When examining memory usage with free -m, the "cached" value represents how much memory the kernel is using for disk caching. This isn't wasted memory - Linux automatically uses available RAM to cache frequently accessed files for better performance.

While Linux doesn't provide a direct command to list cached files, we can use several approaches to examine this information:

1. Using vmtouch

vmtouch is a portable tool specifically designed for working with the filesystem cache:

# Install vmtouch on Debian/Ubuntu
sudo apt-get install vmtouch

# Check if a file is cached
vmtouch -v /path/to/file

# Check cached files in a directory
vmtouch -v /var/log/

2. Using fincore

fincore (from the linux-ftools package) shows cached pages for files:

# Build from source
git clone https://github.com/david415/linux-ftools
cd linux-ftools
./autogen.sh
./configure
make

# Check cached pages
./fincore /var/log/syslog

3. Using /proc/meminfo and /proc/PID/maps

For advanced users, you can correlate information from:

cat /proc/meminfo
cat /proc/$(pgrep your_process)/maps

Here's a script to find the top 10 cached files:

#!/bin/bash
for file in $(find / -type f -size +1M 2>/dev/null); do
    if [ $(vmtouch -f $file | grep 'resident pages' | awk '{print $5}') -gt 0 ]; then
        echo "$(du -h $file) is cached"
    fi
done | sort -rh | head -10

While clearing cache (echo 3 > /proc/sys/vm/drop_caches) can be useful for testing, it's generally not recommended in production as it forces the system to rebuild its cache, causing temporary performance degradation.

For detailed analysis, SystemTap can trace cache events:

# SystemTap script to monitor cache additions
probe kernel.function("add_to_page_cache_lru") {
    printf("%s: %s\n", execname(), filename)
}

When examining your free -m output showing 5.9GB in cache, we're dealing with Linux's page cache mechanism - a critical performance optimization that keeps frequently accessed files in memory. Unlike explicit caches (like browser cache), this is managed automatically by the kernel.

While Linux doesn't provide a direct "ls" for cached files, we have several powerful alternatives:

1. Using vmtouch for File-based Cache Analysis

# Install vmtouch on Debian/Ubuntu
sudo apt install vmtouch

# Check cache status for a directory
vmtouch /var/www/html/

2. Kernel Exposed Cache Information

The kernel exposes cache information through several interfaces:

# Show cached file pages (requires root)
sudo grep -i cached /proc/meminfo

# Find cached file mappings (advanced)
sudo awk '$6 ~ /^file/ {print $1}' /proc/*/maps | sort | uniq -c | sort -nr

For programmatic access to cache information:

Python Script to Analyze Page Cache

import os

def get_cached_files():
    with open('/proc/meminfo') as f:
        for line in f:
            if 'Cached:' in line:
                cached_kb = int(line.split()[1])
    
    # Requires root privileges
    cached_files = set()
    for pid in os.listdir('/proc'):
        if pid.isdigit():
            try:
                with open(f'/proc/{pid}/maps') as f:
                    for line in f:
                        if ' file ' in line:
                            path = line.split()[-1]
                            if os.path.exists(path):
                                cached_files.add(path)
            except:
                continue
    
    return cached_kb, sorted(cached_files)

For most debugging scenarios:

1. Use vmtouch for quick file-level checks
2. Monitor /proc/meminfo for cache size tracking
3. For deep analysis, consider kernel tools like perf or bpftrace

This knowledge becomes crucial when:

• Tuning database performance
• Optimizing web servers
• Debugging memory pressure issues
• Benchmarking storage vs memory performance