AdminAdmin

Monitoring Virtual Memory Using vmstat

Just using a lot of swap space doesn’t necessarily mean that you need more memory. Here’s how to tell when is happy with the available memory and when it needs more...

inux novices often find virtual portions of physical memory when possible. memory mysterious, but with a All processes use memory, of course, but grasp of the fundamental each process doesn’t need all its allocated concepts, it’s easy to understand. memory all the time. Taking advantage of this L With this knowledge, you can fact, the kernel frees up physical memory by monitor your system’s memory utilization writing some or all of a process’ memory to using vmstat and detect problems that can disk until it’s needed again. adversely affect system performance. The kernel uses paging and swapping to perform this memory management. Paging Getting the basics right refers to writing portions, termed pages, of a Physical memory—the actual RAM process’ memory to disk. Swapping, strictly installed—is a finite resource on any system. speaking, refers to writing the entire process, The Linux memory handler manages the not just part, to disk. In Linux, true swapping allocation of that limited resource by freeing is exceedingly rare, but the terms paging and

www.linuxforu.com | LINUX FOR YOU | DECEMBER 2005 87

C M Y K Admin

swapping often are used interchangeably. 0 0 0 29232 116972 4524 244900 0 0 0 0 0 0 0 0 0 When pages are written to disk, the event is called a 0 0 0 29232 116972 4524 244900 0 0 0 0 2560 6 0 1 99 page-out, and when pages are returned to physical 0 0 0 29232 116972 4524 244900 0 0 0 0 2574 10 0 2 98 memory, the event is called a page-in. A page fault occurs when the kernel needs a page, finds it doesn’t exist in All fields in this output are well explained in the physical memory because it has been paged-out, and re- vmstat , but the most important reads it in from disk. columns for this article are free, si and so. The Page-ins are common, normal and are not a cause for free column shows the amount of free memory, si shows concern. For example, when an application first starts up, page-ins and so shows page-outs. In this example, the its executable image and data are paged-in. This is normal so column is zero consistently, indicating there are no behaviour. page-outs. Page-outs, however, can be a sign of trouble. When the kernel detects that memory is running low, it attempts to The abbreviations so and si are used instead of the free up memory by paging out. Although this may happen more accurate po and pi for historical reasons. briefly from time to time, if page-outs are plentiful and Here’s an example of a system with paging activity: constant, the kernel can reach a point where it’s actually spending more time managing paging activity than running procs memory swap io system cpu the applications, and system performance suffers. This r b w swpd free buff cache si so bi bo in cs us sy id woeful state is referred to as thrashing. . . . Using swap space is not inherently bad. Rather, it’s 1 0 0 13344 1444 1308 19692 0 168 129 42 1505 713 20 11 69 intense paging activity that’s problematic. For instance, if 1 0 0 13856 1640 1308 18524 64 516 379 129 4341 646 24 34 42 your most-memory-intensive application is idle, it’s fine for 3 0 0 13856 1084 1308 18316 56 64 14 0 320 1022 84 9 8 portions of it to be set aside when another large job is active. Memory pages belonging to an idle application are Notice the nonzero so values indicating there is not better set aside so the kernel can use physical memory for enough physical memory and the kernel is paging out. You disk buffering. can use and ps to identify the processes that are using the most memory. Using vmstat You also can use top to show memory and swap vmstat, as its name suggests, reports virtual memory statistics. Here is an example of the uppermost portion of a statistics. It shows how much virtual memory there is, how typical top report: much is free and paging activity. Most importantly, you can observe page-ins and page-outs as they happen. This is 14:23:19 up 348 days, 3:02, 1 user, load average: 0.00, 0.00, 0.00 extremely useful. 55 processes: 54 sleeping, 1 running, 0 zombie, 0 stopped To monitor the virtual memory activity on your system, CPU states: 0.0% user, 2.4% system, 0.0% nice, 97.6% idle it’s best to use vmstat with a delay. A delay is the number Mem: 481076K total, 367508K used, 113568K free, 4712K buffers of seconds between updates. If you don’t supply a delay, Swap: 1004052K total, 29852K used, 974200K free, 244396K cached vmstat reports the averages since the last boot and quit. Five seconds is the recommended delay interval. For more information about top, see the top man page. To run vmstat with a five-second delay, issue the command: This can be viewed by issuing the command man top at the command prompt. vmstat 5 Conclusion You also can specify a count, which indicates how many It isn’t necessarily bad for your system to be using some of updates you want to see before vmstat quits. If you don’t its swap space. But if you discover your system is often specify a count, the count defaults to infinity, but you can running low on physical memory and paging is causing stop output with Ctrl-C. performance to suffer, add more memory. If you can’t add To run vmstat with ten updates, five seconds apart, more memory, run memory-intensive jobs at different issue the command: times of the day and avoid running non-essential jobs when memory demand is high or distribute jobs across multiple vmstat 5 10 systems if possible.

Here’s an example of the output generated by a system By: Brian K Tanaka. The author has been a system free of paging activity: administrator since 1994 with companies such as SGI, Intuit and RealNetworks. He can be reached at [email protected]. procs memory swap io system cpu Courtesy: Linux Journal r b w swpd free buff cache si so bi bo in cs us sy id

88 DECEMBER 2005 | LINUX FOR YOU | www.linuxforu.com

C M Y K