CloudLinux lveinfo, lvetop and lvectl Commands

CloudLinux Manager shows usage in WHM, but when the server is slow you often want answers faster from SSH. Three tools cover most cases: lvetop for live usage, lveinfo for history and faults, and lvectl for limits.

On MdmHost hosting plans this is managed for you. This guide is for administrators of their own CloudLinux cPanel server with root SSH access.

Before you start

Root SSH access to a CloudLinux server.
The lve-stats package running (it is installed with CloudLinux): systemctl status lvestats.

Live usage with lvetop

lvetop

Shows LVEs (users) sorted by CPU, with memory, I/O, entry processes and processes, refreshed every few seconds. Press q to quit. Use it during an incident to see which account is busy right now.

History and faults with lveinfo

Top 10 users by CPU over the last day:

lveinfo --period=1d --order-by=cpu_avg --limit=10

Users who hit entry process limits in the last hour:

lveinfo --period=1h --by-fault=mep --limit=10

One user's history in 1-hour steps:

lveinfo --period=1d --user=username --time-unit=1h

Fault code	Limit
`mep`	Entry processes
`pmem`	Physical memory
`nproc`	Number of processes
`io` / `iops`	Disk throughput / operations

Run lveinfo --help for all columns; options vary slightly between lve-stats versions.

See what was running

For the processes and requests a user was running when they hit a fault, use snapshots:

lve-read-snapshot --period=1h -u username

View and change limits with lvectl

lvectl list
lvectl list-user
lvectl set-user username --speed=150% --pmem=2G --maxEntryProcs=40
lvectl apply all

Limits set with lvectl are individual overrides. For lasting changes prefer package limits in CloudLinux Manager (see CloudLinux Manager settings).

Tip: Reset an individual override with lvectl set-user username --default=all so the account follows its package again.

A quick incident routine

lvetop to spot the busy account.
lve-read-snapshot for that user to see the URLs or scripts.
Check the domain's access log for bots or attacks.
Fix the cause with the customer: caching, bot blocking, plugin removal (see fixing 508 errors).

Troubleshooting

lveinfo returns no data

lvestats is stopped or its database is new. Start it with systemctl start lvestats and wait a few minutes.

Usage shows under a numeric ID

That is the user's UID; map it with getent passwd UID.

Users see the same data in cPanel's Resource Usage.

Frequently asked questions

Can resellers use these commands?

No. They are root tools. Resellers see their customers' usage in their own CloudLinux Manager interface in WHM.

Is lvetop heavy on the server?

No, it reads kernel counters and is safe to run during an incident.

How far back does history go?

lve-stats keeps history for a configurable period, typically around a month. Longer periods need exporting the data.

Can I get CSV output?

Yes. lveinfo supports output formats such as CSV and JSON; use them to build reports or feed monitoring tools.

What is a sensible alert?

Alert on accounts with hundreds of faults per hour, not single faults. Occasional faults during peaks are normal.

Was this guide helpful?

Still stuck?

Ask MdmHost AI for a quick answer, or open a ticket and our team will take a look. We are here 24/7.

Ask MdmHost AI Open a ticket