vmstat Virtual Memory

vmstat cheatsheet — virtual memory statistics for Linux performance analysis. vmstat 1 — live stats every second. vmstat -s — summary. Columns: r, b, swpd, free, si, so, bi, bo.

5 min read

What it is

vmstat reports virtual memory statistics, and is useful for understanding system performance bottlenecks related to memory, processes, CPU, and I/O.

Installation

vmstat is typically part of the procps or procps-ng package, which is usually installed by default on most Linux distributions.

Linux: Often pre-installed. If not:

sudo apt update && sudo apt install procps # Debian/Ubuntu
sudo yum install procps-ng # CentOS/RHEL
sudo dnf install procps-ng # Fedora

Mac: vmstat is a built-in Unix utility and is available by default.

Windows: vmstat is not a native Windows command. You can achieve similar functionality using tools like Task Manager (GUI) or PowerShell cmdlets like Get-Counter.

Commands / Usage

Basic Usage

View a single snapshot of system activity:

vmstat

Shows processes, memory, swap, I/O, system, and CPU activity for a single interval.

View system activity every 2 seconds, 5 times:

vmstat 2 5

vmstat <delay> <count> Reports statistics every <delay> seconds, for a total of <count> reports.

View system activity continuously every 1 second:

vmstat 1

Reports statistics every second until interrupted (Ctrl+C).

Process Statistics

Show process information with a delay of 1 second:

vmstat -a 1

-a or --active Shows active and inactive memory.

Show processes blocked for resources:

vmstat -f 1

-f or --forks Displays the number of forks since boot.

Memory Statistics

Show memory statistics with a delay of 1 second:

vmstat -s 1

-s or --stats Displays a table of various event counters and memory statistics.

Show swap statistics with a delay of 1 second:

vmstat -S 1

-S or --swap Reports swap activity.

I/O Statistics

Show disk I/O statistics with a delay of 1 second:

vmstat -d 1

-d or --disk Displays disk statistics.

Show Virtual Network Interface statistics with a delay of 1 second:

vmstat -n 1

-n or --net Displays network interface statistics.

CPU Statistics

Show CPU statistics with a delay of 1 second:

vmstat -p 1

-p or --partition Displays statistics for each CPU partition (core).

System Statistics

Show system statistics with a delay of 1 second:

vmstat -t 1

-t or --timestamp Adds a timestamp to each line of output.

Show system statistics with a delay of 1 second and include timestamps:

vmstat -W 1

-W or --wide Use wide output.

Combining Options

Show detailed memory and swap statistics every 2 seconds:

vmstat -sS 2

Combines the -s (stats) and -S (swap) options.

Show disk and network statistics with timestamps every 3 seconds:

vmstat -tdn 3

Combines -t (timestamp), -d (disk), and -n (net) options.

Common Patterns

Monitoring for high CPU usage (us, sy, id columns):

vmstat 1 | awk '/^[0-9]/{ if ($15 > 90) print strftime("%Y-%m-%d %H:%M:%S"), $15 }'

This watches the idle CPU percentage (id, the last column) and prints a timestamp if it drops below 10% (meaning CPU usage is > 90%).

Monitoring for high memory swapping (si, so columns):

vmstat 1 | awk '/^[0-9]/{ if ($7 > 0 || $8 > 0) print strftime("%Y-%m-%d %H:%M:%S"), $7, $8 }'

This checks the si (swap in) and so (swap out) columns. If either is greater than 0, it indicates swapping is occurring, and the timestamp, si, and so values are printed.

Monitoring for I/O wait (wa column):

vmstat 1 | awk '/^[0-9]/{ if ($14 > 10) print strftime("%Y-%m-%d %H:%M:%S"), $14 }'

This monitors the I/O wait percentage (wa, the second to last column). If it exceeds 10%, it prints a timestamp and the I/O wait value.

Getting a snapshot of disk read/write activity:

vmstat -d

Provides a summary of total disk reads, writes, sectors read/written, and transfers since boot.

Getting a snapshot of network activity:

vmstat -n

Shows network statistics like packets received/sent, errors, and dropped packets.

Gotchas

  • Units: The units for memory (swpd, free, buff, cache) are typically in kilobytes, but this can vary slightly by system and vmstat version. Always check the header row or consult man vmstat for confirmation.
  • CPU Columns: The CPU columns (us, sy, id, wa, st) represent percentages of total CPU time. us is user time, sy is system (kernel) time, id is idle time, wa is I/O wait time, and st is stolen time (from a virtual machine hypervisor).
  • Swap Columns: si (swap in) and so (swap out) represent the amount of memory swapped in from or out to disk per second. Non-zero values indicate active swapping, which is often a sign of memory pressure.
  • r and b columns: The r column shows the number of processes waiting for run time (or runnable). The b column shows the number of processes in uninterruptible sleep (usually waiting for I/O). High numbers in r can indicate CPU contention, while high numbers in b can indicate I/O bottlenecks.
  • buff vs cache: buff refers to buffer cache, used for block device I/O. cache refers to page cache, used for file system I/O. Both are memory that can be reclaimed if needed by applications.
  • free memory: The free column in the default output is often misleadingly low. Most of the memory that appears "used" is actually being utilized for disk caching (buff and cache), which is highly efficient and will be released by the kernel if applications need it. Focus more on free + buff + cache for a sense of readily available memory.