Understanding Linux Memory Usage: Decoding buffers/cache in free Command Output


3 views


When working with Linux servers, the free -m command output often causes confusion. Let's break down the example:

            total      used      free   shared buffers    cached
Mem: 12286456  11715372    571084        0   81912   6545228
-/+ buffers/cache:  5088232   7198224
Swap: 24571408     54528  24516880

Linux memory management uses three different calculation methods:

1. Raw memory stats (first line):
- Total: 12286456 KB (12GB)
- Used: 11715372 KB
- Free: 571084 KB
- Buffers: 81912 KB
- Cached: 6545228 KB

2. Adjusted memory stats (-/+ buffers/cache line):
- Used: 5088232 KB (5GB)
- Free: 7198224 KB

3. Swap space:
- Total: 24571408 KB (24GB)
- Used: 54528 KB
- Free: 24516880 KB

The key misunderstanding comes from how Linux uses memory for buffers and cache. The operating system will:

1. Use available memory for disk caching (cached)
2. Use memory for temporary storage of filesystem metadata (buffers)
3. Release these when applications need more memory

Therefore, the second line showing 5GB used represents what's actually consumed by applications, while the first line counts memory used for performance optimization.

Here's a bash script to monitor real memory usage:

#!/bin/bash
while true; do
    free -m | awk 'NR==2{printf "Real used: %sMB\n", $3}'
    sleep 5
done

You should investigate memory usage when:
- The second line's "used" approaches your total RAM
- Swap usage becomes significant
- The "buffers/cache" free memory drops below 10% of total

For deeper analysis, check /proc/meminfo:

cat /proc/meminfo | grep -E 'MemTotal|MemFree|Buffers|Cached'

This gives more granular information about memory allocation.

To clear caches (for testing purposes only):

sync; echo 3 > /proc/sys/vm/drop_caches

Note: This is not recommended for production systems as it will temporarily reduce performance.


When you run free -m on a Linux server, you'll typically see output like this:

             total       used       free     shared    buffers     cached
Mem:         11998      11440        558          0         79      6391
-/+ buffers/cache:       4969       7029
Swap:        23995         53      23942

Linux reports memory usage from three different perspectives:

1. Raw memory statistics (first line)
2. Memory accounting after buffers/cache adjustment (second line)
3. Swap space information

The key columns to understand are:

  • buffers: Memory used by kernel buffers (temporary storage for raw disk blocks)
  • cached: Memory used for page cache (cached files read from disk)

Here's a Python script to parse free output:

import subprocess

def parse_free():
    output = subprocess.check_output(['free', '-m']).decode('utf-8')
    lines = output.split('\n')
    mem_line = lines[1].split()
    buffers_cache_line = lines[2].split()
    
    return {
        'total': int(mem_line[1]),
        'used': int(mem_line[2]),
        'free': int(mem_line[3]),
        'shared': int(mem_line[4]),
        'buffers': int(mem_line[5]),
        'cached': int(mem_line[6]),
        'used_after_cache': int(buffers_cache_line[2]),
        'free_after_cache': int(buffers_cache_line[3])
    }

print(parse_free())

The "-/+ buffers/cache" line shows what memory would look like if buffers and cache were reclaimed. This represents the actual memory pressure on your system.

To monitor memory usage properly, you should:

watch -n 1 'free -m | grep -A1 "Mem:"'

Use this Bash snippet to alert when memory gets critical:

#!/bin/bash

THRESHOLD=90  # Percentage threshold

while true; do
    mem_info=$(free | grep Mem)
    total=$(echo $mem_info | awk '{print $2}')
    used=$(echo $mem_info | awk '{print $3}')
    percent_used=$((100*$used/$total))
    
    if [ $percent_used -gt $THRESHOLD ]; then
        echo "Memory usage exceeded threshold: ${percent_used}%"
        # Add your alert action here
    fi
    
    sleep 60
done

To clear caches (for testing purposes only):

echo 3 > /proc/sys/vm/drop_caches

Remember: Linux aggressively uses available memory for caching to improve performance. "Free" memory is often wasted memory in Linux.