Discover Hidden Memory Consumers on Linux Using hcache – A Practical Guide

What is hcache?

hcache is an enhanced version of the pcstat tool, designed for Linux to deeply analyze the distribution of memory caches (buff/cache). It adds global cache ranking, per‑process cache analysis, and multi‑format output, allowing users to quickly locate files or processes that consume the most cache.

Official repository

https://github.com/silenceshell/hcache

Applicable scenarios

Server memory alerts, OOM investigations, performance tuning, etc.

Core features

1. Global cache ranking

Use the --top option to sort all files by cache usage. Example shows top 5 files: $ hcache --top 5 The output includes columns:

Name : file path (use --bname for short name).

Size : file size in bytes.

Pages : number of memory pages used.

Cached : actual cached pages.

Percent : percentage of total pages.

2. Per‑process cache analysis

Specify a PID with -pid to view cache usage of a specific process. $ hcache --pid 1234 --bname This lists all cached files for the process, showing short names for easy identification.

3. Flexible output formats

hcache supports several formats to suit automation and logging:

Table format (default) – suitable for terminal viewing.

JSON/CSV – easy integration with monitoring systems.

Histogram ( --histo) – graphical representation of cache distribution.

Quick start: Installation and usage

Installation

hcache is a single‑file binary; download and make it executable:

$ wget https://silenceshell-1255345740.cos.ap-shanghai.myqcloud.com/hcache
$ chmod +x hcache
$ mv hcache /usr/local/bin/

Alternative download:

$ wget https://blog.tag.gg/soft/hcache

Common commands

Show top 10 cache consumers: hcache --top 10 Show top 5 with short names: hcache --top 5 --bname Export top 3 results as JSON:

hcache --top 3 --json > cache_report.json

Real‑world case: Solving a memory alert

Scenario: a server repeatedly triggers OOM, with free showing >70% of buff/cache used.

Identify cache heavy files: $ hcache --top 10 --bname Result shows /var/log/journal/ consuming 70% of cache.

Find the responsible process: $ lsof /var/log/journal/system.journal Reveals systemd-journald writing frequently.

Mitigation steps:

Adjust log rotation to limit file size.

Periodically clean old logs or manually drop caches with echo 3 > /proc/sys/vm/drop_caches (use with caution).

Technical principle and advantages

Underlying mechanism

hcache parses memory‑mapping data from the /proc filesystem and combines page‑cache statistics to generate reports. It relies on the Linux kernel’s Page Cache mechanism, which speeds up I/O by caching frequently accessed file data.

Comparison with other tools

free : only shows total cache, cannot locate specific files.

pcstat : limited functionality, lacks sorting and per‑process analysis.

hcache : builds on pcstat, adding global sorting, multi‑format output, and process‑level insights.

Conclusion

hcache’s simplicity and practicality make it a “Swiss‑army knife” for Linux memory analysis, helping both routine monitoring and detailed troubleshooting, and should be added to any sysadmin’s toolkit.

Note: Manipulating caches can affect system stability; avoid deleting critical files or repeatedly dropping caches in production. Test changes in a non‑production environment before applying them live.