Linux – what are the different caches reported by slabtop

Background

The slab's reported in slabtop are difficult to quantify to a particular kernel module because they're getting merged down into singular types which overlap based on their similarity to others in terms of the objects they're holding.

Specifically, on modern Linux the names shown in slabinfo are basically a hint because the current slab allocator in the kernel merges multiple slab types together if they are sufficiently similar. If five different subsystems all want to allocate (different) 128-byte objects with no special properties, they don't each get separate slab types with separate slabinfo entries; instead they are all merged into one slab type and thus one slabinfo entry. That slabinfo entry normally shows the name of one of them, probably the first to be set up, with no direct hint that it also includes the usage of all the others.

(The others don't appear in slabinfo at all.)

This article goes on to discuss that because of the above merging, often times there's slab cache types that don't show up at all in /proc/slabinfo. You can see some of this effect by looking here: /sys/kernel/slab. This directory shows which slab caches are getting merged with others in the form of symbolic links.

The image on the left shows the links (light blue) from the directory /sys/kernel/slab which are getting merged into other slabs. The image on the right shows all the caches which are merging into :t-0000256 slab.

Tracking slabs

If we continue to look through the /sys/kernel/slab directory:

$ ls -l /sys/kernel/slab/  | grep filp
lrwxrwxrwx 1 root root 0 Aug  5 21:23 filp -> :t-0000256

Here's the filp you were inquiring about. To see more about it you might want to try installing the slabinfo CLI.

• Short users guide for SLUB
• linux/vm/slabinfo.c

slabinfo

I did not have this CLI available to triage this further on CentOS 7.x but you may want to investigate it. Compiling this CLI gives you access to slabinfo -a which shows the aliases that the slabs associate with under /sys/kernel/slab. I believe it's these alias that you're looking for which will help to associate which slabs are which in the slabtop.

References

• How /proc/slabinfo is not quite telling you what it looks like
• The SLUB allocator
• Overview of Linux Memory Management Concepts: Slabs
• Chapter 8 Slab Allocator
• Slab allocators in the Linux Kernel: SLAB, SLOB, SLUB
• slabinfo.c
• Short users guide for SLUB