question about memory usage in linux

Michael Torrie torriem at
Tue Nov 22 09:51:50 MST 2005

On Tue, 2005-11-22 at 09:07 -0700, Gregory Hill wrote:
> Does anyone know why top would report active memory usage far above that
> used by the combination of all its processes?  Even listing in threaded
> mode, the total of all processes memory usage adds up to several hundred
> megabytes less than the 'active' memory usage listed in the summary.
> It's a recent problem, but the memory and swap gets completely full,
> requiring a full reboot to fix.  Killing mysql and apache (which are the
> only things using anything above 1% of memory) still leaves several
> hundred megabytes of 'active' memory usage.  I tried using ps, but it
> doesn't show anything that wasn't listed by top.  Is there a better tool
> to see what is using memory and what is not?  It's possible that some
> mod_perl code has a memory leak, but usually the apache processes would
> reflect that.  They don't.  I'm completely stumped.  Could it be failing
> RAM?  Could someone have hacked the box and planted some super secret
> program that doesn't show up in ps or top (or even replaced them with
> alternate versions that don't show everything)?

I think you are just misinterpreting what top is telling you.  On my
machine, for example, when I sort by memory usage ("m"), I see that X is
currently taking up 10% of my memory.  Upon inspection, I find (and some
of you will cringe at this but X is a special case) that the 10% number
only refers to the amount of *resident* memory that X is using (100m).
X is in fact using 272m of total memory[1].

The point here is that the percentage you are seeing (1%) is only the
amount of physical RAM the process is using, not the amount of total
memory it is using.  Thus as a process leaks memory (older LAMP setups
do leak), swapping and thrashing increase.  On a loaded system, it's
possible that the process is being starved out and so the resident
footprint is forced below the working set which just makes the problem
worse.  So if your swap is completely full, that means one of your
processes is taking it up, regardless of the amount of resident ram it
is using. It is *not* a kernel leak.  It's a process memory leak.  

What processes had the most amount of virtual memory use at the time of
the thrashing?  I see from your recent post that mysql is currently
using about 20 mb of RAM, and 20 mb of swap.  Apache is also using about
23 mb of RAM and 10 mb of swap.  Watch these numbers the next time it
starts thrashing.  I'm assuming the numbers that free is reporting to
you are average for your system. So if swap ever rose about 200 mb or
so, start looking.


[1] X is a special case because the total memory usage X reports
includes all the VRAM plus all the shared memory segments that are
actually owned by the X clients.  I'm running gnome, so there's a lot of
X shared memory owned by all the apps.
> It's running on Redhat 9, Apache 1.3/mod_perl/mod_php, mysql 4.1.  Yes,
> I know it needs to be updated, but I can't take the server down.
> Any ideas are welcome.
> Greg
> /*
> PLUG:, #utah on
> Unsubscribe:
> Don't fear the penguin.
> */
Michael Torrie <torriem at>

More information about the PLUG mailing list