This question already has an answer here:

Is there any way to find which process was running on a particular time in linux?

I found the disk utilization was 99% and CPU utilization was 100% on two different times yesterday. The issue was resolved automatically, but I need to find which process or user causes the issue.

I used sar -d -f /var/log/sa/sa11 to find disk utilization. Util was 98% from 11:10:01 to 11:40:03. and sar -P ALL -f sa11 to find cpu utilization. user was 99.36% from 8:40 to 9:50.

After that everything was normal without any restart.

I need to know which process(es) causes the utilization so high.

marked as duplicate by Gilles linux Dec 14 '15 at 23:35

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.


By default, and depending of your distro, there is not much recording of what is running. Your only chance is that may be the application leaves a message in some log located in /var/log/ which you can spot using time slot analysis.

A more accurate way is to explicitly monitor each exec syscall which you can achieve using auditd daemon. But this mean installing, configuring and running this daemon.

  • auditd is running on my vm. How can I get the information of that particular time? – al mamun Dec 14 '15 at 17:07
  • first you can see what is logged in /var/log/auditd/, depending of the rules applied you can have some luck (or not) – netmonk Dec 14 '15 at 17:09
  • There is no file or dir named /var/log/auditd. I checked auditctl -l. It returns "No Rules". – al mamun Dec 14 '15 at 17:15

Not the answer you're looking for? Browse other questions tagged or ask your own question.