Monitoring Memory Usage in Linux: A Comprehensive Guide

Introduction

Effective RAM monitoring is a key skill for Linux administrators and developers working with servers. Improper memory usage leads to system slowdowns, OOM Killer errors, and emergency reboots. In this guide, you will learn how to use built-in and third-party tools to obtain accurate information about memory state, interpret it, and make informed decisions.

Basic Commands for a Quick Overview

free: Overall Statistics

The simplest way to get a summary:

free -h

Example output:

              total        used        free      shared  buff/cache   available
Mem:           7.7G        1.2G        5.1G        156M        1.4G        6.1G
Swap:          2.0G          0B        2.0G

Key columns:

• total — total amount.
• used — utilised memory (applications + caches). Don't confuse with actual usage!
• free — completely unused memory (in Linux, this value is often small).
• buff/cache — memory occupied by disk cache and buffers.
• available — the most important metric. An estimate of memory available for new processes without swapping.

💡 Tip: Always look at available, not free. High buff/cache is normal and useful.

top / htop: Real-time Monitoring

top is available on any system. For a more convenient interface, install htop.

htop

In htop:

• Press F6 → choose sorting by %MEM (percentage of total RAM) or RES (physical memory in KiB).
• The VIRT column — virtual memory (including shared libraries, swap).
• The SHR column — shared memory (e.g., shared libraries).

vmstat: Virtual Memory Summary

vmstat -s

Will show detailed statistics, including swap-in and swap-out counts.

/proc/meminfo: "Raw" Data from the Kernel

cat /proc/meminfo

This is the source for all the utilities listed above. Useful for scripts.

sar: Historical Data (Requires Setup)

If the sysstat package is installed:

sar -r 1 3  # every second, 3 times

Graphical Utilities

For workstations with a GUI:

• GNOME System Monitor (gnome-system-monitor): The "Resources" tab shows memory and swap graphs.
• KDE System Guard (ksysguard): Similar, with the ability to add sensors.

Advanced Tools

nmon — Powerful All-in-One Monitoring

Installation:

# Ubuntu/Debian
sudo apt install nmon

# RHEL/CentOS/Fedora
sudo yum install nmon  # or dnf

Run: nmon. Press m for memory graphs, c for CPU, d for disk. q — exit.

glances — Cross-platform Monitor with a Web Interface

Installation:

pip3 install glances  # requires Python

Run:

glances

For remote monitoring:

glances -w  # starts a web server on port 61208

Then open in a browser http://<your_server>:61208.

How to Interpret Metrics

Common Beginner Mistakes

1. Free memory (free) is close to zero — this is normal. Linux uses RAM for cache. Look at available.
2. Swap (swap) is actively used — if si/so in vmstat are constantly non-zero, the system is actively swapping. This is a sign of insufficient RAM.
3. High buff/cache — not a problem. The system will free this memory if a process needs it.
4. A process's RES is larger than its VIRT — usually impossible. Check if the process is duplicated in top (e.g., threads).

Warning Signs

• available < 10% of total.
• Constant si/so > 0 in vmstat.
• Frequent Out of memory messages in dmesg or logs (journalctl -k | grep -i oom).

Monitoring Automation

Simple Script for Sending Alerts

Create /usr/local/bin/memory_alert.sh:

#!/bin/bash
THRESHOLD=90  # percentage
CURRENT=$(free | awk '/Mem:/ {printf("%.0f"), $3/$2 * 100}')
if [ "$CURRENT" -ge "$THRESHOLD" ]; then
    echo "Warning: memory usage ${CURRENT}% (threshold ${THRESHOLD}%)" | \
    mail -s "Alert: memory on $(hostname)" admin@example.com
fi

Add to crontab (crontab -e):

*/5 * * * * /usr/local/bin/memory_alert.sh

Logging with sar

Configure sysstat (installed on most distributions by default):

sudo systemctl enable --now sysstat

Data will be collected every 10 minutes. View:

sar -r -f /var/log/sa/sa$(date +%d)  # for today

Tool Comparison

Additional Features

Monitoring Memory for a Specific Process

# Find out how much memory a process with PID 1234 uses
pmap -x 1234 | tail -1

Finding Processes Using Swap

for pid in $(ls /proc | grep '^[0-9]'); do
    swap=$(grep VmSwap /proc/$pid/smaps 2>/dev/null | awk '{sum+=$2} END {print sum}')
    if [ "$swap" -gt 0 ]; then
        echo "PID $pid uses ${swap}KiB of swap: $(ps -p $pid -o comm=)"
    fi
done

Checking Memory Fragmentation (NUMA systems only)

numactl --hardware

Conclusion (Last Content Section)

Effective memory monitoring in Linux is built on two pillars: regular collection of basic statistics (free, top) and in-depth analysis when problems arise (nmon, glances, pmap). Don't panic over high buff/cache — it's a kernel optimization. Focus on available and swap activity.

Start simple: add free -h and htop to your daily checklist for a quick assessment. When issues occur, use nmon to record a session (nmon -f -s 10 -c 100) for later analysis.

Remember: the best monitoring is the one set up in advance and warns of problems before they become critical. Automate data collection via sar or glances and set up alerts for low available.