swapfile being eaten by unknown process

[John]

On Mon, 14 Feb 2005 22:35:55 -0600, Dan Nelson wrote
> In the last episode (Feb 14), Kris Kennaway said:
> > On Tue, Feb 15, 2005 at 01:30:42AM +0000, John wrote:
> > > Is there a way of seeing *what* program/process is eating swap.
> > > There are loads of ways of seeing that it is being eaten, but so
> > > far haven't found a way of knowing what eats, so can't fix the
> > > problem. Can anyone enlighten me?
> > 
> > Use ps or top, and look for the process with the huge size.  This is
> > not foolproof, because a process can allocate memory without using it
> > (e.g. rpc.statd), but it's a place to start.  If you see a process
> > that is both large, and paging to/from disk, that's a better
> > indication.
> 
> To see which processes are paging: run top, hit 'm' to switch modes,
> and hit 'o' then 'fault' to sort the processes by how many page 
> faults they are doing.  This isn't completely foolproof either,
>  since reads from mmap()ed files count as faults as well.
> 

Another data point - I see this in my nightly security logs:

swap_pager: indefinite wait buffer: device: ad0s1f, blkno: 28190, size: 4096

maybe there's a bad block on the swap partition?? 
--
lists'reiteration.net