Where Does Linux Memory Go? Uncovering RSS, Buffers, Slab, and PageTables

A student asked why ps aux shows RSS memory under 30 MiB while free reports used memory of 7.8 GiB and swapping, wondering whether ps aux misses some memory and how to locate the memory counted as used by free.

We usually look at memory status with free -m:

$ free -m
              total       used       free   shared  buffers  cached
Mem:         48262       7913      40349        0       14      267
-/+ buffers/cache:   7631      40631
Swap:        2047        336      1711

The diagram below clarifies how to interpret this output.

In this case the system has 48 262 MiB total, of which 7 913 MiB is used. Buffers and cache together occupy 281 MiB (14 MiB buffers + 267 MiB cache) and can be reclaimed, so the real used memory is lower than the raw used column suggests.

We can drop most of the buffer/cache with:

$ sudo sysctl vm.drop_caches=3
vm.drop_caches = 3
$ free -m
              total       used       free   shared  buffers  cached
Mem:         48262       7676      40586        0        3       41
-/+ buffers/cache:   7631      40631
Swap:        2047        336      1711

After clearing buffers/cache the used memory drops to 7 676 MiB.

To investigate where the remaining used memory goes we look at process memory via tools like nmon and top. The RES column in top comes from the second field of /proc/PID/statm (resident set size).

Excerpt from man proc about /proc/[pid]/statm:

/proc/[pid]/statm
Provides information about memory usage, measured in pages.
The columns are:
size       total program size (same as VmSize in /proc/[pid]/status)
resident   resident set size (same as VmRSS in /proc/[pid]/status)
share      shared pages (from shared mappings)
text       text (code)
lib        library (unused in Linux 2.6)
data       data + stack
dt         dirty pages (unused in Linux 2.6)

The resident set size reflects the actual physical pages a process uses; shared libraries are counted for each process, which can lead to double‑counting.

Example script RSS.sh sums the resident pages of all processes:

#/bin/bash
for PROC in `ls /proc/|grep "^[0-9]"`; do
  if [ -f /proc/$PROC/statm ]; then
    TEP=`cat /proc/$PROC/statm | awk '{print ($2)}'`
    RSS=`expr $RSS + $TEP`
  fi
done
RSS=`expr $RSS \* 4`
echo $RSS"KB"

Running it yields roughly 7 024 MiB, still a few hundred megabytes short of the 7 637 MiB reported by free.

Another hidden consumer is kernel slab memory. slabtop shows the various caches, but does not give a total. We can compute it with:

$ echo `cat /proc/slabinfo |awk 'BEGIN{sum=0;}{sum=sum+$3*$4;}END{print sum/1024/1024}'` MB
904.256 MB

Page tables also consume memory. Their size can be read from /proc/meminfo:

$ grep PageTables /proc/meminfo | awk '{print $2}' KB
58052 KB

Summarising, memory consumption falls into three categories:

Process memory

Kernel slab caches

Page tables

A combined script cm.sh adds RSS, page tables and slab info and compares the result with free:

#/bin/bash
for PROC in `ls /proc/|grep "^[0-9]"`; do
  if [ -f /proc/$PROC/statm ]; then
    TEP=`cat /proc/$PROC/statm | awk '{print ($2)}'`
    RSS=`expr $RSS + $TEP`
  fi
done
RSS=`expr $RSS \* 4`
PageTable=`grep PageTables /proc/meminfo | awk '{print $2}'`
SlabInfo=`cat /proc/slabinfo |awk 'BEGIN{sum=0;}{sum=sum+$3*$4;}END{print sum/1024/1024}'`
echo $RSS"KB", $PageTable"KB", $SlabInfo"MB"
printf "rss+pagetable+slabinfo=%sMB
" `echo $RSS/1024 + $PageTable/1024 + $SlabInfo|bc`
free -m

Running it shows rss+pagetable+slabinfo=7800.334MB versus free reporting 7 629 MiB used; the 171 MiB difference comes from double‑counted shared libraries.

In conclusion, Linux memory accounting is intricate: process RSS, reclaimable buffers/cache, kernel slab caches, and page tables all contribute to the numbers shown by free, and careful analysis is required to understand the true memory usage.