Understanding Linux vmstat Virtual Memory Data

The vmstat (Virtual Memory Statistics) tool is a lightweight command-line utility used in Linux to monitor and report system resource usage. This article details the specific virtual memory metrics gathered by vmstat, explaining how the tool measures physical memory, swap utilization, memory paging events, and kernel slab structures to help diagnose performance bottlenecks.

Core Memory Fields

When executed without additional flags, vmstat displays standard columns grouped under distinct headers. The memory section details the current state of physical and swap allocation:

• swpd: The total amount of virtual memory currently moved out to the swap partition or swap file on disk (measured in kilobytes). A non-zero value indicates that the system has offloaded inactive memory to disk.
• free: The amount of completely idle and unused physical RAM.
• buff: The amount of physical RAM allocated to buffers, which temporarily hold in-flight block I/O operations and disk filesystem metadata.
• cache: The amount of memory used as page cache to store frequently accessed files read from the disk.

Using the -a (active/inactive) flag replaces buff and cache with:

• inact: Inactive memory, which includes pages that have not been accessed recently and are prime candidates for eviction or swapping.
• active: Active memory, representing pages actively in use by processes that the kernel will avoid swapping out unless absolutely necessary.

Swapping Metrics

The swap section directly tracks paging traffic between physical RAM and the disk:

• si (Swap-In): The rate of memory read from the swap space back into physical RAM per second. Frequent swap-in activity indicates that processes are trying to access data that was previously offloaded.
• so (Swap-Out): The rate of memory written from physical RAM to swap space per second. Persistent swap-out activity indicates physical memory exhaustion and is a primary indicator of a memory bottleneck.

Summary Statistics (vmstat -s)

Running vmstat -s outputs a detailed breakdown of event counters and cumulative memory statistics derived from /proc/meminfo and /proc/vmstat:

• Global Capacity: Total virtual memory, used memory, active/inactive memory, and total swap versus used swap.
• Paging Counters: Total pages paged in from disk (pages paged in) and out to disk (pages paged out).
• Page Faults: Total page faults, distinguishing between minor faults (resolved in RAM without disk access) and major faults (requiring retrieval of pages from disk).
• Kernel Allocations: Slab allocations including reclaimable and non-reclaimable slab memory.

Kernel Slab Utilization (vmstat -m)

With the -m switch, vmstat gathers slab allocation statistics directly from /proc/slabinfo. This provides information about kernel-level virtual memory objects, such as directory entries (dentry), file system inodes, and buffer heads, detailing how many instances of each kernel object currently occupy memory.