How to Check RAM Usage in Linux
See how much memory is really available, and which process is eating it.
Almost every "Linux ate my RAM" panic is a misread column. The kernel treats unused memory as wasted memory and fills it with cached file data, released the instant a program needs it. The number that reflects real headroom is "available", and once you read that one instead, most alarms disappear.
Step by step
1 The overall picture
$ free -htotal is the physical RAM, used is what processes hold, buff/cache is the kernel caching files, and available is what could be given to a new program right now. Judge pressure by available.
2 Find the biggest consumers
$ ps aux --sort=-%mem | head -n 10The ten hungriest processes. RSS is resident memory — actual RAM in use. VSZ counts virtual mappings and overstates reality, so ignore it for this purpose.
3 Watch it live
$ htopSort by memory with F6 and watch a suspected leak grow over minutes. top works too if htop is not installed: press M to sort by memory.
4 Check swap activity
$ vmstat 1 5The si and so columns are swap in and out. Occasional values are fine; sustained non-zero traffic while available is low means genuine memory pressure, and everything will feel slow.
5 Confirm an out-of-memory kill
$ journalctl -k | grep -i "out of memory"When the kernel runs out, it kills the largest process. If something disappeared without explanation, the evidence is here.
Tips worth knowing
- Memorise the rule: alert on "available", never on "free". Monitoring built on "free" produces constant false alarms.
- Swap used is history; swap traffic is pain. A few hundred MB parked in swap from last week is harmless.
- A process whose RSS climbs steadily and never drops is the signature of a leak. Take readings at intervals — that curve turns a hunch into a bug report.
- In containers, free shows the host, not the container limit. Read /sys/fs/cgroup/memory.max instead.
Frequently asked questions
Why is almost none of my RAM free?
The kernel is using it as disk cache, which makes everything faster and is reclaimed instantly when needed. This is correct behaviour, not a problem.
What is the difference between free and available?
free is memory doing absolutely nothing. available is the kernel's estimate of what could be handed to applications, including reclaimable cache. The second is the useful number.
My process was killed with no error — why?
Probably the OOM killer. Check journalctl -k for "Out of memory" and the name of the process it chose.
Should I add swap?
Some swap is worth having as a safety margin, but swap is not a substitute for RAM. If you are swapping continuously, you need more memory or a lighter workload.
The commands behind it
RAM and swap at a glance — and how to read "available" correctly.
psSee what is running, find a process ID, and combine with grep to hunt down a program.
top & htopThe live dashboard: CPU, memory, load average and the processes consuming them.
journalctlQuery the system journal: by service, time window, priority — and follow live.
Concepts involved: Process
More how-to guides
See how much space is left, and find out what is using it.
Extract a .tar.gz archiveUnpack tar.gz, tar.bz2, tar.xz and zip archives from the command line.
Free a port that is already in useFind which process holds a port and stop it cleanly.
Find and replace text in filesReplace text in one file or across a whole project, safely.