[NTLUG:Discuss] where's the memory?

[kbrannen@gte.net]

brian at pongonova.net wrote:
> On Fri, Mar 22, 2002 at 04:55:27PM -0600, kbrannen at gte.net wrote:
> 
>>I understand caching and buffers (which is why I asked about the 283M number 
>>instead of the 352M number. :-)  But when "ps" reports that I'm only using 50M
>>instead of the 283M reports by free, xosview, and top, I start to wonder where
>>that other 223M went.  I mean, it could be very useful if I start to do
>>development work here. :-)  So I'd like to know why there's an inconsistency
>>between ps and the others.
> 
> 
> That's because ps shows memory actually allocated to processes running on your
> machine.  top/free/etc. show memory being used by the kernel for all caching and
> allocation requests.  The kernel will dynamically alter its memory management as
> demand for memory allocations change.  Even though the memory appears to be "used,"
> it's simply being managed by the kernel.  If you want to determine the amount of
> memory used by the running processes, you'll have to add up the memory allocated to
> each process.

Maybe I'm being a bit slow here, but let me try to sum up the conversation so 
far...

There are 3 "main types" of memory:
* memory allocated to processes (also splitable into text, data, & something 
else I don't remember [shared libs?]);
* memory used by the kernel;
* memory dynamically allocated to system buffers & cache (but I'm not counting 
this memory in my totals).

And I'm count memory from the #1 & #2 in the 283M of my example.  And ps 
reports about 50M, which you say is only from memory type #1 above; leaving 
the "missing" 223M to be found in type #2.  Is that accurate?

If yes, how in the world do I make the kernel give it back?  And yes I read 
where you said that all I really need to be concerned about is how much is 
swapping, but this is the situation that leads to massive swapping!

I'm probably not being fair to you by leaving out 1 other data point.  That 
is, if I leave everything going, eventually it will expand beyond the 384M of 
real memory, then start eating swap too.  Last time, all but a sliver of real 
(being used for system buffers & cache) was used, and I'd used about 200M of 
my 256M of swap space.  I killed every process I knew I didn't need, kill 
every X app but:  xcb, xosview.  Now if that isn't sad, I don't know what is! 
  This does not give Linux a good reputation, IMHO.

> 
> The other 223M didn't go anywhere -- it's still there, being actively managed by
> the kernel.  You'll know when the kernel runs out of physical memory, because
> you'll begin to swap.  Prior to that point, I wouldn't worry about it.  

Yeh, well I'm now starting to swap.  And I bet that if I kill X and go back to 
a console text prompt, almost all the memory will "come back" (or so prior 
experience has shown).  So what is holding it down?  How do I find it?  How do 
I limit it's usage?  [I'm not expecting you to answer that, but if you can, 
it's a real bonus as the knowledge can be spread!]

> 
> It's much more useful to monitor your *swap* memory than your physical memory.
> This will be a sure indicator that it's time to start killing off some processes!

I'll agree, but what do you do when almost all of swap is being used, and 
there are no process to be killed?  I don't mean any that are too "precious", 
just none to be kill without fundamentally crippling your system?  That's 
where I am, or at least where I'm slowly going.  I really want to cry "memory 
leak", but want to be very sure before I do. :-)

Kevin