iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
A CentOS server showing 80% or 95% memory use is not necessarily running out of RAM. Linux intentionally fills idle memory with filesystem cache, so the useful questions are how much memory is available, whether swap is active, and which processes or kernel components own the resident pages. Start with free -h, vmstat, top, and ps; use smem when shared libraries make process totals misleading. Then separate application, cache, cgroup, journald, and kernel pressure before changing limits or adding hardware.
What a high memory percentage actually means
Tools such as free and top report several different categories. A high “used” value can include memory that the kernel can reclaim quickly when an application needs it. Filesystem page cache and reclaimable kernel objects improve performance and are not equivalent to private application allocations.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →The most useful first indicator is MemAvailable, not MemFree. Available memory estimates what the kernel can give to new processes without heavy swapping. Swap activity and paging rates show whether the host is under real pressure. A machine with little free RAM, substantial available RAM, and no sustained swap traffic may be healthy; a machine with almost no available RAM and continuous swap-in/swap-out is not.
| Metric | What it represents | How to use it |
|---|---|---|
MemFree |
Completely unused RAM at that instant | Useful context, but too narrow to judge pressure by itself. |
MemAvailable |
Estimated RAM available for new work without major swapping | Primary indicator of headroom on modern Linux kernels. |
Cached, SReclaimable, and much of buff/cache |
Filesystem and reclaimable kernel cache | Normally released when needed; a large value alone is not a leak. |
SwapFree and paging rates |
Unused swap and the rate pages move between RAM and swap | Sustained swap-in/swap-out indicates pressure and likely latency. |
Slab and SUnreclaim |
Kernel memory used for internal caches and objects | Important when user-space RSS does not explain total use. |
There is no universal “normal CentOS memory percentage.” Workload, kernel version, cache behavior, and uptime determine a reasonable baseline. Compare the host with its own historical measurements and service requirements.
#1 Best Overall
- A-Tech 16GB RAM Module, DDR4 SO-DIMM 260-Pin, 3200MHz PC4-25600 (PC4-3200AA)
- Non-ECC Unbuffered, JEDEC DDR4 Standard 1.2V Operating Voltage
- Compatible with select Laptop, Notebook, Mini PC, and All-in-One (AIO) systems. Please verify your system's memory type, form factor, and maximum supported capacity before purchasing
- Not compatible with desktop DIMM, non DDR4 memory, or ECC memory types such as RDIMM, LRDIMM, and ECC UDIMM
- Increases available memory capacity to enhance system responsiveness, application performance, and multitasking capabilities.
Measure pressure before changing anything
Take a point-in-time summary
Run the following as an ordinary user; root is only needed for some later diagnostics:
free -h
cat /proc/meminfo | egrep 'MemTotal|MemFree|MemAvailable|Buffers|Cached|SReclaimable|Slab|SwapTotal|SwapFree'
vmstat 1 5In free -h, record total, available, swap used, and the buff/cache line. In vmstat, watch the si and so columns. Repeated non-zero values mean pages are being swapped in or out during the sample. Also inspect the run queue and I/O wait columns: reclaim and swap can make a server appear CPU-bound while it is actually waiting on storage.
Capture a trend, not just one snapshot
Memory incidents often follow a leak or a traffic pattern. Save samples during normal load and during the incident with vmstat, sar, service metrics, and cgroup counters. A single reading after a restart cannot establish whether usage is growing, stable, or simply cache warmed by a backup or deployment.
If the sysstat package is installed, these commands sample memory and swap activity:
sar -r 1 5
sar -W 1 5Keep timestamps with the output and correlate them with deployments, scheduled jobs, traffic, and log bursts.
Find the processes occupying resident memory
Use top for an interactive view
top -o %MEMIn top, RES is resident physical memory, SHR is the portion potentially shared with other processes, and %MEM is the process share of physical RAM. VIRT is the process address space; it can include mapped files, reserved address ranges, and swapped pages, so it is not a measurement of RAM actually resident.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Rank #2
- Compatible with select DDR4 Desktop computers + Easy to install at home, no expertise required
- Maximize your system's performance, boost loading speeds and multitask with ease
- Backed by A-Tech's Lifetime Warranty + Friendly tech support team available to help before and after your purchase
- Single 8GB RAM Module | DDR4 DIMM 288-Pin | Speeds up to 2400MHz, PC4-19200 / PC4-2400T
- NON-ECC Unbuffered | 1Rx8 or 2Rx8 - Single or Dual Rank | JEDEC DDR4 standard 1.2V
Use ps for a reproducible list
ps aux --sort=-%mem | head -n 20For ps, RSS is non-swapped physical memory and %MEM is its percentage of installed RAM. Save the command output before restarting anything. Include the command name, PID, elapsed time, start time, and service unit so you can identify a worker pool or a process that grows continuously.
Account for shared pages with smem
RSS can make several processes appear to own the same shared libraries in full. The smem utility reports physical use while accounting for shared pages. Its USS (unique set size) is private physical memory; PSS (proportional set size) divides shared pages among the processes using them.
smem -tk
smem -r -k -s pss | head -n 20Use USS to find processes whose memory is truly private and PSS to estimate each process’s fair share of total physical use. The smem manual describes this accounting as reporting physical memory “taking shared memory pages into account.”
Decide whether the cause is an application, a service group, or the kernel
One process or worker pool dominates
If one daemon or a group of workers has the largest RSS or PSS, inspect its heap, request backlog, cache configuration, and worker count. A web server, database, language runtime, or queue consumer may be correctly retaining data, or it may have a leak. Check the application’s own metrics and its package or release notes before imposing a host-wide change.
Recommended Free Tools
A restart can restore headroom, but it is containment rather than a repair. Record the process size and uptime before the restart, the workload that preceded growth, and the exact package or application version. Schedule recurring restarts only as a documented temporary measure while the leak or unbounded cache is fixed.
A systemd service owns the aggregate
A service may spawn several processes, so a process list can understate its total footprint. Inspect the service’s cgroup:
Rank #3
- 16GB Module ( 1x 16GB ) | DDR4 3200 MHz ( PC4-25600 / PC4-3200AA )
- DDR4 SO-DIMM ( 260-Pin ) | Non-ECC Unbuffered | 2Rx8 - Dual Rank x8 | 1.2V - DDR4 Standard Voltage
- High performance Memory RAM upgrade compatible with select DDR4 Laptop, Notebook, & All-in-One (AIO) Computers
- Boosts the performance of your system by speeding up loading times, improving system responsiveness, and increasing your system's ability to handle greater workloads
- All modules undergo quality assurance testing to ensure dependable and reliable performance
systemd-cgtop
systemctl status <service>
systemctl show <service> -p MemoryCurrent -p MemoryHigh -p MemoryMaxsystemd-cgtop ranks control groups and helps reveal a slice whose combined workers consume more memory than any single PID. Replace <service> with the real unit name, such as api.service; keep the angle brackets out of the command.
Process totals do not explain the host
When RSS/PSS totals are much lower than total use, inspect kernel memory, cgroups, and historical paging rather than repeatedly killing arbitrary processes:
cat /proc/meminfo | egrep 'Slab|SReclaimable|SUnreclaim'
dmesg -T | egrep -i 'oom|out of memory|killed process'
sar -r 1 5
sar -W 1 5A growing SUnreclaim value points toward kernel allocations that cannot be reclaimed easily. Review network, filesystem, container, and driver activity, and compare with kernel logs and recent changes. A cgroup limit can also make a service hit an OOM condition while the host still has unused memory elsewhere.
Common causes and the appropriate response
Filesystem cache is filling idle RAM
Linux caches recently used file data because serving it from RAM is faster than reading storage. Cache is generally reclaimable. Do not treat a large buff/cache number as proof of a leak, and do not make this command a routine fix:
echo 3 > /proc/sys/vm/drop_cachesDropping caches discards useful data, can create an immediate I/O storm as applications reread files, and does not reduce an application’s private allocation. Investigate cache only when MemAvailable is low, reclaim is stalling, or paging and latency show pressure. Capture measurements first so you can demonstrate whether reclaim changed anything.
An application cache or worker pool is unbounded
Reduce configured cache size, cap queue depth, lower worker concurrency, or apply the application’s documented memory limit. Validate the change against throughput and latency. If the service has a leak, a lower limit may cause earlier failures without stopping the leak; pair the limit with an upgrade or configuration fix.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Rank #4
- Compatible with select DDR4 Desktop computers + Easy to install at home, no expertise required
- Maximize your system's performance, boost loading speeds and multitask with ease
- Backed by A-Tech's Lifetime Warranty + Friendly tech support team available to help before and after your purchase
- 16GB RAM Kit ( 2 x 8GB Modules ) | DDR4 DIMM 288-Pin | Speeds up to 2666MHz (2667MHz), PC4-21300 / PC4-2666V
- NON-ECC Unbuffered | 1Rx8 or 2Rx8 - Single or Dual Rank | JEDEC DDR4 standard 1.2V
systemd or systemd-journald is abnormal
Check versions, journal activity, and recent package updates:
systemctl --version
rpm -q systemd
journalctl --disk-usage
journalctl -u systemd-journald --since todayRed Hat documented a RHEL 7 incident involving systemd-219-19.el7_2.13 in which PID 1 reached 3.508 GiB resident memory, or 61.9% of RAM, in 2024 reporting. That is an incident example, not a CentOS baseline. A separate Red Hat report gave example systemd-journald footprints of 152 MB versus 90 MB on otherwise similar servers. Such differences require checking the exact release, workload, and vendor fixes.
Journal retention settings primarily control disk storage, not the complete RAM footprint. In the systemd 252 manual, the default percentage limits for persistent and runtime journals are documented as 10% and 15%, each capped at 4 GiB. SystemMaxUse= and RuntimeMaxUse= cap persistent and runtime journal space; SystemKeepFree= and RuntimeKeepFree= reserve free disk space. Set these in the appropriate journald configuration, then restart or reload journald according to the documentation for your release. Continue measuring process and paging memory after changing retention.
Kernel or slab consumption is growing
High slab use can come from legitimate workloads such as large directory trees, networking, containers, or filesystem metadata. Compare Slab, SReclaimable, and SUnreclaim over time. Look for kernel warnings, driver changes, and workload events before attempting cache drops or reboots.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Swap is exhausted or constantly active
Swap gives the kernel another place to store cold pages, but it is slower than RAM. More swap can prevent an immediate crash while increasing I/O wait. Red Hat warns that complete use of memory and swap can make a system hang from increased I/O workload or crash after the out-of-memory killer terminates processes.
Check both capacity and activity. If swap is nearly full and vmstat shows sustained movement, reduce the workload or memory footprint first. A temporary increase in swap may buy recovery time, but it is not a substitute for fixing an application or adding RAM.
Best Value
- material: plastic
- Color: black, transparent
- Length: 128mm, wall thickness 0.3mm
- Features: Effectively protect DDR memory RAM modules, dust-proof and anti-static.
- Used for: Place a standard size DDR2 DDR3 DDR4 desktop DIMM module.
Contain a service with systemd memory controls
On CentOS releases whose systemd and kernel support these cgroup controls, use a drop-in rather than editing the vendor unit:
sudo systemctl edit example.serviceAdd a deliberately tested policy in the editor:
[Service]
MemoryHigh=2G
MemoryMax=3G
# MemorySwapMax=0MemoryHigh= is a reclaim and throttling boundary; it is intended to apply pressure before a hard failure. MemoryMax= is a hard ceiling for the unit and can lead to OOM kills inside that cgroup. MemorySwapMax= controls how much swap the unit may use where supported. The example values are illustrative; choose them from measured service requirements and leave enough headroom for the operating system and other units.
Free tools Windows power users keep installed
One-click scans. No signup required.
- Confirm support with
systemd --versionand your CentOS documentation. - Create the drop-in with
sudo systemctl edit example.service; do not overwrite the packaged unit. - Apply the manager configuration with
sudo systemctl daemon-reload. - Restart the service during a maintenance window, or use the unit’s normal reload procedure if the setting supports it.
- Verify with
systemctl show example.service -p MemoryCurrent -p MemoryHigh -p MemoryMax. - Monitor logs, request failures, latency, and OOM messages. Remove or revise the limit if it causes avoidable service disruption.
A cgroup limit contains blast radius; it does not repair a leak. It can also move failure from a slow, host-wide incident to a faster service-level OOM, so alerting and a recovery plan are essential.
Choose between tuning, more swap, more RAM, and workload relocation
| Action | Root-cause impact | Latency and failure risk | Blast radius and reversibility | Use when |
|---|---|---|---|---|
| Tune or upgrade the application | Can fix leaks, oversized caches, and excessive concurrency | May reduce throughput if limits are too aggressive | Usually service-specific and reversible through configuration or rollback | One application or worker pool shows sustained growth. |
Set MemoryHigh/MemoryMax |
Contains consumption but does not fix the cause | Reclaim throttling or cgroup OOM can increase errors | Normally limited to one unit and easy to remove from a drop-in | A service threatens other workloads and has a known safe ceiling. |
| Increase swap | Does not reduce allocations | Can add I/O wait and severe latency under pressure | Host-wide behavior; often quick to change, but storage capacity is finite | You need temporary safety margin while fixing the underlying issue. |
| Add RAM | Raises capacity without changing the workload | Usually lowers pressure, but does not cure a continuing leak | Hardware or VM change with cost and maintenance implications | Measurements show sustained, legitimate demand above installed RAM. |
| Move part of the workload | Reduces demand on the affected host | Introduces network and operational dependencies | Broader change, but can be rolled back with capacity planning | Workloads cannot be tuned enough or have conflicting peaks. |
Base the decision on trend data from vmstat, sar, process PSS, and cgroup metrics. A single post-incident snapshot is weak evidence for a hardware purchase; a recurring period of low availability, swap activity, and acceptable application behavior after tuning is stronger.
A practical incident checklist
- Record the time, workload, recent deployments, backups, and scheduled jobs.
- Run
free -h, the selected/proc/meminfoquery, andvmstat 1 5. - Rank processes with
top -o %MEMandps aux --sort=-%mem | head -n 20. - Use
smemPSS/USS when shared libraries or workers make RSS ambiguous. - Check
systemd-cgtopand the service’sMemoryCurrentvalue. - Inspect slab values, kernel logs, and historical swap activity if user-space totals do not reconcile.
- Check systemd and journald versions and log volume before changing retention or restarting PID 1 services.
- Contain a proven offender with a tested cgroup policy, then watch for OOM kills and failed requests.
- Escalate to application tuning, more swap, more RAM, or workload relocation only after documenting sustained pressure.
Bottom line
CentOS is not “wasting” RAM merely because free or top displays a high percentage. Judge pressure by MemAvailable, swap movement, paging, and response time; identify ownership with RSS and, when necessary, PSS; then distinguish an application allocation from cache, cgroup accounting, journald, or kernel memory. Fix the responsible workload, use systemd limits to contain it, and add capacity only when measurements show that the demand is legitimate and persistent.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errors
