From owner-freebsd-questions@FreeBSD.ORG Thu Jun 8 15:36:41 2006 Return-Path: X-Original-To: freebsd-questions@freebsd.org Delivered-To: freebsd-questions@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id CE84416E1DC for ; Thu, 8 Jun 2006 13:59:02 +0000 (UTC) (envelope-from kris@obsecurity.org) Received: from elvis.mu.org (elvis.mu.org [192.203.228.196]) by mx1.FreeBSD.org (Postfix) with ESMTP id 22DDE43D4C for ; Thu, 8 Jun 2006 13:59:02 +0000 (GMT) (envelope-from kris@obsecurity.org) Received: from obsecurity.dyndns.org (elvis.mu.org [192.203.228.196]) by elvis.mu.org (Postfix) with ESMTP id 0B19F1A3C32; Thu, 8 Jun 2006 06:59:02 -0700 (PDT) Received: by obsecurity.dyndns.org (Postfix, from userid 1000) id 6BF4351878; Thu, 8 Jun 2006 09:59:01 -0400 (EDT) Date: Thu, 8 Jun 2006 09:59:01 -0400 From: Kris Kennaway To: Andrea Venturoli Message-ID: <20060608135901.GA71080@xor.obsecurity.org> References: <4487DAAE.3040703@netfence.it> Mime-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="y0ulUmNC+osPPQO6" Content-Disposition: inline In-Reply-To: <4487DAAE.3040703@netfence.it> User-Agent: Mutt/1.4.2.1i Cc: freebsd-questions@freebsd.org Subject: Re: Strange swap behaviour X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 08 Jun 2006 15:36:45 -0000 --y0ulUmNC+osPPQO6 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Thu, Jun 08, 2006 at 10:07:10AM +0200, Andrea Venturoli wrote: > Hello. >=20 > A server of mine is running 6.1/amd64 with 1GiB of RAM. > From time to time swap use will grow enormously and performance will=20 > suffer from this; also the nightly clamav run will not complete, as the= =20 > process will get killed due to lack of swap space. > The day after I'll look into top and see this two processes are the=20 > largest ones: > > 672 snort 1 -58 0 4007M 62344K bpf 0 8:53 0.00% sno= rt > > 669 snort 1 -58 0 323M 29704K bpf 1 1:45 0.00% sno= rt >=20 > I kill them and start them again; I get: >=20 > >10295 snort 1 -58 0 81708K 66432K bpf 0 0:01 12.38% sno= rt > >10283 snort 1 -58 0 81704K 66368K bpf 0 0:01 5.77% sno= rt >=20 >=20 > However swap utilization will drop from 4095/4096 MiB to 136/4096 MiB. >=20 > Is this normal? Yes. > Does the size figure in top only show physical RAM usage? No, that is what the 'res' field (resident size) shows. > Or is only swap space reclaimed after the process gets killed? It's reclaimed when the process releases the memory, which is either when it decides to stop hogging so much VM or when you kill it. Kris --y0ulUmNC+osPPQO6 Content-Type: application/pgp-signature Content-Disposition: inline -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.3 (FreeBSD) iD8DBQFEiC0kWry0BWjoQKURAmQqAKCU5zaBcqEKKKR4jAXzkN2f6O3+vwCg4LUS VgFwQ/4R6NYfCt8UqpX80DE= =k+Qt -----END PGP SIGNATURE----- --y0ulUmNC+osPPQO6--