Meaning of the buffers/cache line in the output of free

Question

Why does my server show

            total      used      free   shared buffers    cached
    Mem: 12286456  11715372    571084        0   81912   6545228
-/+ buffers/cache:  5088232   7198224
   Swap: 24571408     54528  24516880

I have no idea on calculating the memory in linux. I think it says that 5088232 is used where as 7198224 is free, meaning it is actually consuming 5GB of RAM?

Solution 1

Meaning of the values

The first line means:

• total: Your total (physical) RAM (excluding a small bit that the kernel permanently reserves for itself at startup); that's why it shows ca. 11.7 GiB , and not 12 GiB, which you probably have.

• used: memory in use by the OS.

• free: memory not in use.

• shared / buffers / cached: This shows memory usage for specific purposes, these values are included in the value for used.

The second line gives first line values adjusted. It gives the original value for used minus the sum buffers+cached and the original value for free plus the sum buffers+cached, hence its title. These new values are often more meaningful than those of first line.

The last line (Swap:) gives information about swap space usage (i.e. memory contents that have been temporarily moved to disk).

Background

To actually understand what the numbers mean, you need a bit of background about the virtual memory (VM) subsystem in Linux. Just a short version: Linux (like most modern OS) will always try to use free RAM for caching stuff, so Mem: free will almost always be very low. Therefore the line -/+ buffers/cache: is shown, because it shows how much memory is free when ignoring caches; caches will be freed automatically if memory gets scarce, so they do not really matter.

A Linux system is really low on memory if the free value in -/+ buffers/cache: line gets low.

For more details about the meaning of the numbers, see e.g. the questions:

• In Linux, what is the difference between "buffers" and "cache" reported by the free command?
• Why does Red Hat Linux report less free memory on the system than is actually available?

Changes in procps 3.3.10

Note that the output of free was changed in procps 3.3.10 (released in 2014). The columns reported are now "total", "used", "free", "shared", "buff/cache", "available", and the meanings of some of the values changed, mainly to better account for the Linux kernel's slab cache.

See Debian Bug report #565518 for the motivation, and What do the changes in free output from 14.04 to 16.04 mean? for more details information.

Solution 2

The currently accepted answer from 2009 is out-of-date. It is important to make sure that the information you are getting is correct and matches the version of free (distributed in the Debian package procps or equivalent in your distribution). It is also helpful to look at the output of man free, and also man 5 proc, which contains information about /proc/meminfo, the file where free gets its data from on Linux.

By default, free's output is in kibibytes (1 kibibyte = 1024 bytes), as you can see in the manual page. I prefer to use the -h argument, which shows suffixes, like this:

$ free -h
              total        used        free      shared  buff/cache   available
Mem:           15Gi       6.1Gi       1.9Gi       301Mi       7.5Gi       8.8Gi
Swap:         979Mi          0B       979Mi

The first line Mem means:

• total (Mem): total installed memory (that is MemTotal from /proc/meminfo), this all the memory in RAM
• used (Mem): used memory, equal to total - free - buffers - cache
• free (Mem): unused memory (that is MemFree), this all the memory that is unused for anything (even caches) in RAM
• shared (Mem): this is the amount of memory used mainly for tmpfs (Shmem)
• buff/cache (Mem), sum of buffers and cache:
  • buffers: memory used by kernel buffers (Buffers), which is memory that the kernel can take advantage of
  • cache: memory used by the page cache and slabs (Cached and SReclaimable). The page cache contains the contents of files in the filesystem cached to RAM, and it is generally a good thing for this to be a high number. I presume "slabs" are a similar caching feature.
• available (Mem): this is an estimate of how much memory is available for starting new applications, without swapping. It includes most of memory counted in the cache field (since the page cache can be dropped to start new applications), but it does not count swap (since it is generally preferable not to use slow swap space).

The second line is Swap. This is my explanation:

• total (Swap): this is the total amount of disk space reserved for swap (SwapTotal in proc/meminfo). You can check by checking that this matches with the output of swapon -s.
• used (Swap): the amount of swap disk space that is currently being used. Again, you can check this by comparing it with the output of swapon -s
• free (Swap): the amount of swap disk space that is currently not being used (SwapFree in /proc/meminfo). It is equal to total (Swap) - used (Swap)

Solution 3

The buffers/cache line shows you how much memory is used by programs (first of those columns), and is free for programs to use (second column). It's a fairly esoteric number, and not something you'd really look at much in practice.

Comments

[Kyle Brandt]

serverfault.com/questions/23433/…

[aaaser]

For anyone needing an even more simple, step-by-step explanation, check thoughtsbyclayg.blogspot.com/2008/09/…, his explanation helped me a lot.

[Sasha]

linuxatemyram.com

[Rick O'Shea]

This is flat out incorrect. The buff/cache is definitely NOT part of used. I'm just looking at a box with 1G used and 12G buff/cache. unix.stackexchange.com/questions/521488/…

[Muahmmad Zeeshan]

And what does the first line (mem line) means

[womble]

That you've got 12GB of RAM installed in the system, 11.5GB of which is used and 0.5GB or so is currently unused. Approximately 82MB of the used memory is used for buffers (network connections, etc), whilst about 6.5GB is being used to store copies of data on disk, so that data won't have to be re-read if it's needed again.

[Muahmmad Zeeshan]

Let me just summarize what i understood. server have 12GB of ram installed. off which first line shows 11.5GB is used. 82MB is free. Second line shows 4.8GB is used by programs. and 6.86GB is being used to copy disk data (second row second column). Now it all means that the system has reached its limits and we have to install more memory?

[pauska]

No, you do not need to install more memory, unless you are experiencing very high i/o disk throughput. Having files in cache instead of being accessed from disk is a good thing.

[sleske]

@Muhammad: "82MB is free." - no, 57MiB is free (but that doesn't really matter, see my answer). "Now it all means that the system has reached its limits" - No, not at all. The system has 6.9GiB in use for caching, which it will readily give to applications, so there's lots of room. Also, swap usage is very low (ony ca. 50MiB). If memory starts getting tight, swap usage will rise. At present you're barely using half the RAM you have.

[Muahmmad Zeeshan]

In this case if our processes/programs increases the value in 2nd row ist column will increase as more processes will consume more memory and the value in 2nd row 2nd column will decrease because the memory for new processes will be allocated from here and our disk I/O will also increase.

[womble]

Not necessarily. Past a certain point the cache hit rate doesn't increase from adding more memory. Linux will use whatever memory is available for disk cache, it doesn't just use what it really needs. If you're worried about your disk IO rates, you should monitor those directly, not try to infer something from loosely related information.

[Muahmmad Zeeshan]

how can i monitor I/O

[womble]

sar -d 1 0 {pad}

[Muahmmad Zeeshan]

how can i explicitly allocate resources to a particular side. e.g. Network

[womble]

Have you considered asking a new question at some point?

[Aaron Hudon]

I disagree, the buffers/cache line is the actual free memory of the system and therefore most relevant if you want to know if the system has room for programs.

[CMCDragonkai]

Could you expand on what kinds of things Linux may be caching? Would it be files that have been accessed or network stuff?

[sleske]

@CMCDragonkai: The answer to serverfault.com/questions/23433/… addresses in detail what constitues "cache" and "buffer".

[SCBuergel]

I do not think the statement "total = used + free" is correct, see the following output on my machine: $ free -h total used free shared buff/cache available Mem: 3.4G 585M 152M 11M 2.6G 2.5G Swap: 4.0G 84M 3.9G

[sleske]

@Sebastian: Ah, interesting. It seems the ouput of free was changed (in 3.3.10). I edited my answer to mention this. If you are interested in this change, consider asking a new question :-).

[Melroy van den Berg]

The 'free' is indeed not literally free, it is perfectly fine to have 'free' close to zero. Since the "Free" RAM is used for disk cache under Linux. And no, it will not decrease your RAM available size, since if more RAM is needed on your system, the disk cache will be automatically decreased if needed.

[Melroy van den Berg]

total = used + free + buff/cache

[Tobitor]

Thanks for that answer! One question from my side: If I would like to look if a server will run out of memor, should I then use the number of free Mem or should I also consider the number regarding buffer+cache?

[Don Foumare]

@Flimm At least in Ubuntu 18 and 20 total is just MemTotal (without SwapTotal). Why would total from the first line (Mem) include SwapTotal even though it's beeing explicitly listed in the line below (Swap)?

[Flimm]

@DonFoumare By "Ubuntu 18", do you mean Ubuntu 18.04 or Ubuntu 18.10? Likewise, by "Ubuntu 20", do you mean Ubuntu 20.04 or Ubuntu 20.10? Any way, I think you're right, after looking at map free and man 5 proc. I've edited my answer.

[Flimm]

@DonFoumare This is why I love contributing to ServerFault! Any misunderstandings I have get corrected for free! :)

[Don Foumare]

@Flimm I meant Ubuntu 18.04 and 20.04