Brendan Gregg's USE method is a checklist that stops you guessing. For each resource (CPUs, memory, storage devices and capacity, network interfaces, and software limits such as file descriptors or cgroup memory), ask three things:
- Utilisation: how busy is it? Examples are CPU percentage, disk bytes used, or inodes used.
- Saturation: how much work is queued or refused? Examples are the run queue, swapping, or
ENOSPC. - Errors: are there error events? Examples are OOM kills, I/O errors, or dropped packets.
Walk the list systematically, even for resources you think are fine. The value is in the elimination. After two minutes you know memory, network, and disk bytes are healthy, and that inodes are at 100%.
It pairs well with limits. A container or unit can be saturated against its own cgroup limit while the host shows free memory. An "OOMKilled on an idle host" means the limit, not the host, is the resource to examine.
Gregg's site has a free USE checklist for Linux that maps each resource to the command that measures it. Keep it next to your on-call runbook.