question about memory usage in linux

Corey Edwards tensai at zmonkey.org
Tue Nov 22 09:14:36 MST 2005


On Tue, 2005-11-22 at 09:07 -0700, Gregory Hill wrote:
> Does anyone know why top would report active memory usage far above that
> used by the combination of all its processes?  Even listing in threaded
> mode, the total of all processes memory usage adds up to several hundred
> megabytes less than the 'active' memory usage listed in the summary.
> It's a recent problem, but the memory and swap gets completely full,
> requiring a full reboot to fix.  Killing mysql and apache (which are the
> only things using anything above 1% of memory) still leaves several
> hundred megabytes of 'active' memory usage.  I tried using ps, but it
> doesn't show anything that wasn't listed by top.  Is there a better tool
> to see what is using memory and what is not?  It's possible that some
> mod_perl code has a memory leak, but usually the apache processes would
> reflect that.  They don't.  I'm completely stumped.  Could it be failing
> RAM?  Could someone have hacked the box and planted some super secret
> program that doesn't show up in ps or top (or even replaced them with
> alternate versions that don't show everything)?

Please send us the output of ps and free.

Generally I'd be pretty doubtful of a kernel memory leak. Have you taken
into account the aggressive file caching that Linux does? Just about
every scrap of available RAM will be used for file cache if nothing else
needs it.

If you're worried about a possible rootkit, you might check out listps.
It will evade user level rootkits.

        http://csl.sublevel3.org/listps/

Corey

-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: This is a digitally signed message part
Url : http://plug.org/pipermail/plug/attachments/20051122/c2c625fd/attachment.bin 


More information about the PLUG mailing list