Why Does `free` Show More Used Memory Than `ps aux`? A Deep Dive into Linux Memory Accounting

Background

A user noticed that ps aux reports RSS memory under 30 MiB while free shows several gigabytes used and even swapping, prompting the question of what memory is hidden from ps and how to locate the memory accounted for by free.

Understanding free Output

free -m
               total       used       free   shared  buffers  cached
Mem:          48262       7913      40349        0       14      267
-/+ buffers/cache:   7631      40631
Swap:          2047        336      1711

The buffers and cached columns represent memory that can be reclaimed; although free counts them as used, they are not permanently occupied.

Clearing Buffers and Cache

sudo sysctl vm.drop_caches=3
free -m

After dropping caches, the used column drops to 7 676 MiB, confirming that most of the previously reported usage was reclaimable buffer/cache memory.

Process Memory Accounting

The RES (Resident Set Size) column shown by top and nmon is derived from the second field of /proc/[pid]/statm, which reports the number of resident pages for a process.

/proc/[pid]/statm
Provides information about memory usage, measured in pages.
Columns are:
  size   total program size
  resident   resident set size (same as VmRSS)
  share   shared pages
  text    text (code)
  lib     library (unused in Linux 2.6)
  data    data + stack
  dt      dirty pages (unused in Linux 2.6)

Resident pages represent the actual physical pages a process occupies; shared libraries are counted for each process that maps them.

Slab Memory

The kernel maintains slab caches for frequently used objects, which can consume a noticeable amount of memory. The slabtop command displays the caches, but does not directly sum their total size. By multiplying each object's size by its count, the total slab memory can be calculated.

echo `cat /proc/slabinfo | awk 'BEGIN{sum=0;}{sum=sum+$3*$4;}END{print sum/1024/1024}'` MB
# Result: 904.256 MB

PageTables Memory

grep PageTables /proc/meminfo | awk '{print $2}'
# Result: 58052 KB

Page tables are kernel structures that map virtual to physical pages; they occupy a fixed fraction of RAM (about 2‑3% on typical kernels).

Scripts to Sum Memory Components

Two Bash scripts were created to aggregate memory usage:

# RSS.sh – sums the resident set size of all processes
#!/bin/bash
for PROC in `ls /proc | grep "^[0-9]"`
do
  if [ -f /proc/$PROC/statm ]; then
    TEP=`cat /proc/$PROC/statm | awk '{print ($2)}'`
    RSS=`expr $RSS + $TEP`
  fi
done
RSS=`expr $RSS \* 4`
echo "$RSS KB"

# cm.sh – combines RSS, PageTables, and SlabInfo
#!/bin/bash
for PROC in `ls /proc | grep "^[0-9]"`
do
  if [ -f /proc/$PROC/statm ]; then
    TEP=`cat /proc/$PROC/statm | awk '{print ($2)}'`
    RSS=`expr $RSS + $TEP`
  fi
done
RSS=`expr $RSS \* 4`
PageTable=`grep PageTables /proc/meminfo | awk '{print $2}'`
SlabInfo=`cat /proc/slabinfo | awk 'BEGIN{sum=0;}{sum=sum+$3*$4;}END{print sum/1024/1024}'`
echo "$RSS KB, $PageTable KB, $SlabInfo MB"
printf "rss+pagetable+slabinfo=%sMB
" `echo $RSS/1024 + $PageTable/1024 + $SlabInfo | bc`
free -m

Running cm.sh on the example system produced:

7003756KB, 59272KB, 904.334MB
rss+pagetable+slabinfo=7800.334MB
Mem: 48262 8050 40211 0 17 404
-/+ buffers/cache: 7629 40633

Findings

Process memory (RSS) accounts for the majority of used RAM.

Slab caches consume roughly 900 MiB.

Page tables add about 58 MiB.

The discrepancy of ~171 MiB between the script’s total and free ’s used column is due to double‑counting shared libraries across processes.

Conclusion

Linux memory accounting involves several layers—process RSS, reclaimable buffer/cache, kernel slab caches, and page tables. Accurate accounting requires separating these components and being aware of shared‑library double counting, which explains why free often reports higher usage than the sum of individual RSS values.