vmstat — Monitor Memory, Swap and CPU in Real Time

vmstat (virtual memory statistics) gives you the pulse of a Linux system in a single, compact line: process queues, memory, swap, block I/O and CPU usage at a glance. Part of the procps-ng package, it is a read-only command – perfect for quickly spotting memory pressure, swapping or I/O bottlenecks. One catch: when you run it with an interval (for example vmstat 2), the first line reports averages since boot – only the lines that follow reflect current activity.

Basic Usage

vmstat — Show a single snapshot of system statistics since boot.

vmstat

vmstat INTERVAL — Show statistics every INTERVAL seconds, continuously.

vmstat 1

vmstat INTERVAL COUNT — Show statistics every INTERVAL seconds, COUNT times.

vmstat 1 10

vmstat -w — Wide output — wider columns for large values.

vmstat -w 1

vmstat -t — Append timestamp to each line.

vmstat -t 1

Memory Statistics

vmstat -s — Show detailed memory statistics in a table format.

vmstat -s

vmstat -S M — Show values in megabytes instead of kilobytes.

vmstat -S M 1

vmstat -S k — Show values in kilobytes (default).

vmstat -S k 1

vmstat -a — Show active and inactive memory instead of buffer and cache.

vmstat -a 1

Disk Statistics

vmstat -d — Show disk statistics: reads, writes, I/O time per device.

vmstat -d

vmstat -D — Show disk summary statistics.

vmstat -D

vmstat -p PARTITION — Show statistics for a specific partition.

vmstat -p sda1

Other Options

vmstat -f — Show the number of forks (process creations) since boot.

vmstat -f

vmstat -n — Display the header only once (not periodically). Useful for logging.

vmstat -n 1 60 > vmstat.log

Output Columns Explained

r (procs) — Number of runnable processes (waiting for CPU). High values = CPU contention.

b (procs) — Number of processes in uninterruptible sleep (usually waiting for I/O).

swpd (memory) — Amount of swap memory used (KB). Non-zero = memory pressure.

free (memory) — Amount of idle/free memory (KB).

buff (memory) — Amount of memory used as kernel buffers (KB).

cache (memory) — Amount of memory used as page cache (KB).

si (swap) — Memory swapped in from disk per second (KB/s). Non-zero = active swapping.

so (swap) — Memory swapped out to disk per second (KB/s). Non-zero = memory pressure.

bi (io) — Blocks received from block devices per second.

bo (io) — Blocks sent to block devices per second.

in (system) — Interrupts per second.

cs (system) — Context switches per second.

us (cpu) — Time spent running user code (%).

sy (cpu) — Time spent running kernel/system code (%).

id (cpu) — Idle time (%). Low = CPU busy.

wa (cpu) — Time waiting for I/O (%). High = I/O bottleneck.

st (cpu) — Time stolen by hypervisor (%). Non-zero = VM resource contention.

Common Patterns

vmstat -w 1 — Real-time system overview with wide columns. The go-to command.

vmstat -w 1

vmstat -S M -w 1 — Real-time monitoring with values in megabytes.

vmstat -S M -w 1

vmstat 1 | awk '$7 > 0 || $8 > 0' — Watch for swap activity (si/so columns non-zero).

vmstat 1 | awk '$7 > 0 || $8 > 0'

vmstat -n -t 1 3600 > vmstat.log — Log system stats for one hour (1 sample/sec).

vmstat -n -t 1 3600 > vmstat.log

vmstat 1 | awk 'NR>2 && $1>4 {print "CPU overloaded: r="$1}' — Alert when runnable processes exceed CPU count.

vmstat 1 | awk 'NR>2 && $1>4 {print "CPU overloaded: r="$1}'

Conclusion

vmstat is one of the fastest diagnostic tools around: one command, one line, and you know whether your system is under memory, CPU or I/O pressure. Remember the key columns: sustained non-zero si/so means real memory pressure from swapping, a persistently high r queue points to a CPU shortage and high wa signals an I/O bottleneck. Always pass an interval such as vmstat 2 and ignore the first line, since it only reports the average since boot. For per-device or per-process detail, pair vmstat with iostat, free and top.