You launch free -h on a server and the column The display shows almost zero. Yet, the applications still respond correctly and no memory errors appear. This result is common: Linux uses unused RAM as a cache, then reclaims some of it when a process needs it.
available, then swap and memory activity over time. A single value used is not enough. Here is the method I use before stopping a service or adding RAM.
Start with `free -h` and the `available` column
The basic command does not require any administrator privileges:
free -hThe option -h Start with these three columns:
totalavailable: the estimate of the memory that a new process can obtain without causing swap;free: pages that are completely unused at this time.
available is generally more useful than freeThe kernel knows how to free up part of the cache and recoverable structures. A machine with 300 MiB in free but 4 GiB in available is not running out of RAM.
Read used, shared and buff/cache without adding them together.
The columns of free do not correspond to independent drawers that would need to be added together. On recent versions of procps-ng, used is calculated from total And availableTherefore, it is not the exact sum of the RSS memory of all processes.
sharedmainly uses the memory bytmpfs;bufferscovers core buffers;hiddenincludes, in particular, the file cache and recoverable structures;buff/cachegroups buffers and cache into the standard display.
To separate buffers And hiddenUse the widescreen display:
free -w -hThis view helps to understand the allocation, but it does not change the diagnosis: the question remains how much memory can be recovered without swap, and then whether this margin decreases permanently.
Why Linux fills RAM with cache
Rereading a file from RAM is cheaper than rereading it from an SSD or hard drive. Therefore, Linux stores recently used data in the page cache. As long as no application is requesting this space, leaving it empty offers no advantage.
Do not clear the caches with drop_caches to artificially raise the spine freeYou are deleting a useful cache and forcing the system to reread the data. This operation is mainly used for controlled testing, not for routine server maintenance.
You can confirm the source of the values in /proc/meminfo :
grep -E '^(MemTotal|MemFree|MemAvailable|Buffers|Cached|SReclaimable|SwapTotal|SwapFree):' /proc/meminfo is an estimate produced by the kernel. It takes into account free memory and a portion of recoverable caches, without assuming that the entire cache can be recovered immediately.
Choose the units and observe several samples
To compare multiple machines or to populate a reading, keep a fixed unit. -m displays mebibytes. For decimal units, add :
free -m
free -h --siAlso avoid drawing conclusions from a single isolated capture. free can repeat the reading every two seconds and stop after five measurements:
free -h -s 2 -c 5See if available A continuous drop occurs if the swap progresses and if the situation returns to normal after a process is complete. A brief drop during a backup or compilation is not the same as a continuous drop over several hours.
Cross-referencing RAM with swap and vmstat
The line Swap of free It indicates its occupancy, but not its activity. A few gigabytes of long-used data do not prove that the machine is still exchanging pages. List the active areas, then observe if And vmstat :
swapon --show
In vmstatIgnore the first line for instantaneous activity: it represents averages since the start. The following lines show the samples. Repeated values in if Or soassociated with a available Low memory usage and slowdowns indicate real memory pressure.
The guide to swap under Linux explains when its usage is normal and why clearing it without RAM can freeze the machine.
Find the processes that are actually consuming memory
If the indicators confirm tension, identify the processes before taking action:
ps -eo pid,user,comm,%mem,rss --sort=-rss | head
htop
In htopSort by memory, retrieve the PID and service name, then check its status:
journalctl -u service-concerne -n 100 --no-pagerDon’t kill the first process at the top of the list. A database often uses RAM as an application cache and may respect its configuration. First, check if RAM consumption is stable, expected, and released when the load decreases.
When to conclude that there is a real lack of RAM
A lack of memory becomes credible when several signals coincide: available remains very low, shows repeated exchanges, response times degrade and the kernel eventually signals the OOM killer.
journalctl -k -b | grep -Ei 'out of memory|oom-killer|killed process'
dmesg -T | grep -Ei 'out of memory|oom-killer|killed process'In this case, correct the cause: incorrectly set memory limit, service leakage, excessive load, or insufficient sizing. Add swap space only as a safety net, not as a replacement for permanently saturated RAM. Free manual page documents the calculations of its columns, while proc_meminfo(5) describes the counters provided by the kernel.