{"id":896,"date":"2026-08-15T22:48:11","date_gmt":"2026-08-15T22:48:11","guid":{"rendered":"https:\/\/virtualserversvps.com\/blog\/?p=896"},"modified":"2026-08-23T22:05:05","modified_gmt":"2026-08-23T22:05:05","slug":"vps-cpu-steal-measurement-mitigation","status":"publish","type":"post","link":"https:\/\/virtualserversvps.com\/blog\/vps-cpu-steal-measurement-mitigation\/","title":{"rendered":"CPU Steal on VPS: Measuring, Diagnosing, and Mitigating Hypervisor Contention"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">If you have ever watched <code>top<\/code> show 30% of your CPU as <code>%st<\/code> while your site crawls, you have met CPU steal. Steal is the time your virtual machine wanted to run but the hypervisor gave the physical CPU to another tenant instead. On a VPS, it is the single most common cause of mysterious slowdowns \u2014 and it is entirely outside your control. What you <em>can<\/em> control is detecting it, measuring it accurately, and choosing a plan that minimizes it. This guide shows you how to measure steal, how to distinguish it from other bottlenecks, and what mitigation strategies actually work.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">What CPU Steal Actually Is<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The hypervisor on a KVM, Xen, or VMware host time-slices each physical core between multiple virtual machines. When your neighbors saturate the host, your VM&#8217;s vCPUs queue for their turn, and the time spent waiting is recorded in the <code>steal<\/code> field of <code>\/proc\/stat<\/code>. It is surfaced by <code>top<\/code> (the <code>%st<\/code> column), <code>vmstat<\/code> (the <code>st<\/code> column), and <code>mpstat<\/code> (the <code>%steal<\/code> column). Understanding the difference between steal and similar metrics is critical:<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table><thead><tr><th>Metric<\/th><th>Meaning<\/th><th>Cause<\/th><th>Actionable?<\/th><\/tr><\/thead><tbody><tr><td><code>%st<\/code> (steal)<\/td><td>vCPU waiting for physical CPU<\/td><td>Hypervisor contention<\/td><td>Switch provider or plan<\/td><\/tr><tr><td><code>%wa<\/code> (iowait)<\/td><td>CPU idle while waiting for I\/O<\/td><td>Disk or storage bottleneck<\/td><td>Upgrade storage, tune I\/O<\/td><\/tr><tr><td><code>%id<\/code> (idle)<\/td><td>CPU has nothing to do<\/td><td>Workload not CPU-bound<\/td><td>App-level optimization<\/td><\/tr><tr><td><code>%us<\/code>\/<code>%sy<\/code><\/td><td>CPU busy with user\/system code<\/td><td>Application or OS overhead<\/td><td>Code profiling, config tuning<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Steal is not the same as iowait: iowait means your workload is waiting on disk or network, while steal means the CPU itself was taken away from you. On a healthy host, steal stays near zero; on an oversold one, it spikes during peak hours as neighboring VMs compete for the same cores.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">How to Measure Steal Accurately<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">One-off measurements are misleading. Steal is a bursty metric \u2014 a single <code>top<\/code> snapshot may show 0% while the average over the last hour was 15%. Use these tools for a reliable picture:<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Quick Check (Ad-Hoc)<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code># Real-time per-second samples over 30 seconds\nvmstat 1 30\n# Look at the 'st' column \u2014 sustained values above 5% are concerning\n\n# Per-core steal percentages\nmpstat -P ALL 5 6\n# Sample every 5 seconds, 6 times\n\n# Single-line average from \/proc\/stat\nawk '\/^cpu \/ {print \"Steal: \" $8 \"%\"}' \/proc\/stat<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">Long-Term Monitoring (Recommended)<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Install <code>sysstat<\/code> and enable collection every 60 seconds. After a week, you can graph steal by hour and identify patterns:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo apt install sysstat\n# Edit \/etc\/default\/sysstat and set ENABLED=\"true\"\n# Edit \/etc\/cron.d\/sysstat to collect every 2 minutes\nsudo systemctl restart sysstat\n\n# After collecting data, view hourly steal averages:\nsar -u -f \/var\/log\/sysstat\/sa$(date +%d --date=yesterday) | awk 'NR>3 {print $1, $NF}'<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">Prometheus + Node Exporter (Production Stack)<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">For a permanent monitoring setup, <code>node_exporter<\/code> exposes the steal counter from <code>\/proc\/stat<\/code> as <code>node_cpu_seconds_total{mode=\"steal\"}<\/code>. A Prometheus alert rule catches sustained contention:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code># Alert when 5-minute average steal exceeds 5%\n- alert: HighCPUSteal\n  expr: avg by (instance) (rate(node_cpu_seconds_total{mode=\"steal\"}[5m])) > 0.05\n  for: 10m\n  labels:\n    severity: warning\n  annotations:\n    summary: \"CPU steal {{ $value | humanizePercentage }} on {{ $labels.instance }}\"<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">Diagnosis: Is Steal Actually Your Problem?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Not every slowdown is steal, and blaming the wrong metric wastes hours. Use this decision tree:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Is steal elevated (sustained &gt; 5%, spiking above 20%)?<\/strong> If no, look elsewhere \u2014 database queries, network latency, or application code.<\/li>\n<li><strong>Is your application CPU-bound?<\/strong> Check <code>%us<\/code> + <code>%sy<\/code> in <code>top<\/code>. Steal matters only when your workload is actively waiting for CPU time. If your app is I\/O-bound, high steal is irrelevant.<\/li>\n<li><strong>Does the slowdown correlate with steal spikes?<\/strong> Compare timestamps of slow requests against steal measurements. If your site is slow at 8 PM and steal spikes at 8 PM, the correlation is strong. If the site is slow all day but steal is only high at night, the problem is elsewhere.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Steal explains slow performance when three conditions all hold: steal is elevated, your application is CPU-bound at the time, and the slowdown correlates with the steal spikes rather than with disk or network metrics.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Mitigation Strategies<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">1. Confirm It Is Not You<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Before blaming the host, rule out local issues: check that you are not swapping (high <code>si<\/code>\/<code>so<\/code> in <code>vmstat<\/code>), that no runaway process is pegging a vCPU, and that your application is actually CPU-bound. A single misconfigured cron job or a memory leak that triggers swapping can look like steal but is entirely your problem to fix.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">2. Pinpoint the Pattern<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Log steal for at least a week. If it is consistently high (every hour, every day), the host is oversold \u2014 no amount of your own tuning will fix it. If it is a one-off spike, it may be a noisy neighbor that will move on, or a batch job on another VM that finishes. If it follows a predictable daily pattern (high during business hours, low at night), schedule your batch jobs and backups for the low-contention window.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">3. Overprovision Slightly<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">If you cannot switch providers immediately, a practical workaround: a 2 vCPU plan with 40% steal delivers roughly the usable compute of a single core. Ordering one size up \u2014 4 vCPUs instead of 2 \u2014 spreads the steal across more cores and reduces the effective impact. This is often cheaper than fighting contention with constant monitoring and support tickets.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">4. Switch to a Provider with Dedicated vCPUs<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">This is the only fix that guarantees low steal. Providers selling &#8220;dedicated vCPU&#8221; or &#8220;vCPU pinning&#8221; plans isolate you from neighbors at the hypervisor level. The premium over shared vCPU plans is usually modest \u2014 often 20-40% more \u2014 and for a CPU-bound workload, it is worth every penny. The <a href=\"https:\/\/virtualserversvps.com\/#providers\">VPS provider comparison table<\/a> at virtualserversvps.com notes which vendors publish their vCPU-to-core ratios and offer dedicated-core plans.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">5. Benchmark Before You Migrate<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Before moving to a new provider, run a steal stress test during their peak hours. Spin up a trial instance, install <code>sysbench<\/code> or <code>stress-ng<\/code>, and measure steal while the CPU is under load:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code># Install stress-ng\nsudo apt install stress-ng\n\n# Run CPU stress for 10 minutes and log steal in parallel\nstress-ng --cpu 0 --timeout 600 &amp;\nvmstat 5 120 | awk '{print strftime(\"%H:%M:%S\"), $0}' > steal-log.txt\n\n# After 10 minutes, check the average steal\nawk '{sum+=$NF} END {print \"Average steal: \" sum\/NR \"%\"}' steal-log.txt<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">If the candidate host shows &lt; 2% average steal under full CPU load, you have found a provider worth moving to. If it shows 5%+ on a fresh trial instance, the host is already oversold \u2014 keep looking.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">The Bottom Line<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">CPU steal is the one performance metric you cannot tune away. You can measure it, diagnose whether it is actually causing your slowdowns, and mitigate it with overprovisioning or scheduling \u2014 but the only honest fix is a provider that does not oversell. Compare dedicated vCPU options and transparent resource guarantees at <a href=\"https:\/\/virtualserversvps.com\/#providers\">our VPS provider comparison<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>If you have ever watched top show 30% of your CPU as %st while your site crawls, you have met CPU steal. Steal is the time your virtual machine wanted&#8230;<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"iawp_total_views":0,"footnotes":""},"categories":[3],"tags":[],"class_list":["post-896","post","type-post","status-publish","format-standard","hentry","category-performance-optimization"],"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v26.1 (Yoast SEO v26.1) - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>CPU Steal on VPS: Measuring, Diagnosing, and Mitigating Hypervisor Contention - Virtual Servers VPS Blog<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/virtualserversvps.com\/blog\/vps-cpu-steal-measurement-mitigation\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"CPU Steal on VPS: Measuring, Diagnosing, and Mitigating Hypervisor Contention\" \/>\n<meta property=\"og:description\" content=\"CPU Steal on VPS: Measuring, Diagnosing, and Mitigating Hypervisor Contention\" \/>\n<meta property=\"og:url\" content=\"https:\/\/virtualserversvps.com\/blog\/vps-cpu-steal-measurement-mitigation\/\" \/>\n<meta property=\"og:site_name\" content=\"Virtual Servers VPS Blog\" \/>\n<meta property=\"article:published_time\" content=\"2026-08-15T22:48:11+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-08-23T22:05:05+00:00\" \/>\n<meta name=\"author\" content=\"Virtual-Servers-Vps-Editor\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Virtual-Servers-Vps-Editor\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"6 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/virtualserversvps.com\/blog\/vps-cpu-steal-measurement-mitigation\/\",\"url\":\"https:\/\/virtualserversvps.com\/blog\/vps-cpu-steal-measurement-mitigation\/\",\"name\":\"CPU Steal on VPS: Measuring, Diagnosing, and Mitigating Hypervisor Contention - Virtual Servers VPS Blog\",\"isPartOf\":{\"@id\":\"https:\/\/virtualserversvps.com\/blog\/#website\"},\"datePublished\":\"2026-08-15T22:48:11+00:00\",\"dateModified\":\"2026-08-23T22:05:05+00:00\",\"author\":{\"@id\":\"https:\/\/virtualserversvps.com\/blog\/#\/schema\/person\/82a299a8284a66ff49f97c74684724a0\"},\"breadcrumb\":{\"@id\":\"https:\/\/virtualserversvps.com\/blog\/vps-cpu-steal-measurement-mitigation\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/virtualserversvps.com\/blog\/vps-cpu-steal-measurement-mitigation\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/virtualserversvps.com\/blog\/vps-cpu-steal-measurement-mitigation\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/virtualserversvps.com\/blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"CPU Steal on VPS: Measuring, Diagnosing, and Mitigating Hypervisor Contention\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/virtualserversvps.com\/blog\/#website\",\"url\":\"https:\/\/virtualserversvps.com\/blog\/\",\"name\":\"Virtual Servers VPS Blog\",\"description\":\"\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/virtualserversvps.com\/blog\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/virtualserversvps.com\/blog\/#\/schema\/person\/82a299a8284a66ff49f97c74684724a0\",\"name\":\"Virtual-Servers-Vps-Editor\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/virtualserversvps.com\/blog\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/d820b15f1cd028e97610d9adf536df7be5cb6423869967037d468d5355fa003f?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/d820b15f1cd028e97610d9adf536df7be5cb6423869967037d468d5355fa003f?s=96&d=mm&r=g\",\"caption\":\"Virtual-Servers-Vps-Editor\"},\"sameAs\":[\"https:\/\/virtualserversvps.com\/blog\"],\"url\":\"https:\/\/virtualserversvps.com\/blog\/author\/virtualserversvps\/\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"CPU Steal on VPS: Measuring, Diagnosing, and Mitigating Hypervisor Contention - Virtual Servers VPS Blog","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/virtualserversvps.com\/blog\/vps-cpu-steal-measurement-mitigation\/","og_locale":"en_US","og_type":"article","og_title":"CPU Steal on VPS: Measuring, Diagnosing, and Mitigating Hypervisor Contention","og_description":"CPU Steal on VPS: Measuring, Diagnosing, and Mitigating Hypervisor Contention","og_url":"https:\/\/virtualserversvps.com\/blog\/vps-cpu-steal-measurement-mitigation\/","og_site_name":"Virtual Servers VPS Blog","article_published_time":"2026-08-15T22:48:11+00:00","article_modified_time":"2026-08-23T22:05:05+00:00","author":"Virtual-Servers-Vps-Editor","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Virtual-Servers-Vps-Editor","Est. reading time":"6 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/virtualserversvps.com\/blog\/vps-cpu-steal-measurement-mitigation\/","url":"https:\/\/virtualserversvps.com\/blog\/vps-cpu-steal-measurement-mitigation\/","name":"CPU Steal on VPS: Measuring, Diagnosing, and Mitigating Hypervisor Contention - Virtual Servers VPS Blog","isPartOf":{"@id":"https:\/\/virtualserversvps.com\/blog\/#website"},"datePublished":"2026-08-15T22:48:11+00:00","dateModified":"2026-08-23T22:05:05+00:00","author":{"@id":"https:\/\/virtualserversvps.com\/blog\/#\/schema\/person\/82a299a8284a66ff49f97c74684724a0"},"breadcrumb":{"@id":"https:\/\/virtualserversvps.com\/blog\/vps-cpu-steal-measurement-mitigation\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/virtualserversvps.com\/blog\/vps-cpu-steal-measurement-mitigation\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/virtualserversvps.com\/blog\/vps-cpu-steal-measurement-mitigation\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/virtualserversvps.com\/blog\/"},{"@type":"ListItem","position":2,"name":"CPU Steal on VPS: Measuring, Diagnosing, and Mitigating Hypervisor Contention"}]},{"@type":"WebSite","@id":"https:\/\/virtualserversvps.com\/blog\/#website","url":"https:\/\/virtualserversvps.com\/blog\/","name":"Virtual Servers VPS Blog","description":"","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/virtualserversvps.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/virtualserversvps.com\/blog\/#\/schema\/person\/82a299a8284a66ff49f97c74684724a0","name":"Virtual-Servers-Vps-Editor","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/virtualserversvps.com\/blog\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/d820b15f1cd028e97610d9adf536df7be5cb6423869967037d468d5355fa003f?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/d820b15f1cd028e97610d9adf536df7be5cb6423869967037d468d5355fa003f?s=96&d=mm&r=g","caption":"Virtual-Servers-Vps-Editor"},"sameAs":["https:\/\/virtualserversvps.com\/blog"],"url":"https:\/\/virtualserversvps.com\/blog\/author\/virtualserversvps\/"}]}},"_links":{"self":[{"href":"https:\/\/virtualserversvps.com\/blog\/wp-json\/wp\/v2\/posts\/896","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/virtualserversvps.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/virtualserversvps.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/virtualserversvps.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/virtualserversvps.com\/blog\/wp-json\/wp\/v2\/comments?post=896"}],"version-history":[{"count":2,"href":"https:\/\/virtualserversvps.com\/blog\/wp-json\/wp\/v2\/posts\/896\/revisions"}],"predecessor-version":[{"id":954,"href":"https:\/\/virtualserversvps.com\/blog\/wp-json\/wp\/v2\/posts\/896\/revisions\/954"}],"wp:attachment":[{"href":"https:\/\/virtualserversvps.com\/blog\/wp-json\/wp\/v2\/media?parent=896"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/virtualserversvps.com\/blog\/wp-json\/wp\/v2\/categories?post=896"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/virtualserversvps.com\/blog\/wp-json\/wp\/v2\/tags?post=896"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}