Tools reference

vmstat -- virtual memory statistics

vmstat(C) is a useful tool for monitoring system performance but is not as comprehensive as sar. vmstat gives an immediate picture of how a system is functioning. It enables you to see if system resources are being used within their capacity.

vmstat's default output concentrates on four types of system activity -- process, paging/swapping, system and CPU activity. If a timing interval is specified then vmstat produces indefinite output until you press <Del>. Consider the following example for the command vmstat 5:

PROCS PAGING SYSTEM CPU r b w frs dmd sw cch fil pft frp pos pif pis rso rsi sy cs us su id

1 126 0 64000 0 0 0 0 0 0 0 0 0 0 0 59 34 0 3 97 0 127 0 64000 8 0 0 0 0 0 0 0 0 0 0 47 22 0 2 98 1 126 0 64000 0 0 0 0 0 0 0 0 0 0 0 45 16 0 2 98 0 127 0 64000 0 0 0 0 0 0 0 0 0 0 0 86 23 1 5 94 0 127 0 64000 0 0 0 0 0 0 0 0 0 0 0 24 12 0 1 99 1 129 0 64000 10 0 15 0 55 0 0 0 0 0 0 1369 43 19 42 39 0 130 0 64000 0 0 0 0 0 0 0 0 0 0 0 277 36 2 6 92 0 130 0 64000 0 0 0 0 0 0 0 0 0 0 0 78 26 0 1 99 0 130 0 64000 0 0 0 0 0 0 0 0 0 0 0 117 36 0 1 99 0 130 0 64000 0 0 0 0 0 0 0 0 0 0 0 138 46 0 2 98 0 130 0 64000 0 0 0 0 0 0 0 0 0 0 0 144 51 1 2 97 ...

In this case vmstat displays data at regular intervals. Each display representing an average of the activity over the preceding five second interval.

The PROCS heading encompasses the first three fields of output:

: r number of processes on the run queue
: b number of processes blocked waiting for a resource
: w number of processes swapped out

During the sample period there were no swapped out processes, hardly any processes on the run queue, and between 126 and 130 blocked processes. Any process which was ready to run would not spend much time on the run queue. This conclusion is reinforced by the value of id under the CPU heading which shows that the system is almost 100% idle most of the time.

The PAGING heading encompasses both paging and swapping activity on the system. The operating system does not preallocate swap space to running processes. It only allocates swap space to processes that have been swapped at least once; this space is only relinquished when such a process terminates. It does, however, decrease its internal count of available swappable memory.

In the above example, the amount of free swap space (frs) remains a constant 64000 (roughly 32MB in 512-byte units). Because this is the amount of swap originally configured for this system, no swapping or paging out to disk occurred during the sampling period. This is confirmed by the zero value of the w field. The fields from pos to rsi also show that no processes or regions were swapped in or out during the time that vmstat was running.

There is a brief amount of paging activity on the sixth line of output. One or more processes attempted to access pages that were not currently valid. To satisfy the demand for these pages, the kernel obtained them from the page cache (cch) in memory or from filesystems on disk but not from swap (sw).

If a process invokes the fork(S) system call, this creates an additional copy, or child process, of the original process. The new process shares the data or stack regions of its parent. The pages in these regions are marked copy-on-write ( COW). This is to avoid wasting CPU and memory resources because the usual purpose of a fork is for either the parent or child process to execute a new command in place of itself. If, instead, the parent or child process tries to write to a page marked COW, this generates a protection fault (pft) causing the page fault handler in the kernel to make a copy of the page.

The dmd field accounts for a combination of demand zero pages (those created and initialized with zeros for data storage) and demand fill pages (those created and filled with text).

System call (sy) and context switching activity (cs) can also be seen under the SYSTEM heading.

The -s option to vmstat reports statistics about paging activity since the system was started or in a specified time interval:

     64000 free swap space
     12222 demand zero and demand fill pages
     25932 pages on swap
     44589 pages in cache
     28719 pages on file
     33791 protection fault
     84644 pages are freed
        23 success in swapping out a process
         0 fail in swapping in a process
        22 success in swapping in a process
        98 swapping out a region
        64 swapping in a region
    457461 cpu context switches
   1870524 system calls

Lines showing large values for pages on swap, success in swapping out a process, success in swapping in a process, swapping out a region, and swapping in a region may indicate that excessive swapping or paging is degrading performance.

The -f option to vmstat provides information about the number of forks (that is, new processes created) since the system was started or in a specified time interval. For example, to monitor how many fork system calls are being invoked every second, use the command vmstat -f 1:

   0 forks
   0 forks
   2 forks
   1 forks
   0 forks
   ...