Linux commands: exploring virtual memory with vmstat

There are many commands, tools, and variations of the two for you to put to work when it comes to system statistics in Linux. However, if you need the specifics around virtual memory, you want to use vmstat.

What is it?

Virtual memory statistics reporter, also known as vmstat, is a Linux command-line tool that reports various bits of system information. Things like memory, paging, processes, IO, CPU, and disk scheduling are all included in the array of information provided.

When you run vmstat, keep in mind that the first report is an average of the requested information since the time of the last reboot. Subsequent reports use measurements of delay and count. I cover those specifically during the syntax discussion.

Command syntax

The syntax for the vmstat command is rather simple:

$ vmstat [options][delay [count]]

• Options - these are covered in detail in the following section.
• Delay - this defines the time interval between updates. If no delay is specified, the report runs as an average since the last reboot.
• Count - this defines the number of updates printed after the given delay interval. If no count is set, the default in an infinite number of updates every x seconds (where x = delay).

Basic output and how to make sense of it

The most basic form of this command uses no options at all. Here is the standard output and how to read it:

[tcarrigan@rhel ~]$ vmstat
procs -----------memory---------- ---swap-- -----io---- -system-- ------cpu-----
 r  b   swpd   free   buff  cache   si   so    bi    bo   in   cs us sy id wa st
 1  0      0 6012852   2120 817048    0    0  2805   289  797  657 21  7 71  1  0

You see information around processes, memory, swap, IO, system, and CPU. The man page for the command states the following (man vmstat):

- Procs
     - r: The number of runnable processes (running or waiting for run times)
     - b: The number of processes in uninterruptible sleep. 
 - Memory
     - swpd: the amount of virtual memory used. 
     - free: the amount of idle memory
     - buff: the amount of memory used as buffers
     - cache: the amount of memory used as cache. 
     - inact: the amount of inactive memory. (-a option)
     - active: the amount of active memory. (-a option)
 - Swap
     - si: Amount of memory swapped in from disk (/s). 
     - so: Amount of memory swapped to a block device (/s). 
 - IO
     - bi: Blocks received from a block device (blocks/s). 
     - bo: Blocks sent to a block device (blocks/s). 
 - System
     - in: The number of interrupts per second, including the clock. 
     - cs: The number of context switcher per second. 
 - CPU
     - These are percentages of total CPU time. 
     - us: Time spent running non-kernel code. (user time, including nice time)
     - sy: Time spent running kernel code. (system time)
     - id: Time spent idle. Prior to Linux 2.5.41, this includes IO-wait time. 
     - wa: Time spent waiting for IO.  Before Linux 2.5.41, included in idle.
     - st: Time stolen from a virtual machine.  Prior to Linux 2.6.11, unknown.

Among the important information here, you find the amount of free memory on the system, as well as the amount of swap activity you are currently experiencing.

Options to know

The -a option will give us the active and inactive memory of the system:

[tcarrigan@rhel ~]$ vmstat -a
procs -----------memory---------- ---swap-- -----io---- -system-- ------cpu-----
 r  b   swpd   free  inact active   si   so    bi    bo   in   cs us sy id wa st
 0  0      0 6022104 609656 1185980    0    0   180    40   80   79  1  1 98  0  0

The -f option will give us the number of forks since boot:

[tcarrigan@rhel ~]$ vmstat -f
         2911 forks

Note that a fork is any process that spawns another processes while remaining active. 

The -s option displays various memory statistics as well as CPU and IO event counters:

[tcarrigan@rhel ~]$ vmstat -s 
      8161656 K total memory
      1216012 K used memory
      1186276 K active memory
       609632 K inactive memory
      6021980 K free memory
         2120 K buffer memory
       921544 K swap cache
      3145724 K total swap
            0 K used swap
      3145724 K free swap
         5888 non-nice user cpu ticks
          476 nice user cpu ticks
         1520 system cpu ticks
       529965 idle cpu ticks
          331 IO-wait cpu ticks
          939 IRQ cpu ticks
          103 softirq cpu ticks
            0 stolen cpu ticks
       755494 pages paged in
       167719 pages paged out
            0 pages swapped in
            0 pages swapped out
       365026 interrupts
       374126 CPU context switches
   1590618807 boot time
         2952 forks

The -d option gives you read/write stats for various disks:

[tcarrigan@rhel ~]$ vmstat -d
disk- ------------reads------------ ------------writes----------- -----IO------
       total merged sectors      ms  total merged sectors      ms    cur    sec
sda    17019     40 1498524   10680   4683   1050  335510    1561      0     10
sdb      105      0    6232      67      0      0       0       0      0      0
sdc      105      0    6232      59      0      0       0       0      0      0
sr0        0      0       0       0      0      0       0       0      0      0
dm-0   16677      0 1469065   12431   5713      0  336816    2485      0     10
dm-1      98      0    4440      39      0      0       0       0      0      0

The -t option gives us timestamp information with every update, a seen here:

[tcarrigan@rhel ~]$ vmstat -t 5 10
procs -----------memory---------- ---swap-- -----io---- -system-- ------cpu----- -----timestamp-----
 r  b   swpd   free   buff  cache   si   so    bi    bo   in   cs us sy id wa st                 EDT
 1  0      0 6021412   2120 921548    0    0   118    26   62   66  1  0 99  0  0 2020-05-27 19:00:11
 0  0      0 6021300   2120 921548    0    0     0     0  349  510  1  0 99  0  0 2020-05-27 19:00:16
 0  0      0 6021272   2120 921548    0    0     0     2  196  294  0  0 100  0  0 2020-05-27 19:00:21
 0  0      0 6021272   2120 921548    0    0     0     0  110  161  0  0 100  0  0 2020-05-27 19:00:26
 0  0      0 6021272   2120 921548    0    0     0     0  112  169  0  0 100  0  0 2020-05-27 19:00:31
 0  0      0 6021272   2120 921548    0    0     0     0  171  267  0  0 99  0  0 2020-05-27 19:00:36
 0  0      0 6021188   2120 921552    0    0     0     0  201  291  0  0 99  0  0 2020-05-27 19:00:41
 0  0      0 6021188   2120 921552    0    0     0     0  152  233  0  0 100  0  0 2020-05-27 19:00:46
 2  0      0 6021188   2120 921552    0    0     0     3  127  165  0  0 100  0  0 2020-05-27 19:00:51
 0  0      0 6021188   2120 921552    0    0     0     0   95  131  0  0 100  0  0 2020-05-27 19:00:56

You see that there are 10 updates, printed every five seconds, with timestamp information attached.

Also, please note that all memory stats are displayed in kilobytes by default.

Summary

To wrap up, let's look at what we learned. The vmstat command is a powerful system statistics tool that can be used with or without options. It prints updates using two main variables (delay and count), and we can customize the command and output to suit our needs. I hope that you have enjoyed this look at the vmstat command. I will cover ifstat in a forthcoming article, so keep an eye out for that!

[ Free online course: Red Hat Enterprise Linux technical overview. ]