Monitoring Virtual Memory with vmstat

Just using a lot of swap space doesn't necessarily mean that you need more memory. Here's how to tell when Linux is happy with the available memory and when it needs more.

It isn't necessarily bad for your system to be using some of its swap space. But if you discover your system is often running low on physical memory and paging is causing performance to suffer, add more memory. If you can't add more memory, run memory-intensive jobs at different times of the day, avoid running nonessential jobs when memory demand is high or distribute jobs across multiple systems if possible.

Resources for this article: /article/8535.

Brian K. Tanaka has been a UNIX system administrator since 1994 with companies such as SGI, Intuit and RealNetworks. He is cofounder of Martingale-Oak, LLC. He can be contacted at



Comment viewing options

Select your preferred way to display the comments and click "Save settings" to activate your changes.

"A page fault occurs when

Anonymous's picture

"A page fault occurs when the kernel needs a page, finds it doesn't exist in physical memory because it has been paged-out, and re-reads it in from disk"

I'm wondering if that's supposed to read

"A page in occurs when the kernel needs a page, finds it doesn't exist in physical memory because it has been paged-out, and re-reads it in from disk"

Since there is no other mention of page fault in the article and this one instance of page fault is surrounded by talk about page in.

Page Fault/In

Mitch Frazier's picture

The reaction to a "page fault" is a "page in".

The jist of what's written is correct, but there are a couple of minor errors. Page faults occur when any application (and not just the kernel) needs a page that is not currently in memory. A page fault is also not a "kernel" thing, it's a hardware thing. The reaction to the fault, often a "page in" is handled by the kernel. Also, the setup required to support virtual memory is handled by the kernel, but the fault itself is all hardware.

There is also a slight inaccuracy in stating that the fault occurs because the page was previously paged out. The page that causes the fault does not have to have been previously paged out. If the page referred to program code it doesn't get paged out, it just gets paged in when the fault occurs since the code exists in the executable file and doesn't need to be paged out. A page fault can also occur when trying to access memory beyond the end of the stack, thus signalling the O/S that more stack space needs to be allocated, but this again is memory that was never paged out. Here the page is just used as a guard or sentry to tell the O/S when the application needs more stack space.

So I would reword that sentence thusly:

A page fault occurs when the CPU needs a page which does not exist in physical memory. In response to the fault the kernel allocates a free page for the missing memory and if the page was previously paged out, the kernel pages in the previously paged out data. If the kernel is unable to find an unused page to allocate for the missing memory then an existing page will be freed and if need be paged out.

Mitch Frazier is an Associate Editor for Linux Journal.

Hi, If you need to draw

Anonymous's picture


If you need to draw charts from your vmstat log files,
this may help you :


This would be great if you

Ian's picture

This would be great if you explained each column of these displays.

Thanks for the great article

LC's picture

Thanks for the great article Brian. This is really helpful. Virtual memory was a mystery to me, but now I understand it a lot better.