首先，通过strace工具看下echo都干了什么，它一共调用了八次mmap函数，而且多次调用mprotect。还有brk
brk函数是干什么的呢？如果当前系统内存很忙，频繁调用brk会怎么样？
brk调用的时候，是为进程分配可用的最小空间，这会产生缺页异常，如果内存很忙，那就会产生页交换。
mmap渗透到内核中的mmap，也是同理
正常情况下，这些都应该是常规操作吧，应该不至于产生高负载，除非，当前服务器已经处于某一个临界点了。
还需要收集两个关键信息：
1 使用pidstat -r看看系统有没有占用内存特别高的服务。
2 使用pidstat -d 看看磁盘I/O的使用信息
llkmao@ubuntu:/big$ strace echo > big_file
execve("/bin/echo", ["echo"], [/* 20 vars */]) = 0
brk(NULL) = 0xe98000
access("/etc/ld.so.nohwcap", F_OK) = -1 ENOENT (No such file or directory)
access("/etc/ld.so.preload", R_OK) = -1 ENOENT (No such file or directory)
open("/etc/ld.so.cache", O_RDONLY|O_CLOEXEC) = 3
fstat(3, {st_mode=S_IFREG|0644, st_size=119767, ...}) = 0
mmap(NULL, 119767, PROT_READ, MAP_PRIVATE, 3, 0) = 0x7fbb0ba3b000
close(3) = 0
access("/etc/ld.so.nohwcap", F_OK) = -1 ENOENT (No such file or directory)
open("/lib/x86_64-linux-gnu/libc.so.6", O_RDONLY|O_CLOEXEC) = 3
read(3, "\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0`\t\2\0\0\0\0\0"..., 832) = 832
fstat(3, {st_mode=S_IFREG|0755, st_size=1868984, ...}) = 0
mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fbb0ba3a000
mmap(NULL, 3971488, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7fbb0b46a000
mprotect(0x7fbb0b62a000, 2097152, PROT_NONE) = 0
mmap(0x7fbb0b82a000, 24576, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x1c0000) = 0x7fbb0b82a000
mmap(0x7fbb0b830000, 14752, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7fbb0b830000
close(3) = 0
mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fbb0ba39000
mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fbb0ba38000
arch_prctl(ARCH_SET_FS, 0x7fbb0ba39700) = 0
mprotect(0x7fbb0b82a000, 16384, PROT_READ) = 0
mprotect(0x606000, 4096, PROT_READ) = 0
mprotect(0x7fbb0ba59000, 4096, PROT_READ) = 0
munmap(0x7fbb0ba3b000, 119767) = 0
brk(NULL) = 0xe98000
brk(0xeb9000) = 0xeb9000
open("/usr/lib/locale/locale-archive", O_RDONLY|O_CLOEXEC) = 3
fstat(3, {st_mode=S_IFREG|0644, st_size=4763056, ...}) = 0
mmap(NULL, 4763056, PROT_READ, MAP_PRIVATE, 3, 0) = 0x7fbb0afdf000
close(3) = 0
fstat(1, {st_mode=S_IFREG|0775, st_size=0, ...}) = 0
write(1, "\n", 1) = 1
close(1) = 0
close(2) = 0
exit_group(0) = ?
+++ exited with 0 +++
lkmao@ubuntu:/big$