CPU Steal Time
What CPU Steal Time Measures
CPU steal time is the share of time a virtual CPU was ready to run but could not, because the hypervisor used the physical processor for another guest. The guest operating system records this waiting time as stolen time, so it appears in its CPU statistics even though the guest did nothing wrong. Steal time is measured on each vCPU, not on the physical host.
On Linux, tools such as top and vmstat show steal time in a column usually labeled st. The value is a percentage of total CPU time. A guest with low steal is getting the processor time it asks for. A guest with high steal is waiting on the host.
What Causes Steal Time and What High Values Mean
Steal time comes from contention on the physical host. Common causes include a host running more vCPUs than it has physical cores, neighboring tenants running heavy CPU work (a classic noisy neighbor effect), and host-side maintenance or background tasks that use the processor. Selling more capacity than the hardware holds is described in the article on overselling.
Brief spikes are normal on any shared host. A sustained rise, especially at the same times each day, is a sign that the host is busy or oversubscribed and that the server is not getting the CPU time it was allocated. Steal time does not show which neighbor is responsible, and it says nothing about memory, disk or network problems.
Steal Time During an Evening Slowdown
A blog runs on a VPS with light traffic. Its owner notices slow page loads every evening, but CPU usage inside the server stays around 40 percent and memory is fine. Monitoring shows that steal time climbs to around 15 percent between 7 and 10 p.m. and falls back in the morning.
The pattern points to a busy host during peak evening hours, not to the blog's software. The owner can ask the provider about host load, check whether another plan offers more guaranteed CPU, or consider a different host.
Frequently asked questions
Is some CPU steal time normal on a VPS?
Yes. A small amount of steal is normal on a shared host, because the hypervisor schedules many guests on the same processors. The concern is a steady or growing value that causes slow responses. Track the pattern over days rather than reacting to a single reading.
Does high steal time mean my VPS is overloaded?
Not necessarily. Steal time shows that the physical processor is busy, not that your server has run out of capacity. A server with a light workload can still show high steal if the host is crowded. Compare steal time with your own CPU use and response times to see whether the host or your application is the bottleneck.