free is the Linux command that summarizes physical memory and swap usage in a single compact table. Part of the procps package, the free command reads the kernel’s /proc/meminfo file and shows how much RAM is used, free, shared, held in buffers and page cache, and available for new workloads, together with the size and usage of swap.
In Linux monitoring, free is usually the first tool consulted when a system feels slow or an application is killed for lack of memory. Its most valuable column is `available`, which estimates how much memory can be given to new processes without swapping. Reading free correctly requires understanding that Linux deliberately fills idle RAM with cache, so a small free value is normal and healthy.
How free reads memory statistics
The free command is a thin presentation layer over procfs. It parses fields such as MemTotal, MemFree, Buffers, Cached, SReclaimable, Shmem and MemAvailable from /proc/meminfo, performs a few subtractions and prints the results. It does not sample over time unless asked, and it adds no information that the kernel does not already expose.
Because the data comes straight from the kernel, the output is cheap to obtain and safe to run on busy production systems. The trade-off is that free shows only a system-wide snapshot: it cannot tell which process consumes memory, which is the job of top, htop or ps.
Reading the columns of free
Each column of the Mem: row answers a different question, and misreading `free` as spare capacity is the most common error. The table explains what each column means in current procps versions.
| Column | Meaning | Source in /proc/meminfo |
|---|---|---|
| total | Installed RAM usable by the kernel | MemTotal |
| used | Memory in use, excluding free and cache | Calculated: total minus free minus buff/cache |
| free | Completely unused memory | MemFree |
| shared | Memory used by tmpfs and shared memory | Shmem |
| buff/cache | Kernel buffers, page cache and reclaimable slab | Buffers, Cached, SReclaimable |
| available | Estimate of memory usable without swapping | MemAvailable |
The `available` estimate comes from the kernel itself (since Linux 3.14) and accounts for the fact that not all cache can be dropped instantly. It is therefore more accurate than adding free and buff/cache by hand. The Swap: row shows total, used and free swap space.
Older procps releases printed an extra -/+ buffers/cache line instead of the available column. Scripts written for that format may break or misreport on modern distributions, so parsing `/proc/meminfo` directly is more robust for automation.
Useful options
By default free prints values in kibibytes, which is hard to read on large servers. A handful of options control units, totals and repeated sampling.
| Option | Effect | Typical use |
|---|---|---|
-h | Human-readable units (Ki, Mi, Gi) | Interactive checks |
-m / -g | Fixed mebibyte or gibibyte units | Consistent logs and reports |
--si | Powers of 1000 instead of 1024 | Matching vendor capacity figures |
-t | Adds a total line for RAM plus swap | Quick overall view |
-w | Splits buffers and cache into two columns | Investigating cache behavior |
-s N | Repeats output every N seconds | Watching a workload start |
-c N | Stops after N repetitions | Short sampling in scripts |
Combining `free -h -s 2` gives a simple live view while a job warms up, although tools such as vmstat show memory alongside paging and CPU activity in the same line.
free compared with other monitoring tools
free answers how much memory the whole system has left, not why it is short or whether the shortage hurts. Several neighboring tools fill those gaps.
| Tool | Shows | When to prefer it |
|---|---|---|
| free | System-wide RAM and swap snapshot | First quick check |
| vmstat | Memory plus swap-in, swap-out and CPU over time | Detecting active paging |
| top / htop | Per-process resident memory | Finding the largest consumers |
| Pressure stall information | Time tasks wait for memory | Measuring real memory pressure |
| sar -r | Historical memory statistics | Comparing with past days |
A system can show little available memory yet run perfectly, or show plenty yet stall. Swap activity in vmstat and memory pressure in `/proc/pressure/memory` reveal whether low memory is actually slowing work, which free alone cannot.
Common misreadings and how to avoid them
Most alarms raised from free output are false alarms caused by cache. The table lists typical observations, what they really mean and the sensible response.
| Observation | Real meaning | Recommended action |
|---|---|---|
Very low free, high buff/cache | Healthy use of idle RAM | None |
Low available, rising swap used | Genuine memory shortage | Find consumers with top, add RAM or limits |
Swap used but available high | Old pages swapped out earlier | Usually none; check vmstat for activity |
High shared | Large tmpfs or shared memory segments | Check /dev/shm and tmpfs mounts |
| Different numbers inside a container | Host values shown, not cgroup limits | Read cgroup memory files instead |
The container case deserves attention: inside many containers free reports the host’s memory, not the container’s cgroup limit, unless the runtime virtualizes /proc/meminfo. Relying on it there can hide an imminent out-of-memory kill. Dropping caches with /proc/sys/vm/drop_caches merely to make free look larger is also counterproductive, because it discards useful cache and slows the next reads.
The short version
Think of computer memory as a desk. Some space holds the papers you are working on, some holds papers you might need again soon, and some is empty. The free command tells you how much of the desk is in use and how much you could clear quickly if new work arrived.
Linux likes to keep recently used files on the desk because fetching them again is slow. That is why the `free` number often looks small and is not a problem. The number that really matters is available: it tells you how much room a new program could get.
Where it makes a difference
An on-call engineer receives an alert that a web server with 16 GiB of RAM shows only 300 MiB free. Running free -h shows 11 GiB in buff/cache and 10 GiB available, with swap barely touched. The engineer concludes that the server is caching static files efficiently and tunes the alert to watch the available value instead.
A week later a different server shows available memory below 500 MiB and swap usage climbing. vmstat 1 confirms continuous swap-out, and htop reveals a reporting job that loads entire tables into memory. Capping that job with a systemd memory limit restores normal response times, and the incident note records free as the tool that separated the false alarm from the real one.