> Source: [sk65143](https://support.checkpoint.com/results/sk/sk65143)

# sk65143 - How to read the Linux /proc/stat file

| Property | Value |
|----------|-------|
| Solution ID | sk65143 |
| Date Created | 2011-08-08 |
| Last Modified | 2022-12-24 |
| Technical Level | General |
| Products | Security Gateway, Security Management Server, Multi-Domain Security Management Server |
| Versions | R81.20, R81.10 (EOS), R81.20, R81 (EOS), R81.10 (EOS), R81 (EOS), R81 (EOS), R81.10 (EOS), R81.20 |
| OS | Gaia |

## Symptoms

- * CPU load on Linux machine needs to be analyzed.

* Output of '`top`' command and output of '`vmstat`' command are controversial.

## Solution

Various pieces of information about kernel/system activity are available in the `/proc/stat` file. All of the numbers reported in this file are aggregates since the system first booted. This statistics varies with architecture.   

***Example from Linux 2.6.18-92 with 8 CPU cores*:**

**cpu**` 79242 0 74306 842486413 756859 6140 67701 0`  
` `**cpu0**` 49663 0 40234 104757317 542691 4420 39572 0`  
` `**cpu1**` 2724 0 2118 105420424 767 1719 6084 0`  
` `**cpu2**` 18578 0 18430 105191522 204592 0 714 0`  
` `**cpu3**` 513 0 979 105428698 739 0 2907 0`  
` `**cpu4**` 1623 0 2105 105426291 444 0 3373 0`  
` `**cpu5**` 3491 0 5326 105414798 7134 0 3087 0`  
` `**cpu6**` 1636 0 3081 105420689 201 0 8229 0`  
` `**cpu7**` 1011 0 2029 105426670 288 0 3731 0`  
` `**intr**` 1139300141 1054390414 3 0 5 255 0 0 0 3 0 0 0 4 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 2 3664020 44569070 0 0 0 0 0 0 0 0 0 0 0 0 0 1 1 1 0 0 0 0 0 2 3702799 4393655 0 0 0 0 0 0 0 0 0 0 0 0 0 1 1 1 0 0 0 0 0 2 3480582 527155 0 0 0 0 0 0 0 0 0 0 0 0 0 1 1 1 0 0 0 0 0 2 3445617 3870988 0 0 0 0 0 0 0 0 0 0 0 0 1 1 1 0 0 0 0 0 6 2 4877935 0 0 0 0 0 0 0 0 0 0 0 0 0 1 1 1 0 0 0 0 0 3 2 3445167 0 0 0 0 647 0 0 0 0 0 0 0 0 1 1 1 0 0 0 0 0 2 3 3481606 0 0 0 0 0 0 0 0 0 0 0 0 2004579 1 1 1 0 0 0 0 0 2 3 3445582 0 0 0 0 0 0 0 0 0 0 0 0 0 1 1 1 0`  
` `**ctxt**` 367249552`  
` `**btime**` 1310547399`  
` `**processes**` 107918`  
` `**procs_running**` 1`  
` `**procs_blocked**` 0`  

<br />

1. The very first line "**`cpu`** " aggregates the numbers in all of the other "**`cpu`*N*** " lines.   

   These numbers identify the amount of time the CPU has spent performing different kinds of work. Time units are in USER_HZ or Jiffies (typically hundredths of a second).   

   The meanings of the columns are as follows, from left to right:
   * 1st column : **user** = normal processes executing in user mode
   * 2nd column : **nice** = niced processes executing in user mode
   * 3rd column : **system** = processes executing in kernel mode
   * 4th column : **idle** = twiddling thumbs
   * 5th column : **iowait** = waiting for I/O to complete
   * 6th column : **irq** = servicing interrupts
   * 7th column : **softirq** = servicing softirqs

   <br />

   **Calculation:**   
   * sum up all the columns in the 1st line "**cpu** " :  
     `( user + nice + system + idle + iowait + irq + softirq )`  
     this will yield 100% of CPU time
   * calculate the average percentage of total '**idle** ' out of 100% of CPU time :`( user + nice + system + idle + iowait + irq + softirq ) = 100%``( idle ) = X %`  
     hence  
     **`average idle percentage X % = ( idle * 100 ) / ( user + nice + system + idle + iowait + irq + softirq )`**   

     *Based on the example above* :  
     `average idle percentage `**X %**` = ( 842486413 * 100 ) / ( 79242 + 0 + 74306 + 842486413 + 756859 + 6140 + 67701 + 0 ) = ( 842486413100 ) / ( 843470661 ) = 99.8833 %`  

   Notes:  
   Since Linux 2.6.11, there is an 8th column called '`steal`' - counts the ticks spent executing other virtual hosts (in virtualised environments like Xen)  
   Since Linux 2.6.24, there is a 9th column called '`guest`' - counts the time spent running a virtual CPU for guest operating systems under the control of the Linux kernel  
   Since Linux 2.6.33, there is a 10th column called '`guest_nice`' - Time spent running a niced guest (virtual CPU for guest operating systems under the control of the Linux kernel).  
   Refer to <http://www.linuxhowtos.org/manpages/5/proc.htm>  

2. The "**`intr`** " line gives counts of interrupts serviced since boot time, for each of the possible system interrupts. The first column is the total of all interrupts serviced; each subsequent column is the total for that particular interrupt.  

3. The "**`ctxt`** " line gives the total number of context switches across all CPUs.  

4. The "**`btime`** " line gives the time at which the system booted, in seconds since the Unix epoch (January 1, 1970).  

5. The "**`processes`** " line gives the number of processes and threads created, which includes (but is not limited to) those created by calls to the fork() and clone() system calls.  

6. The "**`procs_running`** " line gives the number of processes currently running on CPUs (Linux 2.5.45 onwards)  

7. The "**`procs_blocked`**" line gives the number of processes currently blocked, waiting for I/O to complete (Linux 2.5.45 onwards)

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content