Monitoring Memory Usage in Linux Systems
Unlike Windows, which offers various "one-click optimization" utilities to free up memory, Linux provides powerful command-line tools for analyzing memory consumption. This article explores three essential commands for checking memory usage: free, top, and vmstat.
The free Command
The free command displays information about physical and swap memory. The -m flag outputs values in megabytes:
$ free
total used free shared buffers cached
Mem: 1008504 547364 461140 12836 53984 254508
-/+ buffers/cache: 238872 769632
Swap: 1046524 0 1046524
$ free -m
total used free shared buffers cached
Mem: 984 534 450 12 52 248
-/+ buffers/cache: 233 751
Swap: 1021 0 1021
Understanding these columns requires knowing how Linux manages memory:
| Column | Meaning |
|---|---|
| total | Total physical memory available |
| used | Memory currently allocated (includes buffers and cache) |
| free | Memory not in use |
| shared | Shared memory (rarely used in modern systems) |
| buffers | Memory reserved for disk write operations |
| cached | Memory holding file data read from disk |
The second row (-/+ buffers/cache) is particularly important as it shows actual memory usage. The "used" value here represents memory actively consumed by applications, while "free" indicates truly available memory.
Understanding Buffers vs. Cache
Both buffers and cache serve as memory caches, but they differ in purpose:
- buffers: Stores data pending writes to disk. A buffer is "something that has yet to be written" to disk.
- cache: Holds recently read data for faster access. A cache is "something that has been read" from disk and stored for later use.
From a systems perspective, page cache caches file data while buffer cache caches raw disk blocks. When working with files, data goes to page cache; when using tools like dd directly on block devices, data uses buffer cache.
Understanding Swap
Swap (virtual memory) acts as overflow storage when physical memory is exhausted. When RAM runs low, Linux moves "anonymous memory" (heap and stack allocasions from malloc or new that have no disk backing) to swap space. This allows the system to continue running even when physical memory is fully utilized.
The top Command
The top command provides a real-time view of system processes, similar to Windows Task Manager:
$ uptime
10:05:01 up 34 min, 1 user, load average: 0.00, 0.11, 0.16
The first line displays system uptime and load averages. The second line shows process states:
| Field | Description |
|---|---|
| total | Total number of processes |
| running | Processes currently executing (R state) |
| sleeping | Processes waiting for events (S state) |
| stopped | Processes halted (T state) |
| zombie | Terminated processes not yet reaped (Z state) |
The CPU usage breakdown shows:
| Field | Description |
|---|---|
| us | User space CPU usage percentage |
| sy | Kernel space CPU usage percentage |
| ni | User processes with altered priority |
| id | Idle CPU percentage |
| wa | CPU time waiting for I/O |
| hi | Hardware interrupt CPU time |
| si | Software interrupt CPU time |
| st | Steal time (virtual machines only) |
The process table columns include:
| Column | Description |
|---|---|
| PID | Process ID |
| USER | Process owner |
| PR | Priority |
| NI | Nice value (negative = higher priority) |
| VIRT | Total virtual memory used |
| RES | Resident (non-swappped) physical memory |
| SHR | Shared memory |
| S | Process state |
| %CPU | CPU usage since last update |
| %MEM | Physical memory percentage |
| TIME+ | Total CPU time consumed |
| COMMAND | Command name |
Press f within top to customize displayed columns.
The vmstat Command
vmstat (virtual memory statistics) provides compact system performance data:
$ vmstat
procs -----------memory---------- ---swap-- -----io---- -system-- ------cpu-----
r b swpd free buff cache si so bi bo in cs us sy id wa st
0 0 76 187932 154112 372228 0 0 143 32 36 90 1 1 94 3 0
Column descriptions:
| Field | Description |
|---|---|
| r | Processes in run queue (waiting for CPU) |
| b | Processes in uninterruptible sleep (blocked) |
| swpd | Virtual memory used (KB) |
| free | Idle memory (KB) |
| buff | Buffer memory (KB) |
| cache | Cache memory (KB) |
| si | Swap in (KB/s) - pages swapped from disk |
| so | Swap out (KB/s) - pages swapped to disk |
| bi | Blocks received from disk (blocks/s) |
| bo | Blocks sent to disk (blocks/s) |
| in | Interrupts per second |
| cs | Context switches per second |
| us | User mode CPU percentage |
| sy | Kernel mode CPU percentage |
| id | Idle CPU percentage |
| wa | CPU idle with pending I/O |
| st | Stolen CPU time (virtual environments) |
These three commands provide comprehansive visibility into Linux memory management. Use free for quick memory summaries, top for process-level detail with real-time updates, and vmstat for system-wide performance metrics including I/O and CPU statistics.