Guides

How to Check Memory Usage in Linux: free, top and ps Explained

By Ravindra Bagale, AWS & DevOps trainer · LinkedIn · Published: 16 October 2026 · Last updated: 17 October 2026

To check memory usage in Linux, run free -h and read the available column. That is the memory programs can still use. Low "free" is normal, because Linux uses spare RAM as disk cache (buff/cache) and gives it back when needed. To find which program uses the most RAM, run ps aux --sort=-%mem | head or press M in top. If programs are being killed, check dmesg -T | grep -i oom.

free -h                              # read "available"
ps aux --sort=-%mem | head -6        # biggest RAM users (RSS column)
swapon --show                        # is there swap?
sudo dmesg -T | grep -i "out of memory"   # OOM killer events
vmstat 1 5                           # si/so > 0 = swapping now

A live example first

A student's WordPress site on a t3.micro (1 GB RAM) keeps showing "Error establishing a database connection". Let us look:

free -h

               total        used        free      shared  buff/cache   available
Mem:           949Mi       812Mi        41Mi       12Mi       95Mi        72Mi
Swap:             0B          0B          0B

Only 72 MiB available, and no swap. Now the big users:

ps aux --sort=-%mem | head -4

USER    PID  %MEM   RSS COMMAND
mysql   702  41.2 400412 /usr/sbin/mariadbd
apache 1810   9.8  95320 php-fpm: pool www
apache 1811   9.6  93180 php-fpm: pool www

And the kernel log:

sudo dmesg -T | grep -i "killed process"

[Fri Oct 16 21:14:03 2026] Out of memory: Killed process 702 (mariadbd) total-vm:1532120kB, anon-rss:401204kB

So the database was being killed by the OOM killer, and WordPress could not connect. We made three changes:

1. Lowered PHP-FPM pm.max_children from 10 to 4.
2. Set MariaDB innodb_buffer_pool_size = 128M.
3. Added a 1 GB swap file as a safety net:

sudo dd if=/dev/zero of=/swapfile bs=1M count=1024
sudo chmod 600 /swapfile && sudo mkswap /swapfile && sudo swapon /swapfile
echo '/swapfile none swap sw 0 0' | sudo tee -a /etc/fstab

Now available stays above 300 MiB, and the error is gone. Friends, the number to watch was available, and the proof was in dmesg.

How does Linux use memory?

Idle RAM is wasted RAM, so Linux fills it with cache to make disk reads faster. That is why free looks small on a healthy server.

How do I check memory step by step?

1. Run free -h and read available.
2. Run ps aux --sort=-%mem | head and note the biggest processes.
3. Read the RSS column (resident memory in KB). VSZ (virtual size) is often huge and not a real problem.
4. Run swapon --show and vmstat 1 5. Non-zero si/so means active swapping.
5. Run sudo dmesg -T | grep -i oom to see if anything was killed.
6. Tune the biggest user (below), then check again.

Per-process memory in detail

top               # press M to sort by memory, e to change units
htop              # easier view, F6 to sort
pmap -x <PID> | tail -1           # total for one process
cat /proc/<PID>/status | grep -E 'VmRSS|VmSwap'

To total memory by program name (useful with many PHP or Apache workers):

ps -C php-fpm -o rss= | awk '{s+=$1} END {print s/1024 " MB"}'

Tune memory by stack

See EC2 memory in CloudWatch

EC2 metrics come from outside the virtual machine, so CPU and network are there, but memory and disk space are not. Install the CloudWatch agent on the instance and choose memory (mem_used_percent) and disk (disk_used_percent). Then you can set an alarm at, for example, 85% memory. Azure needs the Azure Monitor Agent and Google Cloud the Ops Agent for the same reason.

Real example: "Linux ate my RAM"

New Linux users so often panic about low "free" memory that a famous page, linuxatemyram.com, exists only to explain that disk cache is normal and harmless. Since Linux kernel 3.14 (2014), the available column was added to free to make this clearer. When you report memory in an incident, always quote available and any OOM messages, not "free".

Mistakes to avoid

1. Dropping caches to "free memory". echo 3 > /proc/sys/vm/drop_caches only makes the next reads slower.
2. Adding huge swap instead of fixing a leak. The server will crawl.
3. Reading VSZ as real usage. Use RSS.
4. Forgetting per-worker memory. 10 PHP workers × 90 MB = 900 MB.

Summary table