All new Registrations are manually reviewed and approved, so a short delay after registration may occur before your account becomes active.
Why are monitoring software incorrectly reporting my CPU usage?
Hi everyone, I’m new to Linux and VPS.
Recently, several of my VPS's instances, both new ones and older ones I’ve had for about a year, have been showing 100% CPU usage in tools like btop, Beszel, Komari. After a reboot, the CPU usage looks normal for a short time, then jumps back to 100%.
The control panel shows only a small percentage of CPU usage, and I don’t see any processes actually consuming CPU. Even if I kill all non‑root users, the monitoring tools still report full usage.
This has been going on for about a month, and none of my VPS's have been suspended. They are installed from default template or mounted Debian 13 ISO, running 6.12.48+deb13-cloud-amd64, if that’s relevant.
On all VPS's with this, my user can run sudo without a password. I’m 100% sure I never set that up in visudo, and the file hasn’t been touched.
PID USER %CPU %MEM COMMAND COMMAND
4873 ams 300 0.4 ps ps -eo pid,user,pcpu,pmem,comm,args --sort=-pcpu
1452 root 1.9 0.8 gluetun-entrypo /gluetun-entrypoint
568 root 1.7 4.5 netbird /usr/bin/netbird service run --log-level info --daemon-addr unix:///var/run/netbird.sock --log-file /var/log/netbird/client.log
2137 root 1.5 0.6 nginx nginx: worker process
566 root 1.4 0.9 agent /opt/komari/agent
45 root 1.2 0.0 kswapd0 [kswapd0]
2119 root 0.8 0.3 node node --abort_on_uncaught_exception --max_old_space_size=250 index.js
11 root 0.5 0.0 kworker/0:1-wg- [kworker/0:1-wg-crypt-wt0]
725 root 0.4 2.3 dockerd /usr/bin/dockerd -H fd:// --containerd=/run/containerd/containerd.sock
170 root 0.4 0.0 kworker/0:2-wg- [kworker/0:2-wg-crypt-wt0]
288 root 0.3 0.0 kworker/0:3-wg- [kworker/0:3-wg-crypt-wt0]
17 root 0.3 0.0 ksoftirqd/0 [ksoftirqd/0]
1 root 0.3 0.2 systemd /sbin/init
9 root 0.3 0.0 kworker/0:0-wg- [kworker/0:0-wg-crypt-wt0]
373 root 0.2 0.0 kworker/0:4-wg- [kworker/0:4-wg-crypt-wt0]
1556 root 0.2 0.0 napi/wt0-0 [napi/wt0-0]
584 root 0.2 1.8 containerd /usr/bin/containerd
I’ve never seen this before. This only started about a month ago. Does anyone know what might cause these tools to report CPU usage incorrectly? htop and top seem to be working fine.
Thanks in advance.
Comments
Sounds like your server was infected with some stealth miner tbh
The provider's control panel will be looking at CPU usage, as it appears to the hypervisor on the node your VPS is running on.
Running ps / top / whatever will be looking at CPU usage in terms of what your VPS can see.
First of all, how this is presented can be confusing as well. 100% CPU in most Linux tools means 100% of one CPU thread. So if you have a 4 vCPU VPS, top would report 400% CPU when maxed out, and your control panel will probably only display 100% use in that case.
Secondly, if the node your VPS is on is very busy, it might appear to your VPS that you're using 100% CPU because as far as it's concerned, it's always doing work and never switches to the idle thread, but from the node's perspective you might be using little of the CPU because it's trying to schedule so many other VPS's threads at the same time.
Often, the easiest way of seeing this is by looking at the steal figure, but that isn't always accurate because hosts can fake that number to make themselves look better.
Long story short - if the provider's control panel is showing significantly less CPU than you can see locally, you don't need to worry about it, as long as you keep within whatever limits are in the AUP/TOS.
I agree, but there’s clearly something going on. It’s happening recently on several VPS's from different providers and control panels. The part that concerns me is that my monitoring tools aren’t reliable now, so I might overlook it when a VPS is actually under heavy load.
I feel like the problem is probably something I did, not the provider or the VPS.
What's the load average?
What I usually do is monitor "idle time" on my monitoring system; it usually gives me a good indication if there is (heavy) load and makes things comparable through time. In Linux you have several "types" of CPU usage you can monitor but they all have there pro's and cons in my opinion, and although not ideal, I've got best experience (monitoring wise) with "idle time".