How to Check Memory Usage in Linux: Virtual Memory, RAM, and Swap

When a Linux server starts slowing down, determine whether the problem is caused by limited available RAM, active swap usage, or a process consuming more memory than expected. 

The fastest way to investigate is to check the memory usage in Linux with free, identify large processes with ps or top, and review active paging with vmstat.

This guide covers the commands you can use to check Linux memory usage, review RAM and swap, find memory-consuming processes, examine paging activity, and read detailed memory information from the kernel.

Quick Diagnosis: Check Linux Memory in Five Steps

If a Linux server is slow or an application is becoming unresponsive, use these checks to determine whether the problem is caused by normal filesystem caching, a memory-consuming process, or active swapping.

1. Check Available Memory and Swap

Run:

free -h

Review the available value under Mem and the amount of used swap. The available value is more useful than free because it estimates how much memory Linux can provide to applications after reclaiming suitable cache.

2. Find the Largest Memory-Consuming Processes

Run:

ps -eo pid,user,comm,%mem,rss --sort=-%mem | head

This lists processes in descending order by memory percentage. Review the %MEM and RSS columns to identify processes using a large amount of physical RAM.

You can also use:

top

Then press M to sort the process list by memory usage.

3. Check for Active Paging

Run:

vmstat 1

Review the si and so columns. Sustained non-zero values indicate that Linux is moving memory between RAM and swap. If this occurs alongside low available memory, high disk activity, or slow application response, the server may be under memory pressure.

4. Check for Out-of-Memory Killer Events

If a process has stopped unexpectedly or a service has disappeared, search the kernel logs:

journalctl -k | grep -i -E 'out of memory|oom|killed process'

These messages can indicate that Linux terminated a process to recover memory after the system could not satisfy a memory request.

5. Monitor the Pattern Before Changing Settings

A single memory reading may not explain a performance problem. Compare memory usage, swap activity, disk activity, and application response over time. Confirm that the issue is recurring before changing vm.swappiness, adding RAM, or increasing swap capacity.

These checks help distinguish among three common situations:

• Linux is using RAM for filesystem cache, but enough memory remains available for applications.
• One or more processes are consuming most of the physical RAM.
• The system is paging heavily and may need workload tuning, process investigation, or additional capacity.

What Is Virtual Memory in Linux?

Physical RAM stores the data and instructions used by running applications. RAM is much faster than disk storage, but every server has a limited amount of it. When applications request more memory than Linux can provide immediately, the kernel needs a way to manage data that is not currently active.

Virtual memory provides that mechanism. Linux can move inactive memory pages from RAM to a disk area called swap. This gives the kernel more room to assign RAM to active applications. When an application needs the data again, Linux reads the page back from swap.

Linux manages virtual memory through two related processes:

• Swapping traditionally means moving the memory belonging to an entire process from RAM to disk. For example, if a browser process has several hundred megabytes assigned to it and the operating system moves that process out of RAM to make room for another program, the browser may need to wait while its memory is brought back. Modern Linux usually does not move an entire process in one operation, but the term “swapping” is still commonly used when discussing memory moved to swap space.
  
• Paging means moving individual memory pages rather than moving all the memory belonging to a process. For example, a database may have several gigabytes of memory assigned to it, but only a small section may be inactive. Linux can move those inactive pages to swap while keeping the pages currently being used by the database in RAM. For a beginner-friendly explanation of swap space, see PhoenixNAP’s article on what swap space is and how it works.

Paging gives the kernel finer control because it can move selected inactive pages instead of moving an entire process. The trade-off is speed. Reading from or writing to disk takes longer than accessing RAM, so an application may slow down if it needs to retrieve pages from swap repeatedly.

Swap usage does not indicate a memory problem. Linux may move inactive pages to swap even when applications still have enough available memory. To determine whether swap is affecting performance, compare swap usage with available memory, paging activity, disk activity, and application response times.

Linux also uses RAM for filesystem cache. If a file has recently been read, the kernel may keep its contents in memory so that a later request does not need to access the disk. When an application requests more memory, Linux can reclaim suitable cache pages.

For more background, see LogicMonitor’s article on how virtual memory works in Linux.

How to Check Linux Memory Usage?

Linux provides several commands for examining memory, but they do not all report the same information. Some show the current RAM and swap totals, while others focus on individual processes, paging activity, or detailed kernel statistics.

The table below explains what each command reports and when it is most useful.

Essential Linux Memory Commands

Check Memory Usage with the Linux free Command

The first command to run when you need to check Linux memory usage is free. Use the -h option so the output is easier to read:

free -h

A typical result looks like this:

The exact headings depend on the Linux distribution and version. Older systems may show separate buffers and cache columns. Newer systems commonly combine them under buff/cache.

In this example, only 1 GiB is completely unused, but 2 GiB is available to applications because Linux can reclaim some filesystem cache. No swap is currently being used. The low free value alone does not indicate a memory problem; compare `available` memory with paging activity and application performance.

The available column estimates how much memory Linux can provide to applications without heavy swapping. It includes unused RAM and memory that the kernel can reclaim from filesystem cache and other suitable allocations.

The key distinction is between allocated memory and available memory. Linux may show high memory usage because it uses spare RAM for cache:

• If available remains healthy and si and so stay at zero or near zero, the server may not be experiencing memory pressure. 
• If available is low and paging activity remains elevated, investigate the largest processes, disk activity, and application performance.

You can display the Linux memory usage output in a specific unit:

free -m

free -g

The options mean:

• -h displays human-readable units, such as MiB or GiB, chosen automatically.
• -m displays values in megabytes.
• -g displays values in gigabytes.
• -t adds a combined RAM and swap total.

For example:

free -g

may produce:

The one-gigabyte free value may look low, but the server also has memory assigned to cache. Linux can reclaim some of that cache when an application requests more RAM. The two-gigabyte available value therefore gives a better estimate of the memory applications can use without heavy swap activity.

Do not diagnose a memory problem from the free value alone. If available memory is healthy, swap use is stable, and paging activity is low, the server may simply be using RAM for normal filesystem caching.

For more detail, read LogicMonitor’s article on why free memory is not the same as available memory.

Use top to Show Real-Time Linux Memory Usage

You can run free while an application is running, but it gives you only one memory snapshot at the moment you execute it. If memory usage changes after that, the command does not continue reporting those changes. 

Use top when you want the process list and memory statistics to refresh continuously:

top

The upper section displays overall CPU and memory statistics. The process list below it shows running programs and their resource usage.

After the top command starts, press uppercase M (Shift + M) to sort the process list by memory usage. The process using the largest share of physical RAM will move to the top.

Some versions also support sorting from the Linux command line:

top -o %MEM

The process table includes several memory fields:

• %MEM shows the percentage of physical RAM assigned to the process.
• RES shows resident memory currently held in RAM.
• VIRT shows the process’s virtual address space, including mapped files and shared libraries.

A large VIRT value does not mean that the process is using the same amount of physical RAM. When reviewing Linux memory utilization, focus on RES and %MEM. Then compare those values with available memory, swap usage, and application behavior.

For a broader view, see our article on monitoring Linux memory over time.

Check Virtual Memory with free -t

After checking physical memory, review swap to find out whether the server is using disk-backed memory:

free -t

For example:

The Total row combines RAM and swap. It shows the total memory capacity configured on the server, but RAM and swap do not provide the same performance. RAM is much faster than disk-backed swap.

In this example, the server has 49,376 units of physical memory and 4,194 units of swap. The Total row combines both values, but it should not be interpreted as equivalent to 53,570 units of RAM. Swap is disk-backed and much slower than physical memory. Because the Swap used value is 0, this output does not show active swap use at the time of the check.

Check Linux Memory Usage by Process and User

The free command shows how much memory the server is using, but it does not identify the application responsible for that usage. Once available memory is low, inspect individual processes to find where the memory is going.

Find the Top Memory-Consuming Process in Linux with ps

To review processes by memory usage, use the top instructions above or run the following ps command for a one-time snapshot:

ps aux | sort -rnk 4 | head -5

Here, -k 4 tells sort to use the fourth column when ordering the output.

The fourth column is %MEM, which shows the percentage of physical RAM assigned to each process.

Review the process name, user, %MEM, and RES values together. A database process may normally use a large amount of memory because it maintains its own cache. A service that continues to grow without a corresponding increase in workload deserves further investigation.

RSS means resident set size. It represents memory currently held in RAM. VSZ means virtual memory size and may include reserved address space that is not using physical memory.

For a more focused report, run:

ps -eo pid,user,comm,%mem,rss --sort=-%mem | head

This lists the process ID, user, command, memory percentage, and resident memory in descending order. It is useful when you need Linux memory usage by process rather than a system-wide total.

Check Memory Usage for a Specific User

When several services share one server, review the processes owned by one account:

top -U <user>

For example:

top -U mysql

This limits the process list to the selected user. It can help separate database memory use from application or operating system activity.

For larger Linux environments, LogicMonitor supports server monitoring by collecting memory measurements across many servers through SSH and showing them alongside CPU, filesystem, uptime, and network data. 

Interactive Linux Memory Monitoring with htop

`htop` provides an interactive alternative to top. It displays processes in a navigable list and includes meters for CPU, RAM, and swap usage.

On Ubuntu or Debian, install it with:

sudo apt install htop

On distributions using DNF, run:

sudo dnf install htop

Then start it:

htop

Use the sort option to arrange processes by MEM%. You can search for a process, filter the list, and inspect process details from the same interface.

htop is useful during an interactive investigation because the process list is easier to navigate. top is often more suitable on minimal servers because it is commonly installed by default and works well in remote sessions.

Read Linux Memory Information from /proc/meminfo

Linux exposes detailed memory statistics through /proc/meminfo:

cat /proc/meminfo

To focus on RAM, cache, and swap fields, run:

egrep 'Mem|Cache|Swap' /proc/meminfo

The most useful fields include:

• MemTotal: total physical RAM detected by the kernel.
• MemFree: RAM that is not currently assigned.
• MemAvailable: estimated RAM available for new applications without heavy swapping.
• Buffers: memory used for kernel buffers.
• Cached: memory used for filesystem cache.
• SwapCached: memory that exists in both RAM and swap.
• SwapTotal: total configured swap space.
• SwapFree: unused swap space.

MemFree and MemAvailable measure different things: 

• MemFree counts RAM that is not currently assigned. 
• MemAvailable also estimates how much reclaimable memory can be made available to new applications. 

For most troubleshooting, MemAvailable is the more useful indicator.

To display the fields most useful during an investigation, run:

grep -E 'MemTotal|MemFree|MemAvailable|Buffers|Cached|SwapTotal|SwapFree' /proc/meminfo

Monitor Virtual Memory Paging with vmstat

The free command shows how memory is assigned and how much swap has been used. It does not show whether Linux is moving pages between RAM and disk at this moment.

To measure that activity, run:

vmstat 1

The command prints a new row every second:

The fields most useful for memory investigations are:

• swpd: memory currently assigned to swap.
• free: unused physical memory.
• buff: memory used for buffers.
• cache: memory used for cache.
• si: pages brought into RAM from swap per second.
• so: pages moved from RAM to swap per second.
• bi: blocks received from a block device.
• bo: blocks sent to a block device.
• wa: CPU time waiting for input/output.

The si and so values show whether swap is actively involved in memory management. A brief increase may occur when Linux moves inactive pages during a workload change. Sustained non-zero values during normal workload deserve closer attention.

If both values stay high for an extended period, the system may be thrashing. Thrashing occurs when Linux spends too much time moving pages between RAM and disk instead of running application work. The result can include high disk activity, increased I/O wait, and slow application response.

If paging remains high across several reporting intervals, use the process and memory checks described earlier to investigate the cause. An application memory leak, insufficient RAM, or a temporary workload increase may be responsible.

Review several `vmstat` rows during the period of poor application performance. One row cannot describe how the system behaves over an extended period.

How to Interpret Linux Memory Usage

The commands above show different parts of the same memory problem. Interpret them together rather than relying on one value.

Low free, but healthy available

Linux may be using RAM for filesystem cache. This is usually normal when available memory remains stable, swap use is not increasing, paging activity is low, and applications are responding normally.

Low available, with one process showing high RES

The process may be consuming most of the physical RAM. Investigate whether its memory use matches the workload. A database or application may intentionally use memory for caching, but continued growth without a corresponding workload increase may indicate excessive caching, a memory leak, or a configuration problem.

Low available, with sustained si and so

The server may be under memory pressure. Review the largest processes, swap growth, disk latency, I/O wait, and the timing of the workload. If Linux spends too much time moving memory between RAM and swap, the system may be thrashing and application response times may deteriorate.

Memory is exhausted and processes stop unexpectedly

Check the kernel logs for Out of Memory (OOM) Killer events:

dmesg -T | grep -i -E 'out of memory|oom-killer|killed process'

On systems that use systemd, you can also run:

journalctl -k | grep -i -E 'out of memory|oom|killed process'

These messages can show whether Linux terminated a process because it could not satisfy a memory request.

Best Practices for Linux Memory Management

Memory values need to be reviewed alongside the workload. High used memory may reflect normal filesystem caching, while active paging may indicate that applications are competing for physical RAM.

Use these practices when reviewing Linux memory:

• Check MemAvailable instead of relying only on MemFree.
• Track swap use and paging activity over time.
• Identify process-level memory growth before adding capacity.
• Establish normal memory ranges for each workload.
• Review memory behavior during peak traffic and scheduled jobs.
• Investigate repeated OOM Killer events in system logs.
• Compare memory usage with CPU, disk, and application performance.
• Review filesystem cache so it is not confused with application memory.
• Size swap according to the workload and operating system guidance.
• Review vm.swappiness when the server swaps more often than expected.

Check the current swappiness value with:

cat /proc/sys/vm/swappiness

Many Linux systems use a default value of 60, although the setting can differ by distribution. A lower value may make the kernel less willing to move application memory to swap, but changing it is not a universal solution.

For a temporary change that lasts until the next reboot, run:

sudo sysctl vm.swappiness=10

Test the change against the application workload. Afterward, review vmstat, swap use, disk activity, and application response times.

Some databases manage their own cache and may respond differently from general-purpose applications. Review the application documentation before changing kernel memory settings.

For more insights on how Linux manages memory, including tips on free memory and file cache, read LogicMonitor’s article More Linux Memory: Free Memory That Is Not Free Nor Cache.

Applying Linux Memory Monitoring in Practice

The five-step workflow above is helpful for an initial investigation. For recurring problems, compare these readings with historical data to determine whether the behavior is normal for the workload or represents a change.

For example, a server may show high memory usage during a scheduled job but return to normal afterward. A process that grows steadily over several hours, repeated increases in swap activity, or memory pressure that coincides with application latency may require further investigation.

LogicMonitor can collect Linux memory, swap, paging, CPU, disk, filesystem, and network metrics over time. This makes it easier to identify recurring memory pressure and correlate it with application performance.

The commands in this guide provide point-in-time checks. For long-term analysis, LogicMonitor can collect Linux memory, swap, paging, CPU, disk, filesystem, uptime, and network measurements through SSH. Historical data helps show whether a memory value is normal for the workload, increasing over time, or correlated with application performance problems.

For more details about configuring SSH-based Linux monitoring and importing LogicModules for broader coverage, explore LogicMonitor’s Linux (SSH) Monitoring package.

FAQs