By the SNMP Monitoring team · Reviewed July 2026
Swap is where memory pressure stops being theoretical. A quiet climb in swap used often shows up before the OOM killer makes career decisions. This how-to is about reading swap over SNMP, interpreting it without cargo-cult thresholds, and alerting when thrash is actually starting—not when the page cache looked “high RAM used” for ten minutes.
OID detail lives with memory leaves: sensors/memory. Sibling: RAM how-to. Parent: server monitoring.
Why monitor swap
Rising swap tells you:
- Working set no longer fits in RAM
- Something is leaking or oversized
- The box may soon spend its life in disk IO
- “CPU wait” tickets are about to get interesting
Bulleted field truths:
- Some swap used after boot is not automatically a fire
- Swap actively growing under load is the signal
- Swap full with free RAM near zero is an emergency
- No swap configured means you lose this early-warning channel—watch RAM harder
If you only graph RAM %, you miss the thrash story. Pair them.
Swap in hrStorageTable + UCD OIDs
Two common paths on Linux agents:
HOST-RESOURCES hrStorageTable — base 1.3.6.1.2.1.25.2.3.1
- descr
.3, units.4, size.5, used.6 - Swap/virtual rows often use type hrStorageVirtualMemory (descr may say “Virtual memory”, “Swap space”, etc.)
- Bytes = value × hrStorageAllocationUnits
UCD memory under 1.3.6.1.4.1.2021.4
- memTotalSwap
.3 - memAvailSwap
.4
Use whichever your agent actually fills. Walk both in lab; don’t assume indexes.
| Source | What you get | Watch-out |
|---|---|---|
| hrStorage virtual/swap row | size / used / units | Pick the right row—not RAM |
| UCD memTotal/AvailSwap | total vs available style numbers | Confirm units in description |
Reading swap used/size with snmpwalk
Find candidates:
snmpwalk -v2c -c <RO_string> <host> 1.3.6.1.2.1.25.2.3.1.3
HOST-RESOURCES-MIB::hrStorageDescr.1 = STRING: Physical memory
HOST-RESOURCES-MIB::hrStorageDescr.3 = STRING: Virtual memory
HOST-RESOURCES-MIB::hrStorageDescr.10 = STRING: /
Then pull the row (example index 3):
snmpwalk -v2c -c <RO_string> <host> 1.3.6.1.2.1.25.2.3.1
HOST-RESOURCES-MIB::hrStorageDescr.3 = STRING: Virtual memory
HOST-RESOURCES-MIB::hrStorageAllocationUnits.3 = INTEGER: 1024 Bytes
HOST-RESOURCES-MIB::hrStorageSize.3 = INTEGER: 2097152
HOST-RESOURCES-MIB::hrStorageUsed.3 = INTEGER: 128000
% used ≈ used/size × 100. Bytes used = used × units.
UCD:
snmpwalk -v2c -c <RO_string> <host> 1.3.6.1.4.1.2021.4
UCD-SNMP-MIB::memTotalSwap.0 = INTEGER: 2097152
UCD-SNMP-MIB::memAvailSwap.0 = INTEGER: 1969152
What "healthy" swap looks like
Numbered interpretation guide:
- Near-zero used, stable — normal for many servers.
- Small used after boot, flat — often fine; note the baseline.
- Used climbing with load — investigate RAM/leaks before users feel it.
- High used % with low free RAM — treat as memory emergency.
- High used but free RAM exists — check swappiness/history; still graph rates.
- Swap size zero — no swap device; don’t alert on empty OIDs, alert on RAM instead.
Context beats a universal “swap > 20% = page.” A batch host that always sits at 5% used is not the same as an API box that just hit 40% in ten minutes.
Alerting on swap
Practical starters:
- Warn on sustained used % above your baseline band
- Crit when free swap is tiny and RAM is tight
- Prefer rate of change when the NMS allows it
- Mute or raise thresholds during known memory-heavy jobs only if documented
Design: alerts. Leaves: memory sensors (swap rows). Always correlate with RAM and load.
External monitoring
Off-box polls still help when the host is thrashing too hard for your on-prem path to be trusted. ostr.io reads swap device name/capacity/usage alongside RAM over external SNMPv2c—allowlist the storage/UCD OIDs you need. Broader pattern: external monitoring, setup.
One CTA here; any NMS can do the arithmetic if the agent answers.
Ops checklist
- Locate swap/virtual row or UCD swap OIDs
- Record baseline used % after steady state
- Graph used % + free RAM together
- Alert on sustained climb / critical free
- Re-verify after resize of swap file/partition
Failure modes
- Alerting on RAM row by mistake
- Forgetting × allocation units
- Paging on “any swap > 0”
- No RAM metric beside swap
Night-shift sketch
Swap used jumps 5% → 45% in 30 minutes, RAM 92%, load elevated: shed traffic or kill the leaky job. Swap 8% flat for a month on a fat DB box: leave it, watch trends weekly. Same OID, different story.
Glossary: glossary.
Building a swap panel that people trust
Put three series on one row: RAM % used, swap % used, load average. When only RAM is high, maybe cache. When swap climbs with load, page someone. When swap is full and RAM is full, page harder. Single-metric red dots create “swap is always yellow” fatigue on hosts that naturally sit with a little swap in use.
Document the row index or descr you locked for swap in the template name (swap_virtual_memory). After adding a second swap device, re-walk—some agents expose multiple virtual rows and your “swap” graph might be the quiet one.
Linux-specific notes
Swappiness and whether swap is a file or partition change behavior, not OIDs. After swapoff/swapon or cloud “memory” shapes, confirm size via SNMP still matches free -h order of magnitude. If SNMP size is zero but swapon --show lists devices, the agent isn’t exporting virtual storage—fix HOST-RESOURCES modules before rewriting alerts.
Containers: host-level snmpd may show host swap, not per-cgroup pressure. Know which namespace you’re polling or you’ll “fix” the wrong tenant’s memory problem.
Capacity vs thrash
Capacity: swap size small relative to RAM on purpose. Thrash: high used with elevated si/so if you also collect those elsewhere—SNMP hrStorage alone is level, not rate of pages in/out. For thrash rate you may need OS metrics beyond this how-to; still, level + RAM + load catches most fires early enough.
Frequently asked questions
What OID is swap usage?
hrStorage used/size on the hrStorageVirtualMemory (or similarly labeled) row under 1.3.6.1.2.1.25.2.3.1, or UCD memTotalSwap/memAvailSwap at 1.3.6.1.4.1.2021.4.3 / .4.
How do I monitor swap on Linux with SNMP?
Enable snmpd with HOST-RESOURCES (and UCD if you use it), walk storage descr, pick the swap row, compute used %, alert with duration. See steps above.
Is high swap usage bad?
Depends. Steady low usage can be normal; rapid growth under load or swap full with no free RAM is bad. Context and rate matter.
Does ostr.io monitor swap?
ostr.io can read swap name/capacity/usage via its external SNMPv2c metric set—keep allowlists tight.
Key takeaways
- Swap = early memory-pressure signal; pair with RAM.
- hrStorage virtual row + UCD 2021.4.3/.4.
- Bytes need allocation units; % = used/size.
- Alert on sustained climb/critical free, not folklore.
- Twin: sensors/memory; external: ostr.io.