How to Check Memory Usage From the Linux Terminal

A terminal window on an Ubuntu-style Linux system.Fatmawati Achmad Zaenuri / Shutterstock

There are many ways to get information about memory usage in your Linux system. In this overview, we will cover the most commonly used command line methods: free, vmstat and top. We will also directly examine the reading of / proc / meminfo.

How Linux Uses RAM

RAM is a finite resource of which all processes, like applications and daemons, want a piece. There are only many available. The kernel arbitrates memory disputes and allocates rationed memory to all hungry processes. It’s a bit like a mother bird with more open beaks pointed at it than it has a larva.

Unused RAM is wasted RAM. Linux uses any spare RAM for things like file buffer space, to keep your computer running at peak performance. It is easy to print that your system’s RAM has been consumed by an uncontrolled process or memory leak, but this is rarely the case.

It’s usually just the core that does its job tenaciously in the background. If there are other requests for RAM that the kernel has poached for its own devices, it gives up memory instantly, so there is no harm.

If the kernel decides that it is more efficient to start using swap space, it also puts it into play. There is a lot of confusion about the value of swappiness in Linux and when the kernel starts using swap. It is false that the swappiness value sets a threshold for the use of RAM which triggers the activation of the swap.

But now let’s look at the different techniques you can use in the terminal window to see the use of RAM on your Linux computer.

Free order

the free order gives you a table of the total, used, free, shared, buffer / cache and RAM available on your computer. It also shows you the total amount of swap space configured and the amount used and available.

In our example, we will use the -m (megabytes) option. However, you can also use -b (bytes), -k (kibio bytes) or -g (gibio bytes).

We type the following command:

free -m

Here is the output we get:

total available shared buff / cache available
Mem: 1987901 95 80990811
Exchange: 1521 651 869

The Mem columns contain the following information:

Total: The total amount of physical RAM on this computer.
Used: The sum of Free + Buffers + Cache subtracted from the total amount.
Free: The amount of unused memory.
sharing: Amount of memory used by tmpfs file systems.
Buff / cache: Amount of memory used for buffers and cache. This can be published quickly by the kernel if necessary.
Available: This is an estimate of the memory available to process memory requests from applications and any other software running on your computer.

The Swap columns contain the following information:

Total: The size of the partition or swap file.
Used: Amount of swap space used.
Free: The amount of swap space remaining (unused).

You can also use the following clever trick that we modified from one of our readers to see the percentage of swap space used:

free -m | grep Swap | awk ‘{print ($ 3 / $ 2) * 100}’

RELATED: How to use the free command under Linux

The vmstat command

It is impossible to have a good understanding of how RAM is used in your Linux box without appreciating the state of your swap space. The RAM and the exchange space operate in close collaboration.

You can use the vmstat command to learn more about how your swap space (or virtual memory) is used. It gives you a report on a variety of swap statistics based on average values ​​since the last restart.

Type the following:


Here is the output without looping:

procs ———– memory ———- — swap– —– io —- -system– —— cpu —–
r b swpd free buff cache si so bi bo in cs us sy id wa st
3 0 671 488 576 084 51088 823 876 1 7 53 62 99 14 4 1 95 0 0

There are a lot of data points in this report, so let’s break them down:

r: The number of “executable” processes. They are running or waiting for their next burst of time-slice CPU cycles.
b: The number of processes in uninterrupted sleep. They do not sleep, but make a blocking system call. They cannot be interrupted until they have completed their current action. Typically, this process is a device driver waiting for a resource to be free. All queued interrupts for this process are handled when the process resumes normal activity.

swpd: The amount of virtual memory used, i.e. the amount of memory that has been exchanged.
free: The amount of inactive (unused) memory.
chamois: The amount of memory used as buffers.
hidden: The amount of memory used as a cache.

To exchange:
if: The amount of virtual memory swapped from swap space.
therefore: The amount of virtual memory swapped to exchange space.

bi: Block. Number of data blocks used to replace virtual memory with RAM.
bo: Block. Number of data blocks used to exchange virtual memory out of RAM and in the exchange space.

in: The number of interrupts per second, including the clock.
cs: The number of context changes per second. A change of context occurs when the kernel goes from system to user mode processing.

CPU: These values ​​are all percentages of the total CPU time:
we: Time spent executing user code (not kernel).
sy: Time spent executing kernel code.
id: Time spent inactive.
Washington: Time spent waiting for entry or exit.
st: The time that a virtual machine must wait for the hypervisor to finish the maintenance of other virtual machines before being able to return and take care of this virtual machine.

RELATED: How to use the vmstat command on Linux

The best order

The upper control displays a screen full of information. The values ​​are updated every few seconds.

To use it, we type the following:


The “e” key has been pressed. This changed the display to megabytes, which are easier to parse visually than long strings representing bytes. There are five lines of information at the top of the screen and a lower pane with columns of data.

Here is the information you will find on each line:

Line one: The time, the computer operating time, the number of people connected and the average load during the last 1, 5 and 15 minutes.
Line two: The number of tasks and their states: run, stop, sleep or zombie.
Line three: CPU information (see distribution of fields below).
Line four: The total amount of physical memory and the amount available, used, buffered, or cached.
Line five: Total amount of swap memory and amount available, used and available (taking into account the memory that should be recoverable from caches).

The CPU fields on line three are:

we: Time spent by the processor executing processes for users in user space.
sy: Time the processor spends executing the system’s kernel space processes.
or: Time spent by the processor executing processes with a manually defined value value.
id: CPU idle time.
Washington: Time the processor spends waiting for I / O to complete.
Hi: Time spent by the CPU maintaining hardware interrupts.
if: Interruption time of processor maintenance software.
st (flight time): Time lost by the CPU due to running virtual machines.

You may need to press the left or right arrow keys to see all of the columns. The values ​​for each column are described below:

PID: Process ID.
USER: Name of the owner of the process.
PR: Priority process.
OR: The great value of the process.
VIRT: Virtual memory used by the process.
RES: Resident memory used by the process.
SHR: Shared memory used by the process.
S: Process status. (See the list of values ​​that this field can take below).
% CPU: Part of the processor time used by the process since the last update.
% SAME: The share of physical memory used.
TIME +: Total CPU time used by the task in hundredths of a second.
ORDER: The name or the command line (name + options). (This column is off screen on the right in the image above.)

The status displayed in column S can be one of the following:

RE: Uninterrupted sleep.
A: Operation.
S: Sleeping.
T: Plot (stopped).
Z: Zombie.

Press Q to exit the top.

Reading / proc / meminfo

Many (and probably most) Linux-based tools that provide memory statistics retrieve their information from the pseudo file system / proc / meminfo. We can use the cat or less commands to do the same.

We type the following:

less / proc / meminfo

You can see different fields depending on the running kernel and the processor architecture. We got the following results on our virtual machine:

MemTotal: 2035260 kB
MemFree: 919064 kB
MemAvailable: 1300932 kB
Buffers: 33 528 kB
Cached: 457,604 kB
SwapCached: 29,732 kB
Active: 313,360 kB
Inactive: 603276 kB
Assets (anon): 74648 kB
Inactive (anon): 355004 kB
Assets (file): 238,712 kB
Inactive (file): 248 272 kB
Inevitable: 16 kB
Mlocked: 16 kB
SwapTotal: 1,557,568 kB
SwapFree: 873024 kB
Dirty: 80 KB
Writeback: 0 KB
AnonPages: 414,100 KB
Mapped: 97,436 kB
Shmem: 4148 kb
Recoverable: 52,932 kB
Slab: 94,216 kB
Recoverable: 52,932 kB
Recovery: 41,284 kB
KernelStack: 9280 kB
PageTables: 45264 kB
NFS_Unstable: 0 KB
Rebound: 0 KB
WritebackTmp: 0 kB
CommitLimit: 2,575,196 KB
Committed_AS: 5072192 kB
VmallocTotal: 34359738367 kB
VmallocUsed: 35712 kB
VmallocChunk: 0 kB
Percentage: 720 kb
HardwareCorrupted: 0 kB
AnonHugePages: 0 KB
ShmemHugePages: 0 KB
ShmemPmdMapped: 0 KB
CmaTotal: 0 KB
CmaFree: 0 KB
HugePages_Total: 0
HugePages_Free: 0
HugePages_Rsvd: 0
HugePages_Surp: 0
Huge size: 2048 kb
Hugetlb: 0 KB
DirectMap4k: 180 160 KB
DirectMap2M: 1,916,928 KB

All sizes are in kibibytes Unless otherwise stated. Here’s what they all mean, as well as others you might see depending on your computer’s configuration and hardware:

MemTotal: Total usable RAM (with the exception of a few reserved bits and the binary code of the kernel).
MemFree: The sum of LowFree + HighFree. The amount of RAM currently available.
MemAvailable: Estimate of the memory available to start new applications, without exchange.
Buffers: Temporary storage for raw disk blocks. This reduces the entry and exit of the hard drive. It also speeds up access to subsequent requests for the same data because they are already in memory.
Hidden: Cached pages read files from the hard drive (except SwapCached).
SwapCached: Memory that has been swapped and returned, and a copy remains in the swap space.
Active: Recently used memory. It is only recovered if it is absolutely necessary.
Inactive: Memory used, but not the most recently used. He is a likely candidate for reclamation.
Active (anon): Memory allocated to files created in a tmpfs pseudo-file system. Anonymous files do not reside on the hard drive.
Inactive (anon): Amount of anonymous memory, tmpfs and shmem that can be expelled (memory recovery).
Active (file): Amount of file cache used or used since the previous memory recovery cycle.
Inactive (file): Amount of file cache read from a hard drive candidate for recovery.
Inevitable: Amount of memory that should be avoidable, but not because it is locked in memory by user space processes.
Mlocked: Total amount of memory that cannot be avoided because it is locked by user space processes.
HighTotal: Total amount of HighMem, which is used by user space programs and page cache. The kernel can access this memory area, but it is slower to access it than LowMem.
HighFree: Free HighMem amount.
LowTotal: Quantity of LowMem, which is available for all the same uses as HighMem, but also for the kernel to use for its own purposes.
LowFree: Free LowMem amount.
MmapCopy: Amount of memory mapped to file data.
SwapTotal: Total amount of swap space available.
SwapFree: Amount of swap space currently unused.
Dirty: Amount of memory waiting to write to disk.
Write back: The memory is actively rewritten on the disk.
AnonPages: Pages not saved to file mapped to user space page tables.
Mapped: Files (such as libraries) that are mapped into memory.
Shmem: Amount of memory consumed in tmpfs pseudo-file systems.
Recoverable: Kernel memory allocations that the kernel will attempt to recover if the memory request is severe enough.
Slab: Cache data structures in the kernel.
SReclamable: Amount of Slab memory that can be recovered, such as caches.
SUnreclaim: Amount of slab memory that cannot be recovered.
KernelStack: Amount of memory allocated to kernel stacks.
PageTables: Amount of memory dedicated to the lowest level of page tables.
Quick lists: Since allocating and deleting page tables is a very common operation, it is essential that it be as fast as possible. Thus, the pages used for page tables are cached in a number of different lists called “quick lists”.
NFS_Unstable: Network file system (NFS) pages received by the server, but not yet written to non-volatile storage.
Bounce: Memory used for block device bounce buffers. A rebound buffer is positioned in memory low enough for a device to access it directly. The data is then copied to the desired user page in HighMem.
WritebackTmp: Memory used by File system in user space (FUSE) for temporary rewrite buffers.
CommitLimit: Total amount of memory currently available to allocate in the system.
Committed_AS: The amount of memory estimated to meet all current demands. If a program requests RAM, the request is saved, but the RAM is not allocated until the program starts using it. It is also allocated only as needed, up to the maximum amount reserved by the program. More memory can be “allocated” than what can actually be provided. If all of the programs try to cash their RAM tokens at the same time, the memory casino could go bankrupt (and have to go hand in hand with the financial backers of the swap space).
VmallocTotal: Total size of vmalloc memory area.
VmallocUsed: Amount of vmalloc zone used. Since Linux 4.4, this field is no longer calculated, it is hard coded.
VmallocChunk: The largest contiguous block of free vmalloc zone.
HardwareCorrupted: Amount of memory marked as having physical memory corruption issues. It will not be assigned.
LazyFree: Amount of memory in the MADV_FREE state. When an application sets the MADV_FREE flag on a range of pages, this indicates that he no longer needs it, and they are now candidates for recovery. Actual recovery may be delayed until there is sufficient memory demand. If the application starts writing on pages, recovery can be canceled.
AnonHugePages: Huge pages not saved in files mapped to user space page tables. Unsaved pages are not from a hard disk file.
ShmemHugePages: Amount of memory used by shared memory (shmem) and pseudo-file systems (tmpfs) allocated with huge pages.
ShmemPmdMapped: Amount of shared memory mapped in user space with huge pages.
CmaTotal: Number of CMA pages (Contiguous memory allocation). They are used by devices that can only communicate with contiguous memory regions.
CmaFree: Number of free CMA (Contiguous Memory Allocation) pages.
HugePages_Total: Huge size of the page pool.
HugePages_Free: Number of huge unallocated pages in the pool.
HugePages_Rsvd: Number of large pages reserved. The commitment to allocate has been made, but no allocation has yet been made.
HugePages_Surp: Number of huge pages in the pool above the defined system value.
Huge size: Huge page size.
DirectMap4k: Number of bytes of RAM mapped to 4K pages.
DirectMap4M: Number of bytes of RAM mapped to 4MB pages.
DirectMap2M: Number of bytes of RAM mapped to 2MB pages.
DirectMap1G: Number of bytes of RAM mapped to 2 GB pages.

As usual with Linux, there are several ways to get a quick overview and always at least one way to get into the details.

You will likely use free, top, and vmstate regularly, and keep / proc / meminfo in reserve when you need to do a deep scan to investigate a particular problem.

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.