vmstat Command in Linux: Memory, CPU, and I/O Statistics

When a server slows down, the first question is what it is waiting on. Is the CPU saturated? Is memory exhausted and the system is swapping? Is disk I/O holding up processes? The vmstat command puts clues about each resource in one compact table, making it a useful first check before you move to a more specialized monitoring tool.

vmstat stands for virtual memory statistics and is provided by procps-ng. Most full Linux installations include it through a package named procps or procps-ng.

This guide explains how to read vmstat output and use its most useful options.

Syntax #

vmstat [OPTIONS] [delay [count]]

• delay - Seconds between reports. Without it, vmstat prints a single report and exits.
• count - Number of reports to print. When you set a delay without a count, vmstat runs until you press Ctrl+C.

Reading the Default Output #

Running vmstat without arguments prints one report:

vmstat

procs -----------memory---------- ---swap-- -----io---- -system-- -------cpu-------
 r  b   swpd   free   buff  cache   si   so    bi    bo   in   cs us sy id wa st gu
 1  0      0 362824  94368 1207160    0    0    12     5   48  112  1  0 99  0  0  0

The process and memory columns show values from the moment the command runs. In the first report, swap, I/O, system, and CPU activity is averaged since the last boot. The output has six sections.

procs #

• r - Runnable processes, including processes running or waiting for CPU time. Compare a sustained value with the logical CPU count from nproc; a busy run queue together with little idle CPU suggests CPU contention.
• b - Processes blocked while waiting for I/O to complete.

memory (default KiB) #

• swpd - Swap space currently in use.
• free - Idle memory that is not currently in use.
• buff - Memory used as buffers.
• cache - Memory used as cache. Linux uses otherwise idle RAM to cache data, so a large value is normal.

The free column alone does not show how much memory applications can readily use. Check the available value from the free command when you need that figure.

swap (KiB/s) #

• si - Memory swapped in from disk per second.
• so - Memory swapped out to disk per second.

Occasional swap activity is not enough to diagnose a problem. Sustained si or so activity together with falling free and cache memory is a stronger sign of memory pressure.

io (KiB/s) #

• bi - Kibibytes received from block devices per second.
• bo - Kibibytes sent to block devices per second.

system #

• in - Interrupts per second, including the clock interrupt.
• cs - Context switches per second. Compare this value with the system’s normal workload rather than using a fixed threshold.

cpu (percentage of total CPU time) #

• us - Time spent running user-space code, including nice time.
• sy - Time spent running kernel code.
• id - Idle time.
• wa - Time the CPU was idle while waiting for I/O. A sustained increase is a clue to investigate I/O, but it does not identify the device or prove that storage is the bottleneck.
• st - Time taken from a virtual machine by the hypervisor.
• gu - Time spent running KVM guest code, including guest nice time.

Older procps-ng versions may end the CPU columns at st. The meaning of the preceding columns is unchanged.

Continuous Monitoring #

A single report gives limited information about a live problem. Pass a delay to watch activity over consecutive intervals:

vmstat 2

This prints a new line every two seconds until you press Ctrl+C. The first line still contains activity averages since boot, while later lines cover each two-second interval. Add -y when you want to omit that first report:

vmstat -y 2

To collect ten interval reports and then stop, add a count:

vmstat -y 2 10

procs -----------memory---------- ---swap-- -----io---- -system-- -------cpu-------
 r  b   swpd   free   buff  cache   si   so    bi    bo   in   cs us sy id wa st gu
 0  0      0 360988  94504 1208068    0    0     0     0   92  198  0  0 100  0  0  0
 1  0      0 360744  94504 1208068    0    0     0    16  104  231  1  0 99  0  0  0
 0  0      0 360720  94504 1208080    0    0     0     0   89  190  0  0 100  0  0  0

Only the first three rows are shown here. Because -y skips the immediate boot-average report, the command waits for and records ten two-second intervals, taking about 20 seconds.

Add timestamps and redirect the reports to a file when you want to review them later:

vmstat -y -t 2 10 > vmstat.log

Active and Inactive Memory #

The -a flag replaces the buff and cache columns with inact (inactive memory) and active (active memory):

vmstat -a

procs -----------memory---------- ---swap-- -----io---- -system-- -------cpu-------
 r  b   swpd   free  inact active   si   so    bi    bo   in   cs us sy id wa st gu
 0  0      0 358900 921048 490836    0    0    12     5   48  112  1  0 99  0  0  0

Active memory contains pages used recently and likely to be referenced again. Inactive memory has not been accessed recently and contains candidates for reclaim when the system needs space. This view is useful when several workloads compete for memory.

Adding Timestamps #

The -t flag appends a timestamp column to each line, which is useful when capturing output to a log file:

vmstat -y -t 2 5

procs -----------memory---------- ---swap-- -----io---- -system-- -------cpu------- -----timestamp-----
 r  b   swpd   free   buff  cache   si   so    bi    bo   in   cs us sy id wa st gu                 EEST
 0  0      0 362824  94368 1207160    0    0     0     0   88  195  0  0 100  0  0  0 2026-09-07 10:30:02
 0  0      0 362700  94368 1207160    0    0     0    12   94  207  1  0 99  0  0  0 2026-09-07 10:30:04

The timestamp uses the system’s local time zone. The example shows only the first two of the five requested reports.

Wide Output Mode #

On systems with many CPU cores or high counter values, the default column widths can cause numbers to truncate or columns to overlap. The -w flag switches to a wider format that avoids truncation:

vmstat -w 2

Memory Event Counters #

The -s flag prints current memory totals followed by CPU and event counters accumulated since boot:

vmstat -s

      2023560 K total memory
       417148 K used memory
       493280 K active memory
       921048 K inactive memory
       362824 K free memory
        94368 K buffer memory
      1207160 K swap cache
      2097148 K total swap
            0 K used swap
      2097148 K free swap
        48712 non-nice user cpu ticks
          952 nice user cpu ticks
        12836 system cpu ticks
      5181148 idle cpu ticks
         5984 IO-wait cpu ticks
            0 IRQ cpu ticks
         3268 softirq cpu ticks
            0 stolen cpu ticks
            0 non-nice guest cpu ticks
            0 nice guest cpu ticks
       621264 K paged in
       247908 K paged out
            0 pages swapped in
            0 pages swapped out
      2518704 interrupts
      5884112 CPU context switches
   1788713671 boot time
        52364 forks

The exact list varies with the kernel and procps-ng version. This view is useful for checking current swap totals and cumulative paging activity. The event counters and CPU ticks start again after a reboot.

Disk Statistics #

The -d flag shows cumulative read and write statistics broken down by disk device:

vmstat -d

disk- ------------reads------------ ------------writes----------- -----IO------
       total merged sectors      ms  total merged sectors      ms    cur    sec
sda    12486    983  956342   34208  18402   4682  920612  142104      0     42
sdb      142      0    9168     252      0      0       0       0      0      0

• total - Total number of completed read or write operations.
• merged - Adjacent requests grouped into a single I/O operation.
• sectors - Total sectors read or written.
• ms - Total milliseconds spent reading or writing.
• cur - I/O operations currently in progress.
• sec - Total seconds spent doing I/O.

To see statistics for a specific partition rather than the whole disk:

vmstat -p /dev/sda1

sda1          reads   read sectors  writes    requested writes
               12384    948812        18320    910484

Changing Output Units #

By default, memory and swap values use 1024-byte kibibytes. The -S flag changes their display unit:

vmstat -S M 2

Accepted values are k (1000 bytes), K (1024 bytes), m (1,000,000 bytes), and M (1,048,576 bytes). This option does not change the swap (si, so) or I/O (bi, bo) fields, which stay in KiB/s.

Options Reference #

• -a - Show active and inactive memory instead of buffer and cache values.
• -d - Display disk statistics per device.
• -D - Display summary disk statistics.
• -f - Show the number of forks since boot.
• -m - Display slab memory information.
• -n - Print the header only once.
• -p device - Display partition-level disk statistics.
• -s - Display memory statistics and event counters.
• -S unit - Set the memory and swap output unit to k, K, m, or M.
• -t - Append a timestamp to each line.
• -w - Use wider columns to prevent unwanted column breaks.
• -y - Omit the first report containing activity averages since boot.

Quick Reference #

Troubleshooting #

All values look like averages, not live activity
The first line contains activity averages since boot, although its process and memory fields are current values. Run vmstat -y 2 to skip that line and show only two-second interval reports.

The shell reports vmstat: command not found
Install the procps package on Ubuntu and Debian with sudo apt install procps. Fedora and RHEL use sudo dnf install procps-ng, while Arch Linux uses sudo pacman -S procps-ng.

vmstat cannot read data under /proc
The command needs access to files under /proc. Containers and systems mounted with restrictive /proc options may hide some statistics. The vmstat -m view also requires access to /proc/slabinfo, which may be unavailable to a standard user.

Conclusion #

Run vmstat -y 2 as a first check when a system slows down, then follow the signal: use top or htop for per-process CPU and memory usage, or iostat -xz 2 for device latency and queues.

About the authors

Dejan Panovski

Dejan Panovski is the founder of Linuxize, an RHCSA-certified Linux system administrator and DevOps engineer based in Skopje, Macedonia. Author of 1000+ Linux tutorials with 20+ years of experience turning complex Linux tasks into clear, reliable guides.

View author page