A VPS that suddenly feels slow, returns 502/503 errors or kills processes is usually out of CPU or memory. The fix depends on what is using it, so start by measuring, not by upgrading. On shared cPanel hosting the same symptom appears as a resource limit; see 508 Resource Limit Reached instead.
Before you start
- SSH access as root or a sudo user (connect over SSH).
- If the server is unresponsive, reboot from your VPS control panel first, then investigate quickly before it fills up again.
See the overall picture
- Run
uptime. A load average higher than your number of CPU cores means work is queuing (count cores withnproc). - Run
free -m. Look at available, not free; Linux uses spare RAM for cache. - Run
top(orhtop) and press P to sort by CPU or M by memory.
Find the top processes
ps aux --sort=-%cpu | head -15ps aux --sort=-%mem | head -15Note the process name and user. For deeper digging see identify processes with lsof and monitor CPU, memory and disk.
Check for out-of-memory kills
dmesg -T | grep -i -E "killed process|out of memory"If MySQL or PHP was killed, the server ran out of RAM. Adding swap gives breathing room while you fix the cause:
fallocate -l 2G /swapfile && chmod 600 /swapfile && mkswap /swapfile && swapon /swapfileAdd /swapfile none swap sw 0 0 to /etc/fstab to keep it after reboot.
Fix the usual suspects
| Process | Typical cause | Fix |
|---|---|---|
php-fpm / lsphp | Too many workers, bot traffic, heavy plugin | Cap workers with PHP-FPM pool tuning; add page caching |
mysqld / mariadbd | Slow queries, oversized buffers | Find slow queries; size innodb_buffer_pool_size to the RAM you have |
nginx / httpd busy | Bots, scrapers, a small DDoS | Check the access log for top IPs; rate limit or block |
dockerd / containers | One container without limits | docker stats, then set CPU and memory limits |
| Unknown binary, random name, 100% CPU | Possible crypto-miner after a compromise | Treat as an incident: incident response on Linux |
Find the busiest IPs in the web log
awk '{print $1}' /var/log/nginx/access.log | sort | uniq -c | sort -rn | headUse /var/log/apache2/access.log or /var/log/httpd/access_log on Apache.
When to upgrade
If usage is high but legitimate (real visitors, normal queries) and caching is already on, the VPS is simply too small. Learn how cores map to load in VPS CPU cores explained.