Disclaimer: I found this great article on a Linux mailing list. It is written by Jake Dawley-Carr and I honestly do not know what the copyright is on it but since it was posted on a mailing list, I assume it is in public domain. If the author contacts me, I will remove it but meanwhile, I would like to republish it because there is no knowing how long the article is going to be indexed and it would be too bad it to get lost.

 

HOWTO: Profile Memory in a Linux System

Introduction

It’s important to determine how your system utilizes it’s resources. If your systems performance is unacceptable, it is necessary to determine which resource is slowing the system down. This document attempts to identify the following:

  • What is the system memory usage per unit time?
  • How much swap is being used per unit time?
  • What does each process’ memory use look like over time?
  • What processes are using the most memory?

I used a RedHat-7.3 machine (kernel-2.4.18) for my experiments, but any modern Linux distribution with the commands “ps” and “free” would work.

Definitions

RAM (Random Access Memory – Location where programs reside when they are running. Other names for this are system memory or physical memory. The purpose of this document is to determine if you have enough of this.

Memory Buffers – A page cache for the virtual memory system. The kernel keeps track of frequently accessed memory and stores the pages here.

Memory Cached – Any modern operating system will cache files frequently accessed. You can see the effects of this with the following commands:

for i in 1 2; do free -o; time grep -r foo /usr/bin >/dev/null 2>/dev/null; done

Memory Used – Amount of RAM in use by the computer. The kernel will attempt to use as much of this as possible through buffers and caching.

Swap – It is possible to extend the memory space of the computer by using the hard drive as memory. This is called swap. Hard drives are typically several orders of magnitude slower than RAM so swap is only used when no RAM is available.

Swap Used – Amount of swap space used by the computer. PID (Process IDentifier) - Each process (or instance of a running program) has a unique number. This number is called a PID.

PPID (Parent Process IDentifier) – A process (or running program) can create new processes. The new process created is called a child process. The original process is called the parent process. The child process has a PPID equal to the PID of the parent process. There are two exceptions to this rule. The first is a program called “init”. This process always has a PID of 1 and a PPID of 0. The second exception is when a parent process exit all of the child processes are adopted by the “init” process and have a PPID of 1.

VSIZE (Virtual memory SIZE) – The amount of memory the process is currently using. This includes the amount in RAM and the amount in swap. RSS (Resident Set Size) - The portion of a process that exists in physical memory (RAM). The rest of the program exists in swap. If the computer has not used swap, this number will be equal to VSIZE.

What consumes System Memory?

  • The kernel – The kernel will consume a couple of MB of memory. The memory that the kernel consumes can not be swapped out to disk. This memory is not reported by commands such as “free” or “ps”.
  • Running programs – Programs that have been executed will consume memory while they run.
  • Memory Buffers – The amount of memory used is managed by the kernel. You can get the amount with “free”.
  • Memory Cached – The amount of memory used is managed by the kernel. You can get the amount with “free”.

Determining System Memory Usage

The inputs to this section were obtained with the command:

free -o

The command “free” is a c program that reads the “/proc” filesystem.

There are three elements that are useful when determining the system memory usage. They are:

  • Memory Used
  • Memory Used - Memory Buffers - Memory Cached
  • Swap Used

A graph of “Memory Used” per unit time will show the “Memory Used” asymptotically approach the total amount of memory in the system under heavy use. This is normal, as RAM unused is RAM wasted.

A graph of “Memory Used - Memory Buffered - Memory Cached” per unit time will give a good sense of the memory use of your applications minus the effects of your operating system. As you start new applications, this value should go up. As you quit applications, this value should go down. If an application has a severe memory leak, this line will have a positive slope.

A graph of “Swap Used” per unit time will display the swap usage. When the system is low on RAM, a program called kswapd will swap parts of process if they haven’t been used for some time. If the amount of swap continues to climb at a steady rate, you may have a memory leak or you might need more RAM. 5.

Per Process Memory Usage

The inputs to this section were obtained with the command:

ps -eo pid,ppid,rss,vsize,pcpu,pmem,cmd -ww --sort=pid

The command “ps” is a c program that reads the “/proc” filesystem. There are two elements that are useful when determining the per process memory usage.

They are:

  • RSS
  • VSIZE

A graph of RSS per unit time will show how much RAM the process is using over time. A graph of VSIZE per unit time will show how large the process is over time.

.

Collecting Data

  • Reboot the system. This will reset your systems memory use

  • Run the following commands every ten seconds and redirect the results to a file.

      free -o ps -eo pid,ppid,rss,vsize,pcpu,pmem,cmd -ww --sort=pid
  • Do whatever you normally do on your system
  • Stop logging your data
  • Generate a Graph: System Memory Use For the output of “free”, place the following on one graph:
      1. X-axis is “MB Used”
    • Y-axis is unit time Memory Used per unit time
    • Memory Used
    • Memory Buffered
    • Memory Cached per unit time
    • Swap Used per unit time
  • Per Process Memory Use For the output of “ps”, place the following on one graph
    • X-axis is “MB Used”
    • Y-axis is unit time
  • For each process with %MEM > 10.0
    • RSS per unit time
    • VSIZE per unit time

Understand the Graphs

  • System Memory Use “Memory Used” will approach “Memory Total” If “Memory Used - Memory Buffered - Memory Cached” is 75% of “Memory Used”, you either have a memory leak or you need to purchase more memory.
  • Per Process Memory Use This graph will tell you what processes are hogging the memory. If the VSIZE of any of these programs has a constant, positive slope, it may have a memory leak.