Your server says 97% RAM used and you panic — then you learn what buff/cache actually means and stop. This is that lesson.
The moment a server starts swapping, every sysadmin reaches for one command. Here is what its numbers actually tell you — and which one you should ignore.
free prints how much physical memory (RAM) and swap space is in use on the machine. It reads the counters out of /proc/meminfo and lays them out in a table: total, used, free, shared, buff/cache, and available — for both RAM and swap. Run bare and you get kibibytes (1024-byte units), which is why the first thing everyone does is add -h. The whole point of the command is the subtle difference between 'used' and 'available': used sounds alarming, available is the number that actually tells you whether you are in trouble.
Linux loves free memory the way a hoarder loves a spare bedroom — it caches aggressively, so 'used' is almost always high and 'free' is almost always low even when nothing is wrong. The number that matters is 'available': memory that can be reclaimed from cache and given to a process the moment it needs it. So when someone shouts 'the box is at 95% RAM!', the correct response is `free -h`. Nine times out of ten, buff/cache is huge, available is healthy, and there was never a problem. When available actually bottoms out, then — and only then — you start worrying about swap pressure.
free -h
total used free shared buff/cache available Mem: 15Gi 7.1Gi 977Mi 42Mi 7.7Gi 8.3Gi Swap: 4.0Gi 3.4Gi 645Mi
-h prints human-readable units. Look at the gap: only 7.1Gi 'used', but 7.7Gi sits in buff/cache and can be reclaimed — so 'available' is a healthy 8.3Gi. The box is fine.
free -h -t
total used free shared buff/cache available Mem: 15Gi 7.1Gi 977Mi 42Mi 7.7Gi 8.3Gi Swap: 4.0Gi 3.4Gi 645Mi Total: 19Gi 10Gi 1.6Gi 42Mi 7.7Gi
-t appends a Total row that sums RAM and swap. Swap is heavily used here (3.4 of 4.0Gi) — a sign this box pushed memory hard in the past, but right now it is not actively thrashing.
free -m
total used free shared buff/cache available Mem: 15698 7236 977 42 7871 8461 Swap: 4095 3450 645
-m prints mebibytes instead of human units. Scripts and monitoring dashboards often read free -m because integers parse cleanly. Note how 15.6Gi of RAM totals to ~15698 MiB.
free -s 2 -c 3
total used free shared buff/cache available
Mem: 16075264 7410308 1001336 43232 8060092 8664956
Swap: 4194300 3533264 661036
total used free shared buff/cache available
Mem: 16075264 7408996 1002396 43228 8060292 8666268
total used free shared buff/cache available
Mem: 16075264 7408996 1002396 43228 8060292 8666268
-s N reprints every N seconds, -c N stops after N iterations. Watch availability trend across a few seconds to spot a slow memory leak in a process — a stable available over time means no leak, a steadily shrinking one means something is chewing RAM.
| Flag | Meaning |
|---|---|
-h | human-readable sizes (KiB, MiB, GiB) instead of bytes |
-m | report in mebibytes — friendly to scripts and dashboards |
-g | report in gibibytes (rounds down, handy for quick eyeballing) |
-t | append a Total row summing RAM and swap |
-s N | repeat the output every N seconds (monitoring loop) |
-c N | stop after N repetitions — pair with -s for bounded sampling |
-w | wide output; breaks buff/cache into separate buffers and cache columns |
free has shipped with procps/procps-ng since the early days of Linux. Its entire job is to read /proc/meminfo — a virtual file the kernel generates on the fly — and render its dozens of raw counters into a table a human can read in one glance. The tool barely changed for decades; the interesting evolution was adding the 'available' column, which arrived in procps 3.3.10 (2013) specifically because the classic used/free pair kept misleading people who did not understand cache.
For years, 'free' memory was tiny and 'used' was huge on every healthy Linux box, and newcomers read that as 'the machine is almost out of RAM'. The 2013 addition of the available column was the kernel and procps maintainers conceding that the old pair was actively deceiving. available is an estimate of what could be reclaimed right now — freeing cache and dropping clean pages — which is the number that correlates with whether you will actually OOM. That one column defused years of false alarms.