# Memory counters and events Perfetto allows to gather a number of memory events and counters on Android and Linux. These events come from kernel interfaces, both ftrace and /proc interfaces, and are of two types: polled counters and events pushed by the kernel in the ftrace buffer. ## Per-process polled counters The process stats data source allows to poll `/proc//status` and `/proc//oom_score_adj` at user-defined intervals. See [`man 5 proc`][man-proc] for their semantic. ### UI ![](/docs/images/proc_stat.png "UI showing trace data collected by process stats pollers") ### SQL ```sql select c.ts, c.value, t.name as counter_name, p.name as proc_name, p.pid from counter as c left join process_counter_track as t on c.track_id = t.id left join process as p using (upid) where t.name like 'mem.%' ``` ts | counter_name | value_kb | proc_name | pid ---|--------------|----------|-----------|---- 261187015027350 | mem.virt | 1326464 | com.android.vending | 28815 261187015027350 | mem.rss | 85592 | com.android.vending | 28815 261187015027350 | mem.rss.anon | 36948 | com.android.vending | 28815 261187015027350 | mem.rss.file | 46560 | com.android.vending | 28815 261187015027350 | mem.swap | 6908 | com.android.vending | 28815 261187015027350 | mem.rss.watermark | 102856 | com.android.vending | 28815 261187090251420 | mem.virt | 1326464 | com.android.vending | 28815 ### TraceConfig To collect process stat counters every X ms set `proc_stats_poll_ms = X` in your process stats config. X must be greater than 100ms to avoid excessive CPU usage. Details about the specific counters being collected can be found in the [ProcessStats reference](/docs/reference/trace-packet-proto.autogen#ProcessStats). ```protobuf data_sources: { config { name: "linux.process_stats" process_stats_config { scan_all_processes_on_start: true proc_stats_poll_ms: 1000 } } } ``` ## Per-process memory events (ftrace) ### rss_stat Recent versions of the Linux kernel allow to report ftrace events when the Resident Set Size (RSS) mm counters change. This is the same counter available in `/proc/pid/status` as `VmRSS`. The main advantage of this event is that by being an event-driven push event it allows to detect very short memory usage bursts that would be otherwise undetectable by using /proc counters. Memory usage peaks of hundreds of MB can have dramatically negative impact on Android, even if they last only few ms, as they can cause mass low memory kills to reclaim memory. The kernel feature that supports this has been introduced in the Linux Kernel in [b3d1411b6] and later improved by [e4dcad20]. They are available in upstream since Linux v5.5-rc1. This patch has been backported in several Google Pixel kernels running Android 10 (Q). [b3d1411b6]: https://github.com/torvalds/linux/commit/b3d1411b6726ea6930222f8f12587d89762477c6 [e4dcad20]: https://github.com/torvalds/linux/commit/e4dcad204d3a281be6f8573e0a82648a4ad84e69 ### mm_event `mm_event` is an ftrace event that captures statistics about key memory events (a subset of the ones exposed by `/proc/vmstat`). Unlike RSS-stat counter updates, mm events are extremely high volume and tracing them individually would be unfeasible. `mm_event` instead reports only periodic histograms in the trace, reducing sensibly the overhead. `mm_event` is available only on some Google Pixel kernels running Android 10 (Q) and beyond. When `mm_event` is enabled, the following mm event types are recorded: * mem.mm.min_flt: Minor page faults * mem.mm.maj_flt: Major page faults * mem.mm.swp_flt: Page faults served by swapcache * mem.mm.read_io: Read page faults backed by I/O * mem.mm..compaction: Memory compaction events * mem.mm.reclaim: Memory reclaim events For each event type, the event records: * count: how many times the event happened since the previous event. * min_lat: the smallest latency (the duration of the mm event) recorded since the previous event. * max_lat: the highest latency recorded since the previous event. ### UI ![rss_stat and mm_event](/docs/images/rss_stat_and_mm_event.png) ### SQL At the SQL level, these events are imported and exposed in the same way as the corresponding polled events. This allows to collect both types of events (pushed and polled) and treat them uniformly in queries and scripts. ```sql select c.ts, c.value, t.name as counter_name, p.name as proc_name, p.pid from counter as c left join process_counter_track as t on c.track_id = t.id left join process as p using (upid) where t.name like 'mem.%' ``` ts | value | counter_name | proc_name | pid ---|-------|--------------|-----------|---- 777227867975055 | 18358272 | mem.rss.anon | com.google.android.apps.safetyhub | 31386 777227865995315 | 5 | mem.mm.min_flt.count | com.google.android.apps.safetyhub | 31386 777227865995315 | 8 | mem.mm.min_flt.max_lat | com.google.android.apps.safetyhub | 31386 777227865995315 | 4 | mem.mm.min_flt.avg_lat | com.google.android.apps.safetyhub | 31386 777227865998023 | 3 | mem.mm.swp_flt.count | com.google.android.apps.safetyhub | 31386 ### TraceConfig ```protobuf data_sources: { config { name: "linux.ftrace" ftrace_config { ftrace_events: "kmem/rss_stat" ftrace_events: "mm_event/mm_event_record" } } } # This is for getting Thread<>Process associations and full process names. data_sources: { config { name: "linux.process_stats" } } ``` ## System-wide polled counters This data source allows periodic polling of system data from: - `/proc/stat` - `/proc/vmstat` - `/proc/meminfo` See [`man 5 proc`][man-proc] for their semantic. ### UI ![System Memory Counters](/docs/images/sys_stat_counters.png "Example of system memory counters in the UI") The polling period and specific counters to include in the trace can be set in the trace config. ### SQL ```sql select c.ts, t.name, c.value / 1024 as value_kb from counters as c left join counter_track as t on c.track_id = t.id ``` ts | name | value_kb ---|------|--------- 775177736769834 | MemAvailable | 1708956 775177736769834 | Buffers | 6208 775177736769834 | Cached | 1352960 775177736769834 | SwapCached | 8232 775177736769834 | Active | 1021108 775177736769834 | Inactive(file) | 351496 ### TraceConfig The set of supported counters is available in the [TraceConfig reference](/docs/reference/trace-config-proto.autogen#SysStatsConfig) ```protobuf data_sources: { config { name: "linux.sys_stats" sys_stats_config { meminfo_period_ms: 1000 meminfo_counters: MEMINFO_MEM_TOTAL meminfo_counters: MEMINFO_MEM_FREE meminfo_counters: MEMINFO_MEM_AVAILABLE vmstat_period_ms: 1000 vmstat_counters: VMSTAT_NR_FREE_PAGES vmstat_counters: VMSTAT_NR_ALLOC_BATCH vmstat_counters: VMSTAT_NR_INACTIVE_ANON vmstat_counters: VMSTAT_NR_ACTIVE_ANON stat_period_ms: 2500 stat_counters: STAT_CPU_TIMES stat_counters: STAT_FORK_COUNT } } } ``` ## Low-memory Kills (LMK) #### Background The Android framework kills apps and services, especially background ones, to make room for newly opened apps when memory is needed. These are known as low memory kills (LMK). Note LMKs are not always the symptom of a performance problem. The rule of thumb is that the severity (as in: user perceived impact) is proportional to the state of the app being killed. The app state can be derived in a trace from the OOM adjustment score. A LMK of a foreground app or service is typically a big concern. This happens when the app that the user was using disappeared under their fingers, or their favorite music player service suddenly stopped playing music. A LMK of a cached app or service, instead, is frequently business-as-usual and in most cases won't be noticed by the end user until they try to go back to the app, which will then cold-start. The situation in between these extremes is more nuanced. LMKs of cached apps/service can be still problematic if it happens in storms (i.e. observing that most processes get LMK-ed in a short time frame) and are often the symptom of some component of the system causing memory spikes. ### lowmemorykiller vs lmkd #### In-kernel lowmemorykiller driver In Android, LMK used to be handled by an ad-hoc kernel-driver, Linux's [drivers/staging/android/lowmemorykiller.c](https://github.com/torvalds/linux/blob/v3.8/drivers/staging/android/lowmemorykiller.c). This driver uses to emit the ftrace event `lowmemorykiller/lowmemory_kill` in the trace. #### Userspace lmkd Android 9 introduced a userspace native daemon that took over the LMK responsibility: `lmkd`. Not all devices running Android 9 will necessarily use `lmkd` as the ultimate choice of in-kernel vs userspace is up to the phone manufacturer, their kernel version and kernel config. On Google Pixel phones, `lmkd`-side killing is used since Pixel 2 running Android 9. See https://source.android.com/devices/tech/perf/lmkd for details. `lmkd` emits a userspace atrace counter event called `kill_one_process`. #### Android LMK vs Linux oomkiller LMKs on Android, whether the old in-kernel `lowmemkiller` or the newer `lmkd`, use a completely different mechanism than the standard [Linux kernel's OOM Killer](https://linux-mm.org/OOM_Killer). Perfetto at the moment supports only Android LMK events (Both in-kernel and user-space) and does not support tracing of Linux kernel OOM Killer events. Linux OOMKiller events are still theoretically possible on Android but extremely unlikely to happen. If they happen, they are more likely the symptom of a mis-configured BSP. ### UI Newer userspace LMKs are available in the UI under the `lmkd` track in the form of a counter. The counter value is the PID of the killed process (in the example below, PID=27985). ![Userspace lmkd](/docs/images/lmk_lmkd.png "Example of a LMK caused by lmkd") TODO: we are working on a better UI support for LMKs. ### SQL Both newer lmkd and legacy kernel-driven lowmemorykiler events are normalized at import time and available under the `mem.lmk` key in the `instants` table. ```sql select ts, process.name, process.pid from instants left join process on instants.ref = process.upid where instants.name = 'mem.lmk' ``` | ts | name | pid | |----|------|-----| | 442206415875043 | roid.apps.turbo | 27324 | | 442206446142234 | android.process.acore | 27683 | | 442206462090204 | com.google.process.gapps | 28198 | ### TraceConfig To enable tracing of low memory kills add the following options to trace config: ```protobuf data_sources: { config { name: "linux.ftrace" ftrace_config { # For old in-kernel events. ftrace_events: "lowmemorykiller/lowmemory_kill" # For new userspace lmkds. atrace_apps: "lmkd" # This is not strictly required but is useful to know the state # of the process (FG, cached, ...) before it got killed. ftrace_events: "oom/oom_score_adj_update" } } } ``` ## {#oom-adj} App states and OOM adjustment score The Android app state can be inferred in a trace from the process `oom_score_adj`. The mapping is not 1:1, there are more states than oom_score_adj value groups and the `oom_score_adj` range for cached processes spans from 900 to 1000. The mapping can be inferred from the [ActivityManager's ProcessList sources](https://cs.android.com/android/platform/superproject/+/android10-release:frameworks/base/services/core/java/com/android/server/am/ProcessList.java;l=126) ```java // This is a process only hosting activities that are not visible, // so it can be killed without any disruption. static final int CACHED_APP_MAX_ADJ = 999; static final int CACHED_APP_MIN_ADJ = 900; // This is the oom_adj level that we allow to die first. This cannot be equal to // CACHED_APP_MAX_ADJ unless processes are actively being assigned an oom_score_adj of // CACHED_APP_MAX_ADJ. static final int CACHED_APP_LMK_FIRST_ADJ = 950; // The B list of SERVICE_ADJ -- these are the old and decrepit // services that aren't as shiny and interesting as the ones in the A list. static final int SERVICE_B_ADJ = 800; // This is the process of the previous application that the user was in. // This process is kept above other things, because it is very common to // switch back to the previous app. This is important both for recent // task switch (toggling between the two top recent apps) as well as normal // UI flow such as clicking on a URI in the e-mail app to view in the browser, // and then pressing back to return to e-mail. static final int PREVIOUS_APP_ADJ = 700; // This is a process holding the home application -- we want to try // avoiding killing it, even if it would normally be in the background, // because the user interacts with it so much. static final int HOME_APP_ADJ = 600; // This is a process holding an application service -- killing it will not // have much of an impact as far as the user is concerned. static final int SERVICE_ADJ = 500; // This is a process with a heavy-weight application. It is in the // background, but we want to try to avoid killing it. Value set in // system/rootdir/init.rc on startup. static final int HEAVY_WEIGHT_APP_ADJ = 400; // This is a process currently hosting a backup operation. Killing it // is not entirely fatal but is generally a bad idea. static final int BACKUP_APP_ADJ = 300; // This is a process bound by the system (or other app) that's more important than services but // not so perceptible that it affects the user immediately if killed. static final int PERCEPTIBLE_LOW_APP_ADJ = 250; // This is a process only hosting components that are perceptible to the // user, and we really want to avoid killing them, but they are not // immediately visible. An example is background music playback. static final int PERCEPTIBLE_APP_ADJ = 200; // This is a process only hosting activities that are visible to the // user, so we'd prefer they don't disappear. static final int VISIBLE_APP_ADJ = 100; // This is a process that was recently TOP and moved to FGS. Continue to treat it almost // like a foreground app for a while. // @see TOP_TO_FGS_GRACE_PERIOD static final int PERCEPTIBLE_RECENT_FOREGROUND_APP_ADJ = 50; // This is the process running the current foreground app. We'd really // rather not kill it! static final int FOREGROUND_APP_ADJ = 0; // This is a process that the system or a persistent process has bound to, // and indicated it is important. static final int PERSISTENT_SERVICE_ADJ = -700; // This is a system persistent process, such as telephony. Definitely // don't want to kill it, but doing so is not completely fatal. static final int PERSISTENT_PROC_ADJ = -800; // The system process runs at the default adjustment. static final int SYSTEM_ADJ = -900; // Special code for native processes that are not being managed by the system (so // don't have an oom adj assigned by the system). static final int NATIVE_ADJ = -1000; ``` [man-proc]: https://manpages.debian.org/stretch/manpages/proc.5.en.html