System and users

`vmstat`

Report processes, memory, swap, I/O and CPU activity, once or at a regular interval.

vmstat [OPTION...] [DELAY [COUNT]]

9 of 9 examples run in Debian 13.7 on 2026-10-31 · procps 2:4.0.4-9 · manual: vmstat(8)

vmstat prints one compact line per sample covering the whole machine: how many processes are runnable (r) or blocked on I/O (b), memory and swap, blocks read and written, interrupts and context switches, and how CPU time splits between user, system, idle, I/O wait and steal. It is the fastest way to tell which resource is the bottleneck before you go looking for the process responsible with top or ps.

Always give it a delay: vmstat 1 prints a line per second. The first line is different: it shows averages since boot, not current activity, so skip it when you read rates (or use -y to suppress it).

Quick reading guide: r persistently above the CPU count means CPU saturation; non-zero si/so (swap in/out) means memory pressure; high wa means processes are waiting on disk; st above a few percent on a VM means the hypervisor is giving your CPU time to someone else (gu, time spent running guest virtual machines, only appears in recent procps versions). The examples run in a container and show the host's figures.

Examples

Print a single report

$ vmstat

explain

output

procs -----------memory---------- ---swap-- -----io---- -system-- -------cpu-------
 r  b   swpd   free   buff  cache   si   so    bi    bo   in   cs us sy id wa st gu
 2  1 2131428 32135348 3006124 61932480    0    2   677  1973 11098    3  2  1 97  0  0  0

With no delay you get one line, and it is the since-boot average. Useful for the memory columns, misleading for the rates.

Sample once a second, three times

$ vmstat 1 3

explain

output

procs -----------memory---------- ---swap-- -----io---- -system-- -------cpu-------
 r  b   swpd   free   buff  cache   si   so    bi    bo   in   cs us sy id wa st gu
10  1 2131428 32126204 3006348 61932316    0    2   677  1973 11098    3  2  1 97  0  0  0
 4  2 2131428 32101848 3009268 61934372    0    0    28 19876 62462 84716 10  6 82  2  0  0
 2  1 2131428 32087336 3010408 61935108    0    0    44  9024 39342 49995  8  4 86  2  0  0

1 is the delay in seconds and 3 the number of lines. The first line is still the since-boot average; the next two describe the last second each.

Skip the since-boot line

$ vmstat -y 1 2

explain

output

procs -----------memory---------- ---swap-- -----io---- -system-- -------cpu-------
 r  b   swpd   free   buff  cache   si   so    bi    bo   in   cs us sy id wa st gu
 5  0 2131428 31913520 3010408 61935116    0    0     0 246312 60077 93314  9 12 78  1  0  0
 4  1 2131428 31821436 3010412 61935116    0    0     0   244 48951 93546  9  2 87  2  0  0

-y drops the misleading first line, so every row is a real one-second sample. Here the count of 2 gives two live samples.

Use wide columns so big numbers stay aligned

$ vmstat -w 1 2

explain

output

--procs-- -----------------------memory---------------------- ---swap-- -----io---- -system-- ----------cpu----------
   r    b         swpd         free         buff        cache   si   so    bi    bo   in   cs  us  sy  id  wa  st  gu
   6    1      2131428     31824188      3010412     61935116    0    2   677  1973 11098    3   2   1  97   0   0   0
   2    1      2131428     31778932      3010412     61935116    4    0     4     0 50562 107606   8   3  87   2   0   0

On machines with lots of RAM the default columns overflow and the table goes ragged. -w widens them.

Show memory columns in megabytes

$ vmstat -S M 1 2

explain

output

procs -----------memory---------- ---swap-- -----io---- -system-- -------cpu-------
 r  b   swpd   free   buff  cache   si   so    bi    bo   in   cs us sy id wa st gu
 3  1   2081  31032   2939  60483    0    0   677  1973 11099    3  2  1 97  0  0  0
 3  1   2081  31020   2939  60483    0    0     0   168 36640 52087  7  3 88  2  0  0

-S M reports swpd, free, buff and cache in units of 1048576 bytes instead of KiB. -S k, -S m (powers of 1000) and -S K are the other choices.

Show active and inactive memory instead of buffers and cache

$ vmstat -a -S M

explain

output

procs -----------memory---------- ---swap-- -----io---- -system-- -------cpu-------
 r  b   swpd   free  inact active   si   so    bi    bo   in   cs us sy id wa st gu
 4  1   2081  31031  39373  33069    0    0   677  1973 11099    3  2  1 97  0  0  0

-a replaces buff/cache with inact and active. Inactive pages have not been touched recently and are the first the kernel reclaims under pressure.

Timestamp each line for a log

$ vmstat -t -y 1 2

explain

output

procs -----------memory---------- ---swap-- -----io---- -system-- -------cpu------- -----timestamp-----
 r  b   swpd   free   buff  cache   si   so    bi    bo   in   cs us sy id wa st gu                 UTC
 5  1 2131428 31762108 3010412 61935120    0    0     0  1092 34796 44256  8  3 87  2  0  0 2026-10-31 20:21:52
 2  1 2131428 31767840 3010412 61935116    0    0     0 328760 52325 71666  7 10 81  2  0  0 2026-10-31 20:21:53

-t appends the date and time to every row, so you can line samples up with application logs later. Redirect to a file and leave it running during an incident.

Show the event counters since boot

$ vmstat -s -S M | head -12

explain

output

       257590 M total memory
       165516 M used memory
        33085 M active memory
        39373 M inactive memory
        31023 M free memory
         2939 M buffer memory
        60483 M swap cache
         8191 M total swap
         2081 M used swap
         6110 M free swap
    483022771 non-nice user cpu ticks
     69543265 nice user cpu ticks

-s prints totals instead of rates: memory figures first, then CPU ticks, paging and swap counts, interrupts, context switches and forks. head keeps the first dozen lines here.

Count processes created since boot

$ vmstat -f

explain

output

    322114462 forks

-f reports the number of forks since boot. Sampling it twice a minute apart tells you how fast something is spawning processes.

Common pitfalls

Reading the first line of vmstat 1 as current load. It is an average since boot; on a server that has been up for months it hides any current spike.
us, sy, id, wa and st are percentages of all CPUs. One single-threaded process pegging one core of 16 shows as about 6% us.
free in vmstat is the same low number as in free: cache counts against it. Judge memory pressure by si/so, not by free.

GNU vs BSD and macOS

The examples above ran the GNU/Linux version. These are the differences that matter on macOS and the BSDs (written from their documentation, not run here).

FreeBSD has a vmstat with a different column set and options (for example -w there is the wait between samples); macOS has vm_stat, which prints page counters, not this table.

Options worth knowing

A selection, described in our own words. For the full list, see vmstat(8) or vmstat --help.

Option	What it does
`-a, --active`	Show active and inactive memory instead of buffers and cache.
`-f, --forks`	Print the number of forks since boot.
`-m, --slabs`	Show kernel slab cache usage (usually needs root).
`-n, --one-header`	Print the header only once instead of periodically.
`-s, --stats`	Print a table of event counters and memory totals.
`-d, --disk`	Show per-disk read and write statistics.
`-D, --disk-sum`	Show summed disk statistics.
`-p, --partition DEVICE`	Show statistics for one partition.
`-S, --unit UNIT`	Unit for memory columns: k, K, m or M.
`-w, --wide`	Use wider columns.
`-t, --timestamp`	Append a timestamp to each line.
`-y, --no-first`	Skip the first line of since-boot averages.
`-V, --version`	Print the procps version and exit.

Examples

Common pitfalls

GNU vs BSD and macOS

Options worth knowing

Related