Understanding the free Command in Linux

Understanding the free Command in Linux

Checking memory is one of those things you end up doing constantly on a Linux box, usually because something is slow and you want to know whether RAM is the reason. free is the quickest way to get that answer. It’s on every distribution, it needs no arguments to be useful, and it takes about ten seconds to learn.

The catch is that people misread the output. Specifically the used column, which almost always looks alarming and almost never is. So below is what free actually reports, which column matters, and why the scary number is usually fine.

What is the free command?

free reads /proc/meminfo and formats it. That’s the whole tool. What it gives you:

• Total memory available
• Used and free memory
• Buffers and cache memory usage
• Swap space statistics

A snapshot, in other words. It tells you where memory stands right now, not how it got there.

Basic Syntax

free [options]

Run it with nothing at all:

free

You’ll get an output similar to this:

               total        used        free      shared  buff/cache   available
Mem:          972160      120344      631688         448      220128      711300
Swap:        2097148           0     2097148

Worth going through column by column, because two of them mislead.

Understanding the Output Columns
 

1. total

All the physical RAM the kernel can see, or the size of your swap. This one is straightforward.

2. used

Memory currently held by running processes and the kernel. This is the number people panic about.

3. free

Memory that’s doing absolutely nothing. On a healthy server that has been up a while this number is small, and that’s correct. Idle RAM is wasted RAM, so the kernel puts it to work.

4. shared

Memory shared between processes, mostly tmpfs. Usually small, occasionally not if something is writing to /dev/shm.

5. buff/cache

Buffers and page cache. The kernel keeps recently read files here so it doesn’t have to hit the disk twice for the same data. Looks like consumed memory, isn’t really: the moment an application asks for it, the kernel drops the cache and hands the memory over. No swapping, no delay worth noticing.

6. available

This is the column to read. It estimates how much memory a new process could get without pushing anything to swap, and it already accounts for the reclaimable part of buff/cache. If available is healthy, you’re fine, whatever used says.

Example with Human-Readable Format
 

Raw kilobytes are hard to eyeball. The -h flag fixes that:

free -h

Output example:

              total        used        free      shared  buff/cache   available
Mem:            15Gi        4.4Gi       2.9Gi       521Mi       8.2Gi        10Gi
Swap:          2.0Gi           0B       2.0Gi

Much easier to scan. This is the form most people use day to day.

Other Useful Options
 

1. Display in Megabytes or Gigabytes

If you want a fixed unit rather than whatever -h decides for you, ask for one directly:

free -m   # Display in MB
free -g   # Display in GB

Useful in scripts, where a unit that changes depending on the numbers is a nuisance to parse.

2. Show Memory Every 2 Seconds

The -s option makes free loop instead of printing once and exiting:

free -h -s 2

Good for watching what a build or a database import actually does to memory while it runs. Ctrl+C stops it.

3. Display the Total at the End

# free -mt
               total        used        free      shared  buff/cache   available
Mem:             949         117         616           0         215         694
Swap:              0           0           0
Total:           949         117         616

-t adds a line combining RAM and swap. Minor, but occasionally exactly what you want.

Understanding Buffers and Cache

This is the part that trips people up. You look at a server, see something like this, and assume the machine is about to fall over:

used: 14GB
free: 1GB

It almost certainly isn’t. Linux filled that memory with cached file data because there was nothing better to do with it, and it hands the memory straight back the moment an application asks. Cache isn’t a commitment.

So ignore used and look at available. If available is comfortable, the system has room, no matter how alarming used looks.

Combine with Other Commands

free gives you the summary. When the summary suggests something is wrong, these tell you what:

• top or htop, to find which process is holding the memory
• vmstat, to see whether the machine is actually swapping
• cat /proc/meminfo, for the full detail free is condensing

vmstat is the one to reach for if you suspect real memory pressure. Sustained activity in its si and so columns means the system is genuinely swapping, and that’s a real problem in a way that a high used figure isn’t.

Summary

Final Thoughts

free is a small tool and there’s not much to it, but reading it correctly saves a lot of wasted time. Most of the memory emergencies people report turn out to be the page cache quietly doing its job.

Short version: check available rather than used, and check vmstat before you believe you have a memory problem at all.

If what you actually want is to drop the cache rather than understand it, clearing the memory cache in Linux covers the three levels and when each is worth using.