CPU utilization is the fraction of available processor time spent doing work rather than sitting idle, expressed as a percentage of wall clock time. On a multi core host it is reported two ways: aggregated across all logical cores, and per individual core.
The breakdown by state carries far more information than the total. Time in user is application code. Time in system is kernel work such as syscalls, context switches, and network stack processing. Time in iowait is the CPU idling on storage. A service at 90% user time is doing real work and probably needs a bigger instance, while 40% system time usually means something pathological like syscall thrashing or an interrupt storm. The per core view matters just as much: a single threaded process pinning one core at 100% barely moves the aggregate on a 16 core box, and that is exactly the failure a total-only dashboard hides.
For alerting, sustained utilization over a window beats instantaneous spikes, since short bursts to 100% are normal on any healthy server. Most teams alert on 5 to 15 minutes above a threshold and pair it with load average to catch queuing. Hyperping's agent reports CPU time per state as a percentage of wall clock plus a per CPU breakdown, so the aggregate and the one hot core are both visible.
