Linux Memory Usage Explained: free, Available RAM, Cache, and Swap

A Linux server can report very little free memory and still be perfectly healthy.

That sounds contradictory, especially if you are used to treating unused RAM as a sign of safety. Linux deliberately uses otherwise idle memory to cache files and speed up the system. When an application needs that memory, much of the cache can be reclaimed.

The result is one of the most common sources of confusion in Linux administration: the used and free columns do not tell the whole story.

Check Linux Memory with free -h

free -h

The -h option displays values in human-readable units such as MiB and GiB.

               total        used        free      shared  buff/cache   available
Mem:            7.7Gi       2.4Gi       620Mi       180Mi       4.7Gi       4.8Gi
Swap:           2.0Gi       128Mi       1.9Gi

At first glance, this server appears to have only 620 MiB free. But the more useful number is 4.8 GiB available. Linux is using several gigabytes for cache, and much of it can be reused when applications request more memory.

What the free Output Means

Column	Meaning	How to read it
total	Usable physical RAM visible to Linux	May be slightly lower than the advertised server memory
used	Memory currently in use after accounting for reclaimable cache	Useful, but not a complete pressure indicator by itself
free	Completely unused RAM	Often small on a healthy, long-running server
shared	Memory used mainly by temporary filesystems such as tmpfs	Investigate if unexpectedly large
buff/cache	Kernel buffers and filesystem cache	Much of it can be reclaimed for applications
available	Estimate of memory that can be given to new applications without swapping	Usually the best first number to check

Why Linux Uses Free RAM for Cache

Reading data from RAM is much faster than reading it again from storage. Linux therefore keeps recently accessed files and filesystem data in memory when possible.

This cache can improve:

• application startup time;
• website response time;
• database and file access;
• package operations;
• repeated reads of the same data.

Unused memory does no useful work. Cache lets Linux turn spare RAM into performance while still making it reclaimable when applications need more space.

Free RAM vs Available RAM

These two values answer different questions:

• free: how much RAM is doing absolutely nothing right now?
• available: how much memory could applications probably use without forcing the system to swap?

For a quick health check, available is normally more meaningful.

Example:

Mem:  7.7Gi total, 620Mi free, 4.8Gi available

This is not a low-memory emergency. The server can likely provide several more gigabytes to applications.

Compare it with:

Mem:  7.7Gi total, 110Mi free, 140Mi available

Now the server has very little reclaimable headroom. If this condition persists, you should identify which processes are consuming memory and whether swap activity is increasing.

What Is Swap?

Swap is disk space that Linux can use to hold memory pages that do not currently need to remain in physical RAM.

Swap can provide breathing room during a short memory spike, but it is much slower than RAM. Heavy or continuous swapping can make a server feel unresponsive because data must repeatedly move between memory and storage.

swapon --show

This lists active swap devices or swap files:

NAME      TYPE SIZE USED PRIO
/swapfile file   2G 128M   -2

You can also see the total in free -h.

Is any swap usage bad?

No. Linux may keep rarely used pages in swap even after memory pressure has passed. A small, stable amount of used swap does not automatically mean the server is in trouble.

More concerning signs include:

• swap use grows continuously;
• available memory remains very low;
• the server becomes slow during disk activity;
• applications stall or time out;
• the kernel kills processes because memory is exhausted.

Watch Memory and Swap Activity with vmstat

vmstat 1

This prints a new line every second. Two especially useful columns are:

Column	Meaning
si	Data being read from swap into RAM
so	Data being written from RAM to swap

Occasional activity may be normal. Sustained non-zero values, combined with low available memory and poor performance, suggest active memory pressure.

Press Ctrl+C to stop the command.

Find Processes Using the Most Memory

For a quick static list:

ps aux --sort=-%mem | head

Or sort by resident memory in KiB:

ps -eo pid,user,comm,%mem,rss --sort=-rss | head

The RSS value is the resident set size: the process memory currently present in physical RAM. It is generally more useful than VSZ when you want a quick view of real memory residency.

For a live display, run:

top

Inside top, press Shift+M to sort processes by memory usage. Press q to exit.

Why process memory does not always add up neatly

Processes can share libraries and memory mappings. The kernel also uses memory for caches, networking, filesystem metadata, and other work. Adding every process percentage may therefore produce a misleading total.

Use process figures to find strong candidates for investigation, not as a perfect accounting system.

Check for Out Of Memory Events

When Linux cannot satisfy critical memory requests, the kernel may invoke the OOM killer and terminate one or more processes.

journalctl -k -g 'oom|out of memory|killed process' --case-sensitive=no

On systems where that filtering option is unavailable, use:

dmesg -T | grep -i -E 'oom|out of memory|killed process'

Typical symptoms include a database, PHP worker, container, or application disappearing without a normal shutdown.

Understand /proc/meminfo

cat /proc/meminfo

This file exposes detailed kernel memory counters. You may see fields such as:

• MemTotal and MemAvailable;
• Buffers and Cached;
• SwapTotal and SwapFree;
• Slab and SReclaimable;
• Dirty and Writeback.

You rarely need every field during a first check, but /proc/meminfo is the source behind many higher-level tools and is useful for deeper investigation.

Memory Problems in Docker and Containers

A host can have free RAM while an individual container reaches its configured limit. The reverse is also possible: containers may look normal individually while their combined usage pressures the host.

docker stats

Check both levels:

1. the container limit and current usage;
2. the Linux host’s available RAM and swap;
3. kernel or container runtime logs for OOM events.

A Practical Memory Troubleshooting Sequence

free -h
swapon --show
vmstat 1
ps -eo pid,user,comm,%mem,rss --sort=-rss | head
journalctl -k -g 'oom|out of memory|killed process' --case-sensitive=no

This sequence answers five useful questions:

1. How much RAM is actually available?
2. Is swap configured and how much is used?
3. Is the system actively swapping?
4. Which processes currently occupy the most RAM?
5. Has the kernel already killed a process?

Common Memory Mistakes

Looking only at the free column

Low free RAM is expected because Linux uses spare memory as cache. Start with available memory instead.

Assuming used swap always means a current emergency

Old, inactive pages can remain in swap. Look for continuing swap activity and application impact.

Killing the largest process immediately

The largest process may be a database using memory exactly as configured. Confirm whether usage is expected and collect logs before terminating production services.

Adding RAM without finding the cause

More RAM helps a genuinely undersized server, but it only delays a memory leak or uncontrolled worker growth.

Linux Memory Command Cheat Sheet

Command	Purpose
free -h	Overview of RAM and swap
swapon --show	List active swap areas
vmstat 1	Watch memory, swap, I/O, and CPU activity
top	Inspect live system and process usage
ps aux --sort=-%mem | head	List high-memory processes
cat /proc/meminfo	Display detailed kernel memory counters
journalctl -k	Inspect kernel messages for OOM events

FAQ

How much available memory should a Linux server have?

There is no universal safe number. A small server and a large database host need different headroom. Watch the trend under normal and peak load. Persistently tiny available memory combined with swapping, latency, or OOM events is more meaningful than a single percentage.

Should I disable swap?

Usually not as a generic optimization. Swap can absorb short spikes and move inactive pages out of RAM. The correct choice depends on the workload, latency requirements, and application design.

Why is total memory lower than the RAM in my VPS plan?

Some memory can be reserved for the kernel, firmware, virtual hardware, or other platform needs. A small difference is normal.

Will adding swap fix insufficient RAM?

Swap can reduce the chance of an immediate OOM event, but it is not a performance replacement for physical RAM. A server that constantly swaps needs workload tuning, stricter limits, more RAM, or some combination of the three.

Final Thoughts

Linux memory usage becomes much easier to understand once you stop treating completely unused RAM as the main health metric.

Start with free -h, focus on available, check whether swap is actively moving data, identify the largest consumers, and search kernel logs for OOM events. Together, those signals tell you far more than the free column alone.