Understanding Linux Memory: free Command, Buffers, Cache, and Swap

Viewing Linux Memory with the free Command

The free command displays several fields:

total : total memory size.

used : memory currently in use (including cached, buffers, and shared portions).

free : amount of idle memory.

shared : memory shared between processes (generally negligible).

buffers : data that has been written and cached in memory for quick response before being flushed to disk.

cached : data read from disk and stored in memory to speed up subsequent accesses.

-/+ buffers/cache Interpretation

-buffers/cache

: memory actively used (note this is not the same as the used column because buffers and cached memory can be reclaimed). Calculated as used - buffers - cached. +buffers/cache: memory available for use (also not the same as the free column). Calculated as free + buffers + cached.

Swap : amount of swap space used on disk.

The purpose of these calculations is that when the +buffers/cache value is exhausted, new read/write requests trigger the kernel to write some memory data to disk, using the disk space as virtual memory.

Buffer and Cache Overview

Cache is designed to accelerate CPU‑memory data exchange, while Buffer aims to improve data transfer between memory and storage devices. Cache primarily serves read operations. Modern CPUs contain multiple levels of cache (L1, L2, L3) to store frequently accessed instructions and data, reducing latency. In addition, the operating system uses a portion of RAM as a page cache (the cached field) to store recently read file data. Buffer mainly supports write operations, aggregating writes to reduce disk fragmentation and seek overhead, thereby improving performance. A kernel daemon periodically flushes buffers to disk, and the sync command can trigger this manually.

Common Symptoms

Symptom 1

: Frequent file access causes physical memory to fill quickly while the cached value keeps growing. Explanation: Linux caches read data to speed up subsequent accesses because CPU processing is much faster than memory access. Symptom 2: Swap space becomes occupied. Explanation: Swap usage indicates that physical memory is insufficient; monitoring swap can reveal memory pressure.

Manually Clearing Swap and Buffers/Cache

Clear Swap

swapoff -a && swapon -a

Explanation: If swap is in use and there is still free space after accounting for +buffers/cache, executing swapoff -a moves swap contents back into memory without data loss.

Clear Buffers/Cache

sync; sync; sync && echo 3 >/proc/sys/vm/drop_caches

sleep 2

echo 0 >/proc/sys/vm/drop_caches

Explanation: sync writes cached data to disk. echo 3 >/proc/sys/vm/drop_caches sets the drop_caches parameter to 3, instructing the kernel to free page cache, dentries, and inodes. sleep 2 pauses briefly to ensure the previous step completes. echo 0 >/proc/sys/vm/drop_caches restores the default value.

Summary

When free physical memory is low, it does not necessarily mean the system is in a bad state because the cache and buffer portions can be reclaimed on demand, effectively acting as additional free memory.

Frequent swap usage, or non‑zero values for buffers and cache over extended periods, indicates genuine memory pressure. By focusing on the -/+ buffers/cache values from free, you can accurately assess whether the system has sufficient memory.