Why a server shows only 372 MB "free" and whether to worry. free -h, available, cache and swap explained on live output.

You run free -h on a 2 GB server and see only 372 MB free. It looks like time to upgrade the plan. Most of the time the server is fine: Linux deliberately uses spare memory as a cache. Let us go through the command on live output and show which column to watch and which one you can ignore.

In short. Look at the available column, not free: it shows how much memory can really be given to programs. buff/cache is the disk cache, and the kernel releases it as soon as memory is needed. The warning signs are available staying near zero for long and permanently non-zero si and so in vmstat (swap is busy). Use ps sorted by memory to find the culprit.

What free -h shows

The free command prints a summary of RAM and swap. The -h option prints sizes in readable units (MB, GB) instead of bytes. This is the answer from our server:

Column by column. total is all memory. used is taken by programs. free is not used by anything at all. shared is memory that processes share (a trifle here). buff/cache is the file cache and buffers. available is the kernel's estimate of how much can go to new programs without pushing anything into swap. The Swap row is the swap file or partition on disk.

Where the "free" memory went

Out of 1.9 GB only 609 MB is used by programs, while 1.2 GB sits in buff/cache. That is not a loss: the kernel keeps recently read files there so it does not read them from disk twice. If a program needs memory, the cache shrinks at once. That is why a healthy server nearly always has little "free" memory and a noticeably larger available. The same numbers are in a system file:

Sizes here are in kilobytes. MemAvailable is roughly MemFree plus the part of the cache that can be given back. The exact formula is more complicated, because the kernel keeps a small reserve for itself, so do not recompute it by hand: take the ready value.

When memory really runs short

There are three signs. First, available stays below 10% of total. Second, the Swap row shows a lot used and the number grows. Third, the most reliable: the system actively shuffles data between memory and disk. You can see it in vmstat, which prints statistics once a second, three times:

The columns we care about are si (data read from swap into memory) and so (data moved from memory to swap). Both are zero, so the server is not swapping. If both show hundreds and do not calm down while the processor waits for the disk (the wa column grows), memory is truly short. The 780 KB of swap in use means nothing: the kernel may have pushed out a few long-unused pages.

How to find what ate the memory

Let us list the five heaviest processes. -e takes all processes, -o sets the columns, --sort=-rss puts the biggest first and head keeps the top of the list:

The RSS column is the process memory in kilobytes, %MEM is its share of all memory. The biggest consumer on our server holds 190 MB, about a tenth. If one process of yours holds half the memory and grows hour by hour, that is a leak: look for it in the application, not in the plan.

A quick check in one line

To avoid reading the table by eye, you can print a single number: the share of available memory. free -m prints sizes in megabytes, and awk takes the second row (Mem) and divides the seventh column (available) by the second (total):

This was measured a few minutes after the first commands, so the figures differ slightly from the table above. If the number stays below 10%, it is a reason to look at memory. The line is handy in a monitoring script or in a cron check.

Should you clear the cache by hand

The internet suggests echo 3 > /proc/sys/vm/drop_caches to "free memory". Better not. The cache is not wasted: it speeds up reading, and the kernel already gives it back instantly when memory is needed. After a manual drop the server only becomes slower for a while, because files have to be read from disk again. Memory can only be truly freed by stopping a needless program or enlarging the plan.

FAQ

What does available mean in free?

It is the kernel's estimate of how much memory can go to new programs without touching swap. It counts the part of the cache the system is ready to give back. This is the number that tells you whether you have enough memory.

Why is almost all memory used?

Because Linux uses spare memory as a file cache. That is normal and useful. It is worrying when available is small, not free.

How much swap use is normal?

A small number such as our 780 KB out of 1 GB means nothing. It is worrying when swap is mostly full and si and so in vmstat are constantly non-zero.

How do I tell whether the server or one program is short of memory?

If available is small across the whole system and many processes each hold a bit, you need a bigger plan. If one process ate almost everything and keeps growing, look for the bug in it.

Summary

  • Read free -h by the available column, not free.
  • buff/cache is the disk cache, and the kernel gives it back when memory is needed.
  • Swap is working if si and so in vmstat 1 3 stay above zero.
  • Find the culprit with ps -eo pid,comm,%mem,rss --sort=-rss | head -6.
  • Do not drop the cache by hand: it slows the server and does not cure a shortage.

🎁 40% off the first month of a new VPS. Promo code GUIDE40
Want to look at the memory of a live server? First month at a discount.
Enter GUIDE40 at checkout. One use per customer.
Pick a VPS and claim the discount →