I haven't been following this thread closely, so may be off target. When pages are moved out of the working set they are either "clean" or "dirty". Clean pages have not been modified since they were originally moved into memory whereas dirty pages have been changed. A dirty page can become clean if it is written back to disk. Typically (though not always) this is a write to swap. Read only pages, such as code or data will always be clean, so can be dropped when required. When a hard fault occurs then pages have to be read from disk, somewhere. That somewhere could be swap, but can also be program images or files. It may be that what you observe is this latter process. HTH, Martin On 12/03/2021 01:29, yf chu wrote: > > yes. I suspect it has something to do with swapping. but swap is turned off on this server. > here is the result of free -m. > total used free shared buff/cache available > Mem: 128174 97449 24400 4158 6325 25232 > Swap: 0 0 0 > > > We have other servers. The processes running on these servers are same. but on other servers, the size of buff/cache is larger than the size on the server which experienced the problem and the size of "free" is smaller than the size on the server which experienced the problem. > <snip> -- J Martin Rushton MBCS