«Linux is eating all my RAM» is one of the things I hear most often from people coming from Windows. They open a system monitor, see the memory almost full and assume there is a problem. In the vast majority of cases it is the opposite: the system is using free memory in the most useful way possible. To tell a normal situation from a real shortage you need to read the right numbers.
Unused RAM is wasted RAM
Linux keeps a copy of recently read files in memory, the page cache. If you reopen a document or relaunch a program, the data is already in RAM and doesn't need to be read from disk again. When an application needs memory, the kernel frees the cache instantly. That memory, then, is occupied but available.
Reading free
The reference command is:
free -h
The output has these columns:
| Column | Meaning |
|---|---|
total |
usable installed RAM |
used |
memory used by programs |
free |
memory not used at all |
buff/cache |
file cache and kernel buffers |
available |
estimate of how much memory programs can still obtain |
The number that matters is available, not free. A system with 16 GB, 300 MB «free» and 9 GB «available» is perfectly fine. The warning sign is an available value approaching zero while swap fills up.
To see who is using memory, top or htop sorted by the RES column show each process's physical memory. In modern browsers each tab is often a separate process, so it is worth looking at the total.
What swap is
Swap is space on disk where the kernel moves rarely used memory pages, to leave RAM for what really needs it. It is not extra RAM: a disk, even a fast SSD, is much slower than memory. Its job is to give breathing room during peaks and to stop programs being closed suddenly.
To see the active swap:
swapon --show
It can be a dedicated partition or a file. A file is more flexible, because it can be created, enlarged or removed without touching the partitions.
Creating a swap file
On ext4, for a 4 GB file:
sudo fallocate -l 4G /swapfile
sudo chmod 600 /swapfile
sudo mkswap /swapfile
sudo swapon /swapfile
The chmod 600 is necessary: swap can hold fragments of memory with confidential data, and no other user should be able to read it. To make it permanent, add it to /etc/fstab:
/swapfile none swap sw 0 0
On Btrfs the procedure is different, because the file must be excluded from copy-on-write; recent versions of the tools offer the btrfs filesystem mkswapfile command, which takes care of it.
How much swap you need
There is no rule that suits everyone. A few practical criteria:
- a desktop with plenty of RAM can work with a few GB of swap, which still acts as a cushion;
- to use hibernation, which saves all memory to disk, swap must be at least as large as the RAM in use at that moment;
- on a small server with little memory, some swap stops a peak from killing the database.
swappiness
The vm.swappiness parameter indicates how inclined the kernel is to move pages to swap rather than free cache. The default on many distributions is 60.
cat /proc/sys/vm/swappiness
sudo sysctl vm.swappiness=10
A lower value makes the kernel prefer dropping cache. To make it permanent, create a file in /etc/sysctl.d/, for example 99-swappiness.conf, containing the line vm.swappiness=10. It is only worth changing if you see a concrete problem, such as a desktop that becomes sluggish after sitting idle.
zram: compressed swap in memory
Several distributions, Fedora among them, use zram by default: a swap device that lives in RAM itself, in compressed form. It sounds like a paradox, but it works: compressing little-used pages costs less than writing them to disk. On computers with little memory, or with slow storage such as SD cards, it is often the best solution. zramctl shows how much space it takes and with what compression ratio.
When memory runs out: the OOM killer
If RAM and swap are exhausted, the kernel has to choose: freeze or sacrifice a process. The OOM killer (Out Of Memory) steps in, picks a process based on a score linked mainly to the memory it occupies, and terminates it. A line like this appears in the logs:
Out of memory: Killed process 2314 (java)
You find it with journalctl -k | grep -i oom. In my work, when a service «dies for no reason», this is one of the first checks. The fix is not to disable the OOM killer but to understand why memory runs out: a badly set limit, a memory leak in the application or simply a machine too small for the load. Some distributions add systemd-oomd, which acts earlier, when the system starts slowing down for lack of memory.
In short
- Memory occupied by cache is available: the value to watch in
free -hisavailable. - Swap is not extra RAM but a cushion for peaks and little-used pages.
- A swap file takes a few commands to create and must be protected with
chmod 600. vm.swappinessand zram let you adapt the behaviour to hardware and usage.- When a process vanishes, look for the OOM killer's lines in the kernel log.
