Glossary · Performance

USE Method

The USE method checks every resource for Utilization, Saturation and Errors to find performance bottlenecks quickly.

Updated November 11, 2026

The USE method is a troubleshooting approach created by Brendan Gregg. For each resource, such as CPU, memory, disks and network interfaces, you check Utilization (how busy it is), Saturation (how much work is waiting) and Errors (failed operations).

Why it matters

When a server is slow, it is tempting to guess. USE gives a short, systematic list so you rule resources in or out quickly. Saturation is the key addition: a CPU at 100% utilization with an empty run queue is fine, while a modest utilization with a long queue is a problem. It focuses on resources, so it pairs with the RED method, which starts from the user's requests.

Example

A quick pass on a Linux host:

CPU       utilization: top / mpstat   saturation: load average vs cores   errors: dmesg
Memory    utilization: free -m        saturation: swap in/out (vmstat)    errors: dmesg for OOM
Disk      utilization: iostat -x      saturation: await, queue length     errors: smartctl
Network   utilization: sar -n DEV     saturation: drops, retransmits      errors: ip -s link

Work through each row and note anything abnormal before changing configuration.

Common mistakes

  • Looking only at utilization and ignoring queues.
  • Forgetting software resources like connection pools, thread pools and file descriptors.
  • Reading average values over long windows that hide short bursts.

Get notified when this term updates

Plus occasional practical tips on uptime and monitoring, nothing else. Unsubscribe anytime.

Keep reading

Glossary · MonitoringBlack-Box MonitoringBlack-box monitoring tests a system from the outside, the way a user would, to detect symptoms like errors and slowness without inspecting internals.Glossary · MonitoringBulkhead PatternThe bulkhead pattern isolates resources into separate pools so a failure or overload in one part of a system cannot exhaust capacity for the rest.Glossary · SecurityDDoS (Distributed Denial of Service)A DDoS attack floods a server or network with traffic from many sources at once, exhausting bandwidth or resources so legitimate users cannot reach the site.Guide · MonitoringAlert Fatigue and On-Call Basics for Small TeamsSet severity levels, escalation paths, alert thresholds and runbooks so a small team gets paged for real problems only and still sleeps through the night.8 min readGuide · Hosting & CDNApache vs nginx Troubleshooting: Logs, Config Tests and Common ErrorsSide-by-side troubleshooting for Apache and nginx: where logs live, config test commands, restart vs reload, and fixes for the most common startup and runtime errors.8 min readGuide · MonitoringCron Job Heartbeat Monitoring to Catch Silent Failures EarlyLearn how heartbeat monitoring catches silent cron failures, with copy-ready examples for crontab, systemd, GitHub Actions, Docker, WP-Cron, Laravel and more.9 min read

This page is general information written by our editorial team and updated when documentation changes. Servers and providers differ, so test changes safely first. See our editorial policy and disclaimer.