Is there any possible command or way to check which process caused high cpu utilization in last 24 hours , because last night at 11:30 pm date:-30-nov-2022 we got alert that cpu utilization was high , so need to figure out which process cause high utilization.
4 Answers
sar
You can use sar. It’s included as part of sysstat. To install:
sudo apt-get install sysstat
Next, enable it by editing /etc/default/sysstat and setting “ENABLED” to true.
Doing so monitors your system and generates a report every 10 minutes, rotating them out after a week. You can modify this behavior by editing the sysstat crontab at /etc/cron.d/sysstat, or by changing rotation settings in the sysstat settings at /etc/sysstat/sysstat.
You can generate a real-time report with the following command:
sar -u 1 3
sysstat will collect background CPU usage data every minute, saving it to /var/log/sysstat/. You can then import this data for analysis, using either a spreadsheet program or a custom tool like sargraph.
atop
An alternative is to use atop which is able to store raw counters in a file for long-term analysis on system level and process level. By default, the daily logfiles are preserved for 28 days. System activity reports can be generated from a logfile by using the atopsar command.
atop is available in the ubuntu repositories by: sudo apt install atop
Top command
Top in batch mode
top -b -n 1
Then fish it out with Sed
top -b -n 1 | sed -n 8,8p
-
I want highest utilization in last 24 hours , I think your command works for current utilization. Dec 1, 2022 at 10:58
Directly access log file
/var/log/syslog
Simmer it down with grep
cat /var/log/syslog | grep Nov | grep 30 | grep 11: | grep pid=
Process command
Process Status (ps)
ps
ps -eo lstart,pid,time,user,comm,pcpu |\ grep 2022 |\ grep Nov |\ grep pm |\ grep 11 |\ sort -n -k 10 -r |\ head --lines 1
Explaination
ps (Process Status) -e (all processes) -o (format the output) lstart (long start) pid (process identification) time (time) user (the user) comm (command) pcpu (cpu usage percent)
Output piped into another program, grep.
grep 2022 | grep Nov | grep pm | grep 11
Then sorted, by number and the column containing the CPU percentage
sort -n -k 10 -r -n (number) -k (column) -r (reverse)
Then piped in to head to allow the first line through only
head --lines 1
-
1
-
1It seems that you think that the process is still running. What if the load came from a "worker" process that is long gone ? A lot of services like Apache, databases and other applications starts sub-prepossesses / worker-threads to execute their work-loads, and these processes doesn't exists anymore. Your answer doesn't work.– Soren ADec 1, 2022 at 23:05