When a Linux process is waiting for a socket to have data ready to read (using a system call like select, poll, or epoll), that process is put into a sleep state by the kernel. It continues accruing “wall-clock time” (“wall time”) but stops accruing CPU time. When the kernel has data for the socket, the process starts running again.

The above tracking method works for containerized things. For virtualized things, it’s different: When a Linux system has nothing to do (all processes sleeping or waiting), the kernel puts the CPU to sleep. The kernel will eventually be woken by an interrupt from something, at which point things continue. In a virtualized environment, the hypervisor can measure how long the entire VM is running or sleeping.