Read available, not free
Linux uses otherwise unused memory as a disk cache, so low free memory on a healthy server is normal. The available column is the kernel estimate of how much memory new work can get without swapping. That is the number to watch. The exact calculation of used depends on the version of the tool, so do not compare it between different systems.
free -h
grep -E 'MemAvailable|Shmem:|SReclaimable' /proc/meminfoWhat cache can and cannot release
Page cache can usually be released when applications need memory. Shared memory and tmpfs (Shmem) appear under cache too, but they cannot simply be dropped, because they hold data that has no copy on disk. A large cache with low available memory therefore often means a large tmpfs or shared memory segment.
df -h -t tmpfs
sudo slabtop -o | head -15Swap in use is not automatically a problem
A server may keep rarely used pages in swap for weeks without harm. What hurts is continuous movement. Watch the si and so columns in vmstat: values that stay above zero mean the system is actively swapping, which is a sign of a real shortage.
swapon --show
vmstat 1 5Find what uses the memory
Sort processes by resident memory. RSS counts pages shared between processes in each of them, so the values of several processes do not simply add up. Tools with PSS, such as smem, give a fairer sum if you have them installed.
ps -eo pid,user,rss,comm --sort=-rss | head -15Recognise a real shortage
The signs are low available memory, constant swapping, and processes killed by the out-of-memory killer. Check the kernel log. Do not run drop_caches to make the numbers look better: it only makes the server read from disk again and does not solve anything.
sudo journalctl -k --no-pager | grep -iE 'out of memory|oom-kill'Memory in CH-J Server Manager
System Monitor reads these values over SSH. On Linux it defines used as MemTotal − MemFree − Buffers − Cached − SReclaimable, and available as the kernel estimate. Shared memory is part of Cached and is not releasable, and the categories in the bar do not overlap. Because the formula differs from some versions of free, the numbers may not match exactly. It also shows swap with its usage history. ZFS ARC is not treated separately, so on ZFS hosts it counts as used memory.