Read Linux Memory and CPU Pressure with vmstat

vmstat gives you a quick, repeatable look at runnable work, blocked processes, memory, swap traffic, block I/O and CPU time in one screen.

The useful result is not one alarming number. It is a short sample that lets you tell CPU pressure from waiting on I/O, and swap activity from merely allocated swap. Allow about ten minutes on a familiar host. This guide describes procps-ng 4.0.4, installed here as Ubuntu package procps 2:4.0.4-4ubuntu3.3. Values and device names will differ on every host.

• You need: a shell account with read access to /proc, which is normally an ordinary user operation.

1. Confirm the installed command

Check which executable your shell will run and record its version before comparing output with another machine:

$ command -v vmstat
/usr/bin/vmstat
$ vmstat --version
vmstat from procps-ng 4.0.4

If command -v returns nothing, install the distribution's procps package through your normal package-management process. Do not copy a binary from another host merely to get the same output format.

2. Take a baseline snapshot

Run vmstat without a delay:

$ vmstat
procs -----------memory---------- ---swap-- -----io---- -system-- -------cpu-------
 r  b   swpd   free   buff  cache   si   so    bi    bo   in   cs us sy id wa st gu
 4  0 3943984 1000824 2429760 20892688    6   17  1028  1195 4956   11  7  2 88  4  0  0

The first report contains averages since the last reboot for the rate-style fields. The process and memory values are instantaneous. Read the columns like this:

• r and b. r is runnable work, including work waiting for CPU time; b is work blocked waiting for I/O.
• swpd, si, so. swpd is used swap memory, while si and so are memory swapped in and out per second.
• free, buff, cache. Available and cached memory in the displayed unit.
• bi, bo, in, cs. Block-device input and output rates; interrupts per second; context switches per second.
• us, sy, id, wa, st, gu. Percentages for user, kernel, idle, I/O wait, stolen virtual-machine time and KVM guest time.

Do not treat a large swpd value as proof of current memory trouble: it can be old, unused swap. Current pressure is more usefully indicated by sustained non-zero si or so, rising r, low useful memory and the workload's own symptoms.

3. Sample a live workload

Use a delay and count to collect a bounded sample. This command waits one second between reports and stops after three updates:

$ vmstat 1 3
procs -----------memory---------- ---swap-- -----io---- -system-- -------cpu-------
 r  b   swpd   free   buff  cache   si   so    bi    bo   in   cs us sy id wa st gu
 1  0 3943984 1000824 2429760 20892688    6   17  1028  1195 4956   11  7  2 88  4  0  0
 0  0 3943984 1000428 2429760 20892668    0    0     0   147 2791 4622  3  1 96  0  0  0
 4  0 3943984 1019916 2429760 20892708    0    0     0    64 7110 13516  8  4 88  0  0  0

The exact numbers are host-specific. The first line is still the since-boot report, so compare the second and later lines when you want the sampled interval. A persistently high r with low id suggests CPU contention. High wa or b points towards waiting on I/O. Non-zero si and so across several samples indicate active swap traffic.

4. Remove the confusing first report

When you only want interval samples, add --no-first (or -y):

$ vmstat --no-first 1 2
procs -----------memory---------- ---swap-- -----io---- -system-- -------cpu-------
 r  b   swpd   free   buff  cache   si   so    bi    bo   in   cs us sy id wa st gu
 2  2 3943984 992176 2429772 20902116    0    0     8 29923 14339 22198 48  4 41  6  0  0
 1  2 3943984 934376 2429804 20933968    0    0     0 61784  7157 14603 37  4 48 11  0  0

Add --one-header (or -n) as well when a longer sample should print the headings only once. This makes redirected output less repetitive, but it does not change the measurements.

5. Choose units without misreading swap and I/O

Memory fields can be displayed in 1024-byte units with --unit K, or in 1000-byte units with --unit k. For example:

$ vmstat --unit K 1 1
procs -----------memory---------- ---swap-- -----io---- -system-- -------cpu-------
 r  b   swpd   free   buff  cache   si   so    bi    bo   in   cs us sy id wa st gu
 2  2 3943984 934376 2429804 20933968    6   17  1028  1195 4956   11  7  2 88  4  0  0

The unit option affects memory and related byte-sized fields, but not si, so, bi or bo. The latter retain their documented rate conventions. Keep the unit choice in notes or scripts so a later reader does not compare unlike reports.

6. Inspect counters and disks when the baseline is not enough

Use vmstat --stats (or -s) for one non-repeating table of event counters and memory statistics:

$ vmstat --stats | head -n 6
     32644620 K total memory
     10081152 K used memory
     10964716 K active memory
     14822324 K inactive memory
       934376 K free memory
      2429804 K buffer memory

The counters are useful context, but they are not interval measurements. For per-device read, write and I/O-in-progress figures, use vmstat --disk (or -d):

$ vmstat --disk | head -n 4
disk- ------------reads------------ ------------writes----------- -----IO------
       total merged sectors      ms  total merged sectors      ms    cur    sec
loop0   3195      0  293054   29710      0      0       0       0      0     29

Device names such as loop0, sda and md0 depend on the host. Do not infer that a device is busy from its cumulative totals alone; use the current I/O column and a repeated sample or another tool when timing matters.

Common traps

• Most readings need no sudo. The --slabs mode, vmstat -m, reads /proc/slabinfo and may be unavailable to ordinary users. If it fails, check the permission error and host policy first; do not loosen /proc permissions just to complete a diagnostic.
• Containers can show only part of the picture. A container or a /proc mount using subset=pid can expose only part of the host's information. Treat missing or unusual data as a visibility boundary, not automatically as a kernel fault.
• An interrupted command has changed nothing. It has only read statistics; there is no configuration to undo.
• Add --timestamp for time-stamped samples, and --wide for large-memory systems where columns wrap. These change presentation, not the underlying counters.
• Pin the procps version if a parser reads the output. Test the exact flags on the target distribution.