Using vmstat

Using vmstat

vmstat (virtual memory statistics) is the quick-glance tool for overall system health. In one line of output it shows: how many processes are running or blocked, CPU breakdown (user/system/idle/iowait), swap activity, and I/O. It is usually the first tool to run when a server is "slow" and you do not yet know which resource is the problem. The first line of output is always averages since boot — skip it and look at subsequent lines.

vmstat output explained

vmstat 1 5    # 1-second interval, 5 samples (first line = since-boot avg, ignore)

vmstat output with all columns explained

procs ------memory------ ---swap-- -----io---- -system-- ------cpu-----
 r  b   swpd   free  buff  cache   si   so    bi    bo   in    cs us sy id wa
 2  0  65536 412000 98000 4.1G     0    0   892   445  524  1234 34  8 55  2
 4  1  65536 380000 98000 4.0G     0    4   912   892  893  2341 45 12 38  4
 1  8  65792 256000 98000 3.8G    12   48  2341  1892 1892  4521 38 18 10 32

r  = runnable processes (waiting for CPU); r > nproc = CPU bottleneck
b  = blocked processes in uninterruptible sleep (I/O wait); b > 0 = I/O bottleneck
si = swap in (KB/s from swap to RAM); nonzero = memory pressure
so = swap out (KB/s from RAM to swap); nonzero = memory pressure
wa = iowait CPU% (CPU idle waiting for I/O); high = disk bottleneck

Diagnosing problems with vmstat

# Scenario analysis:

# CPU bottleneck: high r, low b, high us/sy, low wa
# r=8 b=0 us=95 sy=3 id=2 wa=0
# → 8 processes waiting for CPU, almost no idle time

# I/O bottleneck: low r, high b, high wa, low us
# r=1 b=7 us=15 sy=5 id=10 wa=70
# → 7 processes blocked on I/O, 70% iowait

# Memory pressure: nonzero si/so
# si=45 so=128
# → System actively swapping — add RAM or reduce memory usage

# Healthy server: r~=nproc, b=0, si=0, so=0, id>20%
# r=2 b=0 swpd=0 si=0 so=0 us=35 sy=8 id=55 wa=2

Memory and swap interpretation

# vmstat memory columns:
# swpd  = amount of swap in use (KB)
# free  = truly free RAM (KB)
# buff  = kernel buffer cache
# cache = page cache (file data)

# swpd > 0 does not automatically mean a problem:
# If si=0 and so=0, the swap was used historically but is not actively swapping now
# Problem indicator: si or so > 0 (active swapping happening now)

# Check if server is currently swapping:
vmstat 1 3 | awk 'NR>2 {print "si="$7, "so="$8}'

vmstat swap check output

si=0 so=0   ← good: no active swapping
si=0 so=0
si=0 so=0

Conclusion

vmstat 1 is a one-line system health dashboard. Scan these columns in order: b (blocked on I/O?), r (CPU queue depth?), si/so (swapping?), wa (iowait%?). Any of these nonzero or elevated indicates the corresponding resource is the bottleneck. vmstat is also the most reliable way to detect memory pressure early — watch for so turning nonzero, which means the kernel is starting to push data from RAM to swap.