vmstat

Display virtual memory statistics

$ vmstat

$ vmstat [2] [5]

vmstat [options] [delay [count]]

delay: Delay between updates in seconds.
count: Number of updates to display.

delay
    Specifies the delay in seconds between each successive report. If not provided, vmstat prints a single report with averages since boot.

count
    Specifies the number of reports to generate. If a delay is specified but count is not, vmstat will report continuously.

-a, --active
    Displays active and inactive memory statistics. Active memory is memory in use, while inactive memory is eligible for reclaim.

-d, --disk
    Reports statistics for disk activity, including total reads/writes, merged reads/writes, and time spent on I/O.

-f, --forks
    Reports the number of forks since boot. This indicates how many processes have been created.

-m, --slabs
    Reports slabinfo, showing kernel slab cache statistics. Useful for tracking kernel memory usage.

-n, --one-shot
    Displays the header only once, even with continuous reporting. Useful for piping output to other tools.

-p partition, --partition partition
    Reports statistics for a specific disk partition, e.g., /dev/sda1.

-s, --stats
    Displays event counters and various memory statistics in a single-report format, useful for quick overviews.

-t, --timestamp
    Adds a timestamp to each report, which is helpful for historical analysis or logging.

-S unit, --unit unit
    Specifies the unit for memory display. Common units include k (kilobytes), M (megabytes), G (gigabytes).

-V, --version
    Displays the version information for vmstat.

-w, --wide
    Uses a wider output format, which can prevent truncation of some columns, especially on systems with many CPUs.

vmstat is a powerful command-line utility used for monitoring system performance on Linux and other Unix-like operating systems. It provides a concise summary of various system activities, including virtual memory statistics, process activity, block I/O, traps, and CPU utilization. By default, it displays an average report since the last reboot. However, it can be run in a continuous mode by specifying a delay and optionally a count, which allows users to observe system behavior changes over time.

The information provided by vmstat is crucial for identifying performance bottlenecks and resource exhaustion. For instance, high swap activity (si, so columns) can indicate memory pressure, while high CPU idle time (id) might suggest I/O bottlenecks if other CPU metrics are low but I/O is high. Its output is categorized into several sections, making it a versatile tool for system administrators and developers alike to diagnose system health and tune performance.

Interpreting vmstat output requires a good understanding of system architecture and typical resource usage patterns. Misinterpreting metrics can lead to incorrect conclusions about performance bottlenecks. For instance, high swap activity is often a sign of memory pressure, but it can also be normal during certain operations.

The data presented by vmstat in continuous mode represents averages over the specified interval, not instantaneous values. This means short bursts of activity might be smoothed out, and it might not capture very transient issues.

While useful, vmstat provides a high-level view. For deep-dive analysis, it often needs to be combined with other tools like strace, perf, or more specific profiling tools.

The default vmstat output is divided into several main sections:
procs:
  r: The number of processes waiting for run time.
  b: The number of processes in uninterruptible sleep (waiting for I/O).
memory:
  swpd: The amount of virtual memory used.
  free: The amount of idle memory.
  buff: The amount of memory used as buffers.
  cache: The amount of memory used as cache.
swap:
  si: Amount of memory swapped in from disk (/s).
  so: Amount of memory swapped out to disk (/s).
io:
  bi: Blocks received from a block device (blocks/s).
  bo: Blocks sent to a block device (blocks/s).
system:
  in: The number of interrupts per second, including the clock.
  cs: The number of context switches per second.
cpu:
  us: Time spent running non-kernel code (user time).
  sy: Time spent running kernel code (system time).
  id: Time spent idle.
  wa: Time spent waiting for I/O completion.
  st: Time stolen from a virtual machine by the hypervisor.

When diagnosing performance issues with vmstat, look for certain patterns:
High 'r' (runqueue length): Indicates CPU contention. If 'r' is consistently higher than the number of CPU cores, your system is CPU-bound.
High 'b' (blocked processes) combined with high 'wa' (I/O wait): Suggests an I/O bottleneck. Processes are waiting for disk operations to complete.
High 'si' and 'so' (swap in/out): Indicates memory pressure. The system is actively swapping pages between RAM and disk, which is slow and impacts performance.
Low 'free' memory with high 'buff'/'cache': This is often normal; Linux uses free memory for buffers and cache to improve performance. Only a problem if 'si'/'so' are also high.
High 'cs' (context switches): Can indicate a large number of processes frequently switching, potentially leading to CPU overhead.

vmstat has been a fundamental utility in Unix-like operating systems for decades, providing insights into system performance. It is part of the procps package (or procps-ng for more modern Linux distributions), which provides a suite of tools for monitoring and managing processes and system resources. Over time, new options and metrics have been added to vmstat to reflect evolving system architectures and provide more granular insights, such as detailed disk statistics, slabinfo, and active/inactive memory reporting, solidifying its role as an indispensable diagnostic tool for system administrators.

iostat(1): Reports CPU utilization and I/O statistics for devices and partitions., mpstat(1): Reports individual or combined processor activity., sar(1): Collects, reports, or saves system activity information, offering historical data., free(1): Displays the amount of free, used, and swap memory in the system., top(1): Provides a dynamic real-time view of running processes., htop(1): An interactive, colorful, and more user-friendly process viewer than top.