May the source be with you, but remember the KISS principle ;-)
Home Switchboard Unix Administration Red Hat TCP/IP Networks Neoliberalism Toxic Managers
(slightly skeptical) Educational society promoting "Back to basics" movement against IT overcomplexity and  bastardization of classic Unix

vmstat -- virtual memory statistics

News Recommended Books Recommended Links Linux Solaris


 Linux Performance Tuning
netstat iostat uptime command sar Unix top command

Unix ps command

watch     Horror Stories Unix History Humor Etc

The first tool to use for locating performance bottlenecks is the vmstat command. It provides compact table-based snapshot of  various system resources utilization. vmstat does not count itself as a running process.  The following metrics might help to determine the  overloaded system are

For analysis of long intervals output from sar might be a good alternative. In both cases one can pipe output into Perl script to produce alerts. For example if a single cpu dual core Linux 2.6 server demonstrated strange behavior with uptime averages above 12 (case that happened to the author). In this case to lessen the amount of collected information you can use threshold 4 for "r"; exceeding this threshold triggers writing vmstat or sar information to log and/or and piping it into Perl script for detailed analysis.

 If the vmstat command is used without any options, it reports the current set of statistics and exits. If a single numeric argument T is supplied it is assumed to be an interval (in seconds) between iterations of the report and vmstat runs in a loop outputting the statistics each T seconds. Optionally the second numerical parameter can be specified which provides the number of iterations of the time loop. For example vmstat 2 10 means output statistics each 2 sec and make 10 iterations before existing.

vmstat reports virtual memory statistics regarding kernel thread, virtual memory, disk, trap, and CPU activity.  Traditionally those parts of the table have headers

On MP (multi-processor) systems, vmstat averages the number of CPUs into the output. For per-processor statistics, see mpstat(1M). vmstat only supports statistics for certain devices. For more general system statistics, you can also use e sar and  iostat. command.

Without options, vmstat displays a one-line summary of the virtual memory activity since the system was booted.

Solaris vmstat

vmstat [-cipqsS] [disks] [interval[count]]

The output from the Solaris vmstat command without options is:

 procs     memory            page            disk          faults      cpu
 r b w   swap  free  re  mf pi po fr de sr f0 s1 s2 s3   in   sy   cs us sy id
 0 0 0  15020  4304   9  58 198 228 220 0 3 0 16  1  1   86 1173   46 24 30 46

procs  reports on process states. r  is the number of processes in the run queue. b  is the number of processes blocked and waiting for resources such as disk or terminal input. w  is the number of runnable processes, or processes swapped but in a sleep state of less than twenty seconds.

Under the memory  heading statistics are given on the usage of real and virtual memory. swap  reports the available swap space in Kilobytes. free  gives the size of the free list.

Under the page heading, page faults and page activity is reported in units per second. Page faulting occurs when the system attempts to access an unmapped page. Statistics are reported as follows:

disk  lists the number of disk operations per second and can show data for up to four disks at a time. Which disks to report can be passed to the vmstat command.

faults  reports the trap or interrupt rate per second. in  is the number if device interrupts per second. sy  is the number of system calls and cs  is the CPU context switch rate.

The last group of statistics pertain to CPU usage. The amount of time spent in user mode, kernel mode and idle are reported.

vmstat can also report on swapping and cache flushing. The -S adds two fields to the beginning of the paging statistics. These are si, which lists the number of pages swapped in per second, and so, which gives the number of entire processes swapped out.

vmstat -c displays cache flushing statistics for a virtual cache. The number of cache flushes since the last reboot are listed. The output of this command looks like:

 flush statistics: (totals)
     usr     ctx     rgn     seg     pag     par
       0       0       0       0       0       0
The cache types listed are:

vmstat -i displays the number of interrupts per device. The output looks like:

interrupt         total     rate
clock          98080370      100
fdc0                 14        0
Total          98080384      100


Old News ;-)

Examining vmstat AIX IBM Systems Magazine

My favorite coarse-grained tool for monitoring servers is definitely the venerable vmstat. After the eyes have been trained to interpret the data, it's amazing what can be gleaned from this tool.

The Basics
In AIX* 5.1, vmstat has the following syntax options:

vmstat [ -f ] [ -i ] [ -s ] [ -I ] [ -t ]
[ PhysicalVolume ... ] [ Interval [Count ] ]

From the AIX 5.1 "man" pages, the vmstat command reports statistics about kernel threads, virtual memory, disks, traps and CPU activity. These system-wide (among all processors) statistics are calculated as averages for values expressed as percentages and as sums otherwise. If the vmstat command is invoked without flags, the report contains a summary of activity since system startup. The interval parameter specifies the amount of time between each report in seconds. The first report contains statistics for the time since startup. Subsequent reports contain statistics collected during the interval since the previous report.

Figure 1(see below) shows data collected on an AIX 5.1 server using the command: $ vmstat -It 15 16 (boot line has been removed).

The first three columns in Figure 1 list information about threads. "r" reports the average total number of kernel, kernel-managed and user threads in the global run queue (per second). In a nutshell, non-zero values represent a CPU queue--tasks waiting on busy CPU(s) or tasks waiting because of data-serialization issues.

Conceptually, a thread is a distinct sequence of execution steps performed within a process. Each thread has its own stack, register set, program counter, thread-specific data, thread-local variables, thread-specific signal mask and state information. However, all such threads share the same address space (program text, data and heap), open files pointers, user credentials, management data and I/O with the other threads in the same process.

In AIX, the kernel allows many threads to run at the same time, but there can only be one thread actually executing on each CPU. (Note: Starting with the POWER5* processor, a hardware configuration called simultaneous multithreading allows two threads to be running in each processor core). Every process has at least one thread; some processes have many. The scheduler and dispatcher only work with threads. Threads can be viewed with the ps -emo THREAD command.

AIX has three types of threads: kernel, kernel-managed and user. Kernel threads aren't associated with a user process, and therefore have no user context. They run in kernel mode and have their own kernel stack. These threads are also inexpensive to create and manage, so they're typically used to perform a specific function like asynchronous I/O.

Monitoring Virtual Memory with vmstat

Linux novices often find virtual memory mysterious, but with a grasp of the fundamental concepts, it's easy to understand. With this knowledge, you can monitor your system's memory utilization using vmstat and detect problems that can adversely affect system performance.

How Virtual Memory Works

Physical memory-the actual RAM installed-is a finite resource on any system. The Linux memory handler manages the allocation of that limited resource by freeing portions of physical memory when possible.

All processes use memory, of course, but each process doesn't need all its allocated memory all the time. Taking advantage of this fact, the kernel frees up physical memory by writing some or all of a process' memory to disk until it's needed again.

The kernel uses paging and swapping to perform this memory management. Paging refers to writing portions, termed pages, of a process' memory to disk. Swapping, strictly speaking, refers to writing the entire process, not just part, to disk. In Linux, true swapping is exceedingly rare, but the terms paging and swapping often are used interchangeably.

When pages are written to disk, the event is called a page-out, and when pages are returned to physical memory, the event is called a page-in. A page fault occurs when the kernel needs a page, finds it doesn't exist in physical memory because it has been paged-out, and re-reads it in from disk.

Page-ins are common, normal and are not a cause for concern. For example, when an application first starts up, its executable image and data are paged-in. This is normal behavior.

Page-outs, however, can be a sign of trouble. When the kernel detects that memory is running low, it attempts to free up memory by paging out. Though this may happen briefly from time to time, if page-outs are plentiful and constant, the kernel can reach a point where it's actually spending more time managing paging activity than running the applications, and system performance suffers. This woeful state is referred to as thrashing.

Using swap space is not inherently bad. Rather, it's intense paging activity that's problematic. For instance, if your most-memory-intensive application is idle, it's fine for portions of it to be set aside when another large job is active. Memory pages belonging to an idle application are better set aside so the kernel can use physical memory for disk buffering.

Using vmstat

vmstat, as its name suggests, reports virtual memory statistics. It shows how much virtual memory there is, how much is free and paging activity. Most important, you can observe page-ins and page-outs as they happen. This is extremely useful.

To monitor the virtual memory activity on your system, it's best to use vmstat with a delay. A delay is the number of seconds between updates. If you don't supply a delay, vmstat reports the averages since the last boot and quit. Five seconds is the recommended delay interval.

To run vmstat with a five-second delay, type:

vmstat 5

You also can specify a count, which indicates how many updates you want to see before vmstat quits. If you don't specify a count, the count defaults to infinity, but you can stop output with Ctrl-C.

To run vmstat with ten updates, five seconds apart, type:

vmstat 5 10

Here's an example of a system free of paging activity:

  procs                     memory    swap        io     system cpu
r  b  w   swpd   free  buff  cache  si so   bi  bo   in    cs us sy  id
0  0  0  29232 116972  4524 244900   0  0    0   0    0     0 0   0   0
0  0  0  29232 116972  4524 244900   0  0    0   0 2560     6 0   1  99
0  0  0  29232 116972  4524 244900   0  0    0   0 2574    10 0   2  98

All fields are explained in the vmstat man page, but the most important columns for this article are free, si and so. The free column shows the amount of free memory, si shows page-ins and so shows page-outs. In this example, the so column is zero consistently, indicating there are no page-outs.

The abbreviations so and si are used instead of the more accurate po and pi for historical reasons.

Here's an example of a system with paging activity:

  procs          memory             swap      io       system  --- cpu ---
r  b  w   swpd   free  buff cache  si  so   bi   bo   in    cs us  sy  id
. . .
1  0  0  13344   1444  1308 19692   0 168  129   42 1505   713 20  11  69
1  0  0  13856   1640  1308 18524  64 516  379  129 4341   646 24  34  42
3  0  0  13856   1084  1308 18316  56  64   14    0  320  1022 84   9   8

Notice the nonzero so values indicating there is not enough physical memory and the kernel is paging out. You can use top and ps to identify the processes that are using the most memory.

You also can use top to show memory and swap statistics. Here is an example of the uppermost portion of a typical top report:

14:23:19 up 348 days,  3:02,  1 user,  load average: 0.00, 0.00, 0.00
55 processes: 54 sleeping, 1 running, 0 zombie, 0 stopped
CPU states:   0.0% user,   2.4% system,   0.0% nice,  97.6% idle
Mem:    481076K total,   367508K used,   113568K free,     4712K buffers
Swap:  1004052K total,    29852K used,   974200K free,   244396K cached

Recommended Links


vmstat reports information about processes, memory, paging, block IO, traps, and cpu activity.

The first report produced gives averages since the last reboot. Additional reports give information on a sampling period of length delay. The process and memory reports are instantaneous in either case.


Field Description For Vm Mode






CPU (These are percentages of total CPU time).

Field Description For Disk Mode


total: Total reads completed successfully merged: grouped reads (resulting in one I/O) sectors: Sectors read successfully ms: milliseconds spent reading


total: Total writes completed successfully merged: grouped writes (resulting in one I/O) sectors: Sectors written successfully ms: milliseconds spent writing


cur: I/O in progress
s: seconds spent for I/O

Field Description For Disk Partition Mode

reads: Total number of reads issued to this partition read sectors: Total read sectors for partition writes : Total number of writes issued to this partition requested writes: Total number of write requests made for partition

Field Description For Slab Mode

cache: Cache name num: Number of currently active objects total: Total number of available objects size: Size of each object pages: Number of pages with at least one active object totpages: Total number of allocated pages pslab: Number of pages per slab


vmstat does not require special permissions.

These reports are intended to help identify system bottlenecks. Linux vmstat does not count itself as a running process.

All linux blocks are currently 1024 bytes. Old kernels may report blocks as 512 bytes, 2048 bytes, or 4096 bytes.

Since procps 3.1.9, vmstat lets you choose units (k, K, m, M) default is K (1024 bytes) in the default mode

vmstat uses slabinfo 1.1 FIXME



See Also

iostat(1), sar(1), mpstat(1), ps(1), top(1), free(1)

Solaris 10

See System Administration Guide: Advanced Administration for device naming conventions for disks.







SunOS 5.10 Last Revised 20 Dec 2004



Groupthink : Two Party System as Polyarchy : Corruption of Regulators : Bureaucracies : Understanding Micromanagers and Control Freaks : Toxic Managers :   Harvard Mafia : Diplomatic Communication : Surviving a Bad Performance Review : Insufficient Retirement Funds as Immanent Problem of Neoliberal Regime : PseudoScience : Who Rules America : Neoliberalism  : The Iron Law of Oligarchy : Libertarian Philosophy


War and Peace : Skeptical Finance : John Kenneth Galbraith :Talleyrand : Oscar Wilde : Otto Von Bismarck : Keynes : George Carlin : Skeptics : Propaganda  : SE quotes : Language Design and Programming Quotes : Random IT-related quotesSomerset Maugham : Marcus Aurelius : Kurt Vonnegut : Eric Hoffer : Winston Churchill : Napoleon Bonaparte : Ambrose BierceBernard Shaw : Mark Twain Quotes


Vol 25, No.12 (December, 2013) Rational Fools vs. Efficient Crooks The efficient markets hypothesis : Political Skeptic Bulletin, 2013 : Unemployment Bulletin, 2010 :  Vol 23, No.10 (October, 2011) An observation about corporate security departments : Slightly Skeptical Euromaydan Chronicles, June 2014 : Greenspan legacy bulletin, 2008 : Vol 25, No.10 (October, 2013) Cryptolocker Trojan (Win32/Crilock.A) : Vol 25, No.08 (August, 2013) Cloud providers as intelligence collection hubs : Financial Humor Bulletin, 2010 : Inequality Bulletin, 2009 : Financial Humor Bulletin, 2008 : Copyleft Problems Bulletin, 2004 : Financial Humor Bulletin, 2011 : Energy Bulletin, 2010 : Malware Protection Bulletin, 2010 : Vol 26, No.1 (January, 2013) Object-Oriented Cult : Political Skeptic Bulletin, 2011 : Vol 23, No.11 (November, 2011) Softpanorama classification of sysadmin horror stories : Vol 25, No.05 (May, 2013) Corporate bullshit as a communication method  : Vol 25, No.06 (June, 2013) A Note on the Relationship of Brooks Law and Conway Law


Fifty glorious years (1950-2000): the triumph of the US computer engineering : Donald Knuth : TAoCP and its Influence of Computer Science : Richard Stallman : Linus Torvalds  : Larry Wall  : John K. Ousterhout : CTSS : Multix OS Unix History : Unix shell history : VI editor : History of pipes concept : Solaris : MS DOSProgramming Languages History : PL/1 : Simula 67 : C : History of GCC developmentScripting Languages : Perl history   : OS History : Mail : DNS : SSH : CPU Instruction Sets : SPARC systems 1987-2006 : Norton Commander : Norton Utilities : Norton Ghost : Frontpage history : Malware Defense History : GNU Screen : OSS early history

Classic books:

The Peter Principle : Parkinson Law : 1984 : The Mythical Man-MonthHow to Solve It by George Polya : The Art of Computer Programming : The Elements of Programming Style : The Unix Haterís Handbook : The Jargon file : The True Believer : Programming Pearls : The Good Soldier Svejk : The Power Elite

Most popular humor pages:

Manifest of the Softpanorama IT Slacker Society : Ten Commandments of the IT Slackers Society : Computer Humor Collection : BSD Logo Story : The Cuckoo's Egg : IT Slang : C++ Humor : ARE YOU A BBS ADDICT? : The Perl Purity Test : Object oriented programmers of all nations : Financial Humor : Financial Humor Bulletin, 2008 : Financial Humor Bulletin, 2010 : The Most Comprehensive Collection of Editor-related Humor : Programming Language Humor : Goldman Sachs related humor : Greenspan humor : C Humor : Scripting Humor : Real Programmers Humor : Web Humor : GPL-related Humor : OFM Humor : Politically Incorrect Humor : IDS Humor : "Linux Sucks" Humor : Russian Musical Humor : Best Russian Programmer Humor : Microsoft plans to buy Catholic Church : Richard Stallman Related Humor : Admin Humor : Perl-related Humor : Linus Torvalds Related humor : PseudoScience Related Humor : Networking Humor : Shell Humor : Financial Humor Bulletin, 2011 : Financial Humor Bulletin, 2012 : Financial Humor Bulletin, 2013 : Java Humor : Software Engineering Humor : Sun Solaris Related Humor : Education Humor : IBM Humor : Assembler-related Humor : VIM Humor : Computer Viruses Humor : Bright tomorrow is rescheduled to a day after tomorrow : Classic Computer Humor

The Last but not Least Technology is dominated by two types of people: those who understand what they do not manage and those who manage what they do not understand ~Archibald Putt. Ph.D

Copyright © 1996-2021 by Softpanorama Society. was initially created as a service to the (now defunct) UN Sustainable Development Networking Programme (SDNP) without any remuneration. This document is an industrial compilation designed and created exclusively for educational use and is distributed under the Softpanorama Content License. Original materials copyright belong to respective owners. Quotes are made for educational purposes only in compliance with the fair use doctrine.

FAIR USE NOTICE This site contains copyrighted material the use of which has not always been specifically authorized by the copyright owner. We are making such material available to advance understanding of computer science, IT technology, economic, scientific, and social issues. We believe this constitutes a 'fair use' of any such copyrighted material as provided by section 107 of the US Copyright Law according to which such material can be distributed without profit exclusively for research and educational purposes.

This is a Spartan WHYFF (We Help You For Free) site written by people for whom English is not a native language. Grammar and spelling errors should be expected. The site contain some broken links as it develops like a living tree...

You can use PayPal to to buy a cup of coffee for authors of this site


The statements, views and opinions presented on this web page are those of the author (or referenced source) and are not endorsed by, nor do they necessarily reflect, the opinions of the Softpanorama society. We do not warrant the correctness of the information provided or its fitness for any purpose. The site uses AdSense so you need to be aware of Google privacy policy. You you do not want to be tracked by Google please disable Javascript for this site. This site is perfectly usable without Javascript.

Last modified: March 12, 2019