Memory Monitoring

Linux intentionally uses otherwise idle memory for caches, so a small free value alone does not prove memory pressure. vmstat helps relate memory to runnable tasks, paging, I/O, and CPU activity.

Sampling with vmstat

Collect one sample per second:

$ vmstat 1

The first data row generally reports averages since boot; subsequent rows cover each interval. Stop with Ctrl-C after capturing a representative period. Units and available fields vary, so check vmstat --unit and the local manual.

Processes and Memory

Common process fields are r, runnable tasks, and b, tasks blocked in uninterruptible sleep. Memory fields include used swap (swpd), idle memory (free), buffers (buff), and cache (cache). These are system-wide values, not per-process consumption.

For an easier view of currently available memory, compare with:

$ free -h

The available estimate is generally more useful than free alone because reclaimable cache can satisfy new allocations.

Paging and I/O

si and so show swap-in and swap-out rates. Sustained paging combined with latency and memory reclaim activity can indicate pressure, but nonzero swap use (swpd) does not by itself prove a current problem. bi and bo report block input and output rates and are not limited to swap traffic.

CPU and System Activity

CPU columns commonly include user (us), system (sy), idle (id), I/O wait (wa), and steal (st) percentages. System columns include interrupts (in) and context switches (cs) per second. Interpret spikes against a baseline; high context-switch rates can be normal for some workloads.

Summary

You can now interpret vmstat as a time-correlated system view.

1. Separate the initial cumulative report from interval samples.
2. Treat cache as potentially reclaimable memory.
3. Correlate paging with reclaim and application impact.
4. Read process, I/O, system, and CPU fields together.