iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
free -m and ps aux report different layers of Linux memory, so their totals are not supposed to match. free -m summarizes physical RAM and swap for the entire machine, while ps aux reports virtual and resident memory for individual processes. The gap usually consists of file cache, reclaimable kernel memory, shared pages, process overhead that ps excludes, and differences in sampling time.
What free -m actually measures
The free utility reads /proc/meminfo and presents a host-wide accounting of physical memory and swap. The -m option requests megabyte display units; the kernel counters are exposed in KiB and procps converts them for presentation. It is therefore a machine-level view, not a list of application allocations.
The command’s principal output fields are:
| Field | Meaning |
|---|---|
total |
Total physical RAM, or total swap in the swap row. |
used |
On current procps, calculated as total - available. It is not the sum of process RSS values. |
free |
Pages that are completely unused at the instant of the reading. |
shared |
Memory attributed to shared allocations, including tmpfs and shared-memory use as represented by the kernel counters. |
buff/cache |
Buffers, file page cache, tmpfs/shmem, and reclaimable slab memory managed by the kernel. |
available |
An estimate of memory that new applications can obtain without forcing the system to swap. |
The modern interpretation is to watch available, not to treat every page outside free as permanently consumed by applications. The kernel estimates MemAvailable from free pages, reclaimable slab, file-backed LRU pages, and low-watermark constraints. A large buff/cache value can therefore coexist with healthy available memory: Linux is using otherwise idle RAM to speed up file access and will reclaim suitable pages when demand rises.
The kernel defines Cached as in-memory file data (the page cache) together with tmpfs and shmem pages. Reclaimable slab objects are another host-level category. These pages are not represented as one process’s private resident allocation, which is why a process list can look small while free reports substantial use.
#1 Best Overall
Swap is also accounted separately. The swap row tells you how much swap space exists and how much is occupied; it is not a duplicate of the RAM figures. A nonzero swap-used value does not by itself prove that the machine is currently under memory pressure, but a falling available value combined with active swapping warrants investigation.
What ps aux actually measures
ps aux uses the BSD-style u format to display one row per selected process. Among its memory columns are virtual size, resident set size, and a percentage derived from resident memory.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstall| Column | Definition | How to interpret it |
|---|---|---|
VSZ |
Virtual memory size, shown in KiB. | The process’s address space: mappings, reservations, libraries, stacks, and other virtual regions whether or not every page is backed by RAM. |
RSS |
Resident set size. | Non-swapped physical pages currently resident for that task’s mappings. |
%MEM |
RSS divided by the machine’s physical memory. | A per-process percentage using the host’s RAM as the denominator, not the free command’s used field. |
VSZ is an address-space measurement, not a claim that the process occupies that many RAM bytes. A program can reserve a large range with mmap, create a sparse allocation, or map a shared library without faulting all of those pages into memory. RSS is closer to a physical-memory question, but it is still not a complete bill for the process.
The ps manual explicitly says that SIZE and RSS omit page tables, the kernel stack, struct thread_info, and struct task_struct. The manual notes that these omitted structures are usually at least 20 KiB of resident memory per process. Other kernel allocations are accounted at the system level rather than charged into the RSS column.
Compare the two commands by the question they answer
| Axis | free -m |
ps aux |
|---|---|---|
| Scope | Entire host: RAM, swap, caches, slabs, and other kernel-managed categories. | Individual processes and their address-space mappings. |
| Primary source | /proc/meminfo. |
Per-process procfs data used by procps. |
| Addressing | Physical-memory and swap accounting. | Virtual size (VSZ) and resident pages (RSS). |
| Sharing treatment | Host totals do not need to assign a shared page to a particular process. | RSS can count one shared physical page in every process that maps it. |
| Reclaimability | Shows available memory and buffers/cache, including pages the kernel can reclaim. | Does not classify the host’s reclaimable cache or slab pools. |
| Kernel overhead | Included in host categories where the kernel accounts it. | Several per-process kernel structures are excluded from SIZE and RSS. |
| Sampling | A live snapshot taken when the command reads the counters. | Separate live snapshots for rows read while the command runs. |
Why the numbers diverge
free covers the machine; ps lists tasks
The first difference is scope. The memory line in free includes every process plus the kernel, page cache, tmpfs, shared memory, slab allocators, and other host consumers. A row in ps represents one task. Adding rows can at best approximate selected user-space mappings; it cannot recreate all machine-wide categories.
VSZ includes pages that are not in RAM
Virtual memory is deliberately larger than resident memory in many normal workloads. Reserved address space, untouched anonymous pages, file mappings that have not been faulted in, and copy-on-write regions contribute to VSZ. Summing VSZ values therefore produces an address-space total with no meaningful comparison to physical RAM.
Free tools Windows power users keep installed
One-click scans. No signup required.
RSS counts shared pages once per mapping
Suppose several processes map the same shared library or shared-memory segment. Each process’s RSS can include the resident page, so adding RSS rows counts that physical page repeatedly. The host has only one copy (or one set of shared pages), while the process list attributes it to each mapper.
For attribution, proportional set size (PSS) divides each shared page among the processes that map it. A page mapped by four processes contributes one quarter of its size to each process’s PSS. PSS is therefore more useful than RSS when you need an estimate of each process’s proportional contribution, although PSS totals still need to be interpreted alongside kernel and cache memory.
Host memory includes categories no process row owns
Page tables and kernel stacks support processes but are not included in the RSS figures described by the ps manual. The kernel also consumes memory for slab objects, filesystem metadata, networking, device drivers, pinned pages, and other internal structures. Tmpfs and shared-memory pages can appear in host counters without looking like private anonymous RSS for one obvious process. Huge pages and workload-specific pools can create additional differences.
Cache is useful memory, not necessarily lost memory
Linux intentionally fills idle RAM with file data and metadata. This is reflected in buff/cache and in the kernel’s Cached, SReclaimable, and related counters, but it may not appear as a large process RSS total. If available remains ample, the cache is normally doing useful work rather than indicating a leak.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →The commands do not read the system at exactly the same instant
Both utilities read live procfs files. Processes allocate and release pages, the page cache changes, and the kernel reclaims memory continuously. Running free and then ps gives two snapshots separated by time; displayed rounding can add a small apparent discrepancy even when the underlying categories overlap.
Is RSS or VSZ the real RAM usage?
For the question “Which process currently has resident pages in RAM?”, RSS is the relevant starting point. It is not a complete charge, because shared pages are counted repeatedly and excluded kernel structures are absent. For “How much address space has this process reserved?”, VSZ is appropriate. It should not be used as a physical-memory total.
| Question | Metric to inspect | Important limitation |
|---|---|---|
| Which tasks have the most resident pages right now? | RSS, sorted descending. | Shared mappings can be counted more than once. |
| How much of a process’s footprint is proportionally attributable to it? | PSS from smaps or smaps_rollup. |
Reading these files costs more and requires permission for some processes. |
| How large is the process’s virtual address space? | VSZ. | Reserved or lazily populated regions may consume little or no RAM. |
| Why is the host’s RAM nearly full? | free plus /proc/meminfo. |
A process list alone omits caches and several kernel pools. |
A practical reconciliation workflow
1. Establish the host-level picture
- Run
free -mfor megabytes orfree -hfor human-readable units. - Read
available,buff/cache, and the swap row together. Do not equateusedwith the sum of application RSS. - Record the output before running additional commands, because the values are live snapshots.
2. Inspect the underlying counters
Use a focused view of /proc/meminfo:
grep -E '^(MemTotal|MemFree|MemAvailable|Cached|SReclaimable|Slab|Shmem|SwapTotal|SwapFree):' /proc/meminfoThese fields explain where the headline values come from:
| Counter | What it helps explain |
|---|---|
MemTotal |
Physical RAM visible to the kernel. |
MemFree |
Completely unused pages. |
MemAvailable |
Estimated capacity for new allocations without swapping. |
Cached |
File page cache plus tmpfs/shmem as defined by the kernel documentation. |
SReclaimable |
Reclaimable slab memory included in the available-memory estimate. |
Slab |
Kernel slab allocations, both reclaimable and unreclaimable portions. |
Shmem |
Shared-memory and tmpfs pages charged in the host accounting. |
SwapTotal and SwapFree |
Total swap capacity and the unused portion. |
3. Rank resident process memory
Use an explicit format rather than relying on terminal column choices:
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
ps -eo pid,comm,vsz,rss,%mem --sort=-rssCompare RSS with VSZ for each row, but do not add VSZ values and do not assume that adding RSS will equal free‘s used field. The command’s %mem values use physical RAM as their denominator, so their sum can be less than, equal to, or greater than an intuitive “used” percentage depending on sharing and omitted host categories.
4. Measure proportional ownership when sharing matters
For a process identified by its PID, inspect the kernel’s aggregate mapping report:
cat /proc/PID/smaps_rollupLook for Rss, Pss, private and shared clean/dirty pages, and anonymous, file-backed, or shmem components. If smaps_rollup is unavailable, /proc/PID/smaps provides the same information per mapping. Access may require appropriate privileges, and reading detailed mappings is more expensive than reading the compact ps view.
5. Investigate non-process consumers
If the process list still does not account for low host availability, return to /proc/meminfo. High slab, shmem/tmpfs, huge-page, pinned-page, or device/filesystem-cache usage can explain the remainder. The appropriate next tool depends on the workload; the important point is that these categories belong to host accounting, not to a single RSS row.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsHow to diagnose common readings
High buff/cache, high available
This is normally ordinary Linux caching. The kernel is using spare RAM for file data and reclaimable objects, while MemAvailable indicates that applications can still obtain memory without immediate swapping. A large cache number alone is not evidence of a leak.
Low available, modest RSS totals
Check Slab, SReclaimable, Shmem, huge-page counters, pinned or locked memory, and device or filesystem caches. These host-level consumers can be substantial without appearing as private RSS in the process list.
Best Value
- New
- Mint Condition
- Dispatch same day for order received before 12 noon
- Guaranteed packaging
- No quibbles returns
Very large VSZ, relatively small RSS
The process has reserved or mapped a large address space but has not made all of it resident. Investigate its allocation strategy and mappings; do not conclude that it has consumed VSZ bytes of RAM.
RSS sum larger than the physical memory in use
Shared libraries and shared mappings are being counted once for every process that maps them. Use PSS to divide shared pages proportionally before comparing process footprints.
Swap is occupied
Some pages have been moved out of RAM, but the swap-used number alone does not identify the responsible process or prove current thrashing. Compare it with MemAvailable, swap activity, and process PSS/RSS while observing the system over time.
Version and interpretation details
MemAvailable has been available as a kernel metric since Linux 3.14; on older kernels, procps emulated an estimate. When comparing older systems, verify what the installed free implementation reports before applying modern interpretations.
Units also matter. The values in /proc/meminfo are generally reported in KiB. free -m converts them for a megabyte-oriented display, and rounding means that displayed columns will not always add exactly. For byte-level investigations, use the procfs counters directly and keep their units consistent.
The reliable way to answer “where did the RAM go?”
Start with the host view, especially MemAvailable, then separate resident process memory from virtual reservations. Use PSS rather than a raw RSS sum when shared mappings are important, and inspect slab, shmem/tmpfs, cache, swap, and other kernel categories when process rows do not explain the host total. The apparent disagreement is not a measurement failure: the commands are answering different questions at different scopes.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
