mpstat

What it does

mpstat (multi-processor statistics) reports CPU utilization broken down into categories like %usr (user space), %sys (kernel), %iowait (waiting on disk I/O), %irq, and %idle, either as an aggregate across all cores or per individual core. It's part of the sysstat package alongside iostat and sar, and is the standard tool for understanding where CPU time is going and whether load is balanced across cores — something plain top summarizes less precisely.

Beginner examples

• mpstat — print one CPU utilization report averaged since boot
• mpstat 1 — print a new report every 1 second, continuously
• mpstat 1 5 — print 5 reports at 1-second intervals, then stop
• mpstat -P ALL 1 — show a separate line per CPU core, refreshed every second

mpstat 1 5

Advanced examples

• Watch for I/O bottlenecks by focusing on %iowait: mpstat 2 | awk '{print $1, $6}'
• Check whether load is balanced across cores or piling onto one: mpstat -P ALL 1 5
• Combine with interrupt statistics to correlate CPU spikes with hardware interrupts: mpstat -I SUM 1
• Get everything at once (utilization + interrupts, all CPUs): mpstat -A
• Log CPU stats to a file for later review during a load test: mpstat -P ALL 5 > cpu_report.log &

mpstat -P ALL 1 5

Common mistakes

• Running mpstat with no arguments and thinking the single report is "live" data — with no interval, it reports the average since boot, not the current moment.
• Ignoring %iowait and assuming a "high CPU" problem when the real bottleneck is disk or network I/O the CPU is waiting on.
• Not installing sysstat first — many minimal Linux images and containers don't include it by default, so mpstat: command not found is common on fresh systems.
• Looking only at the aggregate all line and missing that one specific core is saturated while others sit idle (a sign of poor thread/process affinity or a single-threaded bottleneck).

Tips

• Use mpstat -P ALL whenever you suspect a workload isn't parallelizing well; a single hot core next to several idle ones is a strong single-thread bottleneck signal.
• Pair mpstat 1 in one terminal with iostat 1 in another during a performance investigation — CPU and disk stats together usually explain a slowdown.
• The last column, %idle, is the complement of everything else; if user+sys+iowait looks fine but %idle is still low, check %irq and %soft for interrupt-heavy workloads (e.g. high network traffic).
• Run mpstat 1 5 (a handful of samples) rather than a single report when explaining a transient spike — one report can be misleading if it lands on a quiet moment.

Best practices

• Always specify an interval (mpstat 1) rather than relying on the boot-average single report when diagnosing current system behavior.
• In monitoring/logging scripts, pin a fixed count (mpstat 1 60) so the job terminates predictably rather than running forever.
• Correlate mpstat's %iowait spikes with iostat's device-level throughput to confirm whether a specific disk is the source of the wait.
• Install sysstat as part of your base server image if you regularly need CPU/IO diagnostics, rather than installing it reactively during an incident.

Real-world use cases

• Diagnosing whether a slow batch job is CPU-bound, I/O-bound, or waiting on interrupts by watching %usr, %iowait, and %irq during a run.
• Confirming that a multi-threaded application is actually using multiple cores by checking mpstat -P ALL for balanced utilization across cores.
• Capacity planning: logging mpstat output over a peak traffic window to decide whether a server needs more CPU cores or the workload needs better parallelization.

Common interview questions

• What does %iowait mean and why does it matter? It's the percentage of time a CPU was otherwise idle but had a pending disk I/O request; high %iowait means disk latency, not CPU compute, is the bottleneck, even though the CPU "looks busy" in some tools.
• How would you check if load is evenly spread across CPU cores? mpstat -P ALL 1 prints a per-core row each interval, letting you compare %usr/%idle across cores to spot an imbalance.
• What package provides mpstat and what other tools come with it? The sysstat package, which also provides iostat, sar, pidstat, and sadc/sadf for historical performance data collection.