Unraveling Linux Memory Usage: From free to slab and PageTables

Earlier a reader asked why ps aux shows an RSS of less than 30 MB while free reports about 7.8 GB used and swapping, suspecting that ps misses some memory. The article walks through the Linux memory accounting process to answer this.

Understanding free -m output

$ free -m
             total       used       free     shared    buffers     cached
Mem:         48262       7913      40349          0         14        267
-/+ buffers/cache:       7631      40631
Swap:         2047        336       1711

The total memory is 48 GB, of which 7.9 GB appears used. However, 14 MB in buffers and 267 MB in cache are reclaimable, so the real used memory is about 7.6 GB.

Clearing reclaimable memory

$ sudo sysctl vm.drop_caches=3
vm.drop_caches = 3
$ free -m
             total       used       free     shared    buffers     cached
Mem:         48262       7676      40586          0          3         41
-/+ buffers/cache:       7631      40631
Swap:         2047        336       1711

After dropping caches, the used memory drops to 7.7 GB, confirming that most of the previously reported usage was reclaimable.

What does the RES column in top mean?

The RES value comes from the second field of /proc/[pid]/statm, which represents the resident set size (RSS) – the number of physical pages actually used by a process.

/proc/[pid]/statm provides memory usage in pages. Columns include size, resident, share, text, lib, data, dt.

Summing RSS across all processes

$ cat RSS.sh
#!/bin/bash
for PROC in `ls /proc/|grep "^[0-9]"`
do
  if [ -f /proc/$PROC/statm ]; then
    TEP=`cat /proc/$PROC/statm | awk '{print ($2)}'`
    RSS=`expr $RSS + $TEP`
  fi
done
RSS=`expr $RSS \* 4`
echo $RSS"KB"
$ ./RSS.sh
7024692KB

The script reports roughly 7 GB of RSS, still short of the 7.6 GB shown by free.

Accounting for slab memory

Kernel slab caches hold frequently used objects and can consume significant memory. $ slabtop To quantify slab usage:

$ echo `cat /proc/slabinfo | awk 'BEGIN{sum=0;}{sum=sum+$3*$4;}END{print sum/1024/1024}'` MB
904.256 MB

Accounting for PageTables

$ echo `grep PageTables /proc/meminfo | awk '{print $2}'` KB
58052 KB

Combining the three components

$ cat cm.sh
#!/bin/bash
for PROC in `ls /proc/|grep "^[0-9]"`
do
  if [ -f /proc/$PROC/statm ]; then
    TEP=`cat /proc/$PROC/statm | awk '{print ($2)}'`
    RSS=`expr $RSS + $TEP`
  fi
done
RSS=`expr $RSS \* 4`
PageTable=`grep PageTables /proc/meminfo | awk '{print $2}'`
SlabInfo=`cat /proc/slabinfo | awk 'BEGIN{sum=0;}{sum=sum+$3*$4;}END{print sum/1024/1024}'`

echo $RSS"KB", $PageTable"KB", $SlabInfo"MB"
printf "rss+pagetable+slabinfo=%sMB
" `echo $RSS/1024 + $PageTable/1024 + $SlabInfo|bc`
free -m
$ ./cm.sh
7003756KB, 59272KB, 904.334MB
rss+pagetable+slabinfo=7800.334MB
             total       used       free     shared    buffers     cached
Mem:         48262       8050      40211          0         17        404
-/+ buffers/cache:       7629      40633
Swap:         2047        336       1711

The combined total (RSS + PageTables + slab) is about 7.8 GB, 171 MB higher than free reports. The excess comes from double‑counting shared libraries in the RSS sum.

Key takeaways

Memory consumption comes from three main sources: process RSS, slab allocations, and PageTables.

Shared libraries cause RSS‑based totals to over‑estimate actual used memory.

Understanding these components helps reconcile discrepancies between ps, free, and other monitoring tools.

Further investigation is needed to accurately separate shared memory contributions, but the above analysis provides a solid foundation for understanding Linux memory accounting.