Why Linux ‘Ate My RAM’: Understanding free, buffers, and cache

Introduction to the free command

When checking memory usage on Windows, high utilization (>80%) leads to noticeable slowdown due to swapping. In contrast, Linux’s free command often shows high memory usage even when few applications run, which reflects its memory‑management design.

The free output (using -m for megabytes) typically includes total, used, free, shared, buffers, and cached values. Buffers hold data waiting to be written to disk, while cache stores data read from disk for faster future access.

To better understand actual available memory, Linux provides a third line that subtracts buffers and cache from used memory and adds them to free memory:

used = total - buffers - cached

free = free + buffers + cached

Swap usage is also displayed; if swap remains unused, the system still has sufficient RAM.

Memory classification

From the user’s perspective, memory can be categorized as:

Used : memory taken by applications.

Free (available) : memory not currently used by any process.

Free (buffers/cache) : memory used by the kernel for buffers and cache, which can be quickly reclaimed for applications.

Thus, the third line of free reflects memory that is effectively free for user programs.

Benefits of buffers and cache

Linux employs buffer cache and page cache to improve disk I/O performance. Data read from slow block devices is kept in memory, allowing subsequent accesses to bypass the disk. When memory becomes scarce, the kernel can swiftly drop these caches to free space for applications, avoiding swap usage.

Consequently, buffers/cache are advantageous and rarely harmful; they merely give the impression that Linux “eats” RAM.

Experimental verification

An experiment reads a 1 GB file twice:

1. Generate a 1 GB file.

2. Clear the cache.

3. Read the file and measure time (≈18 s).

4. Read the file again (≈0.3 s), a 60‑fold speedup due to caching.

This demonstrates how Linux’s buffer and page caches dramatically improve repeated file‑read performance.