What is "steal time" on Linux?
Posted: Sun May 19, 2013 6:08 pm
When the Linux kernel sees a gap in its time accounting -- when it is involuntarily held up and sees a time skip -- it calls this "steal time" or "stolen time". This represents part of the small virtualization overhead of the system, with the rest of the overhead coming in the form of less-obvious delays in I/O, memory accesses, time to execute certain instructions, and so on. You can see the steal-time in "top" as a number beside "st".
Here at NFO, seeing a steal-time of less than 1% is normal, because Xen needs a certain amount of resources to swap out the running VDS for the HVM stubdomain and overall dom0 (I/O and administration) domain. Because we have such underloaded machines, you should not see more than 1%, unlike at some hosts that run large numbers of VPSes on each node. If you see a larger value, please let us know, so that we can inspect the machine to see if there's something unusual going on, like an attack.
Here at NFO, seeing a steal-time of less than 1% is normal, because Xen needs a certain amount of resources to swap out the running VDS for the HVM stubdomain and overall dom0 (I/O and administration) domain. Because we have such underloaded machines, you should not see more than 1%, unlike at some hosts that run large numbers of VPSes on each node. If you see a larger value, please let us know, so that we can inspect the machine to see if there's something unusual going on, like an attack.