The sar manpage says :

pgpgin/s - Total number of kilobytes the system paged in from disk per second.

pgpgout/s - Total number of kilobytes the system paged out to disk per second.

fault/s - Number of page faults (major + minor) made by the system per second. This is not a count of page faults that generate I/O, because some page faults can be resolved without I/O.

majflt/s - Number of major faults the system has made per second, those which have required loading a memory page from disk

Does this measure swap activity? What paging does it refer to? Getting data from disk is considered paging?

Also, I've read that large and constant values for majflt/s is not good. why?

Example :

Sar -B

12:00:08 AM  pgpgin/s pgpgout/s   fault/s  majflt/s
12:10:05 AM    207.55   2522.76   5109.80      0.01
12:20:07 AM    303.83    274.64   4446.52      0.00
12:30:05 AM     53.85    251.81   4183.98      0.00
12:40:05 AM     43.19    234.05   4181.53      0.00
12:50:06 AM     88.89    265.46   4311.81      0.00
01:00:09 AM     64.60    232.72   4239.05      0.00
01:10:07 AM     69.71    216.89   4523.03      0.00
01:20:06 AM     81.37    250.02   4359.93      0.00
01:30:06 AM     79.77    246.28   4291.49      0.00
01:40:02 AM     42.89    227.22   4319.88      0.02
01:50:06 AM    214.46    441.33   4760.78      0.00

1 Answer 1


Paging is not the same as swapping. You might have paging activity when calling executables to read portions of their binary code off disk or working with memory-mapped files. This does not (necessarily) means that swap is used. pgpin/s and pgpout/s values refer to this process.

Major faults / second do measure disk read activity that needs to happen due to memory requests to portions of virtual address space not currently loaded to physical memory. This indicator is also not exclusivly for swapped-out pages but for any kind of pages (including memory-mapped files and executable binaries on disk).

A constantly high number of major faults would mean that your process execution is interrupted too often to wait for disk I/O to complete reading pages (code, memory-mapped file data or other memory portions previously swapped out to disk).

This considered, it is a good indicator if your system may be lacking memory for its current load - major faults are going to be repeatedly produced if pages previously loaded into memory are getting thrown out (or swapped out) again due to shortage of memory and then requested again because they are actively worked on by the current processes.

  • 1
    Got it, thx. So pgpgin/s and pgpgout/s is anything that causes disk i/o. What about faults/s? and the difference between major and minor faults.
    – rags
    May 18, 2011 at 13:43
  • 6
    A minor fault is a page fault not causing disk I/O - a page might be present in memory, but not (yet) assigned to the process' address space. A major fault in turn does cause disk I/O as the page has been determined to be not there and in need to be read from disk. As for pgpin and pgpout values - these are not as cleanly defined as you would wish them to be - this mailing list post gives some insight: gossamer-threads.com/lists/linux/kernel/…. If you really need to see swap activity, take a look at the si / so counters of vmstat.
    – the-wabbit
    May 18, 2011 at 20:31
  • 2
    working link to gossamer-threads gossamer-threads.com/lists/linux/kernel/…
    – Dan Pritts
    Mar 17, 2016 at 19:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.