Where's all my RAM?

So what is really going on?

Linux is borrowing unused memory for disk caching. This makes it looks like you are low on memory. The disk cache also known a dcache is an important part of your system that is generally split into two separate components, Buffers and Cache. Each of these portions of the memory store information about the topology of your disk. When an application or user makes a request for a piece of information on disk the Linux Kernel will first check these memory locations for information on that file or data storage facility. This allows the system to more accurately schedule and queue input and output to the physical drive while simultaneously improving the performance a user might experience. We can get a much better idea of how memory in a system is allocated by looking at the information provided by /proc on a system though there maybe infinitely more information here than some of you are ready to process, so in this article I will stick primarily to the information you might find when running free -m.

[root@server ~]# cat /proc/meminfo
MemTotal:        6120540 kB
MemFree:          169944 kB
Buffers:          162928 kB
Cached:          5008668 kB
SwapCached:          500 kB
Active:          3119404 kB
Inactive:        2572516 kB
Active(anon):     394940 kB
Inactive(anon):   129456 kB
Active(file):    2724464 kB
Inactive(file):  2443060 kB
Unevictable:        1880 kB
Mlocked:            1880 kB
SwapTotal:       7924728 kB
SwapFree:        7922836 kB
Dirty:                16 kB
Writeback:             0 kB
AnonPages:        521724 kB
Mapped:            47920 kB
Shmem:              2492 kB
Slab:             193240 kB
SReclaimable:     175696 kB
SUnreclaim:        17544 kB
KernelStack:        3056 kB
PageTables:         7444 kB
NFS_Unstable:          0 kB
Bounce:                0 kB
WritebackTmp:          0 kB
CommitLimit:    10984996 kB
Committed_AS:    1598188 kB
VmallocTotal:   34359738367 kB
VmallocUsed:      304620 kB
VmallocChunk:   34359428804 kB
HardwareCorrupted:     0 kB
HugePages_Total:       0
HugePages_Free:        0
HugePages_Rsvd:        0
HugePages_Surp:        0
Hugepagesize:       2048 kB
DirectMap4k:        6656 kB
DirectMap2M:     6275072 kB

Buffer Pages

The buffer cache ("Buffers:" in cat /proc/meminfo or free -m) is a close relative to the dentry/inode caches. The dentries and inodes in memory represent structures on disk, but are laid out very differently. When we need to fetch an inode or dentry to populate the caches, we must first pull in a page from the disk. This page has information on which those structures are represented. This information can not be a part of the page cache itself because it is not actually the contents of a file, but rather it is the raw contents of the disk. A page in the buffer cache may have dozens of on-disk inodes inside of it, although we may have only created an in-memory inode for one. The buffer has information that the kernel believe it will need not only for this inode or request but for others in the same group as well. This ultimate saves time and resources since the kernel will not have to make additional request to the disk to get information on these requested structures. There can be a variety of reasons that the system may choose to buffer an individual block or group of blocks but here are two common cases in which the kernel may create buffer pages.

  • When reading or writing pages of a file that are not stored in contiguous disk blocks.
    This happens either because the filesystem has allocated non-contiguous blocks to the file, or because the file contains "holes"
  • When accessing a single disk block.
    This can happen when reading a superblock or an inode block.

Raw disk operations such as dd use buffers.

[root@server ~]# free -m
              total       used       free     shared    buffers     cached
Mem:          5977       5811        165          0        159       4891
-/+ buffers/cache:        760       5216
Swap:         7738          1       7737

For example reading 10M of raw disk blocks.

[root@server ~]# dd if=/dev/sda6 of=/dev/zero bs=1024k count=10
10+0 records in
10+0 records out
10485760 bytes (10 MB) copied, 0.209051 seconds, 50.2 MB/s

Buffers size increased by 10MB (159M-169M).

[root@server ~]# free -m
              total       used       free     shared    buffers     cached
Mem:          5977       5811        165          0        169       4891
-/+ buffers/cache:        760       5216
Swap:         7738          1       7737


When ever files or blocks of data are accessed frequently on a system the Linux Kernel will cache information about that block or file so that future request for it can be processed more efficiently. This can include the Dentry Cache, Inode Cache, and Page Cache which each store some component information about those blocks or files.


Page Cache

The Linux Page Cache ("Cached:" in cat /proc/meminfo or free -m) is the largest single consumer of RAM on most systems. It is not uncommon to see this memory segment exceed 50% of the total available RAM on a healthy system.

Any time you or an application request a file be read from the disk that data is first read into memory and then goes into the page cache. After this initial read is completed, the kernel has the option to simply throw the page away since it is not being used or store that information in memory for later retrieval. If the kernel elects to keep this information in your cache and a request for data from the same area in that file is again requested by any application the data can be read directly out of memory. This shortcut allows the system to reduce disk I/O and significantly speed-up operations as the kernel will not need to schedule an additional read from the disk to retrieve that information again. This is the reason Linux uses its page cache so extensively. The kernel is effectively betting that after you or an application accesses a page on disk a single time, you will soon access it again.

The same is true for mmap()'d files ("Mapped:" cat /proc/meminfo or free -m). The first time the mmap()'d area is accessed, the page will be brought in from the disk and mapped into memory. The kernel could choose to immediately discard that page after the instruction that touched the page has completed. However, the kernel makes the same bets that it did for simple reads of a file. It keeps the page mapped into memory and bets that you or an application will soon access it again. This behavior at times can manifest itself in confusing ways.

It might be assumed that mmap()'d memory is not "Cached" because it is in active use and that "Cached" means "Completely unused right now". However, Linux itself does not define it that way. The Linux definition of "Cached" is closer to "This is a copy of data from the disk that we have here to save you time." It implies nothing about how the page is actually being used. This is why we have both "Cached:" and "Mapped:" in cat /proc/meminfo. All "Mapped:" memory is "Cached:", but not all "Cached:" memory is "Mapped:".


Dentry/Inode Cache

Each time you do an ls (or any other operation: open, stat, etc...) on a filesystem, the kernel needs to obtain data which  may be stored on the disk. The kernel parses that data and puts it in some filesystem-independent structures so that it can be handled in the same way across all filesystems. In the same fashion as the page cache in the above examples, the kernel has the option of throwing away these structures once the ls is completed. However, it makes the same bets as before: if you or that application has read it once, you're bound to read it again. The kernel stores this information in several "Cached:" segments called the dentry and inode caches. dentries are common across all filesystems, but each filesystem has its own cache for inodes. These individual components store information about the location of a file on disk such as the block and sector ID. These structures also store additional information such as the human readable path to a file, the owner of that file, and it's permission set.

You can view the different caches and their sizes by executing this command.
(This RAM is a component of "Slab:" in cat /proc/meminfo)

[root@server ~]head -2 /proc/slabinfo; cat /proc/slabinfo | egrep dentry\|inode
slabinfo - version: 2.1
# name            <active_objs> <num_objs>    : tunables    : slabdata <active_slabs> <num_slabs> 
ext4_inode_cache   12171  15411    984   33    8 : tunables    0    0    0 : slabdata    467    467      0
mqueue_inode_cache     36     36    896   36    8 : tunables    0    0    0 : slabdata      1      1      0
hugetlbfs_inode_cache     26     26    616   26    4 : tunables    0    0    0 : slabdata      1      1      0
sock_inode_cache     434    460    704   46    8 : tunables    0    0    0 : slabdata     10     10      0
shmem_inode_cache    997   1000    808   40    8 : tunables    0    0    0 : slabdata     25     25      0
proc_inode_cache     873    925    648   25    4 : tunables    0    0    0 : slabdata     37     37      0
inode_cache         1116   1323    600   27    4 : tunables    0    0    0 : slabdata     49     49      0
dentry             18542  18564    192   42    2 : tunables    0    0    0 : slabdata    442    442      0

Older kernels (around 2.6.9) left some structures in the slab cache for longer periods of time than newer kernels do. That means that even though they may have been unused, they're left there until there is sufficient memory pressure. This happens more frequently with proc_inodes. /proc inodes also pin task_structs, which means that each one can effectively occupy over 2 KBytes of RAM. This RAM won't show up as "Cached:" and may appear to be a kernel memory leak. On a system with only 100 tasks (with little memory pressure) there can be hundreds of thousands of these left lying around though this is a normal condition.


What if I want to run more applications?

Run as many applications as you want to, the disk cache in no way affects the over availability of memory on a system but it can certainly affect the overall performance especially if your system is experiencing a memory related performance problem. If your applications want more memory, they simply take back a chunk that the disk cache has effectively borrowed. Disk cache can always be given back to applications immediately!


How do I stop Linux from doing this?

You can't really disable disk caching as it is part of the core virtual memory systems of Linux. You can however control caching to some degree with kernel level parameters if you feel it is really required. In most cases the only reason anyone ever wants to disable disk caching is because they don't really understand what those segments of memory are being used for or how the system can choose to allocate or de-allocate those segments. Disk caches by design are meant to make applications load faster and run smoother.


Why does top and free say all the ram is used?

This is just a misunderstanding of how Linux classifies memory usage. In most cases you will find that both you and the Linux kernel actually agree that memory taken by an application is "Used", while memory that isn't used for anything is "Free". So what do you call memory that is both used for something and available to applications, such as the disk cache? Most people would likely call it "Free Memory" but Linux classifies it as "Used Memory" which often leads to confusion.

Memory that is You would call it Linux calls it
taken by applications Used Used
available for applications, and used for something Free Used
not used for anything Free Free


How do I see how much free ram I really have?

To see how much ram is free to use for your applications, run free -m and look at the row that says "-/+ buffers/cache" in the column that says "free". That is your answer in megabytes.

[root@server ~]# free -m
              total       used       free     shared    buffers     cached
Mem:          5977       5811        165          0        159       4891
-/+ buffers/cache:        760       5216
Swap:         7738          1       7737

Some information sourced from http://www.linuxatemyram.com/