Halloween DealsAmazon USHalloween week deals: useful picks before month-endAmazon US: current deals, useful picks and tech finds.Check DealsClean PCRecommendedOne scan can reveal what keeps slowing WindowsLook for cleanup and repair opportunities.Run ScanHalloween DealsAmazon USOctober picks are moving - compare before checkoutAmazon US: current deals, useful picks and tech finds.See Picks×
Skip to content
VGSources
Blog

Linux Performance Debugging on a VPS: Tools and Workflow

A practical, production-safe workflow for finding CPU, memory, disk I/O or network bottlenecks on a Linux VPS, from sysstat baselines through perf and eBPF tracing.
Length10 min Posted Quest giverVGSources Team
Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

A slow VPS is not diagnosed by load average alone. Start by recording the exact symptom and time window, establish a baseline, then measure CPU, memory, storage I/O and networking before selecting a deeper tool. Use the least invasive command that can answer the current question, change one variable, and compare results under the same workload.

This workflow combines low-overhead sysstat history, perf for CPU and software events, and eBPF tools such as BCC and bpftrace for focused latency and kernel questions. It is designed for production VPSs where you may have limited privileges, restricted hardware counters or a provider-controlled kernel.

As an Amazon Associate I earn from qualifying purchases.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Start with a precise symptom, not a favorite command

Write down what “slow” means before opening a shell. A web service might show higher request latency, while the same VPS feels slow because SSH logins pause, a batch job takes longer, packets are lost, or a database waits on storage. Record when the symptom began, whether it is continuous or intermittent, whether it can be reproduced, and what changed immediately beforehand.

Keep the time window attached to every observation. A five-minute spike and a problem that has persisted for six hours require different evidence. Preserve a baseline from a normal period whenever possible: command output, workload volume, kernel and distribution versions, running services and the configuration that was active. Without that baseline, a tuning change can appear successful simply because the workload became lighter.

#1 Best Overall
Elebase USB to USB C Adapter for iPhone 18 Pro Max,USBC Car Charger Adapter | 4Pack Type C Female to A Male Cable Converter for Apple Duo 17 16 15 14 Plus,iWatch Watch 12 11 10,iPad 9 8 Air,Airpods 5 4
  • Read Before You Buy — No Video Output: These adapters support charging and USB 2.0 data transfer, but cannot transmit video signals. Except for standard USB webcams (which use USB data only), they are not compatible with HDMI/DisplayPort cables, video-capable USB-C hubs, or docking stations with video output.
  • Convert USB-A Ports to USB-C: Designed to connect USB-C earphones, cables, flash drives, card readers, and other USB-C accessories to standard USB-A ports. Plug-and-play with no drivers or software required.
  • Aluminum Alloy Housing: Built with a sturdy aluminum alloy shell that aids in heat dissipation and protects against daily wear and scratches. Designed to maintain a stable and secure connection.
  • Compact & Travel-Friendly: The ultra-compact design allows the adapter to stay plugged into your device without blocking adjacent ports or adding bulk, reducing wear and tear on your original USB ports.
  • 12-Month Warranty: Backed by a 12-month manufacturer warranty for peace of mind. Designed to meet strict quality control standards for reliable everyday performance.

Use a low-risk first pass

  1. Record the symptom, start time, affected service and a normal comparison period.
  2. Capture CPU, memory, I/O and network evidence with read-only commands.
  3. Check whether the VPS provider is imposing a quota, steal time or an unfamiliar kernel limitation.
  4. Form one testable hypothesis, such as “requests wait on a saturated block device.”
  5. Run the least invasive measurement that can confirm or reject that hypothesis.

Measure the four resource classes

Linux performance problems usually become clearer when each resource is examined for utilization, saturation and errors. This is the USE Method described by Brendan Gregg: check those three dimensions for every resource before jumping to a specialized profiler.

CPU and run-queue pressure

CPU utilization is only one part of CPU pressure. A busy processor, runnable tasks waiting for a time slice, and a VPS losing cycles to a provider’s scheduling are different conditions. Use mpstat for per-CPU activity and vmstat for run-queue context. A high load average can include tasks blocked on I/O, so it does not identify a CPU bottleneck by itself.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Correlate load with user time, system time, idle time and any reported steal time. If one core is saturated while others are idle, a single-threaded process or affinity setting may be the limiting factor. If run-queue demand rises while CPU remains idle, investigate blocking, scheduling or I/O rather than adding more CPU.

Memory and reclaim pressure

Check available memory, swap activity and reclaim behavior over time. vmstat exposes paging and swap columns, while pidstat can associate process activity with the period of pressure. Linux uses otherwise-free memory for cache, so a low “free” value alone is not proof of exhaustion; sustained reclaim, swap-in or swap-out activity is more meaningful.

Capture the interval rather than relying on one snapshot. A workload that briefly allocates memory can look healthy after the event has passed. If a service was recently redeployed, compare its resident usage and allocation pattern with the baseline before changing kernel settings.

Filesystem and block I/O

Storage stalls often masquerade as CPU or load problems because blocked tasks contribute to load average. The Linux kernel userspace debugging guidance specifically recommends iostat -x for detailed input/output-device utilization and performance. Use it with a time interval so you can see whether utilization, queueing and request latency rise during the symptom.

What’s actually slowing this PC down?

Pick the symptom - the matching free tool is one click away.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
Rank #2
Sale
Anker USB-C Hub, 5-in-1 USB Hub for Laptops, 4K HDMI Multiport Adapter | USB C Dongle with 90W Max Power Delivery, 3×5Gbps USB A Data Ports, for MacBook, Dell, and More (Charger Not Included)
  • 5-in-1 USB-C Hub: Experience comprehensive connectivity featuring a Power Delivery input, two USB-A 2.0 ports, a USB-A 3.0 port, and an HDMI port. (Note: The USB-C power delivery input port is only for connecting an external wall charger to power your laptop and cannot power peripheral devices.)
  • 90W Pass-Through Charging: Achieve optimal charging with 90W pass-through power to your laptop, supported by a total input of 100W, with the hub reserving 10W for operational efficiency. (Note: Wall charger not included.)
  • Quick Data Transfers: Accelerate your productivity with rapid data transfers using a high-speed 5Gbps USB 3.0 port and two 480Mbps USB 2.0 ports.
  • 4K HDMI Display: Enhance your visual experience with a hub capable of delivering 4K resolution at 30Hz in both mirror and extend modes. Please note that this hub is compatible with MacBook (macOS 12 and newer), Windows 10 and 11, ChromeOS, and laptops equipped with DP Alt Mode and Power Delivery. Note: This device is not compatible with Linux.
  • What You Get: Anker USB-C Hub (5-in-1, 4K HDMI), welcome guide, 18-month warranty, and our friendly customer service.

Pair device-level evidence with process context from pidstat. Identify which device is busy, whether reads or writes dominate, and whether the application is issuing many small operations. A full device can be a throughput limit; high request latency with modest throughput points toward queueing, storage contention or a provider-side limit.

Network throughput and errors

Measure the interface during the affected window, looking for throughput, drops, errors and retransmission symptoms. A service can have spare CPU and storage yet remain slow because packets are retransmitted or an upstream link is constrained. Compare application latency with interface counters and, where privileges allow, TCP-level observations.

Do not treat an idle interface as proof that networking is healthy: a connection can be stalled by retransmits or remote-side delay without consuming much bandwidth. Record the direction of traffic and whether the issue affects all clients or one path.

Apply the USE Method before escalating

For each resource, ask three questions:

  • Utilization: How busy is the resource during the symptom?
  • Saturation: Are work items waiting because the resource cannot accept more work?
  • Errors: Are counters, retries, drops or failed operations increasing?

This prevents a common mistake: selecting a sophisticated tool before establishing what needs explanation. If device utilization and queueing are normal, a block-I/O tracer is unlikely to be the best first move. If CPU counters show a hot process, sampled call stacks can explain where its time goes. If the application is waiting in the kernel or on a socket, tracing blocked time is more informative than a CPU-only profile.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Choose the tool that matches the question

Tool or family Best use Relative role
sar, iostat, vmstat, mpstat, pidstat (sysstat) Baseline, time series and process or device context across CPU, memory and I/O Broad coverage with low overhead; start here when the bottleneck class is unknown
perf stat Hardware and software counter measurements Deeper CPU and event evidence after a symptom is measured
perf top Live view of sampled hot functions Interactive CPU attribution
perf record and perf report Sampled call stacks retained for later analysis Detailed attribution and comparison between workloads
ftrace Kernel function and event tracing Use when evidence points to a specific kernel path
BCC Ready-made or custom complex eBPF tools and daemons Rich, reusable tracing for involved investigations
bpftrace One-liners and short scripts for focused questions Fast experiments for latency, scheduling, filesystem and network events
Flame graphs Visualization of sampled stack traces Turns profiling output into a navigable view of where sampled time accumulates

Compare candidates on breadth versus depth, expected production overhead, required privileges, kernel and package support, time resolution, and whether the question concerns CPU, memory, I/O, networking or blocked time. A missing command can mean an absent package or a restricted kernel feature; it does not prove that the corresponding resource is healthy.

Install and validate tooling on the target VPS

Package names and tracing permissions vary by distribution. The official workshop installation for Ubuntu uses:

Rank #3
Sale
Anker USB C Hub, 7in1 Multi-Port USB Adapter, 4K@60Hz USBC to HDMI Splitter | 85W Max PD, 2 USB 3.0 & 1 USBC Data Ports, SD/TF Card Reader, for Laptops/Mac and Other Type C Devices (Charger Not Included)
  • Sleek 7-in-1 USB-C Hub: Features an HDMI port, two USB-A 3.0 ports, and a USB-C data port, each providing 5Gbps transfer speeds. It also includes a USB-C PD input port for charging up to 100W and dual SD and TF card slots, all in a compact design.
  • Flawless 4K@60Hz Video with HDMI: Delivers exceptional clarity and smoothness with its 4K@60Hz HDMI port, making it ideal for high-definition presentations and entertainment. (Note: Only the HDMI port supports video projection; the USB-C port is for data transfer only.)
  • Double Up on Efficiency: The two USB-A 3.0 ports and a USB-C port support a fast 5Gbps data rate, significantly boosting your transfer speeds and improving productivity.
  • Fast and Reliable 85W Charging: Offers high-capacity, speedy charging for laptops up to 85W, so you spend less time tethered to an outlet and more time being productive.
  • What You Get: Anker USB-C Hub (7-in-1), welcome guide, 18-month warranty, and our friendly customer service.
sudo apt-get install sysstat bpfcc-tools bpftrace gcc

After installation, verify both BCC and bpftrace rather than assuming that package installation succeeded. The workshop demonstrates this by running opensnoop, which observes open-system calls. Run the check on the VPS you will diagnose: provider images can differ in kernel configuration, architecture and available capabilities.

Expect restrictions on hardware performance counters, eBPF helpers, kernel tracepoints or privileged operations. Test with the permissions used by the service account, and use sudo only when policy permits. Document the distribution release, kernel version, installed package versions and any permission error so another operator can distinguish an environmental limit from a real absence of events.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Use perf for CPU and event attribution

The Linux kernel documentation describes perf as an analysis tool for Linux 2.6-and-newer systems that abstracts CPU-hardware differences and provides a command-line interface. It is the standard interface for counting events and collecting sampled profiles, but a VPS may expose fewer hardware counters than a physical host.

Count before sampling

Begin with perf stat around a representative command or controlled workload. Counters can indicate whether instructions, cycles, branches, cache behavior or software events changed between a normal and slow run. Keep the workload, duration and configuration constant so the comparison is meaningful.

perf stat -- ./your-workload

If the provider blocks a counter, treat the error as a capability limitation and use available software events or another measurement. Do not infer “no problem” from an event that could not be collected.

Inspect a live hot path

Use perf top when the process is currently consuming CPU and you need an interactive view of sampled functions. Confirm that the observed process and time window correspond to the reported symptom; otherwise the display may simply show background activity.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
Rank #4
Sale
UGREEN USB to USB C Adapter Combo 4-Pack, 10Gbps USB C Converter Space Gray | Data transfer & Fast charging for MacBook, iPhone 17/16/15, iPad, Samsung Galaxy, Apple Watch
  • Dual Converters, Infinite Potential:Includes 2× USB C male to USB A female adapters and 2× USB A male to USB C female adapters. Perfect for a wide range of uses—tablets with Bluetooth keyboards, expand USB ports on macbook, and more. Two different converters for all your daily needs
  • Next-Level 10Gbps & 3A Charging: No more slow 480Mbps, this usb to usb c adapter has a transfer speed of up to 10Gbps, allowing you to do more transferring in less time. This usb adapter fits both USB A and USB C charger, supporting up to 3A fast charging
  • Upgraded Exquisite Craftsmanship: With an aluminum alloy housing and metal connector, the usbc to usb adapter is extremely durable and sturdy. Rigorously tested to withstand more than 10,000 times of plugging and unplugging, ensuring long-lasting performance
  • Broad Compatible: The usb c to usb adapter widely supports all USB C/ USB A devices like laptops, tablets, cellphones, car chargers, and phone chargers. Such as compatible with MacBook Pro/Air 2023/2022, Thunderbolt 4/3 Devices,Apple MagSafe Watch 9/8/7/SE/Ultra, iPad Pro 2022/2021, Samsung Galaxy S23/S20/S10, and iPhone 17/16/15 Pro. Plug and play
  • Please Note: To reach 10Gbps speed, keep the cable under 3.3 ft. For USB A Male to USB C adapters, try flipping the USB C connector. USB C Male to USB A adapters support bidirectional 10Gbps transfer within 3.3 ft
sudo perf top

Record call stacks for later review

perf record samples a workload and writes data that perf report can summarize. This is useful when the problem is intermittent or when you need to share a profile without keeping an interactive session open.

sudo perf record -g -- ./your-workload
sudo perf report

The -g option requests call graphs. Symbol availability, compiler settings and stripped binaries affect how readable the report is, so preserve the exact binary and build information used for the capture.

Escalate to eBPF when the question is about latency or blocking

eBPF tracing can answer questions that CPU sampling cannot, such as which filesystem operations exceed a latency threshold, how long tasks wait on the run queue, whether TCP retransmits occur, or where time is spent off-CPU. Brendan Gregg’s eBPF guidance identifies BCC and bpftrace as the main front ends: BCC for complex tools and daemons, and bpftrace for one-liners and short scripts.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Use BCC for established complex tools

BCC provides ready-made tools and supports custom programs when an investigation needs several probes, aggregation or a daemon-like workflow. Select a tool that directly matches the hypothesis, limit its scope to the affected process or device, and stop it as soon as the needed evidence is captured.

Use bpftrace for a focused experiment

A short script is appropriate when you can state one event question precisely: for example, “Which process issues slow filesystem operations?” or “How often do retransmit events occur during the incident?” Start with a narrow probe and a short duration, then expand only if the result is inconclusive. Kernel versions and available tracepoints differ, so validate the script on the target VPS before relying on its output.

Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Support on Ko-Fi

Bring in ftrace and flame graphs at the right time

ftrace provides kernel function and event tracing. Use it after broad measurements or perf evidence identify a kernel path worth examining; enabling broad tracing without a question can produce large, difficult-to-interpret output.

Best Value
Sale
Anker USB C Hub, 5-in-1 USBC to HDMI Splitter with 4K Display | 85W Max PD, 1 Powered USB-C 5Gbps & 2 Powered USB-A 3.0 5Gbps Data Ports, for MacBook Pro, MacBook Air, Dell and More (Black)
  • 5-in-1 Connectivity: Equipped with a 4K HDMI port, a 5 Gbps USB-C data port, two 5 Gbps USB-A ports, and a USB C 100W PD-IN port. Note: The USB C 100W PD-IN port supports only charging and does not support data transfer devices such as headphones or speakers.
  • Powerful Pass-Through Charging: Supports up to 85W pass-through charging so you can power up your laptop while you use the hub. Note: Pass-through charging requires a charger (not included). Note: To achieve full power for iPad, we recommend using a 45W wall charger.
  • Transfer Files in Seconds: Move files to and from your laptop at speeds of up to 5 Gbps via the USB-C and USB-A data ports. Note: The USB C 5Gbps Data port does not support video output.
  • HD Display: Connect to the HDMI port to stream or mirror content to an external monitor in resolutions of up to 4K@30Hz. Note: The USB-C ports do not support video output.
  • What You Get: Anker 332 USB-C Hub (5-in-1), welcome guide, our worry-free 18-month warranty, and friendly customer service.

Flame graphs visualize sampled stack traces. They are especially useful for comparing a normal profile with a slow profile, showing whether samples concentrate in application code, system calls, locking or another path. A flame graph is a visualization of measurements, not a measurement by itself: preserve the capture conditions and sampling method alongside the image.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Keep production diagnosis safe

  • Prefer read-only, low-overhead tools for the first pass.
  • Limit tracing to the smallest process, device, event set and time window that answers the question.
  • Schedule heavier captures during a controlled interval when the service can tolerate them.
  • Record who ran each command, with which privileges, and when it started and stopped.
  • Do not restart services, drop caches or change kernel parameters merely to make a test easier unless that intervention is itself the approved experiment.
  • Store command output with workload volume, deployment version, kernel version and configuration so before-and-after results remain comparable.

Production safety is a measurement discipline as much as a tooling choice. A profile collected after the symptom disappears cannot explain the original event, and an unrecorded configuration change destroys the baseline needed for comparison.

Change one variable, then re-measure

Once evidence supports a hypothesis, make one configuration or workload change. Repeat the same commands under a comparable load and preserve the new output beside the baseline. If latency, queueing or error counters do not improve, roll back the change rather than stacking another adjustment on top of an unproven one.

Keep the final record explicit: the original symptom, measurements that established the bottleneck, the exact change, the conditions of the retest and the observed result. This turns a one-time fix into a reproducible operational procedure.

Common diagnostic mistakes and their corrections

Treating load average as the diagnosis

Load average combines runnable and uninterruptible tasks. Correlate it with CPU utilization, run-queue behavior, memory reclaim and device latency before attributing the load to a processor shortage.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Running every tracer at once

Simultaneous profilers obscure causality and can add unnecessary overhead. Start with sysstat, then escalate one layer at a time according to the unanswered question.

Assuming a command’s absence means a healthy system

A VPS may lack a package, a kernel feature or permission to access counters. Validate installation and capabilities, and document the limitation instead of interpreting an error as a clean result.

Changing several settings together

Multiple changes make it impossible to know which one affected the symptom. Revert inconclusive changes and retest one variable under the original workload conditions.

A practical decision path

  1. If the bottleneck class is unknown, collect sar, iostat, vmstat, mpstat and pidstat history.
  2. If CPU time or a hot process is implicated, use perf stat, then perf top or perf record/perf report.
  3. If storage utilization or latency is implicated, focus on iostat -x, process I/O context and a narrowly scoped filesystem trace.
  4. If tasks appear blocked, investigate run-queue latency, off-CPU time or the relevant kernel event with BCC or bpftrace.
  5. If the evidence points to a kernel function or event, use ftrace for that path and visualize sampled stacks with a flame graph when comparison will help.
  6. After any change, repeat the original measurements and roll back if the measured symptom does not improve.

The sequence keeps diagnosis proportional: broad and inexpensive measurements first, attribution second, and kernel-level tracing only when the evidence justifies it.

Free tools Windows power users keep installed

One-click scans. No signup required.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

What to remember

  • A high load average is a prompt to investigate, not a bottleneck label.
  • Define the symptom and baseline before tuning.
  • iostat -x is the Linux kernel documentation’s concrete recommendation for detailed device performance.
  • perf provides the standard counter, live-sampling and recorded-profile workflow.
  • BCC and bpftrace complement each other: complex tools and daemons versus one-liners and short scripts.
  • Distribution packages, privileges and kernel capabilities differ across VPSs, so validate every tool on the actual host.

Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.

Leave a Reply

Your email address will not be published. Required fields are marked *

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

More quests from Patch Notes

  1. How to Set Up a RedM (RDR2) Server in 2026: License Key, txAdmin and server.cfg, Step by StepBlog11min
  2. Best RedM (RDR2) Server Hosting in 2026: Comparing Four Hosts on Slots, Memory and PriceBlog10min
  3. How to Host a Mindustry Server in 2026: server-release.jar, Port 6567 and the Commands That MatterBlog7min
Recommended PC Tool
Recommended PC Tool
PC Slower Than It Used to Be?Free scan - under a minute
Outdated Drivers Are Slowing You DownFree scan - exact matches

Two free Windows tools

One Free Minute Could Fix That PC

Before you go - each of these free tools takes about a minute and tackles what quietly slows a Windows PC down.

Special offer. View Outbyte info, uninstall instructions, EULA, and Privacy Policy.