I have a scenario where I can see there is paging activity on my Ubuntu 16.04 laptop using vmstat 1 100.

Due to the sheer size of the current load it is expected that processes are more or less swapped out to disk which is fine. I would, however, like to identify those that cause pages to swapped in all the time (as identified by vmstat) as this might indicate that memory allocation could be improved.

My sysadmin skills are a bit rusty but I am comfortable in a root shell.

What commands should I use to identify the processes which are causing swapping activity?


With performance problems (e.g. high CPU iowait times) it's generally best to monitor these things over time rather than after the fact, especially when short-lived processes might be the culprit. On Linux one tool you can use interactively is iotop (fixed link) (see also the answers to this question about tracking disk I/O). You can script this (batch mode) or run it interactively like top, use the cursor keys to sort by SWAPIN, or use the -o option so the output isn't so cluttered. You will need Python ≥2.7 and various kernel configuration parameters enabled (see iotop's README or man page).

Rather than use only data from /proc like vmstat, iotop uses taskstats, this uses netlink IPC to efficiently provide process accounting directly from the kernel to user space.

On most flavours of Linux with the default "swappiness" setting of 60, it's fairly normal to see paging activity when the system is moderately busy: the kernel is pre-emptively writing little-used process pages to swap instead of purging more recently used disk cache pages. (There's a related parameter vfs_cache_pressure to tune some cacheing behaviour.) If you observe persistent ongoing paging, then there is likely more to it than just this.

Otherwise, if you are concerned about swap use right now rather than over time: the kernel keeps track of swap use per process in /proc/PID/status. You can do something quick with gawk (≥v4.0):

gawk '/^Name:/{nm=$2} /^Pid:/{pid=$2} /^VmSwap:/{sw=$2} 
  ENDFILE{printf("%-24s %6i %6ikiB\n",nm,pid,sw)}' /proc/[0-9]*/status | 
sort -h -k 3

According to the documentation shmem (shared memory) that's swapped out is not counted here, but you hopefully won't need to care about that. Eric Ljungstrom's getswap.sh script can also be used, there's a more advanced version of it in this answer.

| improve this answer | |
  • Just to be clear - I am not seeing swap usage increased but that apparently some processes are reading in pages all the time. I want to identify these. Can iotop do that? – Thorbjørn Ravn Andersen Feb 1 '18 at 23:43
  • Yes, it will show swapin (as a %), apologies I linked to the wrong iotop (there are it seems at least four different ones...) Fixed link. The kernel does not "blame" a process for page out, they are not accounted for per PID. – mr.spuratic Feb 2 '18 at 10:19

Try the command:

 ps -eo pid,cmd,vsz

This will list process in the format process id, command executed, and virtual memory size of the process in KiB

| improve this answer | |
  • From "man ps": _vsz VSZ virtual memory size of the process in KiB (1024-byte units). _ I need the activity, not the total size. These are page-ins. The total size will not change. – Thorbjørn Ravn Andersen Jan 31 '18 at 10:24
  • You would need to run something like "find /proc -maxdepth 2 -name stat -exec cat '{}' \;" then and parse the output. – Raman Sailopal Jan 31 '18 at 10:46
  • Did you actually try this? – Thorbjørn Ravn Andersen Jan 31 '18 at 12:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.