FREE - Documentation
Memory Accounting Model
Key components
- total: total installed RAM
- used: memory actively used by processes or the kernel
- free: completely unused memory pages
- shared: memory used by tmpfs and shared memory
- buff/cache: memory used by kernel buffers and page cache
- available: estimated memory available for new applications without swapping
Available Memory Heuristic : Output Modes and Formats
The available field is calculated by the kernel to reflect reclaimable memory, including page cache and slabs. This value is more meaningful than free for capacity planning.
Human Readable Output
free -h
Automatically scales values using powers of 1024.
Byte-Level Precision
free -b
Used for scripting and exact measurements.
SI Units
free -H
Uses powers of 1000 instead of 1024.
Time-Based Monitoring
Continuous Sampling
free -s 2
Refreshes output every two seconds.
Limited Iterations
free -s 1 -c 5
Useful for observing memory pressure spikes.
Swap Memory Analysis
Swap Utilization
free -h --swap
Displays swap usage alongside RAM.
Key indicators:
- High swap usage with low CPU usage may indicate memory leaks
- Active swap with free RAM often indicates kernel tuning issues
Swap-Free Systems
On systems without swap, free reports zero swap usage but still computes available memory correctly.
Kernel Buffers and Cache
Page Cache Behavior
Linux aggressively uses free memory for caching filesystem data.
free -h
High buff/cache values are normal and desirable.
Droppable Memory
Cached memory can be reclaimed instantly under pressure without performance penalties.
NUMA Awareness
Node-Level Reporting
On NUMA systems, free reflects aggregated memory only.
For node-specific analysis, free must be correlated with:
numactl --hardware
Control Groups and Containers
cgroup Memory Limits
Inside containers, free reports memory visible to the cgroup, not the host.
free -h
This reflects:
- memory.max
- memory.current
- memory.swap.max
Misinterpretation may occur if host memory is assumed.
Security Concepts
Information Disclosure
free exposes memory size, swap presence, and pressure indicators.
Mitigations:
- Restrict shell access
- Avoid exposing metrics to untrusted users
- Mask memory info in containers when necessary
Side-Channel Considerations
Memory pressure patterns may leak workload characteristics in shared environments.
Used in combination with:
- cache timing attacks
- allocation pressure observation
Performance and Capacity Planning
Memory Saturation Detection
Indicators of saturation:
- available approaching zero
- rising swap usage
- increased page faults
free -s 1
Overcommit Awareness
free does not reflect vm.overcommit settings directly and must be correlated with:
- /proc/meminfo
- vmstat
Common Misinterpretations
Low Free Memory
Low free memory does not indicate a problem.
Correct interpretation relies on available memory.
Cache vs Used
buff/cache is not wasted memory and should not be forcibly cleared in production systems.
Troubleshooting
System Feels Slow but Free Memory Exists
Possible causes:
- Swap thrashing
- I/O wait
- CPU contention
Check:
free -h
Then correlate with:
- vmstat
- iostat
OOM Killer Triggered Unexpectedly
Possible reasons:
- cgroup memory limits
- overcommit misconfiguration
- memory fragmentation
Validate available memory and swap:
free -h
Memory Usage Differs from top or ps
Reason:
- free shows system-wide accounting
- top/ps show process RSS/VSZ
This discrepancy is expected.
Useful Links
- https://man7.org/linux/man-pages/man1/free.1.html
- https://man7.org/linux/man-pages/man5/proc_meminfo.5.html
- https://www.kernel.org/doc/html/latest/admin-guide/mm/index.html
- https://www.kernel.org/doc/html/latest/admin-guide/cgroup-v2.html
