How I Troubleshot a KVM Memory Issue That Led to Swap & High CPU (Runbook + Real Scenario)

Recently, I noticed something strange on one of my KVM hypervisors. The server wasn’t heavily loaded, but earlier I saw: qemu-system-x86 consuming 800%+ CPU kswapd running hot Swap usage near 100% But when I checked later: CPU was low RAM had plenty free Swap was still full Here’s the exact troubleshooting flow I followed — and how you can do the same. 🧠 Environment Context Hypervisor: KVM + libvirt Host RAM: 314 GB Swap: 976 MB Multiple VMs running Problem VM: testnet-node3 🔍 Step 1 — Identify High CPU Process First signal: ps -eo pid,comm,%cpu,%mem --sort = -%cpu | head -n 10 Output showed: qemu-system-x86 818% ⚠️ Important: In Linux, 100% = 1 core. So: 800% = ~8 cores fully used That means one VM was heavily consuming CPU. 🔎 Step 2 — Identify Which VM Maps to That Process Each VM is a qemu-system-x86 process. To map PID to VM: ps -fp <PID> Or list VMs: virsh list --all To see details: virsh dominfo <vm-name> This is how I identified: testnet-node3 📊 Step 3 — Check Host Memory & Swap