← back to latest

Read the load average without mistaking it for CPU usage

uptime

anatomy

uptime
Print the current time, how long the machine has been up, how many users are logged in, and three load averages. On Linux the whole line comes from two kernel files, `/proc/uptime` and `/proc/loadavg`, so it costs nothing to run even on a machine that is struggling to do anything else.
load average
Not a percentage. Each number is a smoothed count of tasks that wanted to run: on the CPU, waiting for a CPU, and on Linux also tasks stuck in uninterruptible sleep, usually waiting on disk or NFS. A 4 means that on average four tasks were in one of those states. Whether that is busy depends entirely on how many cores are there to serve them.
1, 5, 15
The three numbers cover the last 1, 5, and 15 minutes. They are exponentially damped moving averages, not windows: recent samples weigh more, and old samples fade out instead of dropping off a cliff. Read them left to right as a trend. A 1-minute figure well above the 15-minute one means the load is rising right now; the reverse means it is draining away.

Sample output

 14:32:07 up 41 days,  3:18,  2 users,  load average: 6.12, 3.87, 1.95

The load is climbing: 1.95 over fifteen minutes, 6.12 over the last one. On a 4-core machine that is 1.5 tasks for every core, so work is queuing. On a 16-core machine the same 6.12 means most cores are idle. Check the core count with nproc before deciding either way.

When you would reach for it

A server feels slow and you want one number before you go digging. An alert fired about “high load” and you need to know if it is still happening or already over. You are logged in over a bad connection and don’t want to start top. uptime answers three questions in one line: is the machine busy, is it getting busier, and did it reboot when nobody expected it to.

Gotchas

  • On Linux, a high load with idle CPUs usually means disk. Tasks waiting on a slow disk, a hung NFS mount, or a failing drive sit in the D state and count toward the load without using any CPU. If top shows the CPUs mostly idle and a high wa (I/O wait) figure, look at storage, not processes. macOS and the BSDs count only runnable tasks, so the same number means something narrower there.
  • Inside a container, uptime reports the host’s load and the host’s uptime. /proc/loadavg is not namespaced, so a container on a busy 64-core host shows a load that has nothing to do with your process. nproc inside the container reports the CPUs you are allowed to be scheduled on, which may not match the host’s core count either.
  • The 1-minute number lags. The kernel samples every five seconds and smooths the result, so a burst that ends right now still takes about a minute to fade from the first figure. Don’t restart a service because of a 1-minute spike without checking whether it is still happening.
  • macOS prints load averages: with no commas between the numbers, and Linux prints load average: with commas. A script that splits the line on commas works on one and breaks on the other. Read /proc/loadavg on Linux or sysctl -n vm.loadavg on macOS when you need the numbers in a script.

Variants

$ awk -v n="$(getconf _NPROCESSORS_ONLN)" '{printf "1m %.2f  5m %.2f  15m %.2f  per core\n", $1/n, $2/n, $3/n}' /proc/loadavg

Linux. Divide the load by the core count so the number reads the same on every machine: under 1.0 per core means there is spare capacity, and above it means work is queuing. getconf works on macOS too, where nproc does not exist

$ ps -eo state=,pid=,comm= | awk '$1 ~ /^[RD]/'

Linux. List the tasks that make up the load right now: R is running or waiting for a CPU, and D is stuck waiting on I/O. A long list of D rows means the disk is the problem, not the CPU

$ uptime -s

Linux, procps. Print the exact boot time instead of a duration, which is what you want to compare against a log timestamp when checking whether a machine rebooted overnight

lineage

The load average is older than Unix. TENEX, the PDP-10 operating system from Bolt Beranek and Newman, computed a 1, 5, and 15 minute exponentially damped average of its run queue in the early 1970s, and RFC 546, published in 1973, is literally a report of TENEX load averages on the ARPANET for the month of July. BSD adopted the same three numbers and the same damping, and the uptime command, which prints nothing but the first line of w, appeared in 3.0BSD. Linux inherited the idea and then quietly changed what it measures. In 1993 Matthias Urlichs sent a patch that counted tasks in uninterruptible sleep alongside runnable ones, arguing that a machine swapping itself to death should not report an idle load of zero. The patch went in, the definition never went back, and almost thirty years of confused dashboards followed, because the same number now means CPU demand on a BSD and CPU plus disk demand on Linux. Brendan Gregg dug the original patch out of an old mail archive in 2017, which is where most people first learned why their idle-looking Linux box reported a load of 30.