What is "steal time" on Linux?

[Edge100x]

When the Linux kernel sees a gap in its time accounting -- when it is involuntarily held up and sees a time skip -- it calls this "steal time" or "stolen time". This represents part of the small virtualization overhead of the system, with the rest of the overhead coming in the form of less-obvious delays in I/O, memory accesses, time to execute certain instructions, and so on. You can see the steal-time in "top" as a number beside "st".

Here at NFO, seeing a steal-time of less than a few percentage points is normal, because Xen needs a certain amount of resources to swap out the running VDS for the HVM stubdomain and overall dom0 (I/O and administration) domain. Steal time occurs more on SMT (hyperthreaded) machines because Xen sees all of the SMT processors as full, physical ones and gets confused when they don't perform that way.

Because we have such highly underloaded machines, you should not see much steal time, unlike at some hosts that run large numbers of VPSes on each node. If you see a larger value, please let us know, so that we can inspect the machine to see if there's something unusual going on, like an attack.