Memory Monitoring

Linux intentionally uses otherwise idle memory for caches, so a small free value alone does not prove memory pressure. vmstat helps relate memory to runnable tasks, paging, I/O, and CPU activity.

Sampling with vmstat

Collect one sample per second:

$ vmstat 1

The first data row generally reports averages since boot; subsequent rows cover each interval. Stop with Ctrl-C after capturing a representative period. Units and available fields vary, so check vmstat --unit and the local manual.

CheckWhich rows are best for observing second-by-second changes from vmstat 1?

Later rows after the initial report. Only the headings above the first data row. Only a row copied from a different host.

Processes and Memory

Common process fields are r, runnable tasks, and b, tasks blocked in uninterruptible sleep. Memory fields include used swap (swpd), idle memory (free), buffers (buff), and cache (cache). These are system-wide values, not per-process consumption.

For an easier view of currently available memory, compare with:

$ free -h

The available estimate is generally more useful than free alone because reclaimable cache can satisfy new allocations.

CheckWhy can a low free value be normal on Linux?

The value always excludes all physical RAM. The kernel can use idle memory for reclaimable caches. Low free memory proves the CPU is powered off.

Paging and I/O

si and so show swap-in and swap-out rates. Sustained paging combined with latency and memory reclaim activity can indicate pressure, but nonzero swap use (swpd) does not by itself prove a current problem. bi and bo report block input and output rates and are not limited to swap traffic.

CheckWhich evidence better supports current memory-pressure diagnosis?

A nonzero swpd value with no other observations. Sustained paging correlated with reclaim activity and workload latency. The hostname printed at login.

CPU and System Activity

CPU columns commonly include user (us), system (sy), idle (id), I/O wait (wa), and steal (st) percentages. System columns include interrupts (in) and context switches (cs) per second. Interpret spikes against a baseline; high context-switch rates can be normal for some workloads.

CheckWhat does the r process field represent?

Read-only mounted filesystems. Remote users with active shells. Tasks that are runnable or waiting for CPU.

Summary

You can now interpret vmstat as a time-correlated system view.

1. Separate the initial cumulative report from interval samples.
2. Treat cache as potentially reclaimable memory.
3. Correlate paging with reclaim and application impact.
4. Read process, I/O, system, and CPU fields together.