Still having Free memory issues..?

sspiro · 03-30-2005, 08:08 PM

This is bizarre. I posted something in Security forum not too long ago about this, thinking I had a virus, thought it cleared up, but its still an issue.

Running Debian on a P2 266 with 160MB of physical RAM, 500mb swap.

The second I boot up the box and check free, I typically have between 1.5MB and 5.2MB free.. Before I started having this problem, I would have about 80 or 90mb free. I'm running apache, mysql, ssh, and one or two other items (now also clamav).

I installed clamav and ran it.. found and cleaned two viruses, went back to about ~60mb free. Thought the problem was fixed. I haven't used the box for two or three weeks. Fired it up tonight and I'm back down to 1989K free.

So what do I do now? I really don't want to reformat and start from scratch. I'm fairly new to this, so be gentle. :O

Moloko · 03-31-2005, 01:50 AM

What viri did you find then, since they can't do a thing on a Linux box? I don't think virusses are an issue.

Let Linux handle the memory. If you execute a program and close it after a while you will have more free memory temporarily, till the system uses it again for other programs or system cache. Nothing is wasted on Linux.

Moloko · 03-31-2005, 01:54 AM

Considering your other thread you might want to run chkrootkit (apt-get install chkrootkit).

sspiro · 03-31-2005, 05:31 AM

Quote:

Originally posted by Moloko
Considering your other thread you might want to run chkrootkit (apt-get install chkrootkit).

Nothing found, nothing deleted...

syg00 · 03-31-2005, 06:04 AM

Quote:

Originally posted by sspiro
So what do I do now? I really don't want to reformat and start from scratch. I'm fairly new to this, so be gentle. :O

Go and find a real problem to worry about.
High memory usage is a design objective of Linux. Memory is fast and it's (relatively speaking) expensive.

Best ROI is to use it - simple as that.
Do some searching - this has been addressed ad nauseam.

benjithegreat98 · 03-31-2005, 09:57 AM

Do the command "free -m"

Here is mine:

Code:

[bphilpott@bcmcmail bphilpott]$ free -m
             total       used       free     shared    buffers     cached
Mem:           248        241          7          0         96         32
-/+ buffers/cache:        112        136
Swap:          511         12        499

This shows the amount of memory and swap in Megabytes.

It shows I have 7 megs free.

I have a total of 248 and used 241 which is 7 remaining free.

Below that I have used 112 M in Buffers/cache. if you subtract 112 from 248 it says there is 136 free. This means that if there was no cache/buffers being used in the memory you would have that much free. Buffer/cache get move out of memory as other programs require memory. If you are confused show us your output of "free -m".

If you are still concerned something is taking too much memory use the command "top" and then hit 'm' to sort by memory usage.

sspiro · 04-01-2005, 01:10 PM

Quote:

Originally posted by syg00
Go and find a real problem to worry about.
High memory usage is a design objective of Linux. Memory is fast and it's (relatively speaking) expensive.

Best ROI is to use it - simple as that.
Do some searching - this has been addressed ad nauseam.

Silly me for wasting my time. I thought this forum was designed to ask questions and learn.. considering the domain name and all.

The only reason I have a concern is because I was running for months at "normal usage" (60mb or so in use) and overnight (literally) I check the server and I'm running at 2 or 3mb avail...

Just doesn't seen normal to me. And it IS a real problem because when I have 2mb or 3mb avail, no one can connect to the server (its a webserver)..

sspiro · 04-01-2005, 01:14 PM

Quote:

Originally posted by benjithegreat98
Do the command "free -m"

Here is mine:

Code:

[bphilpott@bcmcmail bphilpott]$ free -m total used free shared buffers cached Mem: 248 241 7 0 96 32 -/+ buffers/cache: 112 136 Swap: 511 12 499

This shows the amount of memory and swap in Megabytes.

It shows I have 7 megs free.

I have a total of 248 and used 241 which is 7 remaining free.

Below that I have used 112 M in Buffers/cache. if you subtract 112 from 248 it says there is 136 free. This means that if there was no cache/buffers being used in the memory you would have that much free. Buffer/cache get move out of memory as other programs require memory. If you are confused show us your output of "free -m".

If you are still concerned something is taking too much memory use the command "top" and then hit 'm' to sort by memory usage.

Code:

spirowebserver:/# free -m
             total       used       free     shared    buffers     cached
Mem:           156         97         59         81         52         13
-/+ buffers/cache:         31        125
Swap:          479          0        479
spirowebserver:/#

Code:

52 processes: 51 sleeping, 1 running, 0 zombie, 0 stopped
CPU states:   0.4% user,   1.2% system,   0.0% nice,  98.4% idle
Mem:    160392K total,   100144K used,    60248K free,    54020K buffers
Swap:   491360K total,        0K used,   491360K free,    13992K cached

  PID USER     PRI  NI  SIZE  RSS SHARE STAT %CPU %MEM   TIME COMMAND
 2144 root      15   0   948  948   748 R     1.3  0.5   0:00 top
 2138 root       4   0  1792 1792  1524 S     0.1  1.1   0:00 sshd
    1 root       0   0   488  488   424 S     0.0  0.3   0:05 init
    2 root       0   0     0    0     0 SW    0.0  0.0   0:03 kflushd
    3 root       0   0     0    0     0 SW    0.0  0.0   0:00 kupdate
    4 root       0   0     0    0     0 SW    0.0  0.0   0:00 kswapd
    5 root       0   0     0    0     0 SW    0.0  0.0   0:00 keventd
  173 root       0   0   596  596   488 S     0.0  0.3   0:00 syslogd
  176 root       0   0   816  816   408 S     0.0  0.5   0:00 klogd
  187 clamav     0   0  7040 7040   832 S     0.0  4.3   0:06 clamd
  228 clamav     0   0  1016 1016   860 S     0.0  0.6   0:00 freshclam
  233 root       0   0   548  548   536 S     0.0  0.3   0:00 authdaemond.pla
  235 root       0   0   548  548   536 S     0.0  0.3   0:00 authdaemond.pla
  236 root       0   0   548  548   536 S     0.0  0.3   0:00 authdaemond.pla
  237 root       0   0   548  548   536 S     0.0  0.3   0:00 authdaemond.pla
  238 root       0   0   548  548   536 S     0.0  0.3   0:00 authdaemond.pla
  239 root       0   0   548  548   536 S     0.0  0.3   0:00 authdaemond.pla
spirowebserver:/#

Memory is "acceptable" for now at 59mb free.. better then 2 or 3..

benjithegreat98 · 04-01-2005, 01:19 PM

If you look at the number below it you have 125 MB free if you did not include the buffer/cache in the memory. If that starts moving closer to zero then something is really starting to eat memory. Buffers/cache get moved out of memory as needed so no need to worry about that eating memory.

If you include your swap space you actually have 479 MB free.

syg00 · 04-01-2005, 03:34 PM

Quote:

Originally posted by sspiro
Silly me for wasting my time. I thought this forum was designed to ask questions and learn..

Search first then ask. If you have a particular problem include all the relevant info.

Quote:

The only reason I have a concern is because I was running for months at "normal usage" (60mb or so in use) and overnight (literally) I check the server and I'm running at 2 or 3mb avail...

Just doesn't seen normal to me. And it IS a real problem because when I have 2mb or 3mb avail, no one can connect to the server (its a webserver)..

This is more useful - should have been in the initial post.
You need to get some comparative numbers for when the problem - particularly users being bounced - is occuring.
The 2.6 kernel introduced a "swappiness" control that might be useable. But it could affect disk response time by force releasing the disk cache. Might get you around a "bombardment" against the webserver that could cause a lot of data to be read constantly, and fill cache.
Do your logs show any such events ???.

sspiro · 04-01-2005, 09:43 PM

Quote:

Originally posted by benjithegreat98
If you look at the number below it you have 125 MB free if you did not include the buffer/cache in the memory. If that starts moving closer to zero then something is really starting to eat memory. Buffers/cache get moved out of memory as needed so no need to worry about that eating memory.

If you include your swap space you actually have 479 MB free.

Quote:

Originally posted by syg00
Search first then ask. If you have a particular problem include all the relevant info. This is more useful - should have been in the initial post.
You need to get some comparative numbers for when the problem - particularly users being bounced - is occuring.
The 2.6 kernel introduced a "swappiness" control that might be useable. But it could affect disk response time by force releasing the disk cache. Might get you around a "bombardment" against the webserver that could cause a lot of data to be read constantly, and fill cache.
Do your logs show any such events ???.

OK. I'm going to continue to keep an eye on it. I can connect to the IP just fine right now, so its all OK. I'll re-run these commands and see what's going on when I have connectivity issues.

Right now the logs don't really show anything out of the ordinary.. I guess its just a learning curve for me really.

jschiwal · 04-05-2005, 01:30 AM

I thought I would throw you the web address of a different root kit hunter program.

http://www.rootkit.nl/

It will alert you of changed files and even point out potential problems with certain setups like ssh.config

---

Isn't Moloko the russian word for 'milk'?

sspiro · 04-07-2005, 11:01 AM

Thank you!

I got more physical memory and installed. I'm at 390mb now, so its running better.. but still running odd. With 390mb physical, I'm using now 170mb and have the balance free. Although I stil have half available and its running good, I still can't find a reason for 170mb to be in use..

foo_bar_foo · 04-07-2005, 03:04 PM

when you can't connect to your server it's most likely not a problem with memory
that is a very small amount of memory and a small swap space fror a server
if you were actually having memory problems you would show all the swap being used
and then lock up/crash i think

i agree with what others have posted -- you are confused about the way linux uses memory and are possibly trying to apply windows concepts where they are not valid.

repeat this over and over
all memory in Linux is virtual
all processes have acces to 100% of available RAM 100% of the time

sspiro · 04-07-2005, 06:13 PM

Quote:

Originally posted by foo_bar_foo

i agree with what others have posted -- you are confused about the way linux uses memory and are possibly trying to apply windows concepts where they are not valid.

repeat this over and over
all memory in Linux is virtual
all processes have acces to 100% of available RAM 100% of the time

Yes, I think you (and the others) are right...

Thank you..