Linux Get CPU Usage: top, mpstat, and /proc/stat

Q: How do I find which thread is using CPU?

`top -H` shows threads instead of processes. The team that has a multi-threaded app finds the hot thread this way. Useful for Java apps with many threads.

Q: Can I get CPU usage from a script?

Yes - parse `/proc/stat` and calculate deltas. Or use `ps` for instantaneous per-process. The team that monitors CPU usage over time uses Prometheus node_exporter or similar.

Getting CPU usage on Linux has three tools for three questions: top for ‘who is using CPU right now and what’s the system average?’, mpstat 1 for ‘per-CPU breakdown’, and cat /proc/stat for raw counters that monitoring tools parse. The team that uses the right tool based on the question gets the answer in seconds.

top: the canonical tool
mpstat: per-CPU breakdown
Raw counters from /proc/stat
Per-process with ps
Time-series with sar
FAQ

top: the canonical tool

top

Press 1 to see per-CPU breakdown. Press P to sort by CPU. Press q to quit.

The header line %Cpu(s): shows user, system, idle, iowait, steal, etc. The process list shows per-process CPU%. The team that uses top has the answer to ‘who is using CPU right now?‘

mpstat: per-CPU breakdown

mpstat -P ALL 1

Refreshes every 1 second. Shows each CPU core separately. The team that has a single-threaded bottleneck sees one core at 100% and the others idle.

For a 5-second snapshot:

mpstat -P ALL 5 1

The 5 is the interval, the 1 is the count.

Raw counters from /proc/stat

cat /proc/stat | head -1

The first line:

cpu  3357 0 4313 1362393 23 0 11 0 0 0

These are jiffies (1/100 second each on most systems):

user: Normal programs running in user mode.
nice: Niced user processes.
system: Kernel mode.
idle: Doing nothing.
iowait: Waiting for IO.
irq, softirq: Hardware/software interrupts.
steal: Stolen by hypervisor (cloud).
guest, guest_nice: Time spent running virtual CPUs.

The team that parses this file (Prometheus node_exporter, collectd) gets time-series CPU usage.

Per-process with ps

ps -eo pid,user,pcpu,pmem,comm --sort=-pcpu | head -20

Shows top 20 processes by CPU%. The team that uses this in a script gets the same info as top without the interactive UI.

Time-series with sar

sar -u 1 60

Samples CPU usage every 1 second for 60 seconds. Shows past data if sysstat is configured to log. The team that uses sar for historical analysis sees CPU usage over hours/days.

FAQ

What’s the difference between top and htop?

htop is a better-looking top with mouse support and per-CPU bars by default. The team that has htop installed uses it instead of top. Both answer the same question.

Why is my CPU usage high in top but normal in /proc/stat?

top shows instantaneous usage. /proc/stat is cumulative counters. The team that compares both gets the rate from the cumulative counters (delta over time) and matches top.

What is steal time?

Time the hypervisor gave to other VMs. High steal time (>10%) means the cloud host is oversubscribed. The team that sees this should consider a different instance type or a less crowded region.

How do I find which thread is using CPU?

top -H shows threads instead of processes. The team that has a multi-threaded app finds the hot thread this way. Useful for Java apps with many threads.

Can I get CPU usage from a script?

Yes - parse /proc/stat and calculate deltas. Or use ps for instantaneous per-process. The team that monitors CPU usage over time uses Prometheus node_exporter or similar.

If you are sizing the infrastructure for the kind of project this post covers, the RunxBuild hosting calculator is the right place to model the line items. The compute, the memory, the storage, the bandwidth, the database - each one is a separate number, and the team’s mental model for the platform is the sum of those numbers. The RunxBuild dashboard is where the team sees the actual usage in one place.

Useful related references: