Using vmstat to detect memory problems in Linux

Troubleshooting and detecting memory related problems in Linux normally boils down to analysing and eventually determine what is going on within the virtual memory. Linux comes with a handy tool called vmstat which helps us examine the virtual memory.

Analysing the virtual memory is important in any memory related problem because this works hand in hand with the actual physical memory (RAM). Since physical memory is finite, the kernel normally moves a process or parts of it (called pages) from RAM to disk - the location on the disk is called virtual memory, and the activity of transferring pages or complete processes is called Paging or Swapping.

Now that we are talking about definitions, let's learn two important definitions:
1) Swap-In/Page-In: This is when the kernel picks a process or a page of a process from virtual memory to RAM.
2) Swap-Out/Page-Out: This is when the kernel decommissions a process or a page of it from RAM to virtual memory.

For this reason when you have a system which is doing constant lots of Swap-Outs it might indicate memory problems because it needs to continously remove processes from the memory in order to make space for the new ones.

VMStat is normally used with a single parameter which determines the sample rate, the most common one being 5 seconds:

vmstat 5

The most important columns are highlighted in the screenshot below - free memory, swap-in (si) and swap-out (so).

If you see a constant high rate of "so's" and a low "free" memory, you might need to pinpoint the underlying application and consider upgrading the physical memory or shifting the application to a dedicated server.

No comments: