Is there any possible command or way to check which process caused high cpu utilization in last 24 hours , because last night at 11:30 pm date:-30-nov-2022 we got alert that cpu utilization was high , so need to figure out which process cause high utilization.

sar

You can use sar. It’s included as part of sysstat. To install:

sudo apt-get install sysstat

Next, enable it by editing /etc/default/sysstat and setting “ENABLED” to true.

Doing so monitors your system and generates a report every 10 minutes, rotating them out after a week. You can modify this behavior by editing the sysstat crontab at /etc/cron.d/sysstat, or by changing rotation settings in the sysstat settings at /etc/sysstat/sysstat.

You can generate a real-time report with the following command:

sar -u 1 3

sysstat will collect background CPU usage data every minute, saving it to /var/log/sysstat/. You can then import this data for analysis, using either a spreadsheet program or a custom tool like sargraph.

atop

An alternative is to use atop which is able to store raw counters in a file for long-term analysis on system level and process level. By default, the daily logfiles are preserved for 28 days. System activity reports can be generated from a logfile by using the atopsar command.

atop is available in the ubuntu repositories by: sudo apt install atop

Top command

Top in batch mode

top -b -n 1

Then fish it out with Sed

top -b -n 1 | sed -n 8,8p

Directly access log file

/var/log/syslog

Simmer it down with grep

cat /var/log/syslog | grep Nov | grep 30 | grep  11: | grep pid=

Process command

Process Status (ps)

ps

    ps -eo lstart,pid,time,user,comm,pcpu  |\
    grep 2022 |\
    grep Nov |\
    grep pm |\
    grep 11 |\
    sort -n -k 10 -r |\
    head --lines 1

Explaination

ps (Process Status)
-e (all processes)
-o (format the output)
lstart (long start)
pid (process identification)
time (time)
user (the user)
comm (command)
pcpu (cpu usage percent)

Output piped into another program, grep.

grep 2022 | grep Nov | grep pm | grep 11

Then sorted, by number and the column containing the CPU percentage

 
sort -n -k 10 -r
-n (number)
-k (column)
-r (reverse)

Then piped in to head to allow the first line through only

head --lines 1