NodeSwapHigh: what to do when it fires

Alert rule

alert: NodeSwapHigh
expr: (1 - node_memory_SwapFree_bytes / node_memory_SwapTotal_bytes) * 100 > 80
and node_memory_SwapTotal_bytes > 0
for: 15m
severity: warning

Alert message: Swap almost full ({{ $labels.instance }})

What it means

More than 80% of swap is in use (provided swap is configured). The system is pushing memory out to disk and runs slowly.

Common causes

A shortage of RAM; a single leaking process; a vm.swappiness that is too high combined with long-inactive pages (in that case used swap may be harmless, but 80% is a reason to take a look).

Diagnostics

free -h
swapon --show
for f in /proc/*/status; do awk '/^Name|^VmSwap/{printf $2" "}END{print ""}' "$f"; done 2>/dev/null | sort -k2 -n -r | head
vmstat 1 5            # si/so columns: active swapping
sysctl vm.swappiness

How to fix

Free memory (see NodeMemoryLow). If processes have merely "lain" in swap with no active swapping (si/so near zero), you can reset swap: swapoff -a && swapon -a — only when RAM is enough for the entire swap contents.

When it is OK to silence

If si/so are zero and there is enough memory, but swap is full of long-inactive pages.

Related alerts

• NodeMemoryLow
• NodeCpuHigh
• NodeMemoryCritical
• NodeLoadHigh
• NodeIowaitHigh

The full pack of 44 tested rules + Alertmanager → Telegram: 790 ₽ (≈ $9, card payment in rubles)
Open in Telegram · Free Monitoring Lite kit · All runbook alerts