Practical Guide to Server Memory Troubleshooting with free, vmstat, and sar

Memory troubleshooting importance

When memory is insufficient, the system resorts to swap, which is more than 100 × slower than RAM, causing noticeable latency and performance degradation.

free command

Usage

Run free -h -s 3 for human‑readable output refreshed every 3 seconds.

Fields

Mem – physical RAM.

total – total RAM capacity (e.g., 1.9 GB).

used – RAM currently allocated (e.g., 298 MB).

free – completely unused RAM (e.g., 814 MB).

buff/cache – buffers and page cache.

available – roughly free + buff/cache, the truly usable memory (e.g., 1.6 GB). Below 10 % of total indicates critical pressure.

Swap – disk‑based swap; any non‑zero used shows reliance on swap.

Quick assessment

If free -h shows available ≈100 MB on a 1.9 GB system, memory is tight; a growing swap used value confirms ongoing pressure.

vmstat command

Periodic sampling

Run vmstat 5 3 to collect three samples at five‑second intervals. The first number is the interval (seconds); the second is the sample count.

Key sections

procs

r – runnable or waiting processes; consistently higher than CPU core count (e.g., >4 on a 4‑core box) indicates CPU contention.

b – blocked processes (waiting for memory, I/O, etc.); any non‑zero value signals a bottleneck.

memory

swpd – swap space used (KB); non‑zero means RAM shortage.

free – idle RAM.

buff – buffer size.

cache – cached data; large cache with low bi suggests efficient filesystem caching.

swap

si – KB/s read from swap.

so – KB/s written to swap; persistent non‑zero values indicate severe memory pressure.

io

bi – KB/s read from disk.

bo – KB/s written to disk; if bi + bo is high and wa > 20 % then I/O is the bottleneck.

system

in – interrupts per second.

cs – context switches per second; high values suggest CPU time wasted on switching.

CPU

us – user‑space CPU usage; sustained > 50 % may require program optimization.

sy – kernel CPU usage; us + sy should stay below 80 %.

id – idle CPU percentage.

wa – I/O wait percentage; > 20 % indicates slow disk operations.

Example bottleneck

Output showing swpd = 1 GB, si = 50 KB/s, and wa = 25 % demonstrates a chain: memory shortage → swap usage → slow disk I/O → CPU waiting. Remedy: increase RAM first, then evaluate disk I/O performance.

sar command

Continuous monitoring

Run sar -r 3 to output memory statistics every three seconds; stop with Ctrl+C.

Fields

Fields correspond to free: kbmemfree, kbmemused, kbbuffers, kbcached, etc., enabling long‑term observation of memory trends and detection of leaks.

Three‑step memory troubleshooting workflow

Step 1 – free : Execute free -h. If available > 20 % of total memory, memory is sufficient; if <10 %, proceed to step 2.

Step 2 – vmstat : Execute vmstat 5 3. Examine swpd, si/so, r/b, and wa to determine whether the issue is pure memory, CPU‑bound, I/O‑bound, or a combination.

Step 3 – sar : Execute sar -r 3 for sustained monitoring. A steadily increasing kbmemused without corresponding swap growth may indicate a memory leak.

Tool role summary

free – fast initial snapshot of memory state.

vmstat – comprehensive view of memory, CPU, and I/O for deeper analysis.

sar – suited for continuous, long‑term memory monitoring.