This article explains how much CPU, memory, and disk the Swif agent uses on Linux devices: briefly higher during enrollment, then low during normal use.
When | CPU | Memory | Disk activity |
Normal use, idle | About 4.5% (1.0% user, 3.5% system) | About 35.5 MiB | None |
Applying policies | About the same as idle | About the same as idle | Depends on the policy. A few kilobytes for most policies. |
The first 5–10 minutes after enrollment | Higher, mostly from the system's package tools | Up to about 769 MB | Higher, while packages install |
Idle and policy figures are for the swifteam agent process, measured on an x86 device running Ubuntu 24.04. CPU is a percentage of one CPU core, as pidstat reports it. Figures on ARM64 devices haven't been published yet.
During enrollment
When the Swif agent first runs on a Linux device, it:
installs what it needs, including osquery and the Swif desktop app
refreshes the package manager, for example with
apt update, to get the latest stable packagesapplies the device's policies
installs other packages, with tools such as
dpkgorsnap, depending on the system
So CPU and memory use rise for the first 5 to 10 minutes. In testing, memory use peaked at about 769 MB.
Where the CPU use comes from
Average CPU use in the first 5 minutes after enrollment, in testing:
Process | Average CPU |
| About 19.9% |
| About 6.7% |
| About 6.5% |
| About 0.09% |
Most of it comes from the system's own package tools, not the Swif agent.
After enrollment
Once setup finishes, the agent uses little. On x86 Ubuntu 24.04, the swifteam agent process uses:
CPU: about 4.5% of one CPU core while idle, of which 1.0% is user time and 3.5% is system time
Memory: about 35.5 MiB
Disk: no disk activity while idle
Applying policies doesn't noticeably change CPU or memory use. Disk activity depends on the policy, and is a few kilobytes for most policies. Policies that install software, such as the Linux Software Update Policy, use more, since the package manager downloads and installs packages.
The swif-agent and syscheck services
Swif runs two services on Linux devices:
Service | Purpose |
swif-agent | The main agent. Applies policies, reports device information, and manages the device. |
syscheck (system checker) | Keeps the agent running and up to date |
Linux has no built-in device management, unlike macOS and Windows. So the two services check on each other every 30 seconds:
The agent restarts the system checker if it isn't running.
The system checker restarts the agent if it isn't running.
The system checker also checks the agent's version, and updates it when a newer version is available.
Don't remove the syscheck service. Without it, the agent can't recover or update itself.
What to do during enrollment
Wait 5 to 10 minutes for setup to finish. CPU and memory use then drop.
Don't stop the agent or system checker during setup. Setup may start again, and take longer.
Check the device's internet connection if usage stays high. Slow package downloads can keep usage up longer.
Check usage on a device
To see the agent's CPU use, run:
pidstat -u -p $(pgrep -d, -f 'swifteam|systemcheck') 5
To see its memory use:
ps -o pid,rss,comm -p $(pgrep -d, -f 'swifteam|systemcheck')
rss is in kilobytes. pidstat is part of the sysstat package.
When to contact Swif support
Contact Swif support if usage stays high more than 30 minutes after enrollment, or if the device is slow during normal use. Include:
the device's name or serial number
when it was enrolled
the output of
top, or thepidstatcommand abovethe agent's logs:
journalctl -u swif-agentandjournalctl -u syscheck
Related resources