From owner-freebsd-questions@FreeBSD.ORG  Thu Jun  8 10:05:38 2006
Return-Path: <owner-freebsd-questions@FreeBSD.ORG>
X-Original-To: freebsd-questions@freebsd.org
Delivered-To: freebsd-questions@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id 4856F16D790
	for <freebsd-questions@freebsd.org>;
	Thu,  8 Jun 2006 08:07:43 +0000 (UTC)
	(envelope-from ml.diespammer@netfence.it)
Received: from parrot.aev.net (parrot.aev.net [212.31.247.179])
	by mx1.FreeBSD.org (Postfix) with ESMTP id 945F543D49
	for <freebsd-questions@freebsd.org>;
	Thu,  8 Jun 2006 08:07:42 +0000 (GMT)
	(envelope-from ml.diespammer@netfence.it)
Received: from soth.ventu (adsl-ull-46-136.51-151.net24.it [151.51.136.46])
	(authenticated bits=128)
	by parrot.aev.net (8.13.6/8.13.6) with ESMTP id k588E2BU050298
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK)
	for <freebsd-questions@freebsd.org>;
	Thu, 8 Jun 2006 10:14:08 +0200 (CEST)
	(envelope-from ml.diespammer@netfence.it)
Received: from [10.1.2.18] (alamar.ventu [10.1.2.18])
	by soth.ventu (8.13.6/8.13.3) with ESMTP id k58873n0073975
	for <freebsd-questions@freebsd.org>;
	Thu, 8 Jun 2006 10:07:03 +0200 (CEST)
	(envelope-from ml.diespammer@netfence.it)
Message-ID: <4487DAAE.3040703@netfence.it>
Date: Thu, 08 Jun 2006 10:07:10 +0200
From: Andrea Venturoli <ml.diespammer@netfence.it>
User-Agent: Thunderbird 1.5.0.4 (X11/20060605)
MIME-Version: 1.0
To: freebsd-questions@freebsd.org
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
X-Scanned-By: MIMEDefang 2.53 on 212.31.247.179
Subject: Strange swap behaviour
X-BeenThere: freebsd-questions@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: User questions <freebsd-questions.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-questions>, 
	<mailto:freebsd-questions-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-questions>
List-Post: <mailto:freebsd-questions@freebsd.org>
List-Help: <mailto:freebsd-questions-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-questions>, 
	<mailto:freebsd-questions-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Thu, 08 Jun 2006 10:05:42 -0000

Hello.

A server of mine is running 6.1/amd64 with 1GiB of RAM.
 From time to time swap use will grow enormously and performance will 
suffer from this; also the nightly clamav run will not complete, as the 
process will get killed due to lack of swap space.
The day after I'll look into top and see this two processes are the 
largest ones:
>   672 snort          1 -58    0  4007M 62344K bpf    0   8:53  0.00% snort
>   669 snort          1 -58    0   323M 29704K bpf    1   1:45  0.00% snort

I kill them and start them again; I get:

> 10295 snort          1 -58    0 81708K 66432K bpf    0   0:01 12.38% snort
> 10283 snort          1 -58    0 81704K 66368K bpf    0   0:01  5.77% snort


However swap utilization will drop from 4095/4096 MiB to 136/4096 MiB.

Is this normal?
Does the size figure in top only show physical RAM usage?
Or is only swap space reclaimed after the process gets killed?

  bye & Thanks
	av.