On Fri 24-01-20 11:04:25, Michal Hocko wrote: [...] > $ awk '{diff=$1-prev; if (prev&&diff) printf "%d %d %d\n", NR, $1, diff; prev=$1}' pswpout > 30 392136 2000 > 31 395513 3377 > 32 399132 3619 > 33 403101 3969 > 34 407211 4110 > 35 410812 3601 > 36 414120 3308 > 37 418119 3999 > 38 422116 3997 > 39 424154 2038 > 40 428110 3956 > > So the swappout started around 18:25:00 Sorry, this should have been 18:25:29 $ sed '1,29d' vmstat-log.txt | head -n1 time 18:25:29 I hope I haven't misprocessed other data but a quick check suggests that s ok. -- Michal Hocko SUSE Labs