Linux – Besides cache, what does the Linux kernel use significant amounts of memory for

linux-kernelperformanceram

My computer feels really sluggish. According to free, I have only ~200M RAM left and more than a gigabyte had to be swapped out. I know that it is good if memory is used for caching but this looks like I'm genuinely low on RAM.

root@desktop:/proc free -h
               total       used        free      shared  buff/cache   available
Mem:           3.9G        3.4G        132M         44M        378M        213M
Swap:          8.0G        1.2G        6.7G

smem -tk reports that at most 2GiB (RSS column) are used by applications. smem -wk accounts for all the memory that is used. Apparently the kernel uses 1.8GiB not for caching:

root@desktop:/proc smem -wk
Area                           Used      Cache   Noncache 
firmware/hardware                 0          0          0 
kernel image                      0          0          0 
kernel dynamic memory          1.9G      74.3M       1.8G 
userspace memory               1.8G     250.9M       1.6G 
free memory                  173.9M     173.9M          0

Is this behaviour expected, and if yes, for what task does the kernel need so much memory?

Best Answer

You can also try this:

Use sar to report on context-switches and irq use over time. Sar is a great but unhearalded system monitoring tool. Run it for a day and then use various reports to look for oddness.

Steps:

Install the sysstat package. Set up the cron job (check /etc/cron.d/ to see if such a file exists) like this:

* * * * * root /usr/lib64/sa/sa1 -S XALL 10 6

This will create lots of data -- about 300 MB per day. It will take a snapshot of the system statistics every 6 seconds. (You can decrease the frequency to twice per minute by changing "10 6" to "2 30")

If you change the capturing frequency, you should erase the day's file in /var/log/sa/sa$(date +%d) -- otherwise the reports might get corrupted.

OK, after you have captured your data, try these (Tip: always pipe through less):

sar -q

To get load-averages and the run-queue sizes. If these are low, then look at the IO wait times:

sar -P ALL

If you don't see jumps in %iowait or troughs in %idle, then check out context-switches: 

saw -w

500 context-switches per second is pretty normal on a mostly-idle system.

You can limit sar reporting by specifying the activity file, giving a start- and end-time (-s <hh:mm:ss> and -e <hh:mm:sss> respectively) and optionally an interval time with -i <secs> (must be greater than your capturing resolution, set up by the cron job).

Example:

sar -f /var/log/sa/sa$(date +%d -d yesterday) -s 09:15:00 -e 12:15:00 -i 600

will give you summary info for the CPU in 10-minute intervals from yesterday between 9:15 and 12:15.

There's more... much more. You can do man sar to get that info.

Related Question