Master Linux vmstat: Syntax, Fields, Options, and Real‑World Usage

Syntax

The vmstat command can be run by any regular user without special privileges. Its basic syntax is:

vmstat [options] [delay [count]]

delay

specifies the update interval in seconds; if omitted, vmstat reports averages since boot and outputs a single line. count defines how many reports to produce; if omitted while delay is set, vmstat runs indefinitely.

Result Field Description

Running vmstat once produces a header line followed by a line of values. The fields are grouped as process information, memory information, I/O information, system interrupts and context switches, and CPU time. Memory values are in kilobytes (KB) by default, and CPU time fields show percentages of total CPU time.

r : number of runnable (running or ready) processes

b : number of processes in uninterruptible sleep

swpd : virtual memory used

free : idle memory

buff : memory used as buffers

cache : memory used as cache

si : memory swapped in from disk

so : memory swapped out to disk

bi : blocks received from a block device (blocks/sec)

bo : blocks sent to a block device (blocks/sec)

in : interrupts per second (including clock)

cs : context switches per second

us : user‑mode CPU time (%)

sy : kernel‑mode CPU time (%)

id : idle CPU time (%)

wa : I/O wait time (%)

st : stolen time from a virtual machine

Note that the b field counts processes blocked in an uninterruptible sleep state, which occurs when a process is waiting for a system call to complete and cannot be interrupted.

Common Options

-a

: display active and inactive memory -f: show the number of forks since boot (fork, vfork, clone, etc.) -s: display system event counters and memory statistics -d: report disk statistics -D: detailed active disk information -p: show detailed information for a specific partition -t: append a timestamp column -S: change the unit of memory display (k, K, m, M) -w: use wide mode for better alignment -V: display vmstat version

Common Usage

vmstat is primarily used to identify system bottlenecks; the command itself is not counted in the statistics.

Specify an interval and count, e.g. vmstat 2 10 prints a report every 2 seconds, ten times.

# vmstat 2 10
procs -----------memory---------- ---swap-- -----io---- -system-- ------cpu-----
 r  b   swpd   free   buff  cache   si   so    bi    bo   in   cs us sy id wa st
 2  0   12552 148356 234324 3382956    0    0     1    21    4    4  2  2 97  0  0
 ... (subsequent lines omitted for brevity) ...

The -S option changes memory units; however, it does not affect the si and so fields.

k    # 1000 bytes
K    # 1024 bytes
m    # 1000 * 1000 bytes
M    # 1024 * 1024 bytes

Active vs. Inactive Memory

The active column shows memory actively used by processes, while inact shows memory that is not currently in use.

Fork Count Since Boot

Use vmstat -f to display the total number of fork, vfork, and clone system calls since the system started. Running the command itself creates an additional fork, so the count increments each time.

# vmstat -f
        12714 forks
# vmstat -f
        12715 forks
# vmstat -f
        12716 forks

Appending a Timestamp

Adding -t inserts a time column, making it easier to compare results over a period.

Wide Mode Display

Long numeric fields can be hard to read; the -w option aligns columns in a wide format for better visual clarity.

Disk Statistics

Disk I/O information is divided into read, write, and overall I/O. Read/write counts are in milliseconds, while overall I/O is in seconds.

Read
    total:  number of successful reads
    merged: grouped reads (one I/O)
    sectors: sectors read successfully
    ms: time spent reading (ms)

Write
    total:  number of successful writes
    merged: grouped writes (one I/O)
    sectors: sectors written successfully
    ms: time spent writing (ms)

IO
    cur:   current I/O operations
    s:     I/O time in seconds

Partition Information

Use -p followed by a device name (e.g., sda3) to display read/write counts and sector statistics for that partition.