Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →free -m and ps aux are not competing meters. free summarizes the entire Linux host, including reclaimable caches, kernel memory and swap, while ps reports virtual and resident memory for individual processes. Their totals therefore are not expected to match. To investigate a memory problem, read MemAvailable and buff/cache in free, then rank processes by RSS and use PSS when shared pages matter.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
What each command actually measures
free -m: a host-wide memory summary
The free command reads /proc/meminfo and reports physical and swap memory for the whole machine. Its output normally includes total, used, free, shared, buffers, cache, buff/cache and available, followed by a swap line. The -m option requests megabytes for display. On current procps, the counters originate in KiB and are converted for presentation, so the displayed decimal “MB” values are rounded summaries rather than byte-perfect accounting.
As an Amazon Associate I earn from qualifying purchases.
Modern procps calculates used as total - available. That is different from treating every page that is not currently on the free line as permanently consumed by applications. available is an estimate of memory that new applications can obtain without resorting to swap. It incorporates free pages and memory the kernel expects it can reclaim, subject to watermarks and other constraints.
The buff/cache value combines kernel-managed buffers, file page cache and reclaimable slab memory. The kernel documentation defines Cached as in-memory file data plus tmpfs and shared-memory (shmem) pages. Those pages can make the used figure look large while still being available for reuse. A large cache is therefore not automatically a leak or a crisis; the more useful question is whether available is falling and whether the system is swapping.
#1 Best Overall
ps aux: one row per process
The u format in ps aux includes process-oriented columns such as %CPU, %MEM, VSZ and RSS. Each row describes one task visible to that invocation, not the entire host.
- VSZ is virtual memory size, shown in KiB. It represents the process’s virtual address space, including mappings that may be reserved, file-backed or not yet resident in RAM.
- RSS is resident, non-swapped physical memory currently associated with that task’s mappings.
- %MEM is RSS divided by the machine’s physical memory, expressed as a percentage. It is not a percentage of the
usedline fromfree.
A large VSZ is not proof that the process occupies that much RAM. Applications commonly reserve address ranges, map shared libraries or create sparse allocations that only consume physical pages when touched.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallWhy the figures diverge
| Comparison | free -m |
ps aux |
|---|---|---|
| Scope | Entire host: physical memory, swap and kernel-managed categories | Individual processes and their address-space mappings |
| Main question | How much memory is installed, available, cached or swapped? | Which tasks have large virtual or resident footprints? |
| Addressing | Physical-memory categories | VSZ is virtual; RSS is resident physical |
| Shared pages | Counted at the host level | RSS can count one shared page once for every process mapping it |
| Kernel overhead | Includes system-wide kernel categories such as slabs and caches | RSS and SIZE omit several per-process kernel structures |
| Sampling | Reads live kernel counters at command time | Reads live process data, potentially at a different instant |
They have different scopes
The simplest explanation is scope. The free total covers every process plus the kernel’s own allocations, filesystem cache, tmpfs/shmem and other host-wide memory. A ps listing contains rows for processes, and may not include every task or mapping you expect depending on permissions, namespaces and the command’s selection rules. Even if you add every visible RSS value, you are not recreating the host total.
Cache, slabs and shmem are not ordinary process RSS
Linux uses otherwise idle RAM for file page cache and other reclaimable data. /proc/meminfo also reports slab allocations, including reclaimable portions, and shmem/tmpfs pages. These categories belong in the host accounting shown by free, but they do not appear as a simple extra process row in ps aux. When applications read files heavily, the cache can grow even though their RSS remains comparatively modest.
Virtual size is not resident use
VSZ includes address space that is not currently backed by RAM. A process can reserve a large range, map a file, or share libraries without faulting every page into memory. Comparing a sum of VSZ values with physical memory is therefore meaningless: virtual ranges can overlap and can exceed installed RAM by design. For a RAM question, start with RSS, not VSZ, while remembering RSS has its own accounting limits.
Shared pages make summed RSS too high
Shared libraries, shared mappings and shared-memory segments can be resident for several processes at once. If each process reports the full page in RSS, adding the rows counts the same physical page repeatedly. The host has one page, but the RSS sum may charge it to many tasks. This is why process percentages can add to more than 100 percent in unusual workloads, and why an RSS total still does not equal the used line.
Some process overhead is deliberately omitted
The Linux ps manual cautions that SIZE and RSS do not count parts of a process including page tables, the kernel stack, struct thread_info and struct task_struct. The manual describes this as usually at least 20 KiB of resident memory, although the exact amount depends on the kernel and configuration. Those allocations are real physical memory and are represented through system-level accounting rather than as a complete addition to each RSS row.
The commands are snapshots taken at different times
Both commands read live procfs data. Processes allocate and free pages, the kernel reclaims cache, and pages move to or from swap while you type. If free -m runs a second before ps aux, the two snapshots can differ even where their definitions overlap. Unit conversion and rounding add small discrepancies.
How to read the important fields in free -m
| Field | Interpretation | How to use it |
|---|---|---|
total |
Physical memory recognized by the kernel | Baseline capacity for the host |
used |
Procps calculation: total - available |
Do not equate it with summed application RSS |
free |
Currently unused physical pages | A narrow snapshot, not the full amount safely available |
shared |
Memory associated with shared-memory mechanisms, including shmem-related accounting | Interpret with the other /proc/meminfo values |
buffers |
Kernel buffer memory | Part of kernel-managed use |
cache |
Cached file data and related cache accounting | Often reclaimable under pressure |
buff/cache |
Buffers plus cache, including reclaimable kernel memory represented by procps | Explains why host use exceeds process RSS totals |
available |
Estimate of memory usable for new applications without swapping | The key capacity indicator for “can I start another workload?” |
| Swap line | Swap total, used and free | Check alongside available memory; active swap can indicate pressure, but its presence alone does not identify the process causing it |
The kernel computes MemAvailable from free pages, reclaimable slabs, file-LRU pages and low-watermark constraints. It is an estimate, not a reservation or a guarantee that every byte can be allocated immediately. The procps documentation notes that this field is available natively on kernels 3.14 and newer; older kernels had it emulated. That version boundary explains differences on legacy systems, not a reason to reinterpret current output.
For the underlying counters, run:
grep -E '^(MemTotal|MemFree|MemAvailable|Cached|SReclaimable|Slab|Shmem|SwapTotal|SwapFree):' /proc/meminfoThis lets you distinguish file cache, reclaimable slab, shmem and swap instead of treating one aggregate as an application bill.
How to inspect process memory correctly
Rank by resident memory
Use an explicit format when you need a reproducible process list:
ps -eo pid,comm,vsz,rss,%mem --sort=-rssThis sorts by RSS, the column that best answers “which processes currently have the most resident mapped pages?” Keep VSZ beside it to spot processes with large reservations but modest residency. Do not add VSZ, and do not assume that adding RSS produces a host total.
Use PSS when sharing matters
When several workers load the same libraries or use shared memory, proportional set size (PSS) is more useful than RSS. PSS divides each shared page among the processes that map it, assigning a proportional share rather than charging every process the full page. Inspect a process with:
cat /proc/<pid>/smaps_rollupIf smaps_rollup is unavailable, inspect /proc/<pid>/smaps. These files expose Rss, Pss, and private/shared clean and dirty pages for mappings. Reading them may require appropriate permissions, and the values are still snapshots that can change while the process runs.
Recommended Free Tools
A practical reconciliation workflow
- Capture the host view. Run
free -morfree -h. Recordavailable,buff/cache, and both swap values. Treatavailableas the capacity question andusedas procps arithmetic, not as the sum of application RSS. - Break down the kernel counters. Check
/proc/meminfoforMemTotal,MemFree,MemAvailable,Cached,SReclaimable,Slab,Shmem,SwapTotalandSwapFree. Look for a category that explains the gap before blaming an individual process. - Rank resident processes. Run
ps -eo pid,comm,vsz,rss,%mem --sort=-rss. Compare the largest RSS values with the host’s available memory, but do not sum them as if shared pages were private. - Apportion shared mappings. For suspicious processes, inspect
smaps_rolluporsmapsand compare PSS with RSS. A much lower PSS indicates that sharing accounts for a substantial part of the apparent RSS. - Investigate what remains. If process PSS still does not explain host consumption, examine slab and shmem/tmpfs growth, huge pages, pinned or locked pages, device-related allocations and filesystem caches through
/proc/meminfoand workload-specific diagnostics. - Repeat during the event. Collect both host and process snapshots close together. A one-off pair of commands can miss a short allocation burst or a reclamation event.
Common questions and correct interpretations
Why does free -m show more used memory than the sum of ps aux?
The host figure includes caches, reclaimable and unreclaimable kernel allocations, tmpfs/shmem, page tables and other categories that are not represented as complete process RSS. RSS also omits specific per-process kernel structures. The difference is expected unless you build a category-by-category accounting model.
Is RSS or VSZ the “real” RAM usage?
RSS is the more relevant starting point for resident RAM, because VSZ includes non-resident virtual mappings. RSS is not a complete ownership bill: shared pages can be charged repeatedly and omitted kernel structures still consume memory. Use PSS for a fairer per-process allocation when mappings are shared, then compare the result with host-level counters.
Best Value
- New
- Mint Condition
- Dispatch same day for order received before 12 noon
- Guaranteed packaging
- No quibbles returns
Why do process percentages not add up to the memory-used line?
%MEM uses RSS divided by physical memory, whereas free uses host-wide total - available. The denominators and included categories differ. Shared RSS can also count one page in multiple percentages, while cache and kernel memory appear in the host view without belonging to a single row.
Where did the rest of the RAM go?
First check available. If it remains healthy, the apparent remainder is often serving as reclaimable file cache, buffers or reclaimable slab. If available is low, swap is growing, or a kernel category is expanding, continue with the /proc/meminfo breakdown and workload-specific investigation rather than relying on a process RSS sum.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesThe rule of thumb
Use free to answer “how much memory can this Linux host provide, and what is the kernel doing with it?” Use ps to answer “which processes have large virtual or resident footprints?” Use PSS and mapping details when shared pages make ownership ambiguous. Once scope, residency, sharing, kernel overhead and sampling time are kept separate, the two commands stop appearing contradictory: they are complementary views of the same memory system.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
