If info is swapped out to disc and later read back into memory, it will often be left allocated in the swap area until swap space runs low.
That means that if the same info needs to be swapped out again later and hasn't changed, the OS can just drop the pages from allocated RAM without needing to write anything to disc saving time.
Swap allocated to stuff that has been read back into memory will be freed either
- when the relevant pages are no longer needed at all (i.e. are freed by the application)
- when the relevant pages are changed (so the copy on disc is no longer up to date)
- the machine runs low on swap space so clears some things that are already in RAM to make room
Look in /proc/meminfo for a line called "SwapCached". This entry counts pages that are found both in RAM and in swap partitions. For instance, picking a small VM at random, the /proc/meminfo virtual file one of my VMs shows:
SwapTotal: 698816 kB
SwapFree: 624520 kB
SwapCached: 17232 kB
indicating that 74268K of swap space is allocated, but that 17232K worth of those pages are also currently mapped into RAM too (so could be deallocated from swap at a moment's notice if the space is needed by something else).
Also there will no doubt be pages sat there that was swapped out ages ago and have never been used again since. The kernel will not reload pages from swap just because there is some free RAM to read it back into as that free RAM might be better used for cache or buffers - pages written to swap are generally only reread when they are next needed.
If you want to clear out what is in swap, as long as you have enough free and/or freeable (i.e. free+cache+buffers (less those parts of the c+b counts that are not freeable RightThisInstant)), just turn it off and back on again with swapoff -a && swapon -a.
Of course you could also have a memory leak somewhere too, but that is not the only explanation for the behaviour you are seeing.
NOT WINDOWS SPECIFIC
I can't speak for Windows directly since you tagged it with the generic operating-system here's the general answer you'd receive from the Linux world:
Cache is a good thing. The more RAM you use (with caches) the better. The OS is usually smart enough to free cache and give it to applications (personally I've never seen a case where that wasn't the case).
That is whenever applications need it, I'm pretty sure that Windows isn't a dumbass, so I'd expect similiar behaviour. In fact I'd bugged about the 3400MB of free RAM:
WTF... I oversized the server so that
it doesn't even use the complete RAM
as cache?
This would be the first thing that comes to my mind when seeing numbers like these.
Yes, go downvote me for answering with the Linux Point of View :)
Apart from that Windows 2007 Server does not exist do you mean Windows Server 2008?
Best Answer
While it is true that kernel uses swap even if there may be memory left, using more than two thirds of it may be an indicator that historically the server may have been running out of memory and that is why it started swapping. I would correlate swap usage with memory usage in the sar reports to deduce whether the system has enough ram. I would also check dmesg or the logs to determine if the server has in fact ran out of memory, and the oom-killer kicked in.