How to Check Linux CPU Usage or Utilization (5 Ways)

Is your Linux server slowing down? CPU usage is often the reason.

Monitoring CPU performance helps you spot issues early, prevent slowdowns, and optimize your server for smoother performance.

This guide walks you through practical ways to check CPU usage in Linux – from essential commands like top and mpstat to visual monitoring with RunCloud.

Let’s dive right in!

What Causes High CPU Utilization?

If you have been running your server for a long time, several services might be running on it. Short CPU spikes are normal during heavy tasks like database queries or backups.

But constant high CPU usage usually means a deeper issue – such as inefficient code, unoptimized plugins, or too many concurrent PHP or Python processes.

Poor caching and malware (like cryptominers) can also push CPU utilization to dangerous levels.

Content management systems such as WordPress might also strain the CPU when plugins or themes are poorly coded or when caching isn’t properly implemented.

Malicious activities can also significantly increase CPU usage. Cryptojacking malware, which hijacks system resources to mine cryptocurrency, is an increasingly common cause of high CPU utilization. Similarly, DDoS attacks or brute-force attempts can flood servers with requests, forcing the CPU to process an overwhelming amount of traffic. 

Sometimes, normal maintenance tasks can lead to temporary CPU spikes. Activities like system backups, virus scans, or package updates typically demand more processing power. However, scheduling these tasks during off-peak hours and properly configuring their resource usage can help minimize their impact on system performance. 

Detecting a Runaway Process in Linux

Run top or htop and look for any process using nearly 100% CPU with a rapidly increasing TIME+ value.

This is usually a runaway process. Stop it using its PID to free up system resources.For a runaway process, the TIME+ value will be unusually high and will increase rapidly, which indicates it is actively and continuously churning through CPU cycles without end. If you find a runaway process, then you can consider killing the process via CLI to free up system resources.

Identifying a DoS Attack on Your Server

If you get an abnormally high number of network connections, especially to your web ports (80 and 443), then it is a good indication that you are under attack. You can use some advanced commands like netstat -an | grep ESTABLISHED | wc -l to view a sudden and massive spike in connections.If you suspect that you are under attack, then you should go ahead and block unwanted traffic using Fail2Ban and consider implementing zero-trust logins for your applications.

Suggested read: Best nine htop Alternatives for Linux, Mac & Windows in 2024 

How to Check High CPU Utilization on Linux?

There are several ways to track CPU usage on your Linux system. Let’s look at a few of the most common methods.

Method 1: Check CPU Usage with the ‘top’ Command

The top command is one of the most fundamental and widely used tools for real-time system monitoring in Linux. It provides a dynamic view of system performance, showing processes sorted by CPU usage, memory consumption, and other resources. You can run it on your computer by executing the following command in your shell:

top

By default, the top updates every 3 seconds and displays essential information such as load averages, task statistics, and CPU states. Users can interact with the display using keyboard shortcuts, including ‘P’ to sort by CPU usage, ‘M’ for memory usage, and ‘k’ to kill processes directly from the interface.

Suggested read: How to Check Running Processes in Linux Using ps, top, htop, and atop Commands 

Method 2: Monitor CPU Usage with the RunCloud Server Monitoring

RunCloud has a built-in server monitoring functionality that provides a user-friendly, visual approach to tracking CPU utilization. You can view it by simply navigating to the “Monitoring” section of your server settings in the RunCloud dashboard.

The dashboard displays historical CPU usage patterns through intuitive graphs, making it easier to identify trends and anomalies. You can also configure alerts for when CPU usage exceeds defined thresholds, and it provides detailed metrics about individual processes and system resources.

Unlike command-line tools, RunCloud’s monitoring solution retains historical data and provides insights without requiring constant terminal access.

In Linux systems, CPU load represents the average number of processes that are either currently executing or waiting for system resources (CPU, disk I/O, etc.) over a specific time period. Unlike CPU usage percentage, which shows immediate processor utilization, the load average gives you a broader view of system demand over time.

A load average of 1.0 on a single-core system means the CPU is exactly at capacity, while on a quad-core system, a load of 4.0 would represent full capacity. When the load average exceeds the number of CPU cores, it indicates that processes are competing for resources and may need to wait their turn, potentially causing system slowdown.

For example, if a quad-core system shows a load average of 8.0, it means the system is overloaded with twice as many processes as it can handle efficiently, leading to degraded performance.

Suggested read: How to Find Most Used Disk Space Directories and Files in Linux 

Method 3: Monitor CPU Usage with the ‘mpstat’ Command

The mpstat command is part of the sysstat package, and provides CPU statistics for each available processor. This tool is particularly valuable for multi-core systems as it shows per-processor utilization, including user time, system time, idle time, and I/O wait time. You can view your CPU usage statistics by running the following command:

mpstat

System administrators can use options like mpstat -P ALL 2 5 to display statistics for all processors, updating every 2 seconds for 5 iterations, helping identify potential CPU core imbalances.

Suggested read: What are Linux Logs? What Are They & How To Use Them 

Method 4: Use the ‘sar’ Command to Check CPU Usage

The System Activity Reporter (sar) command is a powerful tool for collecting, reporting, and storing system activity information. It can display historical CPU performance data and create detailed reports about system resource usage. The sar command can show CPU utilization data from the current day or from stored system activity files, which makes it invaluable for analyzing performance trends over time.

You can execute the following command to see the CPU usage history on your computer:

sar

In the above example, we can see that each row provides a snapshot of the CPU utilization metrics in 10-minute increments. If you want to customize the output, then you can pass the appropriate flags as the input. For example, sar -u 2 5 shows CPU usage updated every 2 seconds for 5 iterations.

Suggested read: Mastering the Echo Command in Linux (with Practical Examples) 

Method 5: Check CPU Usage with the ‘iostat’ Command

The iostat command provides CPU statistics and input/output statistics for devices and partitions. While it is primarily known for I/O monitoring, it also offers CPU reporting capabilities, which include breakdowns of user time, system time, idle time, and I/O wait time.

You can run the following command to view your CPU usage activity:

iostat

This command is particularly useful when investigating whether high CPU usage is related to disk I/O operations, and you can customize the output of this command according to your needs: options like iostat -c focus specifically on CPU statistics, while iostat -x provides extended statistics.

Suggested read: Using Dynatrace to Monitor RunCloud Servers 

Method 6: Monitor CPU Usage with the ‘vmstat’ Command

The Virtual Memory Statistics (vmstat) command offers a concise view of system performance, including CPU usage, memory, swap space, and I/O statistics. It’s especially useful for identifying bottlenecks affecting CPU performance, such as memory constraints or excessive swapping. You can use this command by executing the following code snippet in your terminal:

vmstat

You can also use some additional command-line arguments to modify its behavior. For example, running vmstat with a delay value (e.g., vmstat 2) provides continuous monitoring and shows how CPU usage changes over time. Its compact output format makes it ideal for quick system health checks and monitoring trends in real time.

Suggested read: How To Monitor Your Web App’s RAM & CPU Usage with Netdata

Wrapping Up

Monitoring CPU usage helps you prevent slowdowns and keep your server running efficiently. While Linux commands like top and sar are powerful, RunCloud makes performance tracking easier with visual insights and automated alerts.

While command-line tools are incredibly powerful for deep-dive, real-time diagnostics, they require you to be actively logged into the server via SSH. They don’t easily reveal trends over time or provide a simple “is everything okay?” status check.

This is why RunCloud provides a Server Monitoring dashboard to get high-level oversight. RunCloud gives you a visual dashboard showing CPU, memory, and disk usage in one place.

You can view historical data, identify spikes, and set alerts for high CPU usage – no SSH access required.

On this screen, you can instantly assess the core vitals of your server:

• Load: Immediately see your server’s current workload without needing to interpret the 1, 5, and 15-minute averages. 
• Memory Usage: A simple percentage shows how much RAM is in use, letting you know if you’re approaching a memory bottleneck.
• Disk Usage: Quickly check if you’re running out of storage space.
• Top Processes: RunCloud automatically surfaces the most resource-intensive processes, and saves you the manual effort of scanning through the top command’s list to find the culprit behind a CPU spike.
• Slow [Database] Queries: For web applications, this is a game-changer. RunCloud can pinpoint the exact database queries that are slowing down your entire site, a task that is notoriously difficult with standard CLI tools.
• Automated Alerting: RunCloud can be configured to send you an alert via Slack, Telegram, or email the moment your CPU usage crosses a critical threshold (e.g., >80% for 5 minutes).

Start your free RunCloud trial today and see your server’s performance at a glance – no command line required.

FAQs on Linux CPU Usage