SaaS on 4-vCPU VPS: p95 API 120 ms → 800 ms on a plain Tuesday. Modest user CPU, %steal 12–25%. Host support: no platform incident. Correct — shared economics, not outage.
CPU steal (%st) is time your VM wanted CPU but the hypervisor served elsewhere.
Reading top/vmstat
CPU line st column. High st + app latency = host contention.
Correlate with hours — neighbor backup 02:00 UTC classic.
Steal vs other causes
High st low us = neighbor. High wa = disk. High us = your code. Profile before blaming host.
Actions
Measure 7 days, migrate host, guaranteed CPU tier, dedicated if strict SLA, cache/queue mitigation.
Host choice
Read shared vs dedicated CPU fine print. Benchmark after provision. Use provider steal metrics if exposed.
Contract
CPU SLA rare; document steal for renegotiation or exit.
Support evidence pack
Graph %steal 7 days 1-min granularity. p95 API correlation same period. Instance type + host ID if known. fio/cpu benchmark before/after host migrate.
Ask: host migration or credit — not "shared is normal" without data.
If refused: comparator with identical benchmark.
Steal acceptable for your SLO: define number (e.g. <3% sustained) before contract signature.
Internal SLA
Define max acceptable steal per prod vs staging tier. Staging tolerates more — do not mix metrics.
Renewal: benchmark three candidate hosts same config — data-driven choice.
Burstable instances (T-type): distinguish steal vs CPU credit exhaustion — different metrics, different fixes.
CI compile on same prod VPS: steal hits builds and API — separate CI runner.
Internal communication
Steal dashboard visible to prod team — avoids « it's the code » vs « it's the host » debate without data.
Before/after upgrade benchmark: finance ticket ROI proof.
Mixed workload: steal hits cron backup same VPS as API — schedule backup off-peak neighbor too.
Operational summary
Sustained CPU steal proves shared contention — benchmark, migrate host, or dedicated vCPU tier. Distinguish steal vs burstable credit exhaustion. Evidence graphs for support and contract renewal.
Do not optimize code forever if steal >10% sustained — hosting invoice first.
Support escalation
Open ticket with 7d steal graph, instance ID, p95 impact, identical benchmark neighbor host if available. Request host migration or credit. If documented refusal: comparator migrate short-list.
Internal: do not blame dev without low steal proof — profile app one day first.
Finance conversation
Present steal graph plus revenue impact estimate — converts « optional upgrade » to « scheduled maintenance budget ».
Dedicated vCPU line item often cheaper than engineer days tuning code on stolen CPU.
Renewal leverage
Attach steal graph and p95 latency correlation to renewal conversation. Competitor benchmark on same price tier strengthens migration case. Document decision if staying despite steal — conscious tradeoff not neglect.
Night batch jobs on same VPS as daytime API share steal budget — schedule fairly or separate instances.
Steal near zero on fresh tiny instance still can hit IOPS or network cap — holistic saturation view.
Operational follow-up
Steal on host renewal dashboard — data beats opinion. Benchmark before signature. Trial competitor host benchmark before renewal signature — cheap insurance. Document gaps between host marketing and field measurement in the quarterly review.
Quarterly follow-up
Steal on host renewal dashboard — data beats opinion. Benchmark before signature. Trial competitor host benchmark before renewal signature — cheap insurance. Document gaps between host marketing and field measurement in the quarterly review.
Keep a dated runbook, before/after metrics, post-incident review — cumulative discipline beats Friday night panic.
Keep a dated runbook, before/after metrics, post-incident review — cumulative discipline beats Friday night panic.
Keep a dated runbook, before/after metrics, post-incident review — cumulative discipline beats Friday night panic.
Keep a dated runbook, before/after metrics, post-incident review — cumulative discipline beats Friday night panic.
Keep a dated runbook, before/after metrics, post-incident review — cumulative discipline beats Friday night panic.
Keep a dated runbook, before/after metrics, post-incident review — cumulative discipline beats Friday night panic.
Evidence pack
7d steal graph + p95 API. Renewal benchmark three hosts.
Decide and move forward without blind spots
- Seven-day
%stealgraph — one-minute granularity, p95 API correlation same period. - Profile app one day — do not blame host without low steal proof and consistent wa/us.
- Open ticket with evidence pack — instance ID, fio/cpu benchmark, request host migration or credit.
- Define acceptable steal SLO — e.g. <3% sustained before contract signature.
- Short-list migrate — comparator with identical benchmark if documented refusal.
Compare guaranteed CPU VPS via our directory and comparison tool.
Frequently asked questions
Acceptable steal?
Near 0% idle. Sustained > 5–10% under load = investigate. Short spikes possible on shared.
How to measure?
top/vmstat %st, sar -u, 1-min monitoring over days.
Does bigger VPS help?
Sometimes — not guaranteed. Dedicated/guaranteed CPU tiers exist.
Different from cloud throttle?
Yes. Steal = hypervisor. Throttle = burstable credits. Both can stack.
Archive a steal graph before opening support ticket — without a curve it is opinion; with a curve it is negotiation.