All Products
Document Center

The CPU utilization of the Linux is too high but no specific processes can be viewed.

Last Updated: Dec 28, 2020

Disclaimer: This article may contain information about third-party products. Such information is for reference only. Alibaba Cloud does not make any guarantee, express or implied, with respect to the performance and reliability of third-party products, as well as potential impacts of operations on the products.


Problem description

When you run the top command, each application consumes few CPU resources, but consumes many CPU resources. In this case, you cannot locate the processes that consume CPU resources.



Alibaba Cloud reminds you that:

  • Before you perform operations that may cause risks, such as modifying instance configurations or data, we recommend that you check the disaster recovery and fault tolerance capabilities of the instances to ensure data security.
  • You can modify the configurations and data of instances including but not limited to Elastic Compute Service (ECS) and Relational Database Service (RDS) instances. Before the modification, we recommend that you create snapshots or enable RDS log backup.
  • If you have authorized or submitted sensitive information such as the logon account and password in the Alibaba Cloud Management Console, we recommend that you modify such information in a timely manner.
  1. The ps command failed to identify the specific number of processes.
  2. The user's host was created in 2012, while the ps and top commands detected by the ll command were created in 2015. Therefore, the commands are suspected of being tampered with.
    • The specific creation time is subject to the actual environment.
    • You can run the type or find command to view the files where the ps and top commands are located.
  3. After the backup completes important data, install the htop command. Then run the htop command to view the programs that consume CPU resources.
  4. Through the analysis of the program, it is presumed that the system is poisoned. It is recommended to delete the file and then take security measures.
  5. If some processes are not displayed, run the following command to sort the processes:
    ps H -eo user,pid,ppid,tid,time,%cpu,cmd --sort=%cpu


Application scope

  • ECS