How to Accurately Monitor Linux Memory Usage in Sightline EDM

In Linux, calculating available memory is not always straightforward. This is because Linux treats memory resources differently than other operating systems. Because of this, many Linux server monitoring tools do not properly calculate the true value of the property correctly, because of what Linux is doing with memory resources behind the scenes. So a Linux admin running a Linux system might see that they have zero (0) Memory resources available, when in fact plenty of memory is available.

Linux, by design, uses RAM memory for disk caching to speed up the system. This means that the Mem % Free metric will consistently be low (maybe 5%), when in actuality, the system is only using 50% of the RAM.

It is possible in Sightline EDM to accurately monitor Linux memory usage and generate alerts when the amount of real memory gets too low, as opposed to when the default Mem % Free metric only appears to be too low.

Currently, this needs to be done using an expression, which lets you build and define your own metrics using currently existing metrics. We will make 2 expressions in order to monitor real Linux memory usage.

  1. Mem Real Free GByte: We will make an expression called “Mem Real Free GByte”. It will add the following three metrics together: “Mem Buffers GByte” + “Mem Cached GByte” + “Mem Free GByte“. These metrics added together provide a metric which takes out the cache and buffers from the memory calculation.
  2. Mem Real pct Free: We will then create an expression called “Mem Real pct Free.” This metric provides a percentage value which can be used to create accurate Linux memory usage alerts across systems. This is because a percentage will be accurate whether the system has 4 GB or 40 GB. This is done by the following calculation: (“Mem Real Free GByte” / “Mem Total GByte“)  * 100. This takes the free GBytes and divides by the total GBytes the system has, and then multiplies the result by 100 to get a percentage. For example, if a 16 GB system has a “Mem Real Free GByte” value of 10 GB, then the calculation would be  (10/16) * 100, which equals 62.5%.

By using these expressions, it is possible to create meaningful alerts based on real memory instead of the default Mem % Free across a wide range of Unix systems.

The screenshot below shows the default Linux memory metric, Mem % Free, in the lower blue line hovering around 1% free, in comparison with the expression created for Mem Real pct Free, which shows the upper orange line around 36% free. Although the blue line appears to indicate that the Linux system is out of memory, that memory is actually being used for disk caching, whereas the orange line shows real memory around 36% free, which is a much better metric for creating performance alerts. 


The difference can also be seen at the end of the graph, when an application begins using real memory, causing the orange line to dip down to 5%. The blue line does not reflect this change, however, because the system simply decreases the amount of memory available for disk caching and increases the amount of memory availabile to other applications, which effectively cancels each other out. In this way, it is possible to set up alerts to accurately monitor Linux memory usage in Sightline EDM’s IT Infrastructure monitoring system.