How to Trace Kernel SLAB and SLUB Memory Allocation Rates in Linux Using slabratetop

The Linux kernel utilizes the SLAB (and modern SLUB) allocator to manage contiguous memory for kernel objects, such as directory entries (dentry), inodes (inode_cache), file descriptors, and network socket buffers (skbuff). When rogue workloads spawn millions of small files or leak network connections, kernel slab memory can consume gigabytes of physical RAM without appearing under user-space process metrics. The eBPF-powered slabratetop utility provides real-time top-style visibility into kernel slab allocation rates.

Understanding Kernel SLAB Allocation Architecture

The kernel organizes memory into object-specific caches to reduce memory fragmentation:

• Cache Pools: Slabs maintain pools of pre-allocated memory slices for frequently instantiated data structures (e.g., kmalloc-512, dentry, buffer_head).
• Allocation Functions: Kernel subsystems allocate slab memory via kmem_cache_alloc() and return objects via kmem_cache_free().
• Traditional Diagnostic Limits: While /proc/slabinfo reports cumulative memory usage, it cannot identify which kernel caches are currently experiencing high allocation frequency.

Installing the BCC Tracing Toolkit

Ensure the BPF Compiler Collection (BCC) is installed on your Linux distribution:

# Ubuntu / Debian
sudo apt update
sudo apt install -y bpfcc-tools linux-headers-$(uname -r)

# RHEL / Rocky Linux / Fedora
sudo dnf install -y bcc-tools kernel-devel-$(uname -r)

The executable is typically installed at /usr/sbin/slabratetop-bpfcc or /usr/share/bcc/tools/slabratetop.

Running slabratetop for Real-Time Allocation Monitoring

Launch slabratetop with superuser privileges:

sudo slabratetop-bpfcc

The utility clears the terminal screen every interval and presents an interactive top-style table:

14:32:01 loadavg: 0.45 0.52 0.61 2/412 18902
CACHE                 ALLOCTS        FREES   NET_ALLOC/s
dentry                 184200       120400         63800
kmalloc-512             45100        42000          3100
skbuff_head_cache       28400        28300           100
inode_cache             14200        14150            50

The columns display:

• CACHE: The specific kernel slab cache name.
• ALLOCTS: Total allocations requested during the sample window.
• FREES: Total objects freed back to the slab cache.
• NET_ALLOC/s: Net rate of growth per second (allocations minus frees).

Isolating Rapid File Inode Churn

If dentry or inode_cache exhibits enormous net allocation rates:

1. Identify workloads performing exhaustive directory traversal (such as unindexed find operations or rapid file creation).
2. Drop clean caches to release unreferenced slab entries:

   sudo sync
   sudo sysctl -w vm.drop_caches=2

3. Monitor slabratetop to confirm whether allocation rates return to steady state baseline levels.