CrackOps
Interview PrepTracksLinuxAWS LabSoonInterview RoomSoon
Sign inStart free
CrackOps

Interview prep for the people who keep production up.

[email protected]
ProductInterview PrepTracksDashboardInterview Room
RolesDevOpsSREPlatformCloud
CompanyAboutContactPrivacyTerms
© CrackOps
Linux / System Information / free

free

Show used, free and available memory

Beginneressentialmemoryperformance

free shows how RAM and swap are used: by processes, by the page cache, and how much is still available for new work. The column to watch is available, not free: Linux deliberately fills spare RAM with cache and gives it back when programs need it.

Syntaxfree [-h | -m | -g] [-w] [-t] [-s SECONDS] [-c COUNT]

Watch it run

A dashboard shows the web server at 95% memory used. Check whether that is a real problem.

devops@devops-lab: ~ — zsh — 96×28
➜ ~
Step 1 of 3
free -h

free is only 412Mi, which is where the 95% alert came from. But 3.7Gi is page cache the kernel will hand back on demand, and available says 3.8Gi can still be allocated without swapping. Healthy.

Anatomy of a command

$
commandfree

procps-ng free: reads /proc/meminfo once per report and prints a small table.

How it works

free reads /proc/meminfo and does some arithmetic. total is MemTotal (RAM minus what the kernel reserved at boot). free is MemFree, pages nobody is using at all. buff/cache is Buffers + Cached + SReclaimable: file contents and kernel objects kept in RAM to avoid disk reads. shared is Shmem (tmpfs, /dev/shm, shared memory), which lives in the cache but can't be dropped while files exist. available is MemAvailable, the kernel's own estimate of how much can be allocated without swapping: free memory plus the reclaimable part of the cache, minus reserves. In procps-ng 4, used is total minus available. The page cache is reclaimed automatically under pressure (kswapd), so a box with little free and plenty available is healthy. When available nears zero the kernel swaps, if it has swap, and then the OOM killer starts killing processes.

Programs and the page cache share RAM; under pressure the kernel reclaims cache, then swaps, then kills.

allocateread()evict cleanpage outnothing leftSIGKILLProcessesmalloc + touchUsed (anon)heap, stacksFile readslogs, binariesPage cachebuff/cachekswapdreclaimSwapdiskOOM killerlast resort
1/7
Programs allocate memory

When a process writes to memory it allocated, the kernel gives it real pages. These anonymous pages are the 'used' memory that belongs to processes (RSS in ps).

3.9Giused
← → to step

Options you'll actually use

-hHuman-readable sizes (Ki, Mi, Gi)
-m / -gShow in MiB / GiB (integers, rounded down)
--siUse powers of 1000 instead of 1024
-wWide: separate buffers and cache columns
-tAdd a Total line (RAM + swap)
-s NRepeat every N seconds
-c NRepeat N times, then exit
-LOne-line summary per report

Common mistakes

Alerting on the free column (or 'used' from old tools that include cache)

Linux keeps free low on purpose by caching files. Alerts based on it fire on perfectly healthy hosts.

Alert on MemAvailable / available, plus swap activity and OOM kills
Running echo 3 > /proc/sys/vm/drop_caches from cron to 'free memory'

It discards useful cache, so the next reads hit the disk; available memory doesn't increase.

Leave the cache alone; find the process using the memory
Assuming buff/cache can always be reclaimed

tmpfs, /dev/shm and shared memory (the shared column) sit in the cache but can't be dropped while in use.

Check shared and df -h /dev/shm /tmp /run
Reading free inside a container to see its memory limit

free reads /proc/meminfo, which shows the host's RAM, not the container's cgroup limit.

cat /sys/fs/cgroup/memory.max and memory.current

Interview questions

Practice

Try these on a Linux machine of your own. Each task has a hint and a solution.

  1. 1

    Show memory usage in human-readable units, with buffers and cache in separate columns.

  2. 2

    Print available memory in MiB only, as a bare number for a script.

  3. 3

    Watch memory every 2 seconds, 5 times.

  4. 4

    Find the MemAvailable line that free's 'available' column comes from.

Related commands

vmstatReport CPU, memory, swap and I/O activity over timetopWatch CPU, memory and processes livepsSnapshot the running processesdmesgRead the kernel's message log
PreviouslscpuNextuptime
Linux / System Information / free

free

Show used, free and available memory

Beginneressentialmemoryperformance

free shows how RAM and swap are used: by processes, by the page cache, and how much is still available for new work. The column to watch is available, not free: Linux deliberately fills spare RAM with cache and gives it back when programs need it.

Syntaxfree [-h | -m | -g] [-w] [-t] [-s SECONDS] [-c COUNT]

Watch it run

A dashboard shows the web server at 95% memory used. Check whether that is a real problem.

devops@devops-lab: ~ — zsh — 96×28
➜ ~
Step 1 of 3
free -h

free is only 412Mi, which is where the 95% alert came from. But 3.7Gi is page cache the kernel will hand back on demand, and available says 3.8Gi can still be allocated without swapping. Healthy.

Anatomy of a command

$
commandfree

procps-ng free: reads /proc/meminfo once per report and prints a small table.

How it works

free reads /proc/meminfo and does some arithmetic. total is MemTotal (RAM minus what the kernel reserved at boot). free is MemFree, pages nobody is using at all. buff/cache is Buffers + Cached + SReclaimable: file contents and kernel objects kept in RAM to avoid disk reads. shared is Shmem (tmpfs, /dev/shm, shared memory), which lives in the cache but can't be dropped while files exist. available is MemAvailable, the kernel's own estimate of how much can be allocated without swapping: free memory plus the reclaimable part of the cache, minus reserves. In procps-ng 4, used is total minus available. The page cache is reclaimed automatically under pressure (kswapd), so a box with little free and plenty available is healthy. When available nears zero the kernel swaps, if it has swap, and then the OOM killer starts killing processes.

Programs and the page cache share RAM; under pressure the kernel reclaims cache, then swaps, then kills.

allocateread()evict cleanpage outnothing leftSIGKILLProcessesmalloc + touchUsed (anon)heap, stacksFile readslogs, binariesPage cachebuff/cachekswapdreclaimSwapdiskOOM killerlast resort
1/7
Programs allocate memory

When a process writes to memory it allocated, the kernel gives it real pages. These anonymous pages are the 'used' memory that belongs to processes (RSS in ps).

3.9Giused
← → to step

Options you'll actually use

-hHuman-readable sizes (Ki, Mi, Gi)
-m / -gShow in MiB / GiB (integers, rounded down)
--siUse powers of 1000 instead of 1024
-wWide: separate buffers and cache columns
-tAdd a Total line (RAM + swap)
-s NRepeat every N seconds
-c NRepeat N times, then exit
-LOne-line summary per report

Common mistakes

Alerting on the free column (or 'used' from old tools that include cache)

Linux keeps free low on purpose by caching files. Alerts based on it fire on perfectly healthy hosts.

Alert on MemAvailable / available, plus swap activity and OOM kills
Running echo 3 > /proc/sys/vm/drop_caches from cron to 'free memory'

It discards useful cache, so the next reads hit the disk; available memory doesn't increase.

Leave the cache alone; find the process using the memory
Assuming buff/cache can always be reclaimed

tmpfs, /dev/shm and shared memory (the shared column) sit in the cache but can't be dropped while in use.

Check shared and df -h /dev/shm /tmp /run
Reading free inside a container to see its memory limit

free reads /proc/meminfo, which shows the host's RAM, not the container's cgroup limit.

cat /sys/fs/cgroup/memory.max and memory.current

Interview questions

Practice

Try these on a Linux machine of your own. Each task has a hint and a solution.

  1. 1

    Show memory usage in human-readable units, with buffers and cache in separate columns.

  2. 2

    Print available memory in MiB only, as a bare number for a script.

  3. 3

    Watch memory every 2 seconds, 5 times.

  4. 4

    Find the MemAvailable line that free's 'available' column comes from.

Related commands

vmstatReport CPU, memory, swap and I/O activity over timetopWatch CPU, memory and processes livepsSnapshot the running processesdmesgRead the kernel's message log
PreviouslscpuNextuptime