All Products
Search
Document Center

Simple Application Server:Troubleshoot high CPU utilization or high CPU load on a Linux simple application server

Last Updated:Mar 26, 2025

This topic describes how to troubleshoot high CPU utilization or high CPU load on a Linux simple application server. This topic also provides common cases.

Scenarios

When the CPU utilization or CPU load of your simple application server is constantly high, you can perform the following steps to troubleshoot the issue:

  1. Find the process that causes the high CPU utilization or high CPU load.

  2. Check whether the process that causes the high CPU utilization or high CPU load is working as expected, and classify the potential causes for troubleshooting.

    • If the process is working as expected, you must optimize the application or upgrade the simple application server. For more information, see Upgrade a simple application server.

    • If the process is not working as expected, you can manually check and terminate the process or use a third-party security tool to check and terminate the process.

Query and analyze CPU loads

In a Linux system, you can run the following commands to view processes. This topic describes only the vmstat (stands for VirtualMemoryStatistics) and top commands.

  • vmstat

  • top

  • ps -aux

  • ps -ef

Use of the vmstat command

Run the vmstat command to view the overall statistics about virtual memory, processes, and CPUs in the operating system.

Command syntax

The following code shows the syntax of the vmstat command:

vmstat [-n] [delay [count]] 
Note
  • [-n]: specifies that the header is displayed only once.

  • [delay]: specifies the refresh interval. If you do not specify this parameter, only one result is displayed.

  • [count]: specifies the number of refreshes. If you do not specify the number of refreshes but specify the refresh interval, the number of refreshes is unlimited.

Example

Run the following vmstat command to collect statistics about the CPU utilization of each process every 1 second for four times:

vmstat -n 1 4

Sample output:

procs -----------memory---------- ---swap-- -----io---- -system-- ------cpu-----
 r  b   swpd   free   buff  cache   si   so    bi    bo   in   cs us sy id wa st
 1  0      0 2684984 310452 2364304    0    0     5    17   19   35  4  2 94  0  0
 0  0      0 2687504 310452 2362268    0    0     0   252 1942 4326  5  2 93  0  0
 0  0      0 2687356 310460 2362252    0    0     0    68 1891 4449  3  2 95  0  0
 0  0      0 2687252 310460 2362256    0    0     0     0 1906 4616  4  1 95  0  0

Fields in the command output:

  • r: indicates the number of threads waiting to be processed by the CPU. A CPU can process only one thread at a time. A larger value indicates that the system runs slower.

  • us: indicates the percentage of CPU time consumed in user mode. A larger value indicates that more CPU time is consumed by a user process. If the value exceeds 50% for an extended period of time, you must optimize the program algorithm or code.

  • sy: indicates the percentage of CPU time consumed in kernel mode.

  • wa: indicates the percentage of CPU time spent waiting for I/O operations to complete. If the value is high, the system experiences significant I/O waits. This may be caused by extensive random access to disks or a bottleneck in disk performance.

  • id: indicates the percentage of idle CPU time. If the value of this parameter remains 0 and the value of the sy parameter is twice the value of the us parameter, the CPU resources in the system are insufficient.

Use of the top command

The top command is a common performance analytics tool in Linux. The command can display the resource usage of each process in the system in real time.

Command syntax

top [-n] [-d] 
Note
  • [-n]: specifies that the header is displayed only once.

  • [delay]: specifies the refresh interval. If you do not specify this parameter, only one result is displayed.

  • [count]: specifies the number of refreshes. If you do not specify the number of refreshes but specify the refresh interval, the number of refreshes is unlimited.

Example

  1. Remotely connect to the Linux simple application server. For more information, see Connect to a Linux server.

  2. Run the following command to view the resource usage of each process in the system.

    The command collects statistics about the resource usage of each process every 2 seconds for five times.

    top -n 5 -d 2

    Sample output:

    top - 17:27:13 up 27 days,  3:13,  1 user,  load average: 0.02, 0.03, 0.05
    Tasks:  94 total,   1 running,  93 sleeping,   0 stopped,   0 zombie
    %Cpu(s):  0.3 us,  0.1 sy,  0.0 ni, 99.5 id,  0.0 wa,  0.0 hi,  0.0 si,  0.1 st
    KiB Mem:   1016656 total,   946628 used,    70028 free,   169536 buffers
    KiB Swap:        0 total,        0 used,        0 free.   448644 cached Mem
    PID USER      PR  NI    VIRT    RES    SHR S %CPU %MEM     TIME+ COMMAND
    1 root        20   0   41412   3824   2308 S  0.0  0.4   0:19.01 systemd
    2 root        20   0       0      0      0 S  0.0  0.0   0:00.04 kthreadd

    Fields in the command output:

    For CPU utilization and CPU load issues, you need to only focus on the first and third lines of the command output.

    • On the first line, 17:27:13 up 27 days, 3:13, 1 user, load average: 0.02, 0.03, 0.05 is displayed, which indicates the current system time, the system uptime, the number of logon users, and the system load.

    • On the third line, the overall usage of current CPU resources is displayed. The resource usage of each process is displayed below the line.

  3. When the top command runs, you can press the following keys to adjust the command output:

    • Press the P key to sort processes in descending order of CPU utilization. This way, you can quickly find the processes that consume a large amount of CPU resources in the system.

    • Press the M key to sort processes by memory usage. If a CPU has multiple cores, press the 1 key to display the load status of each CPU core.

  4. Run the ll /proc/PID/exe command to view the program file that corresponds to each process ID (PID).

  5. Terminate the processes that consume a large amount of CPU resources.

    1. Enter k.

    2. Enter the PID of the process that you want to terminate and press the Enter key.

      The default PID is the first PID in the command output. If you want to terminate the process whose PID is 23, enter 23 and press the Enter key, as shown in the following figure.

      image

    3. After the operation is complete, a message similar to Send pid 23 signal [15/sigterm] appears. Press the Enter key to confirm.

      image

Analysis of common cases of high CPU utilization

Case 1: The CPU utilization is low but the CPU load is high

Problem description

No business programs are running on a Linux ECS instance. The top command shows that the CPU utilization is low, but the CPU load (load average) is high, as shown in the following figure.

image

Cause

A large number of zombie processes exist in the system.

The load average is used to evaluate the CPU load. A higher value indicates a longer task queue and more tasks waiting to be executed.

Solution

Use the ps -axjf command to check whether the system has processes in the D+ state, which is an uninterruptible sleep state.

Processes in this state cannot be terminated or automatically exit. To resolve the issue that the system has processes in the D+ state, you can restore the dependency resources of the processes or restart the system.

image

Case 2: The kswapd0 process consumes a large amount of CPU resources

Problem description

Your simple application server stutters. You run the top command to find that the kswapd0 process occupies 99% CPU load.

image

Causes

Constant page changing by the system causes the consumption of a large amount of CPU resources.

Kswapd0 is a page-changing process in virtual memory management. When your server is out of memory, kswapd0 performs a page-changing operation, which consumes a lot of CPU resources.

Solutions

Modify the vm.swappiness kernel parameter to control the size of the swap space.

  1. Connect to the Linux instance. For more information, see Connect to a Linux server.

  2. View the swappiness parameter.

    cat /proc/sys/vm/swappiness

    A command output similar to the command output in the following figure is returned. In this example, the returned value is 40, which indicates that the swap space is used when less than 60% of physical memory is available.

    Note

    A smaller swappiness value indicates that the kernel uses less swap space and more physical memory. A larger swappiness value indicates that the kernel uses more swap space and less physical memory.

    image

  3. Modify the swappiness parameter based on your business requirements.

    1. Open the kernel parameter configuration file named sysctl.conf.

      vi /etc/sysctl.conf
    2. Modify the swappiness parameter based on your business requirements.

      For example, configure vm.swappiness = 10 in the sysctl.conf configuration file.

    3. Press the Esc key and enter :wq to save the changes and exit the file.

    4. Reload the sysctl configuration file to make the configuration take effect.

      sysctl -p

      If this issue persists, we recommend that you upgrade the specifications of the simple application server. For more information, see Upgrade a simple application server.

Case 3: Troubleshoot the issue of 100% CPU utilization

Problem description

You find the CPU utilization reaches 100% when you use your simple application server, and you cannot use the top or htop command to query the specific process that consumes most of the CPU resources.

Cause

The issue may be caused by a virus.

Solutions

  1. View the time when the CPU utilization of the simple application server reached 100%. For more information, see View the monitoring information of a simple application server.

  2. View the command modification records of the Linux simple application server.

    1. Use the rescue feature to log on to the Linux simple application server. For more information, see Connect to a simple application server by using the rescue feature.

    2. Run the following command to check whether the commands of the Linux system were recently modified:

      stat /usr/bin/top

      If a command output similar to the command output in the following figure is returned, the system has commands that were modified. Check whether the points in time at which the commands were modified are consistent with the points in time at which the CPU utilization was 100%.

      image

  3. Run the following commands to check whether the ps and top commands were modified:

    rpm -Vf /bin/ps
    rpm -Vf /usr/bin/top
    • If the instance runs as expected, no modification information is returned.

    • If an exception occurs on the instance, a command output similar to the command output in the following figure may be returned. The command output indicates that the ps and top commands were modified.

      image

  4. Run the following command to check whether the IP address of the current instance is resolved to an invalid domain name:

    iftop -i [$Device] -n -P
    Note

    Replace [$Device] with the network interface controller (NIC) used by the current system, such as eth0.

    The following output is returned. If you did not connect to crypto-pool.fr, crypto-pool.fr is invalid.

    image

  5. Use the following solution to troubleshoot the issue if the top or ps command is modified and the IP address of the current instance is resolved to an invalid domain name (This means that your simple application server is infected with a virus):

    1. Back up the data of your simple application server. For more information, see Create a snapshot.

    2. Re-initialize the system disk and then use Security Center to perform security hardening on your simple application server. For more information, see Reset a simple application server and What is Security Center?