Unfortunately, the above answers are NOT correct in the CPUACCT controller for a KVM guest:
cpu_time == user_time + system_time + guest_time (<-- wrong)
If you run a CPU-intensive benchmark compared to an I/O or network-intensive benchmark in the VM, you'll see that "guest time" does not match up in the formula.
Guest time (according to /proc/< pid >/stat) represents ONLY the time used by the VCPUs to run the guest virtual machine (While not exiting or handling I/O).
The CPUACCT controller's top-level parent directory for each KVM/libvirt guest includes both the time spent on the "emulator" and "vcpuX" sub-directories in their totality, including vhost kernel threads and non-VCPU pthreads running inside the QEMU main process, not just guest time or user/system time.
That makes the above formula wrong. The correct formula would be:
guest_time = sum(vcpuX)=>cpu.time - sum(vcpuX)=>(for each child: cpuacct.stat=>user + cpuacct.stat=>system)
You cannot simply use the top-level parent files to calculate guest time. That would be totally inaccurate under any I/O bound workload.