Determine which programs are using swap / how much

Question

This is my first question -- I realize I may have done something wrong here, so please point me in the right direction if I have.

I'm interested in figuring out which programs on my machine are using swap, and how much each is using. I realize this can probably be done with top, but I am having trouble figuring how how.

What I've tried:

1. Start top
2. Press f (add column)
3. Press p (SWAP colum)

This adds a SWAP column, but the data doesn't seem to be correct. Top lists Firefox as using 582m of swap, but the header simultaneously reports that 0k of swap is being used.

Am I doing something wrong? Is there a better way to monitor swap usage?

Answer 1

There are two columns to pay attention to: VIRT and RES. VIRT tells you how much memory has been reserved for the process. This does NOT necessarily mean that it's allocated or in use, but simply available should the process request it. The other to look at is RES which tells you the amount of space in resident memory. This is how much it's actually using. The SWAP column is simply VIRT minus RES.

From what little I've searched, it looks like showing swap IN USE isn't possible.

Answer 2

Unfortunately it isn't that simple.

"swap" is really considered to be "non-resident anonymous pages". That is, pages which are not backed by any disc file (not mmap'd file-backed pages).

When the kernel gets a bit short of memory, it tends to discard pages which haven't been used much recently. It might choose to discard file-backed pages, or anonymous pages. If it does the latter, that uses "swap".

However, there isn't a single process which triggers it, it's just general memory pressure.

Moreover, you can't even measure page usage very accurately. There are two counts per process, which are (vaguely) useful. These are VSIZE (or vm size) which is the total number of pages that a process has allocated - but this tends to be a big overestimate of how much is actually "used", as it can count pages twice, and count pages not being used at all (mapped but not used).

The other is RSS, or "resident set size", which is the amount of memory in pages which are currently resident. However this isn't really the true picture either:

• The same page is not necessarily used by exactly one process - they can be shared.
• Some pages are used internally by the kernel and hence not charged to any one process

I am not aware of any tools which attempt to make a better estimate than this, but it is theoretically feasible to do a bit better with the new diagnostics available in /proc in recent kernels.