I have a box with 1 gigabyte of ram. Currently it is not in use by users.
There is a mysql running on it with just the db of ossec, httpd and very very basic services. if you exclude the asl running (and clamav) 10 services to be accurate. The box has 1 gigabyte of ram. asl-httpd is shut down.

It uses so much ram that it even pulls around 30 mbytes of swap !!! Is this normal ? Why do we have so much ram usage ?
It can't even be accessed by wan so its not an attack that causes ram usage for some reason.
Before installing asl there was at least 500mbytes of free ram. That being the worst case.
Is there something we can do to optimize this ?

those could just be anonymous mappings; eg data that does not map to a file. Certain apps like mysql will write anonymous mappings to swap like that, its nothing unusual. I have 16G in my laptop for example and this moment it hasnt touched about 10G of that, swap is at 13M.

wow. I thought swap is the last memory that a system will use after ram has been full. Using swap is bad right ?
It makes the system slow... ? So why does it use swap ?

PS : Cool laptop !!! I had 6GB on mine and thought it was too much until 2 mins ago

That is normal. You may want to read this FAQ about how Linux (and all modern OS kernels) use memory:

https://www.atomicorp.com/wiki/index.ph ... _in_use.3F

Heh, yeah I have (until recently) the most powerful laptop in the world. The next up beats mine because it has 1 more USB 3.0 port And no, its not a mac. I run linux... I'm *actually* cool.

Using swap isn't always a bad thing, its part of garbage collection in modern apps. A few megs here and there is to be expected, large amounts of swap are indicative of too little ram.

I have a new signature now. Thanks Scott!