REW

What Is Proc Vmstat?

Published Aug 29, 2025 5 min read
On this page

/proc/vmstat is a virtual file in the Linux kernel that provides a wealth of system-wide statistics about virtual memory, CPU activity, paging, and I/O. It is the raw data source for the vmstat command-line utility, which processes and presents this information in a user-friendly, tabulated format. While the vmstat command is excellent for quick, real-time snapshots, directly querying /proc/vmstat offers a more detailed, comprehensive, and programmatic way to access these granular performance metrics.

Structure and access

Unlike a regular file, /proc/vmstat is dynamically generated by the kernel when accessed. It presents data as a list of name-value pairs, with each pair on a new line and separated by whitespace.

# Example output from /proc/vmstat
$ cat /proc/vmstat
...
pgpgin 282496
pgpgout 1177695
pswpin 23
pswpout 333
pgmajfault 2235
...

Use code with caution.

Key metrics and their significance

Paging and swapping statistics

Paging and swapping are central to virtual memory management. Monitoring these metrics is crucial for diagnosing memory pressure.

  • pgpgin/pgpgout: The total number of pages the system has paged in from (input) and paged out to (output) disk. These are measured in 1KB pages and indicate memory swapping activity.
  • pswpin/pswpout: The number of pages swapped in from and out to swap space. High values for these, especially pswpout, indicate the system is under severe memory pressure and is resorting to using the slower disk as virtual RAM.
  • pgmajfault: The total number of "major page faults" since boot. A major page fault occurs when a process attempts to access a memory page that is not in physical RAM and must be loaded from disk. A consistently high rate of major page faults can be a symptom of a memory bottleneck.
  • pgfault: The total number of all page faults, both major and minor. Minor page faults are less severe as they can be resolved without accessing the disk.

Memory allocation and reclamation

These statistics provide a deeper look into how the kernel manages physical memory.

  • pgalloc_dma, pgalloc_normal, pgalloc_high: The number of pages allocated from different memory zones (DMA, Normal, Highmem). A high number of allocations could indicate that a memory-intensive process is running.
  • pgfree: The total number of pages freed by the kernel.
  • pgscan_direct_dma, pgscan_direct_normal, pgscan_direct_high: The number of pages scanned by the kernel's memory management subsystem (the kswapd process) in an attempt to free up memory directly. A high scan rate indicates the system is actively looking for pages to reclaim.
  • pgsteal_dma, pgsteal_normal, pgsteal_high: The number of pages that have been "stolen" or reclaimed by the kernel to satisfy a new memory allocation request. This is a crucial metric for understanding memory pressure, as it shows how often the kernel needs to actively evict pages from other processes to find free memory.

Interrupts and context switches

These metrics shed light on system overhead and responsiveness.

  • nr_interrupts: The total number of interrupts serviced by the system since boot. An interrupt is a signal from a device that requires the CPU's attention.
  • nr_context_switches: The total number of times the kernel has performed a "context switch," where it saves the state of one process and restores the state of another. A high number of context switches can indicate excessive process scheduling overhead.
  • forks: The total number of times the fork, vfork, and clone system calls have been used to create new processes.

CPU statistics

/proc/vmstat also contains raw CPU metrics that are used by various performance tools.

  • cpu_user, cpu_nice, cpu_system, cpu_idle, cpu_iowait: These fields reflect the total CPU time spent in different states since boot. The values are typically in "jiffies" (kernel clock ticks) and can be used to calculate CPU utilization percentages.
  • cpu_steal, cpu_guest: Specific to virtualized environments, cpu_steal indicates time stolen from a virtual machine by the hypervisor, while cpu_guest measures time spent running a virtual CPU.

How to interpret and use /proc/vmstat

Performance monitoring

By periodically reading and parsing /proc/vmstat, you can build scripts or monitoring tools to track system performance over time. A common practice is to take a snapshot of the metrics at an interval and compute the difference to get a rate-of-change for each metric.

Troubleshooting performance bottlenecks

  • High swapping (pswpin, pswpout): Suggests that the system is running low on physical memory. The solution may be to increase RAM, reduce memory-intensive workloads, or optimize memory usage.
  • High I/O wait (cpu_iowait): Indicates the CPU is spending a significant amount of time idle, waiting for I/O operations to complete. This could point to a slow disk subsystem or a storage bottleneck.
  • High context switches (nr_context_switches): A consistently high rate could signal a large number of processes competing for the CPU, leading to high scheduling overhead.
  • High page faults (pgmajfault): If this value is consistently increasing rapidly, it's a clear sign of memory pressure.

Comparison with vmstat command

The vmstat command is the user-facing utility that presents a readable, tabulated summary of the data found in /proc/vmstat.

  • vmstat: Provides a formatted, easy-to-read output, perfect for quick, interactive monitoring.
  • /proc/vmstat: Offers the raw, unprocessed data, ideal for scripting, automated monitoring, and granular analysis.

While the vmstat command is sufficient for many use cases, accessing /proc/vmstat directly is necessary for applications that need specific, detailed metrics that the command-line utility may not expose by default.

Enjoyed this article? Share it with a friend.