High CPU usage: quick diagnostics

Quick answer: Run top, press P and read the top three processes — that identifies the culprit in seconds. Compare load average to your CPU core count to judge severity, then decide: runaway process (restart it), traffic spike (cache/scale) or a stuck job (kill it). For root-cause work, see the full deep dive.

Overview

This is the incident checklist for "the server is suddenly slow / fans are spinning": identify, stabilize, then investigate. The detailed tuning guide lives in the VPS category.

Before you start

• SSH access; if the server is too loaded to accept logins, use the KVM Console.

Step-by-step guide

1. Snapshot the situation:

   uptime
   top -bn1 | head -20

   Load average above the number of vCPU cores means real queueing (2 cores + load 8 = saturated).
2. Identify the top consumers in top (P sorts by CPU). Typical culprits: php-fpm, mysqld, a backup job, a stuck script.
3. Check for I/O wait masquerading as CPU load — a high wa value in top means the disk, not the CPU, is the bottleneck.
4. Stabilize: restart a leaking service (sudo systemctl restart php8.3-fpm), kill a runaway process (kill PID), or pause the offending cron job.
5. If the load is legitimate traffic, enable caching and consider a plan upgrade; sustained 100% on all cores is a sizing signal, not a bug.

Common issues

• Malware/cryptominers: unknown process names using full CPU — verify with the compromise checklist.
• WordPress cron storms or bots: the access log shows the pattern — rate-limit or cache.
• Backup jobs at peak hours: reschedule to the quietest window.

When to contact support

If CPU stays pinned with no visible process consuming it, or performance dropped sharply without any load change on your side, open a ticket with the outputs of uptime and top -bn1 and the time window.

Frequently asked questions

What load average is too high for my VPS?

Compare it to your vCPU count: load equal to the core count means full utilization, noticeably above it means queueing. A 4-core VPS at load 4 is busy; at load 12 it is saturated.

An unknown process is consuming all CPU — what should I do?

Treat it as a possible compromise: check the binary path, the owning user and network connections before killing it, and follow the hacked-server checklist if anything looks foreign.

Related articles

• How to troubleshoot high CPU load
• High RAM usage: quick diagnostics
• Slow website troubleshooting
• How to collect logs for support

Need a hand? Contact Cloud2Y support →