The case
Memory ran out in the middle of an order. And the kernel chose who died.
The store's server had 8 GB of RAM. On a Friday, a report used almost all of it, and the order system started to slow down. Within minutes, the database process was shut down, and the orders in progress stopped.
The decision was made by the kernel, not by the report program.
This post builds on Kernel: the core of the operating system and Processes and Threads: how the system runs your programs: the kernel is what manages the memory and the files those processes use.
The problem
Memory and disk are finite
Each program needs memory to keep track of what it's doing, and several run at the same time. RAM is fast but small. The disk is large but slow. And files, which live on the disk, need names, permissions and a way to find each piece later.
Without a layer that organizes all of this, one program could read another program's memory, or overwrite a colleague's file.
The solution
Virtual memory
With virtual memory, each process sees an address space that belongs only to it, as if it had all the memory to itself. The kernel translates those addresses into physical memory (RAM) through a page table. Each page has a fixed size, usually 4 KB.
Because of that translation, two processes can use the same virtual address, and each still accesses its own area of RAM. A process that tries to read another process's memory is blocked by the kernel.
Isolation
Each process sees only its own address space.
At the store: the report can't read the order system's memory.
More memory than RAM
Pages that aren't in use can go to disk, and come back when they're needed.
At the store: the server runs more processes than fit in RAM, just more slowly.
Sharing
When two processes use the same code, the kernel can keep a single copy in RAM.
At the store: several instances of the same program share the code.
Under the hood
Pages and page faults
When a program accesses a page that isn't in RAM, a page fault happens. The kernel pauses the process, fetches the page from disk and resumes the execution. This happens without the program noticing, and it takes time.
If the system spends all its time swapping pages between RAM and disk, and barely does useful work, we have thrashing: the computer is busy only moving memory around.
Don't mix them up
RAM × swap
RAM is physical memory, fast, where processes actually run. Swap is an area of the disk used as an extension of memory when RAM runs out. It keeps the system from stopping altogether, but it is much slower.
RAM (physical memory)
“Does the data need to be accessed right now, as fast as possible?”
- Example
- The database pages being queried.
- Focus
- Fast and limited. This is where the process runs.
Swap (swap area)
“Has RAM run out, and does the system need to keep the process alive?”
- Example
- The pages of a report that sat idle overnight.
- Focus
- Slow, but larger. It avoids a total failure at the cost of performance.
Storage
File systems
A file system is the way the kernel organizes the disk into files and directories. It answers three questions: where each piece of the file is, who can read or write it, and what to do after a power loss.
- Inode: a file's record. It stores the size, the permissions, the dates and where the content blocks are. The file name is not stored in the inode.
- Directory: a table that links names to inodes. That's why renaming a file doesn't touch its content.
- Permissions: who owns the file and who can read, write or execute it. The kernel checks this rule on every access.
- Journaling: before changing the disk, the system records the intention in a log. If the power goes out in the middle, it completes or undoes the operation on the next boot, without leaving the disk inconsistent.
Linux uses, for example, ext4. Windows uses NTFS, and macOS uses APFS. The names change; the idea is the same.
In practice
Checking memory and disk
On Linux, two commands show the state of the system:
free -h
df -hfree -h shows RAM and swap in use. df -h shows the space used on each file system. When the disk fills up, many services stop writing, even with memory to spare.
| Situation | Where to look |
|---|---|
| The server is slow and the disk is busy | free -h and the swap usage |
| A service stops writing logs | df -h, free space on the disk |
| A process was killed without warning | The kernel log, which records the reason |
Key terms
Six terms to remember
Tap a card to see the definition.
Quick test
Three questions, exam style
01
Two processes use the same virtual address. Why doesn't one read the other's data?
02
A program accesses a page that isn't in RAM. What does the kernel do?
03
A file was renamed. What changed on the disk?
Virtual memory and file systems are two sides of the same kernel job: giving each program a safe space, and organizing the disk so it can be used without conflicts. When memory runs out, the kernel decides who stays. When the power goes out, journaling decides what survives. Together, they are what keeps a database like the store's running.