Monitor VPS CPU, Disk I/O and Bandwidth (htop, iotop, vnStat, Netdata) and Stay Within Fair Use

To stay within fair use on a JUSTG cloud VPS, watch three numbers: the 1-hour CPU average (keep it at or below 50%), sustained disk throughput (not above 100 MiB/s for 4 hours or more) and network use (not above 70% of the shared port for long periods), plus your monthly traffic. This guide shows how to measure each one with standard Linux tools on Debian, Ubuntu and Rocky Linux / AlmaLinux, how to get a warning before a limit is reached, and how to throttle your own jobs.

The Fair-Use Rules and Plan Limits

Each plan also includes a monthly traffic quota:

See the cloud VPS plans guide for prices and details.

Step 1: Install the Tools

# Debian / Ubuntu
apt update && apt install -y htop sysstat iotop vnstat nload iftop

# Rocky Linux / AlmaLinux (htop, vnstat, nload and iftop come from EPEL)
dnf install -y epel-release && dnf install -y htop sysstat iotop vnstat nload iftop

Step 2: Check CPU Load and the 1-Hour Average

The fair-use rule is about the average over an hour, so a single look at top is not enough. Use these commands:

nproc                        # number of vCPU cores
uptime                       # load average over 1, 5 and 15 minutes
top -b -n 1 | head -n 5      # %Cpu(s) line: us sy ni id wa ... st
mpstat 60 60                 # one hour of 1-minute samples, then an "Average" line
pidstat -u 5 3               # which processes use the CPU

• %Cpu(s) in top is the whole VPS. CPU use is 100 - id, so id below 50 for an hour means you are above the limit.
• htop shows each core as a bar. A single process can show more than 100% because 100% means one full core. Press P to sort by CPU and M by memory.
• Load average counts processes waiting for CPU and disk, so a high value with low CPU use usually points to slow I/O.
• st (steal) is time the hypervisor gave to others. If it stays high while your own use is low, open a ticket with the output.

To see past hours, turn on sar history. It keeps a sample every 10 minutes, so you can check any hour after the fact:

# Debian / Ubuntu: turn on history collection (Rocky/Alma: only enable the service)
sed -i 's/^ENABLED="false"/ENABLED="true"/' /etc/default/sysstat
systemctl enable --now sysstat

sar -u                           # CPU every 10 minutes today, plus an Average
sar -u -s 13:00:00 -e 14:00:00   # one specific hour
sar -d -p                        # disk throughput history (rkB/s, wkB/s)
sar -n DEV                       # network history per interface (rxkB/s, txkB/s)

Step 3: Measure Disk I/O with iostat, iotop and pidstat

iostat -xm 5        # per disk (e.g. vda): rMB/s, wMB/s, %util, r_await, w_await
iotop -oPa          # only processes doing I/O, with accumulated totals
pidstat -d 5        # per-process kB_rd/s and kB_wr/s

# If iotop warns about CONFIG_TASK_DELAY_ACCT, enable it until the next reboot:
sysctl -w kernel.task_delayacct=1

In iostat, add rMB/s and wMB/s for your disk. Short peaks are normal; what matters is a total that stays around 100 or more for hours. Typical causes are large backups, database imports, log floods, swapping on a small plan, or a crawler writing millions of files. iotop and pidstat -d show which process is responsible.

Step 4: Track Monthly Traffic with vnStat

vnStat records traffic per interface in the background with almost no overhead, and keeps history across reboots.

systemctl enable --now vnstat
ip -br link              # interface name, e.g. eth0 or ens3

vnstat -i eth0           # summary (data appears after about 5 minutes)
vnstat -m                # per month, with an estimate for the current month
vnstat -d                # per day
vnstat -h                # per hour
vnstat -l                # live rate in Mbit/s, Ctrl+C to stop

vnstat -m shows received (rx), sent (tx) and total traffic per month, and an estimated line for the current month. Compare that estimate with your plan's quota. vnStat counts both directions; if you are unsure how your quota is counted, ask by ticket.

For a live view of the port, use these. Sustained rates near 350 Mbps on the 500 Mbps port mean you are over the 70% guideline:

nload eth0               # live in/out graph for one interface
iftop -i eth0 -P         # live traffic per connection, with ports
ss -tnp state established | head -n 20   # which processes hold connections

Step 5: Optional Dashboards: Netdata or Prometheus node_exporter

Netdata

Netdata draws real-time graphs of CPU, disk, network and services with no setup. It can use 100 MB of RAM or more, so it suits plans with 2 GB or more; on mini and 01, the command-line tools above are a better fit. Never expose its port to the internet:

# Debian / Ubuntu (Rocky/Alma: dnf install -y netdata from EPEL)
apt install -y netdata

# /etc/netdata/netdata.conf - listen on localhost only
[web]
    bind to = 127.0.0.1

systemctl restart netdata
ss -tlnp | grep 19999        # must show 127.0.0.1:19999, not 0.0.0.0 or *

# On your own computer: open a tunnel, then browse http://localhost:19999
ssh -N -L 19999:127.0.0.1:19999 [email protected]

Prometheus node_exporter

If you already run Prometheus and Grafana elsewhere, the lightweight node_exporter is enough on the VPS. It listens on port 9100 on all interfaces, so allow only your Prometheus server (on Rocky/Alma, use the official binary from the Prometheus releases page):

apt install -y prometheus-node-exporter
ss -tlnp | grep 9100

# Allow only your Prometheus server to scrape it
ufw allow from 203.0.113.30 to any port 9100 proto tcp
# firewalld (Rocky/Alma):
firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="203.0.113.30" port port="9100" protocol="tcp" accept'
firewall-cmd --reload

Step 6: Set Up a Simple Alert

This small script warns when the 15-minute load passes half of your cores, the root disk is 85% full, or monthly traffic passes 80% of the quota. Load is only a rough early sign; use sar -u to confirm the real CPU average. Warnings go to the system log and, optionally, to a webhook (chat, email gateway and so on):

#!/bin/bash
# /usr/local/sbin/vps-alert.sh - simple early warnings, run from cron
QUOTA_GB=1000        # your plan's monthly traffic, e.g. plan 01 = 1 TB
IFACE=eth0
WEBHOOK=             # optional, e.g. https://hooks.example.com/REPLACE-ME

alert() {
  logger -t vps-alert "$1"
  [ -n "$WEBHOOK" ] && curl -fsS -m 10 --data-urlencode "text=$(hostname): $1" "$WEBHOOK" >/dev/null
}

CORES=$(nproc)
LOAD15=$(cut -d' ' -f3 /proc/loadavg)
awk -v l="$LOAD15" -v c="$CORES" 'BEGIN { exit !(l > c * 0.5) }' \
  && alert "15-minute load $LOAD15 on $CORES cores"

DISK=$(df --output=pcent / | tail -n 1 | tr -dc '0-9')
[ "$DISK" -ge 85 ] && alert "root file system ${DISK}% full"

USED=$(vnstat -i "$IFACE" --oneline b | cut -d';' -f11)
[ -n "$USED" ] && [ "$USED" -gt $(( QUOTA_GB * 800000000 )) ] \
  && alert "over 80% of monthly traffic: $(( USED / 1000000000 )) GB"
exit 0

chmod 700 /usr/local/sbin/vps-alert.sh
echo '*/15 * * * * root /usr/local/sbin/vps-alert.sh' > /etc/cron.d/vps-alert
journalctl -t vps-alert --since today      # see past warnings

Field 11 of vnstat --oneline b is the current month's total in bytes. Set QUOTA_GB and IFACE for your VPS.

Step 7: Throttle Your Own Workload

Most fair-use problems come from one heavy job. Slow that job down instead of the whole server.

CPU and disk for a single command

# Lowest CPU and disk priority for a one-off job
nice -n 19 ionice -c3 tar -czf /root/site.tar.gz /var/www

# Hard caps for a one-off job (cgroup v2: Debian 11+, Ubuntu 22.04+, Rocky/Alma 9)
lsblk -d -o NAME,SIZE        # disk name, usually vda
systemd-run --scope -p CPUQuota=50% \
  -p IOReadBandwidthMax="/dev/vda 50M" -p IOWriteBandwidthMax="/dev/vda 50M" \
  tar -czf /root/site.tar.gz /var/www

nice and ionice only lower priority: the job still runs at full speed when nothing else competes, and ionice has no effect with the none or mq-deadline disk schedulers common on virtual disks. systemd-run with CPUQuota and IO*BandwidthMax sets real caps. CPUQuota=100% equals one full core.

A permanent cap for a service

systemctl edit myapp.service
# add in the editor:
[Service]
CPUQuota=100%
IOReadBandwidthMax=/dev/vda 80M
IOWriteBandwidthMax=/dev/vda 80M

systemctl restart myapp.service
systemctl show myapp.service -p CPUQuotaPerSecUSec

Network transfers

rsync -a --bwlimit=20M /var/www/ [email protected]:/srv/www/   # about 170 Mbit/s
wget --limit-rate=20m https://example.com/big.iso
curl --limit-rate 20M -O https://example.com/big.iso

# Cap ALL outgoing traffic on eth0 at 300 Mbit/s (lost on reboot)
tc qdisc replace dev eth0 root tbf rate 300mbit burst 256kb latency 50ms
tc -s qdisc show dev eth0
tc qdisc del dev eth0 root        # remove the cap

Step 8: Upgrade or Move to a Dedicated Server

Throttling helps with occasional peaks. If your normal workload keeps the CPU above a 50% hourly average, needs sustained disk throughput, or regularly fills the port or the monthly quota, the server is too small for the job:

• Upgrade the plan from the service page for more cores, RAM, SSD and traffic. See how to upgrade a VPS and extend the partition.
• Choose a dedicated server for constant heavy CPU, disk or bandwidth use: the hardware is yours alone. Dedicated servers are available in Tokyo, Seoul and Johannesburg from $199/mo and in Moscow from $299/mo. Ask Sales/Inquiries by ticket for advice.

FAQ

My VPS gets slow after a long busy period. Is it the CPU limit?

It can be: if the 1-hour CPU average goes above 50%, the CPU is limited to 50% automatically. Find the busy process with htop or pidstat -u, reduce or throttle it, and check the hourly history with sar -u.

Is the 70% port rule about the monthly traffic quota?

No, they are separate. The 70% rule is about speed over long periods (about 350 Mbps on the 500 Mbps port), while the quota is the total volume per month. Watch the first with vnstat -l or nload and the second with vnstat -m.

Who can help me read the numbers?

Open a ticket to Technical support with the service IP, the time with time zone and the command output. JUSTG offers 24/7 AI support by ticket, and engineers follow up when a person is needed.