Dissecting the free command: What the Linux sysadmin needs to know

free is a popular command used by system administrators on Unix/Linux platforms. It's a powerful tool that gives insight into the memory usage in human-readable format.

The man page for this command states that free displays the total amount of free and used memory on the system, including physical and swap space, as well as the buffers and caches used by the kernel. The information is gathered by parsing /proc/meminfo.

Like any other command, free has gone through revisions over time to make its output meaningful and accurate for decision making. In Red Hat Enterprise Linux (RHEL) 6, the output is somewhat different from that of RHEL 7 and 8. However, in all these versions, there are key parameters that do not change.

On RHEL 6, typing free -h (I used the -h option for human-readable format) shows output similar to the following:

[root@srv ~]# free -h
             total       used       free     shared    buffers     cached
Mem:           94G        44G        49G       161M       993M       1.3G
-/+ buffers/cache:        42G        52G
Swap:          15G         0B        15G

(figure 1)

RHEL 7/8 displays information similar to the below:

[root@server1 ~]# free -h
               total        used        free      shared  buff/cache   available
Mem:            15G        751M        1.2G        272M         13G         14G
Swap:            0B          0B          0B

(figure 2)

RHEL 8 will have an output similar as below:

[root@tiger ~]# free -h
              total        used        free      shared  buff/cache   available
Mem:          819Mi       164Mi       146Mi        25Mi       509Mi       491Mi
Swap:            0B          0B          0B
(Figure 3)

To make the output above more readable, the command provides various options:
free -b, -k, -m, -g: Display the amount of memory in bytes, kilobytes, megabytes, gigabytes respectively. You can also use free -h to show output in human-readable output. Please run free --help for more information on the options.

The various columns, displayed by the various releases above, seek to identify the Total, used, free, shared memory. It also seeks to display the memory held in cache and buffers as well.

However, as with most commands, the relevant columns to check which may be of interest to the system administrator when doing housekeeping or troubleshooting an issue are explained below.

Red Hat Enterprise Linux 6

In the case of RHEL 6, the focus should be on the -/+ buffers/cache column.

In figure 1 above, the total is 94 GB, used is 44 GB, and free is 49 GB. This system is quite busy, but the used RAM seems high. This shouldn't cause much concern, but the admin needs to look at the -/+ buffers/cache column. The -/+ buffers/cache displays used memory as 42 GB and free memory as 52 GB. This means that the actual quantity of used RAM is 42 GB and not 44 GB. The value 44 GB includes the cache as well. A mere look at the used value without considering the cache affects your interpretation of the system's performance.

The buffers and cached columns are explained below:

• buffers: memory used by kernel buffers
• cached: memory space occupied by "Page Cache."

Cache pages are nothing but the data/files which get copied over to RAM when the kernel performs read/write operations on a disk. The reason for keeping these page cached is for I/O performance. So, the kernel maintains these files in RAM and frees them up whenever not required or whenever a memory space is requested by a new process/command provided when there is no free space available in RAM.

Red Hat Enterprise Linux 7/8

On RHEL 7/8, the focus should be on the available column. In RHEL 7/8, the -/+ buffers/cache was taken off and replaced with the available column. The buffer and cache were combined into buff/cache and have the same meaning as explained above. The available column estimates how much memory is available for starting new applications without swapping.

In figure 2 above, the total installed RAM is 15 GB, used is 751 MB, and free is 1.2 GB. Using the same reasoning as we did with RHEL 6, a mere look at the used value could lead to the wrong conclusion. The used column should be understood with the cache column in mind as well. There is a lot of caching with the available value of 14 GB, which is very high, almost equal to the total RAM.

When should the system administrator start to worry?

A healthy system with more than enough memory will, after running for a while, show the following expected and harmless behavior:

• free memory is close to 0 or significantly small
• used memory is close to total
• available memory (or free -/+ buffers/cache) is bigger relative to the total memory
• swap used value does not change

However, the system administrator needs to worry when there are signs that constitute a genuine low memory situation. Below are some of those signs:

• available memory (or free -/+ buffers/cache) is close to zero or is significantly small
• swap used values start to increase or fluctuate as there are no free memory pages for the system to use and so it must resort to using the swap disk
• There are OutOfMemory-killer messages in the logs when checked with grep -i kill /var/log/messages* or dmesg | grep oom-killer

Wrapping up

The free command is a very useful utility that can tell the system administrator a great deal about what's happening on the server. Learning to recognize the differences between the versions of free can help with a more accurate interpretation of the output.

[ Want to try out Red Hat Enterprise Linux? Download it now for free. ]