Linux intentionally uses otherwise idle memory for caches, so a small free value alone does not prove memory pressure. vmstat helps relate memory to runnable tasks, paging, I/O, and CPU activity.
Process Utilization · Lesson 6
Memory Monitoring
Learn how to interpret vmstat memory, paging, process, I/O, and CPU samples.
Sampling with vmstat
Collect one sample per second:
$ vmstat 1
The first data row generally reports averages since boot; subsequent rows cover each interval. Stop with Ctrl-C after capturing a representative period. Units and available fields vary, so check vmstat --unit and the local manual.
Which rows are best for observing second-by-second changes from vmstat 1?
Processes and Memory
Common process fields are r, runnable tasks, and b, tasks blocked in uninterruptible sleep. Memory fields include used swap (swpd), idle memory (free), buffers (buff), and cache (cache). These are system-wide values, not per-process consumption.
For an easier view of currently available memory, compare with:
$ free -h
The available estimate is generally more useful than free alone because reclaimable cache can satisfy new allocations.
Why can a low free value be normal on Linux?
Paging and I/O
si and so show swap-in and swap-out rates. Sustained paging combined with latency and memory reclaim activity can indicate pressure, but nonzero swap use (swpd) does not by itself prove a current problem. bi and bo report block input and output rates and are not limited to swap traffic.
Which evidence better supports current memory-pressure diagnosis?
CPU and System Activity
CPU columns commonly include user (us), system (sy), idle (id), I/O wait (wa), and steal (st) percentages. System columns include interrupts (in) and context switches (cs) per second. Interpret spikes against a baseline; high context-switch rates can be normal for some workloads.
What does the r process field represent?
Lesson complete
You finished Memory Monitoring
You can now interpret vmstat as a time-correlated system view.
Separate the initial cumulative report from interval samples.
Treat cache as potentially reclaimable memory.
Correlate paging with reclaim and application impact.
Read process, I/O, system, and CPU fields together.
Keep your learning progress
Create a free account to save this lesson and continue learning on any device.
Create a free account