When CPU usage and disk writes spike together on a Linux VPS, do not assume the CPU is the cause. A process may be doing heavy computation, waiting for storage, being delayed by a busy host, or paging memory to disk. CPU utilization, load average, I/O wait, device latency, per-process writes and Linux Pressure Stall Information (PSI) describe different parts of that event.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
The reliable approach is to capture those signals during the same spike, identify the device and process involved, correlate the timestamp with service logs and scheduled jobs, and only then change the workload. The command set below separates execution from waiting, shows which task is writing, and provides evidence when a virtual disk may be throttled by the provider.
As an Amazon Associate I earn from qualifying purchases.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →What a CPU-and-disk spike can actually mean
A VPS can show high CPU and high disk activity for several unrelated reasons. A database checkpoint may consume CPU while flushing data. Swap activity may make a memory shortage look like a storage problem. A backup can generate large writes while the application remains mostly idle. Conversely, a virtual disk can be saturated or throttled, leaving processes blocked while CPU execution stays modest.
Start by separating four states:
- CPU execution: user time is application work; system time is kernel work such as filesystem and networking operations.
- CPU waiting: iowait is time the CPU was idle because runnable work was waiting for I/O completion. It is not a measurement of disk throughput.
- Host contention: steal time on a virtual machine indicates that the guest wanted CPU time but the hypervisor scheduled another tenant or host task. Guest metrics cannot prove the reason for high steal; the provider must confirm host-side contention.
- Task pressure: load average counts runnable tasks and tasks in uninterruptible sleep. A task blocked on storage can raise load even when CPU utilization is low.
Interpret these values together. Microsoft’s Linux VM guidance describes bottlenecks as relationships among metrics rather than any one utilization number. A device at high utilization with low queue latency can be behaving differently from a device at moderate utilization with very high await time.
#1 Best Overall
- BLUE LIGHT BLOCKING GLASSES: Our blue light glasses for women boast UV400 protection, blocking harmful blue rays from computer screens. With these bluelight glasses women, you can enjoy gaming, reading, or watching TV with no worries of eye strain.
- EYE RELIEF: Our blue light glasses are engineered to reduce blurry vision or strain caused by prolonged screen time. These womens blue light glasses aid in better sleep by preventing blue light from disrupting your natural sleep cycle, helping you fall asleep faster and enjoy a more restful night's sleep, making them the perfect christmas present.
- COMFORTABLE: Crafted from durable material, our trendy blue light glasses for woman or blue light glasses men ensure long-lasting comfort. The high-transmittance lenses accessories, gamer gifts for men, help keep your eyes relaxed. Perfect stocking stuffers, gifts for gamers men, christmas gifts for men, halloween costumes.
- LIGHTWEIGHT: These clear blue light glasses feature a lightweight frame, meaning they’ll stay comfy for long-term wear. Perfect as blue blockers glasses for women or mens blue light glasses, these non-prescription fake glasses for men can be worn throughout the day. The blue light blocking glasses women feature polycarbonate HD lenses, which are anti-reflective and restore true color.
- WORRY-FREE PURCHASE: If you experience any issues, our support team is ready to assist you quickly. These are the perfect costume glasses for cosplay dressing up.
Capture a synchronized snapshot before changing anything
Run a short collection while the spike is occurring. Each command samples a different layer, so run them over overlapping intervals and keep the output with its timestamp.
date -Is
uptime
vmstat 1 10
iostat -xz 1 10
mpstat -P ALL 1 10
pidstat -dur 1 10
sudo iotop -oPa -d 1 -n 10
cat /proc/pressure/cpu
cat /proc/pressure/ioThe first report from vmstat and iostat may represent counters accumulated since boot (or since the counters were initialized), while later lines represent the requested one-second intervals. Use the interval lines to describe the spike. Save standard error as well as standard output; missing privileges or unavailable accounting can otherwise be mistaken for a quiet system.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Microsoft recommends top, htop, mpstat, pidstat and vmstat for CPU investigation, and iostat, iotop and vmstat for disk investigation. The value comes from comparing the readings taken at the same time, not from collecting one command hours after another.
Read CPU, load and memory signals correctly
CPU execution, iowait and steal
Use mpstat -P ALL 1 or top to inspect user, system, iowait, idle and, on virtual machines, steal time. High user or system time with little idle time means the guest is actively executing work. High iowait together with blocked tasks points toward an I/O dependency, but iowait alone does not identify the device or writer. High steal means the guest is waiting for host CPU scheduling and should be discussed with the VPS provider if it persists.
Per-CPU output matters on multi-vCPU plans. One saturated vCPU can be hidden by a low average across many idle vCPUs. Look for a single CPU with high user/system time, or for all CPUs showing steal or iowait during the event.
Load average is not CPU percentage
uptime and top show one-, five- and fifteen-minute load averages. Load includes runnable tasks and tasks in uninterruptible sleep, commonly represented by a blocked I/O state. Therefore, load can rise while CPU execution remains low. Compare the load with CPU idle/iowait, the vmstat blocked count and PSI rather than treating load as a percentage.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Rank #2
- WINDEX GAMING WIPES: effortlessly clean all your gaming gear and gaming electronics in one easy step with our new Windex Gaming Wipes
- AMMONIA FREE: our ammonia-free formula is safe to use on all of your favorite gaming equipment like consoles, headsets, controllers, screens, keyboards, and more
- PRE-MOISTENED WIPES: each wipe instantly removes dust, dirt, and stubborn smudges and fingerprints leaving a streak-free shine
- ANTI-STATIC: great for cleaning and wiping down your gaming gear and electronics leaving behind no visible residue
- COMPACT RESEALABLE PACKAGE: store your pack of Windex Gaming Wipes anywhere in your home for whenever a quick and easy wipedown is needed
What vmstat adds
vmstat reports process, memory, paging, block-I/O, trap and CPU activity. Its b column is the number of processes blocked while waiting for I/O. Rising b alongside high iowait and device await time is stronger evidence of storage-related stalls than any one of those readings alone.
Check the paging columns during a write burst. Rising si (swap in) or so (swap out) indicates pages moving between memory and swap. Confirm with:
free -h
swapon --show
cat /proc/pressure/memoryPaging can create write traffic and latency while the original cause is memory pressure. Do not disable swap or kill a process solely because swap activity appears; first establish which workload is reclaiming memory and whether the event is periodic.
Determine which virtual device is slow or busy
Use iostat -xz for interval device behavior
Run iostat -xz 1 10. The extended report shows per-device read and write rates, request sizes, queue or await times and utilization. Identify the device carrying the VPS filesystem, then compare its interval values during the spike with quiet intervals.
Free tools Windows power users keep installed
One-click scans. No signup required.
- Write rate: how much data the guest is submitting per interval. A high rate can be legitimate workload demand.
- Request size and merge behavior: small random writes and large sequential writes stress storage differently.
- Await and queue time: latency and time spent waiting in the device path. A rising await with a growing queue indicates requests are not completing as quickly as they arrive.
- Utilization: the percentage of time the device had outstanding work. High utilization is a saturation clue, not proof that one process is responsible.
Do not compare an all-time first report with a one-second interval and call the result a spike. Use the subsequent interval lines, and note that virtual block devices may expose only a simplified view of the provider’s physical storage.
Understand kernel counters and merged requests
The kernel exposes block counters through /proc/diskstats and /sys/block/<device>/stat; tools such as iostat and sar commonly read those interfaces. Application write calls, block-layer writes and hardware writes are not interchangeable. The kernel can queue and merge requests before they reach the underlying device, so a per-process total and the device’s current hardware traffic can legitimately differ.
Rank #3
- Ergonomic & Adjustable Design: Fight "text neck" and improve your posture. Designed for comfort, it offers an adjustable height (7.1in-8.5in) (1.4in adjustable range) and angle (5°-85°) Please note: cell phone stand is only 9 inches tall—the length of a standard pencil
- Without blocking subtitles Perfect for office desk Tiktok Face Time Zoom video—this is the ultimate kitchen desk essential for phones! Perfect viewing experience while reducing neck back strain, A must-have for gamers streamers desk, and anyone who values both style and support!
- Sleek & Stable Design fits Otterbox Case: Say goodbye to bent cables, tangles, and tip-overs! LISEN’s stylish adjustable desk phone holder features a built-in charging hole and smart cable management, keeping your phone secure and your workspace clutter-free cool gadgets for men
- ANTI-SLIP DESIGN free hands: The under 10.00 items easy gadgets back and the bottom of this kitchen essentials for women are fully covered by anti-skid silicone, which LISEN stand up desk decor can provide maximum protection device from any scratches and slides
- Your Perfect Viewing Companion:If your product arrives damaged or breaks within 365 days, reach out to LISEN for a quick and hassle-free solution. Struggling with assembly, like tightening the screw? We’ve got your back! Your experience matters to us. (Product including: phone Holder stand*1, screw*1, hexagon screwdriver*1, specification*1)
For a direct inventory of devices and mount points, use commands such as:
lsblk -o NAME,TYPE,SIZE,FSTYPE,MOUNTPOINTS
findmnt -T /path/to/the/affected/fileThese commands help you connect the filesystem used by a service to the device reported by iostat, especially when the VPS uses logical volumes or separate data disks.
Recommended Free Tools
Find the process or thread writing to disk
Scriptable view with pidstat
pidstat -d 1 reports per-task I/O over one-second intervals. Add CPU and memory columns when useful with pidstat -dur 1 10. Look for a task whose write rate rises at the same time as the device and PSI signals. A process with a large cumulative total but a low current rate may simply have written heavily earlier; use the interval columns to find the active writer.
Interactive view with iotop
sudo iotop -oPa -d 1 -n 10 shows an interactive per-process or per-thread view and filters for tasks doing I/O. Run it with sufficient privileges. Its display distinguishes total process-to-kernel I/O from current I/O reaching underlying hardware. Those numbers can differ because requests are queued, buffered or merged.
iotop depends on task and I/O accounting options in the kernel. If accounting is unavailable, the view can be incomplete; treat missing rows as a limitation, not proof that no process is writing.
Inspect the identified PID without altering workload state
Replace PID and UNIT with the values you found:
ps -fp PID
readlink -f /proc/PID/exe
sudo tr ' ' ' ' < /proc/PID/cmdline; echo
sudo lsof -p PID
systemctl status UNIT
journalctl -u UNIT --since '-15 min'ps and /proc reveal the executable and arguments; lsof shows open files; service status and journal entries connect the PID to a managed unit. If the process has multiple threads, use the thread view in pidstat or iotop to see whether one worker is responsible.
Rank #4
- Easy Installation: Our gaming lights have been designed to enhance your entertainment experience. Simply position the led light bar next to your TV or game console to create a game room environment with ease. They come with USB power and a 60 inch cord for direct mounting and mobility
- Audio Syncing & Extensive Mode: The built-in high-sensitivity music sensor allows you to sync the TV led lights to your favorite music. Lights react and move to the beat of music, film and game audio, creating an incredible immersive sound and light experience – and all without the need for an additional hub. You can choose from 64+ patterns, including strobe, illusion, jump, energy, gradient, running, chasing, fluttering mode etc. Each mode can be applied to different scenes
- 64+ Chasing IC+RGB & W Effect: The independent control design of IC+RGB and white all-in-one multifunctional rgbw led bar lights monitor backlight allows you to easily switch the led lights for desk between IC+RGB and white to enjoy a variety of lighting effects, you can choose white lighting mode with high brightness for better illumination when working, etc. Choose IC+RGB lighting mode when you need to create an entertaining atmosphere for the light show, 16 million colours of Color changing rgb light bar let you dance to the beat and create a dynamic party atmosphere
- Dynamic and Dimmable Lights: 1%-full brightness free brightness adjustment gives you the flexibility to adjust dimmable led light bar for room decorations or a variety of occasions
- USB Powered: USB light bars for room can be powered by powernank, usb charger, TV, Monitor, laptop PC mainframe, making behind TV led lighting bar easy to install in any location.TV led lights are powered by the TV usb interface / PC mainframe, can be turned on/off synchronously with TV / PC
Use PSI to confirm that tasks are actually stalled
Linux Pressure Stall Information (PSI) reports time during which work is delayed by CPU, memory or I/O contention. Read:
cat /proc/pressure/cpu
cat /proc/pressure/io
cat /proc/pressure/memoryEach file includes rolling avg10, avg60 and avg300 values. The kernel documentation defines some as the share of time when at least some tasks are stalled on that resource, and full as time when all non-idle tasks are stalled simultaneously.
- Rising CPU
some: runnable work is waiting for CPU time. Correlate with user/system utilization and steal. - Rising I/O
some: at least some tasks are blocked on I/O. Correlate with blocked tasks, await and queue behavior. - Sustained I/O
full: all non-idle tasks are stalled on I/O at the same time; this is a severe saturation signal. - Memory pressure: reclaim or allocation stalls may explain swap and write bursts even when the storage device is not the original cause.
PSI complements device utilization. A device can look busy without delaying the application, while a virtual device with modest guest throughput can still produce substantial I/O pressure if completion latency is high.
Correlate the writer with what it was scheduled to do
After identifying the task, establish why it wrote. The monitoring tools identify the writer; the service’s logs and schedule establish the cause. Match timestamps from the interval output with:
- cron entries and scripts in system-wide and user cron locations;
- systemd timers, listed with
systemctl list-timers --all; - database checkpoints, write-ahead-log or journal flushes, compaction and temporary-file activity;
- backup, snapshot and export jobs, including schedules managed outside the guest by the VPS provider;
- log rotation, compression, package updates and security scans;
- swap-in and swap-out activity caused by memory reclaim.
A periodic spike at the same minute each hour is evidence of scheduling, not necessarily storage failure. A burst that follows a database checkpoint log points to application behavior. A writer that changes when the VPS is moved between hosts, while the workload remains constant, is evidence worth providing to the provider rather than a reason to rewrite the application immediately.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Recognize the common causes
Swap and memory reclaim
When vmstat shows rising si/so, memory PSI rises and the writer is a swap device or memory-intensive process, the immediate issue is reclaim pressure. Check resident memory, configured swap and the service’s cache settings. Reduce the workload or add memory only after confirming which process is consuming it; indiscriminately dropping caches can create another write and read storm.
Best Value
- Compatible with Wide Screens - To ensure compatibility with the dual monitor mount, your each monitor must meet three conditions at the same time: First, computer screens size range: 13 to 32 inches. Second, screen weight range: 4.4 to 19.8 lbs. Third, the back of the monitor screen must have VESA mounting holes with a pitch of 75x75mm or 100x100mm.
- Regarding the compatibility with desks - Your desk must meet three conditions at the same time: First, desk material: Only wooden desks are recommended, plastic or glass desks cannot be used. Second, desk thickness range: 0.59" - 3.54". Third, the bottom of the desk should not have any cross beams or panels, as this will interfere with installation. We recommend carefully checking that your desk and monitors meets all above conditions before purchasing.
- Dual C-Clamp Hold - Worried your dual monitors might wobble or slip? Our upgraded base uses a larger platform plus a dual C-clamp structure to lock the dual monitor arm firmly to your desk. Each arm safely keeps your screens steady while you type, click and game—no shaking, no sliding, just a clean and secure setup you can trust every day. It also provides Grommet Mounting installation choice, both options ensure stable and secure fixation for your 0.59" - 3.54" desk.
- Full-Motion Adjustment For Comfortable View - Pull the screen closer when you’re deep in a spreadsheet, push it back to watch videos, or rotate to portrait for coding — moving everything smoothly with just one hand. The monitor stand offers +85°/-50° tilt, ±90° swivel and 360° rotation. Raise your monitor up to 15.75″ to support a healthy sitting posture. Whether you’re working from home, gaming through the night, or switching between video calls and documents, getting the screens to your natural line of sight helps relieve neck, shoulder and back strain so you can stay focused longer with less fatigue.
- Keep Your Desk Organized: By lifting both screens off the desktop, this dual monitor stand opens up valuable space for your keyboard, notebook, docking station or a simple, clutter-free work area. Built-in cable management guides wires along the arms, keeping cords out of sight and out of the way. Enjoy a tidy, modern workstation that looks as good as it feels to use.
Excessive or debug logging
Find the service writing the files, then inspect its log level, rate limits and rotation configuration. Preserve the evidence and retention requirements; deleting an active log during an incident can remove the information needed to diagnose the fault and can interfere with a service holding the file open. A safer control is to lower debug verbosity or pause a nonessential log producer while retaining a defined retention plan.
Database maintenance
Check the database’s own activity view and logs for checkpoints, WAL or journal flushes, compaction and temporary files. These operations can create short, legitimate bursts. Tune the operation or schedule it away from peak traffic only after confirming its timing and the application’s durability requirements.
Backups and snapshots
List guest timers and cron jobs, then check provider-managed backup or snapshot schedules. A backup can read and write heavily without appearing as the application process you expected. Rescheduling, throttling or changing the backup method is less disruptive than killing a database or filesystem process mid-operation.
Virtual-device limits or provider throttling
Suspect a storage limit when the affected device shows persistently high await or queue time, I/O PSI remains elevated, and guest write throughput is modest relative to the application’s demand. The provider may enforce IOPS, throughput or burst limits that are not visible inside the VPS. Guest tools cannot prove the host-side policy; preserve interval output and ask the provider to correlate the timestamps with host metrics and the plan’s documented limits.
How to tell workload saturation from provider-side throttling
| Observation | More consistent with workload demand | More consistent with a virtual-device limit |
|---|---|---|
| Per-process write rate | One identifiable task produces a large, explainable burst. | Writer demand is modest or spread across tasks, yet latency remains high. |
| CPU state | User/system CPU rises with the operation. | CPU execution is modest; iowait, blocked tasks or I/O PSI rise. |
| Device behavior | Throughput and queue grow in proportion to the known job. | Await or queue remains high and throughput plateaus despite continuing demand. |
| Periodicity | Matches a checkpoint, rotation, backup or timer. | Appears under ordinary load or only on a particular host/time window. |
| Host evidence | Application logs explain the event. | Provider confirms an IOPS, bandwidth, burst or noisy-neighbor limit. |
Use all five axes together: CPU execution versus steal, iowait and PSI, device await/utilization and queue behavior, per-process write rate, and timing. A single high utilization percentage cannot distinguish these cases.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Safe response after you have evidence
- Preserve the snapshot. Keep the timestamp, command intervals, affected mount, PID, service name and relevant logs.
- Choose the least disruptive control. Pause a scheduled backup, reduce debug logging, reschedule maintenance or limit a nonessential batch job before stopping a database or filesystem process.
- Protect data integrity. Do not kill the top writer merely because it is at the top of
iotop. It may be a database journal, filesystem journal, backup or security process. - Re-measure after the change. Repeat the same
vmstat,iostat,pidstatand PSI intervals so the before-and-after comparison uses identical signals. - Escalate with evidence. If high wait and pressure persist with modest guest throughput, send the provider timestamped interval output, device name, mount point, plan, workload description and the exact period of impact. Ask for host-side throttling, IOPS and noisy-neighbor checks.
If the workload is legitimate but exceeds the virtual disk’s documented capacity, the durable options are to tune write batching and scheduling, separate data and logs onto appropriate devices, or move to a VPS/storage tier with documented I/O capacity. Avoid claiming that a tier change fixed the issue until the same measurements show lower latency and pressure under comparable demand.
A compact incident checklist
- Record the UTC timestamp and affected mount point.
- Capture
uptime,vmstat 1 10,iostat -xz 1 10,mpstat -P ALL 1 10,pidstat -dur 1 10,iotopand CPU/I/O PSI. - Separate user/system execution, iowait, idle and steal.
- Check
vmstatblocked tasks and swap in/out. - Map the busy filesystem to its block device.
- Identify the current per-task writer, not only the cumulative total.
- Inspect the PID, service unit, open files and recent journal entries.
- Check cron, systemd timers, database maintenance, backups, rotation and provider snapshots.
- Compare device await, queue, utilization and throughput with PSI and process rates.
- Apply the least disruptive control, then collect the same evidence again.
Why this method avoids common misdiagnoses
High load with low CPU is not automatically a CPU failure; blocked I/O tasks can account for the load. High device utilization does not identify the responsible process; per-task sampling does. A large iotop total does not necessarily equal current hardware traffic because the kernel buffers and merges requests. High iowait does not by itself prove provider throttling, and low guest throughput does not prove the disk is healthy. The diagnosis becomes defensible only when synchronized CPU, task, device and PSI observations agree with the workload’s logs and schedule.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
