Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

on my linux system I get these stats from top:

Tasks: 155 total,   1 running, 153 sleeping,   0 stopped,   1 zombie
Cpu(s):  1.5%us,  0.3%sy,  0.0%ni, 97.4%id,  0.7%wa,  0.0%hi,  0.0%si,  0.0%st
Mem:   8177180k total,  2025504k used,  6151676k free,    44176k buffers
Swap:  7999996k total,   495300k used,  7504696k free,   637612k cached

There it shows me that my system is using 495Mb of swap. Why is this so? 6Gigs of ram are free. And if I would disable swap entirely the system would also work.

Any explanation what the number really shows or who is swapping?

share|improve this question

Even if there's no application demands on your memory, Linux will swap out unused portions of processes "in advance" of actually needing to so that it can free that memory immediately when the time comes. You can adjust the tendency to do this by adjusting vm.swappiness (/proc/sys/vm/swappiness) per the instructions here.

As for seeing what is swapped, you're theoretically able to tell from the output of top (by subtracting the virtual and resident memory columns, or using the swap column that does the same for you) but my system has 0 swap used and an apache2 process with 248m "Virtual Image", of which 9376k is supposedly "resident", leaving 239m "swapped". I'm not sure if there's an actual way to identify which specific processes or parts of processes are actually in the swap file.

share|improve this answer

Here's a script to show you the swap used by process on your Linux system.

Credit to the original author: Erik Ljungstrom 27/05/2011.

Modified by me to increase usefulness and friendliness. HTH.

# Get current swap usage for running processes
# Original: Erik Ljungstrom 27/05/2011
# Modifications by ariel:
#   - Sort by swap usage
#   - Auto run as root if not root
#   - ~2x speedup by using procfs directly instead of ps
#   - include full command line in output
#   - make output more concise/clearer
#   - better variable names

# Need root to look at all processes details
case `whoami` in
    'root') : ;;
    *) exec sudo $0 ;;


    for DIR in `find /proc/ -maxdepth 1 -type d | grep "^/proc/[0-9]"` ; do
        PID=`echo $DIR | cut -d / -f 3`
        CMDLINE=`cat /proc/$PID/cmdline 2>/dev/null | tr '\000' ' '`
        for SWAP in `grep Swap $DIR/smaps 2>/dev/null | awk '{ print $2 }'`
            let PROC_SWAP=$PROC_SWAP+$SWAP
        if [ $PROC_SWAP == 0 ]; then
            # Skip processes with no swap usage
        echo "$PROC_SWAP        [$PID] $CMDLINE"
    echo "$TOTAL_SWAP   Total Swap Used"
) | sort -n
share|improve this answer

Linux will use part of your memory for caching and buffers, even if it's not full of running programs. This behavior is controlled by the vm.swappiness sysctl. The default is 60, but many of the kernel developers think that on machines over 1GB memory or user desktops it should be zero.

What swappiness mean? It is a value that the kernel will use to decide how happy it will be swapping programs to disk before destroying caches and buffers. This is great on servers (specially file servers or servers with high I/O) and low memory computers but it's bollocks on desktops. So if you set it to zero it will eat all your caches and buffers before thinking in swapping. Or at least it was supposed to work that way, as I said the only way to keep Linux from swapping completely on my laptop was turning off swap with swapoff.


  • Servers: swappiness 60 or more
  • Desktops with high memory: swappiness < 60, 0 or no swap at all, your mileage may vary, watch for the oom_killer messages (that means you ran out of memory and kernel killed something)
  • Low memory desktops: swappiness 60 and swap space = physical memory will probably be the best
share|improve this answer

Swap is used for pages in the memory that are not accessed often, even when you have tons of ram free it still swaps some programs. This is partially to avoid to have to swap when it does get full. Otherwise you would have a request suddenly for a lot of memory and then your OS should start swapping before being able to give that memory to your program. The pages are not being used so they do not have to be in your RAM, so they get swapped.

share|improve this answer
Sorry I did not mention, I understand the concept of swapping, I just don't understand the why. I have 6 gigs free so no need / pressure to swap anything. And I also understand that many pages (e.g. of libs) are only mapped and not yet swapped in to ram. So I guess I really have to read the code. – Fabian Aug 19 '11 at 14:58
I think it just is made this way, it just sees, something in the memory that hasn't been used, so I better swap it out. It doesn't know if you might have apps suddenly needing 5 GB of RAM of more. It just makes sure that if it isn't used it is swapped out. It just works this way I guess :p – Lucas Kauffman Aug 19 '11 at 15:02

Read the rest of your top output, specifically the difference between the VIRT and RES will tell you how much of each process is currently swapped out.

In Re: why swap is being used, your system will page out any infrequently accessed data to ensure that there is free RAM for new programs, disk caching, etc. - For all the gory details you would have to read the swapping algorithm in the kernel source (probably not worth it).

share|improve this answer
The swapped out is not the difference between VIRT and RES. The current Linux kernels will allocate memory on write, not at malloc() time. So you can have tons of VIRT, but almost no RES without any problem. The VIRT can be much greater than the total physical RAM and no swap usage at all. – Mircea Vutcovici Aug 23 '11 at 18:41
@Mircea - When did that change? I don't typically pay attention to the linux VM subsystem. – voretaq7 Aug 23 '11 at 18:43
I think in kernel 2.6.* Even if you have a program that is allocating memory that will not be used, it will not take from physical memory or page out. The drawback is that if you do not have enough physical memory, the OOM killer mechanism will come in action, and it will kill the least useful process (from his POV). – Mircea Vutcovici Aug 23 '11 at 18:52
don't get me started on what a terrible idea the OOM-Killer is :-/ According to POSIX malloc can (and should) fail when you try to over-allocate. Interesting about the lazy RAM allocation though - I guess it has its uses. – voretaq7 Aug 23 '11 at 19:07

Can you please run:

for a in /proc/[0-9]*/stat;do cat /proc/[0-9]*/stat|cut -d\  -f 36|grep -q ^0$||echo $a|sed -r 's#/proc/(.+)/stat#\1#';done|xargs -r ps -lwwp

This should show the processes that are swapping.

You can also use this bash function to parse the /proc//stat file:

local MYPID=$1
STAT_KEYS=$(echo $STAT_KEYS|sed -r 's#([A-Z_]+( |$))#proc_'$MYPID'_stat_\1 #g')
for VAR in $STAT_KEYS;do
    local $VAR
read $STAT_KEYS </proc/$MYPID/stat
for VAR in $STAT_KEYS;do
    echo $VAR = $(eval 'echo $'$VAR)

get_stat $1

See also:

share|improve this answer
It seems that NSWAP and CNSWAP are not updated by Linux kernel. See: – Mircea Vutcovici Aug 26 '11 at 15:26

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.