Wiki· Updated 19 Oct 2026
rs slow — why it is slow
What rs slow findings mean: steal, iowait, swapping, OOM, a busy disk, conntrack — and what to do.
rs slow measures the server for N seconds (--seconds N, 5 by default). Run it while it is slow.
| Finding | Meaning | What to do |
|---|---|---|
| steal ≥ 10% | the hypervisor withholds CPU: the provider's host is oversold or the plan limits CPU | cannot be fixed inside — ask the provider, move hosts or to a plan with dedicated cores |
| iowait ≥ 20% | processes wait for the disk | see Disks: who writes — iotop -oPa; often a database without indexes, logs or a backup |
| CPU 90%+ busy | the CPU is doing work | Top by CPU: that process is the cause; for containers — the Containers section |
| Load above the core count | tasks queue up (CPU or disk) | look at iowait and processes |
| < 10–20% memory available | memory is running out | Top by memory; limit the service or add RAM |
| Active swapping | memory is short, pages go to disk — everything slows | free memory or add RAM |
| No swap | when memory runs out the kernel kills processes at once | a swap file: fallocate -l 2G /swapfile && chmod 600 /swapfile && mkswap /swapfile && swapon /swapfile and a line in /etc/fstab |
| OOM kills in 24 h | the kernel killed processes for lack of memory | which ones — in the report; journalctl -k --since -24h | grep -i oom |
| Disk busy 80%+ of the time | the disk is the bottleneck | iotop -oPa; SSD instead of HDD, fewer logs, heavy jobs at night |
| File system 85%+ full | at 100% databases and Docker stop | rs clean, du -xh / --max-depth=2 | sort -h | tail |
| Container restarts | crashes on start or on memory | docker logs --tail 50 <name> |
| conntrack 80%+ | the connection table is nearly full — new connections are dropped | sysctl -w net.netfilter.nf_conntrack_max=… (double it), permanently in /etc/sysctl.d/ |
| Open files near the limit | apps get "Too many open files" | find the descriptor leak; raise fs.file-max |
| Disk errors in the kernel log | the disk may be failing | back up now; SMART: smartctl -a /dev/<disk>; on a VPS — the provider |
If nothing stood out, run it again while it is slow, and longer: rs slow --seconds 30.