Run free -h on a busy Linux server and you may see something alarming: most of the RAM appears to be used, while the free column is surprisingly small. That does not automatically mean the server is running out of memory.
Linux deliberately uses otherwise idle RAM for useful work, including filesystem cache. Much of that memory can be reclaimed when applications need it. For administrators, the real question is therefore not simply “How much RAM is free?” but “How much memory can the system make available, and is it experiencing memory pressure?”
On Linux, low free RAM is not by itself a problem. The kernel uses available physical memory for applications, kernel data, buffers, and caches so that RAM does not sit unnecessarily idle.
When reading free -h, the available value is usually more useful than free for judging how much memory can be used by new applications without requiring swapping. To diagnose real memory pressure, combine it with swap activity, process memory use, vmstat, and evidence of OOM events.
- Why Linux intentionally keeps RAM busy.
- The difference between free, used, available, buffers, and cache.
- What the Linux page cache does.
- What swap is and what swap usage does — and does not — tell you.
- How to read free -h, /proc/meminfo, and vmstat.
- What happens when Linux runs out of reclaimable memory.
- How to perform a basic memory-pressure diagnosis.
- 🧠 What Is RAM Doing on a Linux Server?
- Applications
- Kernel
- Page Cache
- Swap
- 📊 Reading free -h Correctly
- 🔄 Why “Almost All RAM Is Used” Can Be Normal
- 📄 What Is the Linux Page Cache?
- 🧱 Buffers and Cache Are Related but Not Identical
- 💾 What Is Swap?
- 📈 vmstat: Is the System Actively Swapping?
- 🔍 Looking Deeper with /proc/meminfo
- 🚨 What Is Real Memory Pressure?
- Low Available Memory
- Swap Activity
- Allocation Failures
- 💥 What Is the OOM Killer?
- 🛠️ A Basic Linux Memory Troubleshooting Workflow
- Check total, available, and swap memory
- Observe activity instead of one snapshot
- Find large memory consumers
- Look at kernel memory information
- Check for OOM evidence
- Correlate the evidence
- 🧪 Mini Lab: Read Your Server’s Memory Correctly
- ⚠️ Common Linux Memory Mistakes
- ✅ Knowledge Check
🧠 What Is RAM Doing on a Linux Server?
RAM is the server’s fast working memory. Running processes need it for program code, stacks, heaps, mapped files, shared libraries, and other runtime data. The kernel also needs memory for its own data structures and caches.
But there is another important use: Linux can use otherwise idle RAM to cache filesystem data that has already been read. If that data is needed again, retrieving it from RAM is normally much faster than reading it again from storage.
Applications
Processes use physical memory for code and runtime data needed to perform their work.
Kernel
The Linux kernel requires memory for internal data structures and system management.
Page Cache
File data can remain in RAM so repeated access does not always require another storage read.
Swap
Eligible memory pages may be moved out of RAM to swap, allowing physical memory to be used elsewhere.
This leads to one of the most important Linux memory concepts:
Unused RAM is not inherently better than used RAM. If Linux can use spare memory to cache useful data and later reclaim that memory when applications need it, the RAM is serving a purpose rather than sitting idle.
📊 Reading free -h Correctly
The fastest first look at Linux memory is usually:
free -hThe -h option displays values in human-readable units. A typical layout contains columns similar to these:
total used free shared buff/cache available
Mem: ... ... ... ... ... ...
Swap: ... ... ...The exact numbers depend entirely on the machine, but the meaning of the columns is what matters.
| Field | What It Means | How to Read It |
|---|---|---|
| total | Total usable physical memory reported to the system. | Provides the scale for the other memory values. |
| used | Memory considered used or unavailable according to the tool’s calculation. | Do not interpret this value alone as application memory pressure. |
| free | RAM currently unused. | A small value can be completely normal. |
| shared | Memory used mostly by tmpfs and related shared-memory accounting. | Useful in context, but not the primary “do I have enough RAM?” number. |
| buff/cache | Memory used for kernel buffers and cache. | Some of this memory can be reclaimed when needed. |
| available | An estimate of memory available for starting new applications without swapping. | Usually the most useful first indicator of remaining memory headroom. |
The critical distinction is between free and available. Free memory is simply memory doing nothing at that moment. Available memory is an estimate that considers memory the kernel can make available, including reclaimable cache.
🔄 Why “Almost All RAM Is Used” Can Be Normal
Imagine a server with plenty of physical RAM. Applications are running, but several gigabytes remain unused. Over time, the server reads files from disk.
Linux can retain some of those file-backed pages in memory as cache:
reads file
file data
page cache
come from RAM
If applications later need more memory, reclaimable cache can be reduced to make room. That is why simply watching the free column often creates false alarms.
A machine may show little completely idle RAM while still having healthy memory headroom.
Do not calculate “RAM usage” as total minus free and conclude that everything else is permanently occupied by applications. Linux memory accounting includes cache and reclaimable kernel memory, so the result can badly misrepresent actual memory pressure.
📄 What Is the Linux Page Cache?
The page cache is a kernel-managed cache of file data in memory. When software reads files, Linux can keep recently accessed file pages in RAM.
If the same data is requested again and is still cached, the system may satisfy the read from memory instead of going back to the underlying storage device.
The key property for memory troubleshooting is that cached file data is not necessarily permanently consuming RAM. Clean cache pages can often be reclaimed when memory is required for more important allocations.
The page cache explains why a Linux system can become more useful as RAM fills. Some of the apparent “usage” represents data being kept nearby in case it is needed again.
🧱 Buffers and Cache Are Related but Not Identical
Older Linux memory discussions often focus heavily on separate buffers and cache values. Modern tools commonly combine them into a buff/cache column for a simpler high-level view.
At the kernel accounting level, /proc/meminfo still exposes fields such as:
Buffers:
Cached:
SReclaimable:
MemAvailable:Buffers account for certain kernel block-related buffers. Cached represents file data in the page cache, excluding some separately accounted memory. SReclaimable represents reclaimable kernel slab memory.
For basic server diagnosis, the important lesson is not to memorize every kernel accounting field. It is to understand that some memory currently in use is reclaimable.
💾 What Is Swap?
Swap is storage space Linux can use as part of its virtual-memory system. When appropriate, memory pages that do not need to remain in physical RAM can be moved to swap, freeing RAM for other work.
You can see the configured swap summary with:
free -hor inspect active swap areas with:
swapon --showA common beginner assumption is that any swap usage means the server needs more RAM. That conclusion is too simple.
Pages can remain in swap even after immediate pressure has passed. The fact that swap contains data tells you that pages have been placed there; it does not by itself tell you that the machine is currently struggling.
Current swap activity is often more informative.
📈 vmstat: Is the System Actively Swapping?
vmstat provides a compact view of process, memory, swap, I/O, system, and CPU activity.
A useful observation command is:
vmstat 1 5This asks vmstat to print reports at one-second intervals, for five reports.
Two columns are especially important when investigating swap behavior:
| Column | Meaning | What to Watch |
|---|---|---|
| si | Memory being swapped in from storage. | Repeated activity can indicate pages are being brought back into RAM. |
| so | Memory being swapped out to storage. | Sustained activity can be evidence of memory pressure. |
The first vmstat report normally represents statistics accumulated since boot, while subsequent interval reports are more useful for observing what is happening now.
A server with some swap already used but little or no ongoing si/so activity may be in a very different situation from a server continually moving pages between RAM and swap.
Sustained swap activity can support a memory-pressure diagnosis, but interpretation still depends on workload behavior, available memory, latency symptoms, I/O activity, and application demand. One changing column is not a complete diagnosis.
🔍 Looking Deeper with /proc/meminfo
free gets its memory information from the kernel through /proc/meminfo. You can inspect that data directly:
cat /proc/meminfoThe file contains many fields. For a beginner-friendly first pass, focus on a smaller group:
| Field | Meaning |
|---|---|
| MemTotal | Total usable physical RAM. |
| MemFree | Physical memory currently unused. |
| MemAvailable | An estimate of memory available for starting new applications without swapping. |
| Buffers | Memory used for kernel buffers. |
| Cached | File data held in the page cache, excluding SwapCached. |
| SwapTotal | Total configured swap capacity. |
| SwapFree | Swap capacity currently unused. |
You can filter those fields without changing anything on the system:
grep -E 'MemTotal|MemFree|MemAvailable|Buffers|Cached|SwapTotal|SwapFree' /proc/meminfo🚨 What Is Real Memory Pressure?
Memory pressure occurs when demand for memory makes the kernel work harder to reclaim space for new allocations.
The system may reclaim clean page cache, reclaim eligible kernel memory, and — when swap is available and appropriate — move eligible pages to swap.
From an administrator’s perspective, memory trouble becomes more convincing when several observations point in the same direction.
Low Available Memory
Available memory remains small relative to workload needs rather than simply showing a low free value.
Swap Activity
Repeated swap-in and swap-out activity suggests the kernel is moving pages between RAM and storage.
Allocation Failures
Logs show out-of-memory handling or applications fail because memory cannot be allocated.
You should also identify which processes are consuming memory. One simple starting point is:
ps aux --sort=-%mem | headThis provides a quick process-oriented view, but remember that per-process memory accounting has its own nuances. Treat it as a starting point for investigation rather than an exact explanation of every physical page in RAM.
💥 What Is the OOM Killer?
Eventually, a system can reach a point where the kernel cannot satisfy a required memory allocation through normal reclaim mechanisms. Linux includes Out Of Memory handling for these situations.
Under the normal system-wide OOM behavior, the kernel may select a process for termination in order to free memory and allow the system to continue operating. This mechanism is commonly called the OOM killer.
The victim is not chosen simply by asking “which process has the highest RAM number?” Linux uses an OOM selection heuristic, and administrators can influence OOM selection in some contexts.
For routine troubleshooting, the most important action is not to tune that selection immediately. It is to establish why the machine reached an OOM condition.
Depending on the Linux distribution and logging setup, kernel messages may be visible through commands such as:
journalctl -kYou can search the kernel log output:
journalctl -k | grep -i -E 'out of memory|oom|killed process'An OOM kill is usually the end of the incident, not the beginning of the diagnosis. Ask what consumed memory, whether demand grew unexpectedly, whether a workload has an appropriate memory limit, whether swap exists where appropriate, and what happened in the minutes leading up to the event.
🛠️ A Basic Linux Memory Troubleshooting Workflow
When a server appears to be running out of RAM, use a sequence rather than reacting to one number.
Check total, available, and swap memory
Start with free -h. Focus on overall scale, available physical memory, and whether swap exists and is already used.
free -hObserve activity instead of one snapshot
Use vmstat to see whether memory and swap behavior changes during the problem.
vmstat 1 5Find large memory consumers
Inspect processes to identify workloads that deserve closer investigation.
ps aux --sort=-%mem | headLook at kernel memory information
If the high-level view is unclear, examine relevant fields in /proc/meminfo.
grep -E 'MemTotal|MemFree|MemAvailable|Buffers|Cached|SwapTotal|SwapFree' /proc/meminfoCheck for OOM evidence
If applications disappeared, restarted unexpectedly, or logged allocation failures, check kernel logs for out-of-memory events.
journalctl -k | grep -i -E 'out of memory|oom|killed process'Correlate the evidence
Decide whether the issue is genuine memory exhaustion, expected cache use, one growing process, unusual workload demand, sustained swapping, or another performance problem that only looks like a RAM problem.
🧪 Mini Lab: Read Your Server’s Memory Correctly
Goal: distinguish unused memory from memory that Linux can make available, then check whether the system is actively swapping.
Step 1 — View the high-level memory summary.
free -hWhat to observe: compare the free, buff/cache, and available columns.
If free is small but available is substantially larger, some memory currently in use can be made available to applications.
Step 2 — Inspect the underlying kernel fields.
grep -E 'MemTotal|MemFree|MemAvailable|Buffers|Cached|SwapTotal|SwapFree' /proc/meminfoWhat to observe: compare MemFree with MemAvailable. They answer different questions.
Step 3 — Observe swap activity for a few seconds.
vmstat 1 5What to observe: find the si and so columns in the interval reports.
How to interpret it: swap space being used is historical evidence that pages have been placed in swap. Ongoing swap-in or swap-out activity tells you more about what the server is doing during your observation window.
⚠️ Common Linux Memory Mistakes
Linux intentionally uses available RAM for useful caching. Check available memory and actual memory-pressure indicators before reaching that conclusion.
Filesystem cache can improve performance by keeping useful data in RAM. Reclaimable cache is fundamentally different from memory that cannot readily be reused.
Swap may contain older pages even when the system is currently stable. Look at present swap activity, available memory, workload behavior, and symptoms together.
Linux RAM also contains kernel memory, page cache, buffers, shared memory, and other allocations. The high-level used value does not describe one single category.
Seeing cache consume RAM is not itself a fault. Forcing caches out merely to make the free number larger can discard useful cached data and does not fix the underlying cause of real memory pressure.
✅ Knowledge Check
- Why can a Linux server have very little free RAM and still be healthy?
- What is the practical difference between free and available memory?
- What useful job does the page cache perform?
- Why does non-zero swap usage not automatically prove that a server is currently under memory pressure?
- What do the si and so columns in vmstat help you observe?
- What does an OOM event tell you about the state of memory allocation on the system?
🎓 Check Your Answers
- Linux can use otherwise idle RAM for caches and other useful kernel purposes. Much of that memory may be reclaimable, so low completely unused memory does not necessarily mean applications have exhausted physical RAM.
- free represents memory that is currently unused, while available estimates how much memory can be used by new applications without swapping, including memory that the kernel expects it can reclaim.
- The page cache keeps file data in RAM after it has been accessed. If the data is requested again while still cached, Linux may avoid another read from the underlying storage device.
- Swap usage shows that some pages have been placed in swap, but those pages can remain there after the original pressure has disappeared. Current swap activity and available memory provide more useful evidence about what is happening now.
- si shows memory being swapped in from storage, while so shows memory being swapped out. Repeated activity can help reveal ongoing memory pressure and page movement between RAM and swap.
- An OOM event means the system or a constrained memory domain reached a point where a required allocation could not be satisfied through normal memory-management mechanisms. The event should trigger investigation into workload demand, memory consumers, limits, and the conditions leading up to it.
Do not judge Linux memory health by the free number alone. Linux uses RAM aggressively because cached data and reclaimable memory can make the system more efficient.
For basic diagnosis, think in this order: available memory → current swap activity → process memory use → kernel memory data → OOM evidence. Memory pressure is a pattern of evidence, not one frightening percentage.
