activity and shows both overall CPU statistics and resource usage for individual processes.

Run:

top

Near the top of the output, you will see a CPU summary similar to:

%Cpu(s): 5.2 us, 1.3 sy, 0.0 ni, 92.8 id, 0.4 wa, 0.0 hi, 0.3 si, 0.0 st

The values are updated while top is running, which makes the command useful for observing short CPU spikes and checking whether high utilization persists.


How to Read CPU Usage in top


The %Cpu(s) line divides CPU time into several categories. For a first check, focus on us, sy, id, wa, and st.

In the example above, 92.8 id means the CPU is idle 92.8% of the time. The remaining time is distributed among user processes, kernel activity, I/O wait, interrupts, and other categories.

A low %id value indicates that more CPU capacity is being used, but the other fields show where that time is going. High %us usually points to application workloads, while high %sy indicates increased kernel activity. Elevated %wa or %st requires a different interpretation because neither necessarily means that applications themselves are consuming all available CPU time.

By default, top may display CPU statistics as an aggregate across all logical CPUs. Press 1 while top is running to display utilization for each logical CPU separately. This can reveal cases where one CPU is saturated even though the overall utilization appears moderate.


Find Processes Using the Most CPU


The process list in top shows CPU consumption in the %CPU column. To sort the list by CPU usage, press uppercase P while top is running.

Processes consuming the most CPU will appear near the top of the list. Pay attention to the PID, USER, COMMAND, and %CPU fields to determine which process is responsible for the workload.

A high value for one process is not necessarily a problem. CPU-intensive applications may legitimately use substantial processing capacity while completing work. The more useful question is whether the utilization persists and whether it affects other applications or overall system responsiveness.

Press q to exit top.



Monitor CPU Usage with htop


htop provides an interactive view of CPU usage and running processes. Compared with top, it makes it easier to see how activity is distributed across individual logical CPUs and to sort or inspect processes while the system is under load.

Start it with:

htop

The CPU meters at the top of the interface show utilization for each logical CPU. This is useful when overall CPU usage looks moderate but a single CPU is consistently busy. The process list below the meters can be sorted by CPU consumption by selecting the %CPU column or pressing P.

Unlike top, htop is not installed by default on every Linux distribution. If it is missing on a CentOS system, follow our guide to install htop on CentOS.

For CPU troubleshooting, focus on processes that remain near the top of the list across several refreshes rather than reacting to a brief spike. A process that appears once with high %CPU may simply be completing a short CPU-intensive task.



Check CPU Usage Per Core with mpstat


When you need a more detailed view of CPU utilization across individual logical CPUs, use mpstat. The command is part of the sysstat package and reports processor statistics without the interactive process interface provided by top or htop.

To display statistics for all logical CPUs once per second, run:

mpstat -P ALL 1

The -P ALL option reports both the combined CPU statistics and separate values for each logical CPU. The final argument sets the reporting interval to one second.

Example output may look like this:

Linux 6.x.x (server)    09/05/2026    _x86_64_    (4 CPU)
20:15:01  CPU  %usr  %nice  %sys  %iowait  %irq  %soft  %steal  %idle
20:15:02  all  18.2   0.0    4.1      0.5    0.0    0.4     0.0    76.8
20:15:02    0  61.0   0.0    5.0      0.0    0.0    1.0     0.0    33.0
20:15:02    1   4.0   0.0    3.0      1.0    0.0    0.0     0.0    92.0
20:15:02    2   5.0   0.0    4.0      1.0    0.0    0.0     0.0    90.0
20:15:02    3   3.0   0.0    4.0      0.0    0.0    0.0     0.0    93.0


In this example, the combined CPU utilization is relatively low, but CPU 0 is considerably busier than the others. This pattern can occur with workloads that do not distribute processing evenly across available CPUs.

For a quick CPU check, the most relevant columns are %usr, %sys, %iowait, %steal, and %idle. They represent the same general categories discussed earlier, so there is no need to interpret every field separately each time you use mpstat.

If the command is not available, install the sysstat package using your distribution's package manager.



Find Processes Using High CPU with ps


ps is useful when you want a quick snapshot of the processes consuming CPU without opening an interactive monitoring tool. You can sort the process list by CPU usage directly from the command line.

Run:

ps -eo pid,ppid,comm,%cpu,%mem --sort=-%cpu | head

The command displays the process ID (PID), parent process ID (PPID), command name, CPU usage, and memory usage. --sort=-%cpu places processes with the highest reported CPU usage first, while head limits the output to ten lines, including the header.

For example:

PID    PPID  COMMAND    %CPU %MEM
2841   1     php-fpm    72.4  3.8
1732   1     mysqld     18.7  8.2
3015   2950  nginx      2.1  0.4


This output shows which processes have the highest %CPU values reported by ps. Unlike top or htop, however, ps does not continuously refresh the values on screen. If CPU load changes quickly, use an interactive or interval-based tool to observe the system over time rather than relying on a single snapshot.



Monitor CPU Usage Over Time with vmstat


A single CPU reading can be misleading when system activity changes quickly. The vmstat command reports system statistics at regular intervals, making it useful for determining whether CPU utilization remains elevated or returns to normal after a short spike.

Run:

vmstat 1

The value 1 tells vmstat to print a new report every second. CPU statistics appear in the cpu section of the output:

procs -----------memory---------- ---swap-- -----io---- -system-- ------cpu-----
r  b   swpd   free   buff  cache   si   so    bi    bo   in   cs us sy id wa st
1  0      0 412680  84520 912340    0    0    12    18  210  390 12  3 84  1  0
2  0      0 408920  84520 913110    0    0     0    24  480  720 68  5 26  1  0
1  0      0 410140  84520 913240    0    0     0     8  260  430 15  3 82  0  0


For CPU monitoring, focus primarily on the us, sy, id, wa, and st columns. Watching several consecutive samples helps distinguish a temporary burst of activity from sustained utilization.

The first report from vmstat shows averages since the last boot. When checking current CPU behavior, use the subsequent interval-based reports for comparison.



Check Load Average Alongside CPU Usage


CPU utilization and load average describe different aspects of system activity, so checking both can provide a more accurate picture of what is happening on a busy Linux server.

To view the current load average, run:

uptime

A typical result looks like this:

20:21:14 up 12 days,  4:37,  1 user,  load average: 1.42, 1.18, 0.96


The three values represent the system load averaged over approximately the last 1, 5, and 15 minutes. They should be interpreted in relation to the number of logical CPUs available to the system rather than treated as percentages.

High load average does not necessarily mean that the CPUs are fully utilized. Linux load also includes tasks in uninterruptible sleep, which are commonly waiting for I/O. This is why a server can show elevated load while CPU utilization remains moderate.

If load remains high and the server becomes slow or unresponsive, the next step is to determine what is keeping tasks runnable or waiting. See our guide to fix Linux VPS freezes caused by high load average for a dedicated troubleshooting workflow.



How to Identify High CPU Usage in Linux


A high CPU percentage alone does not identify the source of a performance problem. The next step is to determine whether the utilization is temporary or sustained, identify which processes are responsible, and check whether another resource is contributing to the slowdown.


Check Whether CPU Usage Is Sustained or Temporary


Short CPU spikes are normal on active systems. Package updates, scheduled jobs, backups, application requests, compression tasks, and other workloads can briefly consume substantial processing time without indicating a problem.

Use top, htop, or an interval-based command such as vmstat to observe the system across multiple samples. If CPU utilization drops quickly and the server remains responsive, the spike may require no action. Consistently low idle time over a longer period deserves closer investigation, especially when application performance begins to degrade.


Identify Whether One Process or the Entire System Is Affected


If CPU usage stays high, check the process list to determine where the processing time is going. A single process remaining at the top of top, htop, or a CPU-sorted ps output points to a different problem than many processes competing for CPU simultaneously.

Per-CPU statistics can add another clue. If mpstat -P ALL 1 shows one logical CPU close to full utilization while others remain mostly idle, the workload may not be distributing work evenly. When most available CPUs remain busy at the same time, the system is experiencing broader CPU demand.

For legitimate workloads that consistently use the available processing capacity, the server may eventually need more compute resources. Workloads with sustained CPU demand can benefit from a High Performance VPS, but additional CPU capacity should not be used to mask a misbehaving process or application.


Check for I/O Wait and CPU Steal Time


Poor server responsiveness does not always mean that applications are exhausting the CPU. Before treating the problem as CPU saturation, check %iowait and, on virtual machines, %steal.

Elevated I/O wait indicates that tasks are spending time waiting for I/O operations, so storage performance or another I/O bottleneck may require investigation. Sustained steal time means the virtual machine is waiting for physical CPU time that the hypervisor is allocating elsewhere.

This distinction matters because adding CPU resources does not address every performance problem. The CPU metrics should point to actual processor contention before high CPU utilization is treated as the root cause.



What to Do If CPU Usage Stays High


If CPU utilization remains high across multiple samples, first identify which processes are responsible and determine whether the workload is expected. A busy application performing legitimate work requires a different response from a process consuming CPU because of a configuration problem, software error, or runaway task.

Compare process-level CPU usage with per-CPU statistics and check whether high %iowait or %steal points to a different bottleneck. Avoid terminating processes solely because they briefly appear at the top of top or htop; confirm that the utilization is persistent and understand the role of the process before taking action.

Once you have confirmed that CPU utilization itself is the problem, see how to troubleshoot high CPU usage on a Linux VPS and choose the appropriate corrective action.



Conclusion


Checking CPU usage is most useful when the numbers are interpreted in context. Overall utilization can show whether processing capacity is busy, while per-CPU and process-level statistics reveal how that demand is distributed.

A high reading by itself does not establish the cause of a performance problem. Confirm that CPU demand persists, identify where the processing time is going, and distinguish actual CPU contention from I/O wait, steal time, or elevated system load before deciding what needs to be changed.

FAQ

The most frequently asked questions!

  • What Is Normal CPU Usage in Linux?

    • There is no single CPU utilization percentage that is considered normal for every Linux system. Expected usage depends on the workload, available CPU resources, and how long the utilization remains elevated.

      Brief periods of high CPU activity are common and do not necessarily indicate a problem. Sustained utilization becomes more important when there is little idle CPU capacity and applications begin to respond slowly or compete for processing time.

  • Can a Linux Process Use More Than 100% CPU?

    • Yes. On a multi-core or multi-threaded system, some Linux monitoring tools can report process CPU usage above 100%. A multi-threaded process may execute on more than one logical CPU at the same time.

      For example, a process using the equivalent of two logical CPUs at full capacity may be reported as approximately 200% CPU. The exact presentation depends on the monitoring tool and its CPU accounting settings.

  • Why Does CPU Usage Differ Between top and ps?

    • top and ps do not calculate and present process CPU usage in exactly the same way. top continuously samples process activity and updates the displayed values, making it useful for observing current changes in CPU consumption.

      The %CPU value reported by ps is based on CPU time used over the process lifetime relative to its elapsed running time. As a result, a process experiencing a recent CPU spike can show different percentages in top and ps. For rapidly changing workloads, compare several samples rather than expecting both commands to display identical values.