Are Buffer and Cache Memory Leaks? Understanding Linux Memory Management

Overview

Core concepts

Buffer : block‑device buffers that accelerate disk I/O.

Cache : page cache that stores file contents.

Available : memory that can be allocated without swapping (free memory plus reclaimable cache).

Detailed steps

2.1 Interpreting free

$ free -h
              total        used        free      shared  buff/cache   available
Mem:          15Gi        8.2Gi       512Mi       256Mi        6.8Gi        6.5Gi
Swap:         2.0Gi          0B        2.0Gi

Key observations: free shows only 512 Mi free – this does not indicate an out‑of‑memory condition. available shows 6.5 Gi, the amount that can be allocated safely. buff/cache of 6.8 Gi can be reclaimed when needed.

2.2 Memory fields in /proc/meminfo

# cat /proc/meminfo

MemTotal : total physical RAM.

MemFree : completely unused RAM.

MemAvailable : memory available for new allocations without swapping.

Buffers : block‑device buffers.

Cached : page cache.

SwapCached : cached swap pages.

Slab : kernel data‑structure cache.

2.3 OOM Killer mechanism

When the system truly runs out of memory, the kernel invokes the OOM Killer to terminate processes.

# View OOM logs
 dmesg | grep -i "out of memory"
 journalctl -k | grep -i oom

# Check a process's OOM score (higher = more likely to be killed)
 cat /proc/<code><PID></code>/oom_score

Example commands and configurations

3.1 Manually dropping caches

# Drop PageCache
 sync; echo 1 > /proc/sys/vm/drop_caches

# Drop dentries and inodes
 sync; echo 2 > /proc/sys/vm/drop_caches

# Drop all caches
 sync; echo 3 > /proc/sys/vm/drop_caches

Note: Use with extreme caution in production; it can degrade I/O performance.

3.2 cgroup memory limits (container scenario)

# Show container memory limit
 cat /sys/fs/cgroup/memory/memory.limit_in_bytes

# Show current memory usage of the container
 cat /sys/fs/cgroup/memory/memory.usage_in_bytes

Best practices and caveats

4.1 Monitoring metric selection

Correct: monitor MemAvailable or the available column from free.

Incorrect: rely solely on MemFree or the free column.

4.2 Important caveats

Buffer and cache usage is normal; they are not memory leaks and improve I/O performance.

Limited swap usage is expected and not inherently harmful.

Protect critical processes from OOM killing, e.g.:

echo -1000 > /proc/<code><PID></code>/oom_score_adj

Troubleshooting and alerting

5.1 Memory‑leak investigation

# List processes by memory usage
 ps aux --sort=-%mem | head -20

# Inspect a process's memory map
 pmap -x <code><PID></code>

# Continuously monitor memory changes
 watch -n 1 'free -h'

5.2 Monitoring alerts (Prometheus example)

groups:
- name: memory-alerts
  rules:
  - alert: LowMemoryAvailable
    expr: node_memory_MemAvailable_bytes / node_memory_MemTotal_bytes < 0.1
    for: 5m
    labels:
      severity: critical
    annotations:
      summary: "Available memory below 10%"

Summary of technical points

Use the available column to assess memory sufficiency; the free column can be misleading.

Buffers and cache are beneficial and increase system I/O throughput.

The OOM Killer is the last line of defense; reducing a process's OOM score can protect it.

References

Linux Kernel Documentation – Memory

Brendan Gregg – Linux Performance