Troubleshoot high load average on a Linux server

The load average counts processes that are running or waiting for CPU or disk. A high number alone does not tell you what is wrong. This guide shows how to read it and narrow down the real cause on a VPS.

Before you start

• SSH access with sudo.
• Know how many vCPUs the server has: nproc.

Read the load average

uptime

14:02:11 up 12 days,  load average: 7.85, 6.10, 3.20

The three numbers are the averages for the last 1, 5 and 15 minutes. Compare them with nproc: on a 4-vCPU VPS, a load around 4 means fully busy, and 8 means processes are queuing. A rising 1-minute value means the problem is happening now.

CPU-bound or I/O-bound?

Run top and look at the %Cpu(s) line:

• High us/sy: processes are using the CPU. Press P to sort by CPU.
• High wa (iowait): processes are waiting for the disk. Load is high but the CPU is idle.
• High st (steal): the hypervisor gives the VPS less CPU than it asks for. If it stays high, contact support.

Find the heavy processes

ps -eo pid,user,%cpu,%mem,stat,cmd --sort=-%cpu | head -15

Typical culprits are PHP-FPM or Apache workers serving a traffic spike or a bot, MySQL running slow queries, backup jobs, and malware such as crypto miners running as the web user.

Processes in state D (uninterruptible sleep) add to load while waiting for the disk:

ps -eo pid,stat,cmd | awk '$2 ~ /D/'

Investigate disk I/O

sudo apt install sysstat iotop && iostat -xz 2

A %util close to 100 shows a saturated disk. sudo iotop -o shows which process is doing the I/O. See disk I/O with fio and iostat.

Check memory and swap

free -h && vmstat 2 5

Non-zero si/so columns in vmstat mean the server is swapping. That turns into I/O wait and high load. Reduce memory use or add RAM. Related guides: the OOM killer and create a swap file.

Common fixes

• Cap PHP-FPM workers to what RAM allows. See tune pm.max_children.
• Find slow MySQL queries with the slow query log, and add indexes.
• Block abusive bots or IPs at the firewall or web server.
• Move backups and heavy cron jobs to quiet hours, and run them with nice and ionice.
• If the load is genuine and steady, upgrade the VPS.

FAQ

What is a normal load average?

Anything at or below the number of vCPUs is generally fine. Short spikes above it are normal; a sustained load well above it needs attention.

Why is load high when CPU usage is low?

Processes waiting for the disk (iowait or D state) count toward load without using CPU. Look at disk activity and swap.

Can high load be caused by malware?

Yes. Unknown processes using 100% CPU, often running as the web user from /tmp, can be crypto miners. Kill them, find how they got in, and clean the site.