Linux Swap Explained: How Swap In, Swap Out, and Swappiness Work

Introduction

Linux provides swap as a mechanism that allows the system to continue operating even when physical memory is under heavy pressure.

Swap temporarily moves infrequently used memory pages from physical memory to a swap area on disk, freeing memory for new allocations. This may allow applications to keep running without being terminated when memory becomes scarce.

Because swap uses disk, however, it is considerably slower than physical memory. Frequent swapping can therefore reduce system performance and responsiveness.

During troubleshooting, swap usage is often assumed to indicate a problem, but this is not necessarily true. What matters is understanding why swap was used and determining whether swap-in or swap-out activity is still occurring continuously.

This article uses diagrams to explain the role and mechanics of swap, swap-out and swap-in operations, the role of swappiness, and how to inspect swap with commands such as free and vmstat.

What Is Swap?

Swap is a mechanism that temporarily moves infrequently used memory pages to a swap area on disk when physical memory (RAM) runs low.

Applications normally keep their data in physical memory. As memory usage grows and free memory becomes scarce, however, the system may be unable to satisfy new memory allocations.

Linux addresses this by moving memory pages that have not been used recently to the swap area, thereby freeing physical memory for applications or the kernel.

Based on factors such as page access history, Linux moves anonymous pages that it considers infrequently used to swap. This lets it keep frequently accessed pages in physical memory and use limited RAM efficiently.

Because swap is stored on disk, access is much slower than RAM. Swap is only a supporting mechanism for memory pressure, and frequent swap use can degrade system performance.

What Is an Anonymous Page?

The concept of an anonymous page is essential to understanding swap.

An anonymous page is a memory page that is not associated with a file.

Examples include heap space allocated by an application with malloc() or new, and a program’s stack. Because this data was not read from a file, no original copy exists on disk.

By contrast, data loaded from HTML files, image files, libraries, and other files is managed as file-backed pages.

The following diagram summarizes the difference.

The key point is that swap primarily applies to anonymous pages.

Because a file-backed page has an original file on disk, Linux can simply discard its page-cache copy when memory is low and read it from the file again when needed.

An anonymous page has no backing file. Simply discarding it would lose application data, so Linux preserves it by moving it to swap.

By reclaiming each type of page appropriately, Linux makes efficient use of limited physical memory.

How Swap Works

Swap involves two operations: swap out and swap in.

Swap Out

Swap out is the process of moving infrequently used anonymous pages to swap when physical memory (RAM) runs low.

While sufficient physical memory is available, application data remains in RAM. When memory usage increases and free memory becomes scarce, the Linux kernel begins page reclaim to make room for new allocations.

During page reclaim, Linux decides whether to reclaim file-backed or anonymous pages based on access patterns, swappiness, and other factors. Swappiness adjusts the relative I/O cost assigned to reclaiming anonymous memory versus file pages. It is explained later in this article.

By freeing physical memory, swap out makes memory available to new applications and the kernel.

Swap out generally targets anonymous pages. Since page-cache data has a backing file, it is normally discarded rather than moved to swap.

Swap In

Swap in is the process of reading a memory page from swap back into physical memory.

A swapped-out page is stored in the disk-based swap area. When that page is accessed again, Linux reads it from swap and restores it to physical memory. This is called swap in.

Because swap resides on disk, swap in takes longer than accessing physical memory. Frequent swap-ins can therefore reduce application responsiveness and overall system performance.

Swap in is also closely related to page faults.

A page fault is an exception raised when a process accesses a page that is not currently in physical memory. Accessing a swapped-out page triggers a page fault; Linux reads the page from swap into physical memory, after which the application resumes execution.

Because swap in is triggered by a page fault, applications can continue without needing to know that their pages were swapped. Reading from swap nevertheless requires storage I/O and may introduce noticeable latency.

The Swap Process

In summary, swap works as follows.

As applications run, physical-memory usage increases. While enough free memory remains there is no problem, but when free memory becomes scarce the Linux kernel starts page reclaim.

Page reclaim frees infrequently used file-backed pages or moves anonymous pages to swap. Which type is reclaimed first is not fixed; Linux considers page access patterns, swappiness, and other factors.

If a swapped-out page is accessed again, a page fault occurs and swap in reads the page back into physical memory.

This sequence lets Linux use limited physical memory efficiently while keeping applications running.

The overall process is shown below.

1. Memory usage increases.
2. Free memory becomes scarce.
3. Page reclaim runs.
4. Unneeded page-cache entries are freed.
5. Anonymous pages are swapped out as necessary.
6. Accessing a swapped page causes a page fault.
7. Swap in reads the page back into physical memory.

Linux combines page-cache reclamation with swapping to use limited physical memory efficiently. Consequently, running low on physical memory does not immediately cause swapping.

swappiness

Swappiness is a kernel parameter that determines how aggressively the Linux kernel uses swap.

When physical memory runs low, Linux obtains memory by discarding page-cache entries or moving anonymous pages to swap. Swappiness is an indicator used to adjust how aggressively swap out is performed.

On RHEL 9, the valid swappiness range is 0–200. A value of 100 treats the I/O cost of swapping anonymous pages and rereading file pages as equal.

• Lower values favor physical memory and avoid swap where possible.
• Higher values use swap more aggressively.

Many Linux distributions use 60 as the default.

swappiness Values

The following values provide a general guide.

Setting the value to 0 does not disable swap entirely. If physical memory runs low, Linux may still swap pages out as necessary.

Database servers, for example, often use a low value because swapping frequently used data can severely reduce performance. On the other hand, many general-purpose Linux servers operate well with the default value of 60.

There is, however, no single correct value.

The optimal value depends on physical-memory capacity, application characteristics, and page-cache usage. During troubleshooting and performance tuning, adjust it according to actual memory usage while monitoring vmstat‘s si and so fields, the free command, and other indicators.

Checking swappiness

Use the following command to check the current value.

[root@almalinux ~]# cat /proc/sys/vm/swappiness
60
[root@almalinux ~]#

In this example, swappiness is set to the default value of 60.

Changing swappiness

To make a change persistent, add the following setting to /etc/sysctl.conf or a configuration file under /etc/sysctl.d/.

[root@almalinux ~]# vi /etc/sysctl.conf
[root@almalinux ~]#
[root@almalinux ~]# grep vm.swappiness /etc/sysctl.conf
vm.swappiness = 10
[root@almalinux ~]#

Then apply the setting with sysctl -p.

[root@almalinux ~]# sysctl -p
kernel.panic = 10
kernel.watchdog_thresh = 20
net.ipv6.conf.all.disable_ipv6 = 1
net.ipv6.conf.default.disable_ipv6 = 1
vm.swappiness = 10
[root@almalinux ~]#
[root@almalinux ~]# cat /proc/sys/vm/swappiness
10
[root@almalinux ~]#

How to Check Swap

Linux provides several commands for checking swap usage and swap-in/swap-out activity.

When troubleshooting, it is important to determine not only whether swap is in use, but also whether swapping is still occurring.

The following methods are commonly used in production environments.

The free Command

The easiest way to check swap usage is the free command.

[root@almalinux ~]# free -h
               total        used        free      shared  buff/cache   available
Mem:           7.6Gi       3.4Gi       1.2Gi       220Mi       3.0Gi       3.8Gi
Swap:          2.0Gi       512Mi       1.5Gi

Focus on the amount of swap in use.

An increase in Swap Used means that anonymous pages have been moved to swap.

However, swap usage alone does not necessarily indicate a problem.

Linux keeps a swapped-out page in swap until it is accessed again. Swap Used may therefore merely reflect swap activity that occurred in the past.

Use vmstat, described below, to determine whether swapping is occurring now.

/proc/meminfo

More detailed information is available from /proc/meminfo.

The most relevant fields are listed below.

The following command displays only the required fields.

[root@almalinux ~]# grep -E "SwapTotal|SwapFree|SwapCached" /proc/meminfo
SwapTotal:      2097148 kB
SwapFree:       1572864 kB
SwapCached:         4096 kB
[root@almalinux ~]#

SwapCached represents pages that are currently in physical memory but still have a corresponding copy in swap.

The vmstat Command

vmstat is the most useful command for checking whether swapping is currently occurring.

[root@almalinux ~]# vmstat 1
procs -----------memory---------- ---swap-- -----io---- -system-- ------cpu-----
 r  b   swpd   free   buff  cache   si   so    bi    bo   in   cs us sy id wa st
 1  0 524288 256000  12000 820000    0    0     8    24 2200 1400  2  3 95  0  0

Pay particular attention to these fields.

During troubleshooting, focus especially on si and so.

• If si remains elevated, pages are frequently being read from swap.
• If so remains elevated, insufficient physical memory is causing swap-out activity.

If si and so remain elevated for an extended period, insufficient physical memory may be degrading performance.

The sar Command

The sar command is useful for reviewing historical swap activity.

[root@almalinux ~]# sar -W 1
Linux 5.14.0-570.19.1.el9_6.x86_64 (almalinux)  08/02/2026      _x86_64_        (4 CPU)

12:00:01 AM pswpin/s pswpout/s
12:00:02 AM      0.00      3.00
12:00:03 AM      0.00      0.00
12:00:04 AM      5.00      0.00

Check the following fields.

Whereas vmstat shows the current state, sar shows trends from the past through the present, making it useful for analyzing the time of an incident.

For more information about sar, see the following article:
A Complete Guide to the sar Command for Essential Linux Performance Monitoring: CPU, Memory, and I/O Analysis

Why Swap Usage Grows and What to Check During Troubleshooting

As explained above, swap moves infrequently used anonymous pages to a disk-based swap area when physical memory runs low.

Swap usage therefore means that Linux performed a swap out to free physical memory.

However, swap usage itself does not necessarily indicate a problem.

The important questions are why swap was used and whether swapping is still occurring.

Insufficient Physical Memory

The most common cause is insufficient physical memory.

When applications consume large amounts of memory, Linux swaps pages out to make room for new allocations.

This can occur, for example, during batch jobs that process large datasets or when many applications run simultaneously.

Memory Leaks

Application memory leaks are another common cause of growing swap usage.

A memory leak gradually increases memory consumption until physical memory runs low and pages are swapped out.

If swap usage continues growing over a long uptime, investigate the possibility of a memory leak.

The swappiness Setting

The swappiness setting also affects how readily swapping occurs.

Higher values encourage swap use, while lower values favor physical memory.

Swapping is not determined by swappiness alone; physical-memory usage and workload characteristics also have a major influence.

Long Uptime

On a server that has been running for a long time, pages swapped out in the past may remain in swap.

In this situation, Swap Used does not decrease even if physical memory is currently plentiful.

In other words, no swapping may be occurring now; the value may simply reflect past swap activity.

Troubleshooting Checklist

Check the following points to narrow down the cause of swap usage.

The key point is that high Swap Used does not automatically mean there is a problem.

During troubleshooting, first check swap usage with free, then use vmstat or sar to determine whether swap-ins or swap-outs are still occurring. Checking per-process memory usage and the swappiness setting as well helps identify the cause efficiently.

Summary

Swap is a mechanism that frees physical memory during page reclaim by moving infrequently used anonymous pages to a swap area on storage.

Moving an anonymous page to swap is called swap out; reading it back into physical memory when it is accessed again is called swap in. Because swap in requires storage I/O, frequent swap-ins may reduce application responsiveness.

The main concepts covered in this article are summarized below.

Do not diagnose a problem based solely on the amount of Swap Used. Even when Swap Used remains elevated, si and so values of 0 in vmstat may mean that only pages swapped out in the past remain.

Conversely, if si or so remains elevated and I/O wait or application latency is also increasing, investigate insufficient physical memory or a memory leak.

A thorough swap investigation should combine free, vmstat, sar, and per-process memory usage to assess both current behavior and historical trends.

If you’d like to learn more about Linux memory management, I’ve covered the topic in detail in the following book. Please check it out if you’re interested.

Learn How Linux Works Through Visual Explanations

This book explains how Linux memory management works through clear, visual illustrations, making the concepts easy to understand even for beginners.

View the Book on Kindle