When a Linux system is experiencing high CPU, I typically start with the top command.

By default, top is real time, meaning that the top output will refresh every few seconds. The -n 1 option can be used to display a snap shot of top.

top -n 1

Sometimes, simply issuing the top command will spot one or more processings using the majority of the CPU. In this example, a Java process is using 90% of the CPU.

PID    User   PR  NI     VIRT     RES     SHR   S  %CPU  %MEM    TIME+   COMMANDS
4594   root   20   0   417768  144754    5803   S  90.0   5.2  0:41:49       Java

By default, top will only return the results that fit the current console window. The -b (batch) flag can be used to return the full top output.

top -b -n 1

Additionally, the -o option can be used to sort the output on a specific column. In this example, the output will be sorted on the %CPU column (which is the default anyways).

top -b -n 1 -o %CPU

If you need to capture the CPU over a period of time, such as over a 24 hour period, a script could be invoked once every minute, where the script outputs the overall CPU average to a file. In this example, a BASH shell script will output the CPU average to a file named cpu.log.

#!/bin/bash
date=$(date +%Y%m%d)
time=$(date +%H%M%S)
cpu=$(top -b -n 1 | grep ^%Cpu | awk '{print $2}')
echo [$date.$time] CPU Usage = ${cpu}% | tee --append cpu.log

Running this script will produce a TXT file that contains something like this.

[20210708.214739] CPU Usage = 60.0%
[20210708.214746] CPU Usage = 70.4%

Better yet, this BASH script will also output the processes using more than 0.0% CPU.

#!/bin/bash
date=$(date +%Y%m%d)
time=$(date +%H%M%S)
cpu=$(top -b -n 1 | grep ^%Cpu | awk '{print $2}')
topprocesses=$(top -b -n 1 | egrep -v '^(Tasks|%Cpu|KiB|   PID)' | sed '/^$/d' | sed '/^top/d' | awk '{print $9 " " $12}' | grep -v ^0.0 | awk '{print $2 "="$1"%"}' | grep -v ^top | sed ':label; N; $! b label; s|\n| |g')
echo "[$date.$time] CPU Average = ${cpu}% ($topprocesses)" | tee --append cpu.log

This script could then be scheduled to run once every minute via a crontab job, something like this.

* * * * * bash /path/to/cpu.sh

One common cause of high CPU is a cron job that runs commands that cause high CPU. Check your cron table (crontab) to see if a scheduled job correlates to the time when there is high CPU. For example, perhaps a crontab job is creating gzip or bzip2 compressed archives of a certain directory, such as /etc, which may cause high CPU while the job is running.

Another cause of high CPU is an application that is doing something to use a lot of CPU. For example, if you have a web server (apache httpd ngnix) or an application server (tomcat websphere) installed on the system, the web app may be using excessive CPU.