Knowing What's Actually Happening
Understanding memory management conceptually is only half the battle. In production, you need to read the system's actual state quickly and accurately.
free -h — The Quick Overview
The most important column is available under Mem: — not free. Available memory includes currently-used page cache that the kernel can reclaim instantly if an application needs it.
/proc/meminfo — The Full Picture
Key fields to know:
| Field | Meaning |
|---|---|
MemAvailable |
Memory available for new allocations without swapping |
Cached |
Page cache (disk file cache) — reclaimable |
Buffers |
Kernel buffer cache for block devices — reclaimable |
Slab |
Kernel data structure cache (dentries, inodes) |
Committed_AS |
Total virtual memory promised to all processes |
AnonPages |
Anonymous memory (heap/stack) — must go to swap if evicted |
vmstat 1 — Real-Time Activity
Watch the si (swap-in) and so (swap-out) columns. Any sustained non-zero values indicate active swapping. The free column shows available RAM frames.
procs -----------memory---------- ---swap-- -----io---- -system-- ------cpu-----
r b swpd free buff cache si so bi bo in cs us sy id wa st
1 0 131072 1126400 512000 9175040 0 0 0 0 450 1200 5 2 93 0 0
0 0 131072 1124352 512000 9175040 2 0 16 0 380 980 3 1 96 0 0
Here, si=2 means 2KB/s is being swapped back in — minor activity. so=0 means nothing is being swapped out. This system is healthy.
smem — Per-Process Memory Accounting
Standard tools like ps report VSZ (virtual size) and RSS (resident set size). RSS overcounts shared memory — if 10 processes share a 10MB library, each reports 10MB RSS, but only 10MB of physical RAM is used.
smem reports PSS (Proportional Set Size) — each process's share of shared memory is divided proportionally, giving a much more accurate picture of actual RAM consumption per process than RSS alone.
A common SRE interview question: "How do you find which process is consuming the most memory on a Linux server?" The naive answer is ps aux --sort=-%mem. The better answer distinguishes between RSS and PSS: RSS overcounts shared libraries, so smem -r -k sorted by PSS gives a more accurate picture. For kernel memory consumers, also check slabtop to see if kernel slab caches are the culprit — this is often missed.