Recommended Free Tools
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
Find a slow VPS by measuring CPU, memory, storage I/O, and network behavior in that order, then use the least invasive tool that can answer the specific question. Start with a time-stamped baseline using sysstat, apply the Utilization–Saturation–Errors (USE) method, and escalate to perf, ftrace, BCC, or bpftrace only after the first measurements identify a likely path. This approach works without taking a production server offline, provided you control sampling, permissions, and the change process.
What VPS performance debugging is trying to prove
“The VPS is slow” is a symptom, not a diagnosis. An overloaded CPU, a process waiting on reclaim, a saturated virtual disk, packet loss, and a slow upstream dependency can all look like the same application problem. A high load average is similarly ambiguous: Linux counts runnable work and tasks in uninterruptible sleep, so it must be correlated with CPU, memory, I/O, and run-queue evidence.
Your first objective is to establish what is slow and when. Useful symptoms include HTTP latency, a delayed SSH login, a batch job that overruns its normal window, or packet loss. Record the start time, affected commands or endpoints, whether the problem is reproducible, and what changed immediately beforehand. Preserve a normal-period baseline; otherwise a later reading has no comparison.
A safe workflow for a live VPS
- Define the incident window. Write down the exact symptom, affected workload, start and end times, frequency, and recent deployments, scheduled jobs, traffic changes, kernel updates, or storage changes.
- Capture a baseline. Save command output with timestamps during a normal period and during the incident. Include the distribution and kernel versions, workload conditions, and the identity of any process or container being examined.
- Measure the four resource classes. Check CPU and run queue, memory and reclaim pressure, filesystem or block I/O, and network throughput and errors. A short time series is more useful than one snapshot.
- Apply USE. For each resource, check utilization, saturation (work waiting), and errors before choosing a specialized profiler.
- Narrow the cause. Use
perffor CPU and software-event attribution. Escalate to ftrace or eBPF when the question involves kernel paths, latency, blocking, or protocol events. - Change one variable. Make one configuration or workload change, repeat the same measurements under comparable conditions, and roll back if the measured symptom does not improve.
This sequence keeps diagnostics proportional to risk. It also prevents a common mistake: installing a powerful tracer before proving which resource is constrained.
#1 Best Overall
- Read Before You Buy — No Video Output: These adapters support charging and USB 2.0 data transfer, but cannot transmit video signals. Except for standard USB webcams (which use USB data only), they are not compatible with HDMI/DisplayPort cables, video-capable USB-C hubs, or docking stations with video output.
- Convert USB-A Ports to USB-C: Designed to connect USB-C earphones, cables, flash drives, card readers, and other USB-C accessories to standard USB-A ports. Plug-and-play with no drivers or software required.
- Aluminum Alloy Housing: Built with a sturdy aluminum alloy shell that aids in heat dissipation and protects against daily wear and scratches. Designed to maintain a stable and secure connection.
- Compact & Travel-Friendly: The ultra-compact design allows the adapter to stay plugged into your device without blocking adjacent ports or adding bulk, reducing wear and tear on your original USB ports.
- 12-Month Warranty: Backed by a 12-month manufacturer warranty for peace of mind. Designed to meet strict quality control standards for reliable everyday performance.
Install and validate the baseline tools
The standard low-overhead baseline comes from the sysstat package: sar for historical time series, iostat for devices, vmstat for memory and run-queue activity, mpstat for per-CPU data, and pidstat for process-level context. On Ubuntu, the official workshop installation is:
sudo apt-get install sysstat bpfcc-tools bpftrace gcc
Package names and service configuration differ between VPS distributions. After installation, verify that the commands exist and that your account has the privileges they require. The same workshop validates both BCC and bpftrace by running opensnoop. A missing command can mean a different package name, a disabled repository, an unsupported kernel feature, or insufficient privilege; it does not prove that the server has no bottleneck.
Use USE to organize the first measurements
Brendan Gregg’s USE Method asks three questions about every resource. The table turns those questions into a practical first pass.
| Resource | Utilization | Saturation | Errors | Evidence to save |
|---|---|---|---|---|
| CPU | Busy time by CPU and process | Runnable tasks and run-queue delay | Thermal, throttling, or scheduler-related warnings when exposed | mpstat, vmstat, pidstat, and the incident timestamps |
| Memory | Resident memory and available memory | Reclaim, swapping, or allocation stalls | OOM-killer events and allocation failures | vmstat, free, process RSS, and kernel logs |
| Block or filesystem I/O | Device busy time and throughput | Queue depth and wait time | I/O errors, timeouts, or filesystem errors | iostat -x, pidstat -d, and relevant logs |
| Network | Bytes and packets per interface | Transmit or receive queues and retransmission pressure | Drops, errors, and TCP retransmits | sar -n DEV, socket summaries, and interface counters |
High utilization alone is not automatically a fault. A disk can be busy while requests complete quickly, or a CPU can be busy while latency remains acceptable. Saturation and errors tell you whether demand is waiting or failing.
CPU and run-queue diagnosis
Start with a time series
Run vmstat 1 for several intervals and mpstat -P ALL 1 in a second session. In vmstat, watch runnable processes, blocked processes, user and system CPU, idle time, and context switching. mpstat shows whether one virtual CPU is overloaded while others are idle, a pattern hidden by an all-CPU average. Add pidstat -u 1 to identify processes consuming user or system CPU.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Rank #2
- 5-in-1 USB-C Hub: Experience comprehensive connectivity featuring a Power Delivery input, two USB-A 2.0 ports, a USB-A 3.0 port, and an HDMI port. (Note: The USB-C power delivery input port is only for connecting an external wall charger to power your laptop and cannot power peripheral devices.)
- 90W Pass-Through Charging: Achieve optimal charging with 90W pass-through power to your laptop, supported by a total input of 100W, with the hub reserving 10W for operational efficiency. (Note: Wall charger not included.)
- Quick Data Transfers: Accelerate your productivity with rapid data transfers using a high-speed 5Gbps USB 3.0 port and two 480Mbps USB 2.0 ports.
- 4K HDMI Display: Enhance your visual experience with a hub capable of delivering 4K resolution at 30Hz in both mirror and extend modes. Please note that this hub is compatible with MacBook (macOS 12 and newer), Windows 10 and 11, ChromeOS, and laptops equipped with DP Alt Mode and Power Delivery. Note: This device is not compatible with Linux.
- What You Get: Anker USB-C Hub (5-in-1, 4K HDMI), welcome guide, 18-month warranty, and our friendly customer service.
top is useful for a live process view, but treat its load and CPU percentages as a starting point. Capture several samples and correlate them with the exact incident window rather than relying on a single screen refresh.
Interpret common CPU patterns
- High user CPU with a long run queue: the workload may simply exceed the vCPU allocation. Profile the hottest process before changing application settings.
- High system CPU: investigate kernel work such as networking, filesystem calls, or excessive context switching.
perfcan attribute the cost. - One CPU busy, others idle: a single-threaded process, interrupt imbalance, or affinity setting may be limiting throughput.
- Low CPU but high load: tasks may be blocked on memory or I/O. Check
vmstatandiostat -xbefore concluding that the VPS needs more vCPUs.
Memory pressure and reclaim
Use free -m for a readable snapshot, then use vmstat 1 to observe reclaim and swap activity over time. Distinguish memory used for cache from memory that is genuinely unavailable: Linux intentionally uses free RAM for filesystem cache. The important signals are available memory, sustained swap-in or swap-out, rising blocked tasks, and allocation or OOM events.
When a process is suspected, record its resident set and growth with pidstat -r 1 -p PID (replace PID with the process ID). Check kernel logs for OOM-killer messages. A one-time low-free-memory reading is not enough to diagnose pressure; repeated reclaim or swap activity aligned with the latency window is stronger evidence.
Storage and filesystem I/O
Use extended device statistics first
The Linux kernel documentation specifically recommends iostat -x for input/output-device utilization and performance. Run iostat -xz 1 during the incident. Extended output lets you compare each device’s utilization, request size, queueing, and wait time. Save enough intervals to show whether the condition is persistent or a short burst.
Free tools Windows power users keep installed
One-click scans. No signup required.
Use pidstat -d 1 to connect device activity to processes. A busy device with little queueing can be normal for a streaming workload; high wait time and an expanding queue indicate saturation. Filesystem latency can also come from metadata operations, sync writes, or a remote storage layer, so process-level I/O and the workload’s operation type matter.
Do not infer too much from one percentage
Virtualized storage hides physical-device details. A VPS may report a virtual disk that is busy because the host is contended, even when the guest process is not issuing an unusual number of requests. Conversely, a low guest utilization reading does not rule out latency in an upstream storage service. Document what the guest can measure and report the boundary rather than inventing a physical explanation.
Rank #3
- Sleek 7-in-1 USB-C Hub: Features an HDMI port, two USB-A 3.0 ports, and a USB-C data port, each providing 5Gbps transfer speeds. It also includes a USB-C PD input port for charging up to 100W and dual SD and TF card slots, all in a compact design.
- Flawless 4K@60Hz Video with HDMI: Delivers exceptional clarity and smoothness with its 4K@60Hz HDMI port, making it ideal for high-definition presentations and entertainment. (Note: Only the HDMI port supports video projection; the USB-C port is for data transfer only.)
- Double Up on Efficiency: The two USB-A 3.0 ports and a USB-C port support a fast 5Gbps data rate, significantly boosting your transfer speeds and improving productivity.
- Fast and Reliable 85W Charging: Offers high-capacity, speedy charging for laptops up to 85W, so you spend less time tethered to an outlet and more time being productive.
- What You Get: Anker USB-C Hub (7-in-1), welcome guide, 18-month warranty, and our friendly customer service.
Network throughput, drops, and retransmits
Collect interface time series with sar -n DEV 1. Compare receive and transmit rates with the application’s expected traffic, then inspect socket state with ss -s. Look for interface errors or drops in the counters exposed by the VPS and for a rise in TCP retransmissions during the same window. A bandwidth ceiling, packet loss, and an application waiting on a remote service produce different patterns even when users describe all three as “network slowness.”
If the VPS provider does not expose physical NIC counters or limits, state that limitation in the incident record. The absence of a guest-visible error is not proof that the upstream network is healthy.
When to use perf
The Linux kernel documentation describes perf as an analysis tool for Linux 2.6 and later that abstracts CPU-hardware differences and provides a command-line interface. Use it after baseline data identifies a CPU or software-event question.
Count events with perf stat
perf stat -p PID -- sleep 10 measures counters while the target process runs for ten seconds. Replace PID with the process ID and choose a window representative of the symptom. Counters can include cycles, instructions, branches, cache events, and context switches, depending on what the virtualized CPU exposes. VPS providers may restrict hardware counters; record any permission or event-availability error instead of treating it as a clean result.
Inspect a live profile with perf top
sudo perf top -p PID samples the hottest symbols while the process runs. This is useful for deciding whether time is concentrated in application code, libraries, system calls, or kernel paths. Stop the command when you have captured the relevant interval; continuous profiling is unnecessary for a short incident.
Record and report sampled call stacks
For a reproducible window, run sudo perf record -g -p PID -- sleep 30, then generate a report with sudo perf report. The -g option records call graphs when supported. The resulting samples show where CPU time was observed, not every event that occurred, so interpret them alongside the baseline and workload description. Sampled stacks can also be visualized as flame graphs; the visualization helps compare wide, shallow CPU work with a narrow, deep call path.
Rank #4
- Dual Converters, Infinite Potential：Includes 2× USB C male to USB A female adapters and 2× USB A male to USB C female adapters. Perfect for a wide range of uses—tablets with Bluetooth keyboards, expand USB ports on macbook, and more. Two different converters for all your daily needs
- Next-Level 10Gbps & 3A Charging: No more slow 480Mbps, this usb to usb c adapter has a transfer speed of up to 10Gbps, allowing you to do more transferring in less time. This usb adapter fits both USB A and USB C charger, supporting up to 3A fast charging
- Upgraded Exquisite Craftsmanship: With an aluminum alloy housing and metal connector, the usbc to usb adapter is extremely durable and sturdy. Rigorously tested to withstand more than 10,000 times of plugging and unplugging, ensuring long-lasting performance
- Broad Compatible: The usb c to usb adapter widely supports all USB C/ USB A devices like laptops, tablets, cellphones, car chargers, and phone chargers. Such as compatible with MacBook Pro/Air 2023/2022, Thunderbolt 4/3 Devices,Apple MagSafe Watch 9/8/7/SE/Ultra, iPad Pro 2022/2021, Samsung Galaxy S23/S20/S10, and iPhone 17/16/15 Pro. Plug and play
- Please Note: To reach 10Gbps speed, keep the cable under 3.3 ft. For USB A Male to USB C adapters, try flipping the USB C connector. USB C Male to USB A adapters support bidirectional 10Gbps transfer within 3.3 ft
Escalate to ftrace or eBPF for latency questions
Use ftrace when perf evidence points to a kernel function or event and you need kernel-level timing. Ftrace exposes function and event tracing through the kernel’s tracing interface, but it can require elevated privileges and suitable kernel configuration.
For eBPF, BCC and bpftrace are complementary front ends. Brendan Gregg’s guidance is concise: BCC is for complex tools and daemons, while bpftrace is for one-liners and short scripts. Choose based on the question rather than treating one as a replacement for the other.
BCC: prepared tools and complex instrumentation
BCC tools are appropriate when you need a ready-made workflow for filesystem operations, run-queue latency, block latency, or TCP retransmissions, or when a longer tool must maintain state. Examples commonly packaged by distributions include opensnoop for tracking file opens, run-queue and block-latency tools, and TCP retransmission tracers. Run the tool only for the incident window, save its command line and output, and verify that the package’s tool names match your distribution.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11bpftrace: focused one-liners
bpftrace is useful for a narrowly defined question, such as counting operations by process or measuring a specific tracepoint. A simple validation command is the distribution’s opensnoop; for custom scripts, first confirm that the required tracepoint or probe exists on the target kernel. Short scripts are easier to review and stop than an open-ended tracing program, but they still require appropriate BPF permissions.
Questions eBPF can answer
- Which processes perform filesystem operations above a chosen latency threshold?
- How long do tasks wait in the run queue before receiving CPU time?
- Which sockets or processes coincide with TCP retransmits?
- Where does a request spend time blocked off-CPU rather than executing?
These are targeted questions. Do not deploy a broad probe when a sysstat time series or perf sample already answers the incident.
Production safety, permissions, and VPS limits
- Privileges: perf, ftrace, and many BCC or bpftrace probes require root or specific capabilities. Use the least privilege your distribution supports and obtain authorization before tracing other tenants’ processes.
- Kernel support: BPF helpers, tracepoints, symbols, and hardware counters vary by kernel version and provider. A restricted VPS may disable them entirely.
- Overhead: No universal overhead percentage applies across workloads. Prefer short collection windows, narrow probes, and low-overhead sysstat sampling; record the command and interval so the measurement is reproducible.
- Data handling: Stack traces, command lines, file names, and network metadata can contain secrets. Restrict saved output and remove sensitive values before sharing an incident report.
- Availability: Baseline commands generally do not require stopping production. Schedule heavier tracing during a reproducible window and define a stop condition before starting.
A decision table for choosing the next tool
| Question | Start with | Escalate to | Why |
|---|---|---|---|
| Which resource is constrained? | vmstat, mpstat, iostat -x, sar |
Resource-specific process or device tools | Broad, low-overhead coverage and historical context |
| Which function consumes CPU? | pidstat and top |
perf top, then perf record/report |
Moves from process identity to sampled call stacks |
| Are hardware or software events unusual? | Baseline counters | perf stat |
Counts cycles, instructions, and other exposed events |
| Where is kernel time or latency spent? | Perf evidence and kernel logs | ftrace, BCC, or bpftrace | Traces functions, events, and blocked intervals |
| Is the issue a network error or retransmit? | sar -n DEV, ss -s, interface counters |
TCP-focused eBPF tracing | Correlates traffic, socket state, and retransmission events |
Common mistakes and recovery steps
Treating load average as the diagnosis
Recover by correlating load with run-queue, CPU, memory, and I/O measurements. If load is high while CPUs are mostly idle, inspect blocked tasks and storage or memory pressure.
Best Value
- 5-in-1 Connectivity: Equipped with a 4K HDMI port, a 5 Gbps USB-C data port, two 5 Gbps USB-A ports, and a USB C 100W PD-IN port. Note: The USB C 100W PD-IN port supports only charging and does not support data transfer devices such as headphones or speakers.
- Powerful Pass-Through Charging: Supports up to 85W pass-through charging so you can power up your laptop while you use the hub. Note: Pass-through charging requires a charger (not included). Note: To achieve full power for iPad, we recommend using a 45W wall charger.
- Transfer Files in Seconds: Move files to and from your laptop at speeds of up to 5 Gbps via the USB-C and USB-A data ports. Note: The USB C 5Gbps Data port does not support video output.
- HD Display: Connect to the HDMI port to stream or mirror content to an external monitor in resolutions of up to 4K@30Hz. Note: The USB-C ports do not support video output.
- What You Get: Anker 332 USB-C Hub (5-in-1), welcome guide, our worry-free 18-month warranty, and friendly customer service.
Running only one snapshot
Recover by collecting a short series that spans both normal and affected periods. A single sample can miss a queue buildup or a periodic job.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Assuming a missing command means a healthy system
Recover by checking package names, repositories, kernel configuration, and privileges on the target distribution. Validate with a known tool such as opensnoop after installation.
Changing several settings at once
Recover by restoring the last known configuration, changing one variable, and repeating the same workload and measurements. Keep the before-and-after output with timestamps.
Profiling without preserving workload conditions
Recover by recording request rate, batch size, process version, kernel and distribution versions, and the exact command line. A profile from an idle period cannot explain a production latency spike.
What to retain in the incident record
- Symptom, affected operation, first and last observed timestamps, and reproducibility.
- Normal and incident-period outputs from
vmstat,mpstat,iostat -xz,sar, and process-level tools. - Kernel and distribution versions, VPS CPU and storage presentation, package versions, and permission limitations.
- The exact
perf, ftrace, BCC, or bpftrace command, collection interval, and stop time. - The single change made, measured before-and-after result, and rollback decision.
Systems Performance: Enterprise and the Cloud, 2nd Edition, published in 2020, presents this measurement-first discipline in depth. The Linux kernel documentation and the perf manual provide the command semantics; use the versions installed on your VPS as the final authority for available options.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesBottom line
Debug a slow VPS as a narrowing experiment: define the symptom, establish a baseline, measure CPU, memory, I/O, and network with sysstat, and apply utilization, saturation, and errors to each class. Use iostat -x for detailed device evidence, perf for CPU and event attribution, and BCC or bpftrace for focused kernel and latency questions. VPS restrictions are part of the result, so document unavailable counters or probes instead of guessing. Re-measure after one controlled change, and keep the evidence that supports the final diagnosis.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
