Memory Metrics Explained

Understanding memory usage is crucial for Linux server administration, yet it's one of the most commonly misunderstood aspects of system monitoring. The Linux kernel's aggressive memory management strategies—particularly around caching and buffering—mean that traditional concepts of "free" and "used" memory don't tell the full story.

Server Scout collects 17 detailed memory metrics every 5 seconds from /proc/meminfo, providing comprehensive insight into how your system manages RAM. This article explains each metric and how to interpret them for effective server monitoring.

The Linux Memory Model

Before diving into individual metrics, it's essential to understand how Linux manages memory. The kernel operates on a simple principle: unused RAM is wasted RAM. Consequently, Linux aggressively uses available memory for caching disk data and buffering filesystem operations.

This creates a common misconception: seeing high "used" memory doesn't indicate a problem. In fact, it often indicates a well-optimised system making full use of available resources. The critical metric is available memory—how much RAM can be allocated to new processes without causing memory pressure.

Linux memory consists of several categories:

• Application memory: RAM allocated to running processes (heap, stack, shared libraries)
• Kernel memory: Used by the kernel itself, including various caches and buffers
• Page cache: Disk data cached in RAM for faster access
• Buffers: Metadata about block devices and filesystem structures
• Reclaimable memory: Cache and buffers that can be freed when applications need more RAM

The beauty of this system is that cache and buffers automatically shrink when applications require more memory, making the transition seamless and maximising performance.

Primary Memory Health Indicators

Essential Metrics for Daily Monitoring

mem_percent represents the percentage of total RAM currently in use, calculated as (total - available) / total × 100. This provides a quick overview of memory utilisation, but don't panic if it's consistently high—this often indicates efficient cache usage.

mem_available_mb is the most critical memory metric. It represents RAM that can be allocated to new processes without swapping, accounting for reclaimable cache and buffers. This is the /proc/meminfo MemAvailable field, which the kernel calculates based on current memory pressure and reclaimable resources.

When mem_available_mb drops below 10-15% of total system RAM, your system is experiencing memory pressure. Applications may start experiencing allocation delays, and the kernel may begin more aggressive cache reclamation or swapping.

mem_total_gb and mem_used_gb provide context for understanding the absolute scale of memory usage on your system.

Cache and Buffer Metrics

Understanding Linux Caching Behaviour

mem_cached_mb represents the page cache—disk data cached in RAM for faster subsequent access. This is typically the largest component of memory usage and is entirely normal. High cache usage indicates your system is efficiently caching frequently accessed files, reducing disk I/O.

The page cache automatically shrinks when applications need more memory, so large cache sizes are generally beneficial rather than problematic. Sudden drops in cache size often correlate with increased application memory allocation.

mem_buffers_mb contains metadata about block devices and filesystem structures. This is typically much smaller than the page cache (usually tens of megabytes) and remains relatively stable.

mem_slab_reclaimable_mb includes kernel data structures that can be reclaimed under memory pressure, such as directory entry caches (dentries) and inode caches. This grows with filesystem activity—servers handling many files will show higher slab usage.

mem_slab_unreclaimable_mb represents kernel memory that cannot be reclaimed. Watch for steady growth over time, as this can indicate kernel memory leaks, particularly with certain drivers or kernel modules.

Application and System Memory

Understanding Real Memory Usage

mem_anon_pages_mb represents anonymous pages—memory allocated by applications for heap, stack, and memory-mapped regions. This is the truest measure of application memory usage, excluding cache and buffers.

Unlike cache memory, anonymous pages cannot be simply discarded—they must be swapped to disk if reclaimed. Monitoring trends in anonymous memory usage helps identify memory leaks or unexpectedly growing application footprints.

mem_shmem_mb includes both System V shared memory segments and tmpfs filesystem usage (including /dev/shm). Database systems like PostgreSQL and applications using shared memory for inter-process communication contribute to this metric. Tmpfs mounts also consume this memory type.

mem_page_tables_mb represents the overhead of virtual memory management—the kernel data structures mapping virtual addresses to physical memory. This grows with the number of processes and the size of their virtual address spaces. Extremely high values may indicate memory fragmentation or an excessive number of processes.

mem_committed_mb shows the total virtual memory promised to all processes. Linux allows overcommitting memory—promising more than physically available. If committed memory significantly exceeds total RAM plus swap space, the system becomes vulnerable to out-of-memory conditions.

Swap and Memory Pressure

Monitoring Memory Pressure Indicators

mem_swap_used_mb and mem_swap_total_mb track swap space utilisation. Some swap usage is entirely normal—Linux proactively swaps out inactive memory pages to make room for more cache.

However, steadily growing swap usage or consistently high swap utilisation (>500MB on most systems) may indicate memory pressure. The system is increasingly relying on disk-based storage for memory, which significantly impacts performance.

mem_dirty_mb represents modified data in memory that hasn't yet been written to disk. During normal operation, this remains relatively small (under 100MB). During heavy write workloads, dirty memory can legitimately spike higher.

Sustained high dirty memory may indicate slow disk I/O preventing timely writeback, potentially leading to memory allocation stalls when the dirty memory limit is reached.

Specialised Memory Types

Advanced Memory Metrics

mem_hugepages_total and mem_hugepages_free are only relevant when huge pages are configured, typically for database systems like Oracle, PostgreSQL, or high-performance computing applications.

Huge pages reduce memory management overhead by using larger page sizes (typically 2MB instead of 4KB). If huge pages are allocated (mem_hugepages_total > 0), you generally want to see mem_hugepages_free at zero, indicating full utilisation.

Unused huge pages represent wasted memory, as they cannot be used for regular allocations or cache.

Interpreting Memory Metrics in Practice

When to Take Action

Memory monitoring isn't about maintaining low usage—it's about ensuring your system can handle its workload without performance degradation. Focus on these warning signs:

1. Available memory consistently below 15% of total: The system is under memory pressure
2. Swap usage growing steadily: Applications are being pushed to disk storage
3. High dirty memory with slow I/O: Write operations may be stalling memory allocation
4. Unreclaimable slab memory growing continuously: Potential kernel memory leak

Healthy vs. Problematic Memory Patterns

A healthy system typically shows:

• High cache usage (efficient disk caching)
• Stable available memory above critical thresholds
• Minimal or stable swap usage
• Committed memory within reasonable bounds of physical capacity

Problematic patterns include:

• Available memory trending downward over time
• Swap usage climbing consistently
• Frequent out-of-memory kills (check system logs)
• Application performance degradation correlating with memory metrics

Server Scout's 5-second collection interval for memory metrics allows you to spot these patterns quickly and correlate memory pressure with performance issues in real-time. Understanding these metrics enables proactive memory management and helps prevent performance problems before they impact your applications.