"Linux" free, Vmstat, top "three cheap" tracing memory __linux

I. Overview of monitoring

Click to open the link

Monitoring is basically divided into machine monitoring and service monitoring, this article is mainly about machine monitoring, service monitoring online deployment of services related to foreign can not talk about ...

second, memory monitoring

Linux is an operating system, he is a set of programs, a group of management of computer hardware and software resources, reasonable organization workflow to facilitate the user to use the computer program set, the operating system is inseparable from hardware resources, the server is his "host." Server hardware problems, the operating system is not good. So the machine monitors what to play. On the one hand play is "what the operating system", on the one hand play is "what the server hardware Resources", that is, monitoring hardware resources to ensure that the operating system is working properly. 1. What does the operating system do

As I said before, operating system is a set of programs, is a group of management even if the software and hardware resources, reasonable organization workflow to facilitate the user to use the computer program set ("Operating system Theory"), an operating system should have at least five functions: memory management, process management, file system management, User interface management, hardware Device management . This leads to the content to be discussed in this article, memory. 2. What resources does the server have

What is a server resource. In fact, the main hardware resources, mainly our attention to the hardware resources. The concern is that the security of the services we deploy online is closely related to these resources. What resources does a server have? disk capacity, disk IO, memory, network card, and CPU. So, to understand the Linux operating system, from the "operating system to do" five parts, but to put the theory into practice, you need to "what the operating system" map to the "Server what resources" on. 3. Memory Monitoring

Back to the point. With the above introduction, it is a direct talk about memory monitoring. Monitoring the memory state, when operating system is abnormal, as one of the clues to judge the system anomaly (basically all need integrated hardware resources monitoring to determine); When confirming the source of the anomaly, monitor the data as the "evidence" to find the culprit.

three, Linux memory mechanism

"Trace the way," first you need to know the memory mechanism of Linux. You can not see the system empty memory only a little bit of certainty that memory is an exception source.

Linux memory mechanism: Click on the Open link

Linux Swap: Click on the Open link

Please read the above two links carefully, because the Linux memory mechanism is the physical memory, on the one hand is the Exchange partition, swap partition as the expansion of physical memory, and physical memory, in terms of caching mechanism, on the one hand is not caching mechanism. A clear understanding of them is the main source of your track thinking. Simple extraction:

1. Swap zoning is not enough, then the system will be suspended animation, basically you can only restart the machine, so swap zoning is very important to allocate;

2. The memory you see is only a little bit, not really, because the Linux caching mechanism exists;

Please read the above two links carefully, as a supplement to the Linux caching mechanism (data screenshot: virtual machine installed by personal pc, because there are seven or eight virtual machines installed, so a single virtual machine is allocated few resources, system CentOS release 6.4, kernel version Linux localhost 2.6.32-358.el6.i686).

Look at the red box data, for Linux physical memory, a total of 498M, has been using 154M, idle 343m,498m=154m+343m, data matching;

Look at the yellow box data, the Linux memory mechanism, a total of 499M, has been using 65M, idle 433m,498m=65m+433m, data matching;

This data is correct to look at, but together, look everywhere feel awkward. But if you really understand the Linux memory caching mechanism, then all of this is reasonable. And look at the next picture.

Look at the red box data: For Linux physical memory, use 154M, where buffers and cached use 23m+65m=88m, and 154m-88m=66m (actually because it's 65M, because with M as a unit, if byte is the unit, There is no error), but coincidentally, in the Linux memory mechanism, the memory used is just 65M.

154m=23m+65m+65m (in order to facilitate viewing, the unit used is m, so there are errors, if you use Byte, there will be no error).

If you take a serious look at the first linked article, you will know that buffers 23M and cached 65M is the Linux cache, and Buffers/cache used 65M is the real memory usage (process, kernel, etc. used memory, Rather than the memory consumed by the Linux caching mechanism.

Look at the Yellow box data: For Linux physical memory, free 343M memory, but for the Linux memory mechanism, free 433M memory, as well as 433m-343m=90m free memory (actually 88M or so), but you see the physical memory of the column, Buffers and cached data add up to just 88M.

Therefore, if you do not understand the Linux memory mechanism, it will be wrong to determine the current memory usage, resulting in a miscarriage of justice, leading to impunity for the culprits.

Add:

In order to prove that the M unit caused the error, to fill in the byte data screenshot, can be added to reduce the verification

Four, free, Vmstat, top "three cheap combination" to trace the truth

Why not use other, more powerful programs to monitor. The first consideration is security. These three instructions are basically the system will be brought, if you install, you can guarantee the installation of the program is safe. You know, this machine is stored in business services and data, easy to make no mistake. Second, performance is also to be considered. After the cluster becomes larger, if each server's resource consumption is very low, that waste is too big, so the company will always find ways to improve the utilization of resources, you can not do their own PC posture to engage in the online server. So the extra installer is monitored, how much server performance is consumed by the extra program, and the stability of this extra program is guaranteed to wait ... There are too many reasons to reject your installation.

So, use the original bar. 1. free

When the system problems, traced to memory, to determine whether the memory is an anomaly source, first look at the free instruction data.

First See swap area swap usage, because of the memory mechanism of Linux, when swap is not enough time, the system will appear suspended animation, of course, you can not see the death, but in the early days of suspended animation, you can still see data, do some remedial work. If the swap area is not normal, then enter the vmstat instruction (next section), if normal, then look at the memory idle situation, mainly concerned about the Linux memory mechanism of free and physical memory of the buffers and cached, the normal is not traced, otherwise enter the Vmstat to make further judgments.

Of course, this is only a list of the general situation of tracing, more still rely on online experience. 2. Vmstat

When the swap area is not enough, the physical memory is basically the bottleneck. If the memory is basically consumed, and the system is dragged very slowly, you can see whether there is a large number of Vmstat swap reading and writing, the early days of suspended animation can see a lot of reading and writing. If there is a large number of swap areas read and write, indicating that the current memory bottleneck, there are a large number of swap, resulting in CPU consumed IO above. When the system needs to be restored, the top command is entered. 3. Top

Top can see the real-time data of the current process, in fact, it is mainly to see who consumes too much memory resources, to determine whether can manually kill and then release the problem of resources.

Note:

Write rough, sorry, do see it, in fact, more or rely on online experience, but can not be separated from the accumulation of knowledge.