Load average high with low CPU utilization — D-state processes
top shows load average well above CPU core count
Focused incident mode — strips away everything but this runbook.
Symptoms
- top shows load average well above CPU core count
- CPU usage (%cpu) is low but load is 20+ on an 8-core system
- top shows many processes in D (uninterruptible sleep) state
A high load average with low CPU is the classic D-state signature. The processes are not burning CPU — they are stuck in the kernel waiting for I/O that never completes.
Evidence to grab
Collect these artifacts before you change anything — they prove (or rule out) each cause.
Load average and CPU state
uptime && top -bn1 | head -5D-state process count
ps -eo state | grep -c '^D'
Diagnostic flow
Run the steps in order, marking each claim confirmed or refuted. The evidence you gather feeds the ranked causes below.
Guided decision tree is ready.
Steps with commands, expected output, and pass/fail branches.
Ranked root causes
Evidence checklist
- D-state processes are waiting on block I/O (wchan shows blk_* or ext4_*)
- iostat shows high await and low IOPS
Confirm before fixing
iostat -x 1 5Monitor disk I/O latency and throughput
Fix
iostat -x 1 3Identify the slow disk; replace or remount if hardware is failing
Resolution runbook
Apply from top to bottom after the cause is confirmed. Review every command before running it — risk tags are shown on each.
uptime && nprocConfirm load exceeds CPU cores
ps -eo state | grep -c '^D'Count D-state processes
ps -eo pid,stat,wchan:20,cmd | grep '^\s*[0-9].*D'Find what the D-state processes are waiting on
iostat -x 1 5Check disk I/O latency
Prevention
- Monitor D-state process count via /proc/stat and alert when it exceeds 5.
- Use fast local storage (SSD/NVMe) for I/O-heavy workloads.
- Set NFS mount options: soft,timeo=30,retrans=3 to prevent indefinite hangs.
- Alert on high iowait (>20%) via vmstat or node_exporter.
Related runbooks
Same stack, same failure family — worth a skim.
Commands marked READ CHANGE DESTRUCTIVE — never run DESTRUCTIVE commands against production data you cannot restore. Copy → verify → execute.