What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
A high memory percentage on a CentOS server is not automatically a leak. Linux intentionally fills otherwise idle RAM with filesystem cache. The reliable question is whether memory is available, whether swap is being used and whether paging is sustained. Start with free -h, vmstat, top and ps; use smem when shared libraries make resident memory look larger than it really is. Then separate process usage, cache, cgroups and kernel memory before changing or restarting anything.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
What “high memory use” means on CentOS
Linux reports several different kinds of memory. A dashboard that says 90% or 95% used may be showing RAM occupied by page cache and reclaimable kernel objects, not RAM that applications can no longer obtain. The free command’s buff/cache value is generally reclaimable; available is a better estimate of what new workloads can use without immediately swapping.
As an Amazon Associate I earn from qualifying purchases.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minute| Metric | What it represents | How to use it |
|---|---|---|
MemFree |
Completely unused RAM at that instant | Useful context, but a low value alone is normal on an active Linux host. |
Buffers and Cached |
Filesystem and block-device cache | Usually reclaimable when applications need memory. |
SReclaimable |
Reclaimable kernel slab objects | Include it when checking whether kernel allocations explain growth. |
MemAvailable |
Kernel estimate of memory available without heavy swapping | Use it with swap and paging activity to judge pressure. |
| Swap used | Pages moved from RAM to swap space | Some use is not automatically bad; rising use with swap-in/out indicates pressure. |
RSS in ps or top |
Resident, non-swapped pages mapped by a process | Good for ranking processes, but shared pages can be counted in several processes. |
PSS and USS in smem |
Proportional shared memory and private memory | More accurate for deciding which process actually accounts for RAM. |
Red Hat’s monitoring guidance treats available, swap activity and the process/kernel breakdown as pressure indicators rather than relying on a single utilization percentage. There is no universal “normal CentOS RAM percentage”; establish a baseline for this host’s workload.
First response: establish whether the host is under pressure
Run these commands before killing a process or dropping caches:
#1 Best Overall
free -h
cat /proc/meminfo | egrep 'MemTotal|MemFree|MemAvailable|Buffers|Cached|SReclaimable|Slab|SwapTotal|SwapFree'
vmstat 1 5Read the three outputs together
- Likely healthy cache use:
freeis low, butavailableremains substantial, swap-in and swap-out invmstatstay near zero, and applications are responsive. - Active memory pressure:
availableis close to zero, swap is filling orvmstatshows sustainedsi(swap in) andso(swap out), with increased I/O wait. - Severe exhaustion: both RAM and swap are effectively full, services stall, or the kernel records out-of-memory kills.
A single sample can miss a burst. Repeat the commands during the incident and retain the output so you can distinguish a short workload spike from a trend.
Find which processes own resident memory
Once pressure is established, rank the processes:
top -o %MEM
ps aux --sort=-%mem | head -n 20Interpret the columns correctly
RSSis the non-swapped physical memory currently resident for a process.%MEMis that RSS as a share of physical RAM.- In
top,RESis resident memory andSHRis the portion identified as shared. VIRTis address space, not an equivalent amount of RAM. A large virtual size is not, by itself, a memory leak.
Look for a process whose RSS keeps growing across several samples, a worker pool with unexpectedly many children, or a queue/cache that expands with request volume. Record the command line, service name, package version and start time before restarting it.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Correct for shared memory with smem
Several processes can map the same shared libraries or shared segments. Summing RSS can therefore overstate total consumption. The smem manual describes its purpose as reporting physical memory while taking shared pages into account.
smem -tk
smem -r -k -s pss | head -n 20USS versus PSS
- USS (Unique Set Size) is memory private to one process and would be released if that process exited.
- PSS (Proportional Set Size) divides a shared page among the processes using it, producing a fairer total.
Use PSS to decide which service accounts for the host’s memory and USS to estimate the impact of stopping one process. If PSS is modest but RSS appears huge across many similar workers, shared libraries are a likely explanation rather than duplicated private heaps.
Check services, slices and cgroups
A process list can hide the aggregate cost of a service with many workers. Inspect systemd’s cgroup view:
systemd-cgtop
systemctl status <service>
systemctl show <service> -p MemoryCurrent -p MemoryHigh -p MemoryMaxReplace <service> with the unit name, such as worker.service. systemd-cgtop groups descendants under their service or slice, so it can reveal a unit whose total is larger than any individual process. Compare MemoryCurrent with configured limits and with the service’s normal workload. A limit that is already being reached is evidence for containment or application tuning; it does not prove why usage grew.
Free tools Windows power users keep installed
One-click scans. No signup required.
Common causes and the appropriate response
Filesystem cache is filling otherwise idle RAM
Cache accelerates repeated reads and is normally reclaimed when applications request memory. Do not treat a large buff/cache number as a leak, and do not routinely run:
echo 3 > /proc/sys/vm/drop_cachesDropping caches discards useful data, can make the next workload slower and does not repair an application leak. Investigate reclaim only when MemAvailable is low or reclaim stalls, and capture free, vmstat and workload evidence first. A cache-clearing test, if justified for a controlled diagnostic, should be temporary and documented rather than scheduled as maintenance.
One application or worker pool dominates
If one service owns the largest PSS or its resident size rises over time, inspect its heap, in-process caches, worker count, request backlog and configured limits. Correlate growth with traffic, deployments and package or application versions. A restart can restore headroom, but it only masks a leak or unbounded workload unless you also preserve the timeline and correct the cause.
- Check whether a recent release changed cache or queue limits.
- Compare the number of workers with the expected concurrency.
- Measure memory per worker using PSS rather than multiplying RSS, because libraries may be shared.
- Use the service’s own diagnostics or heap profiler where available, without collecting sensitive request data.
Red Hat lists application tuning as the first capacity response when excessive consumption is identified.
Recommended Free Tools
systemd or systemd-journald is abnormal
Memory behavior in systemd and journald is version- and workload-specific. Check the installed version, journal volume and recent messages:
systemctl --version
journalctl --disk-usage
journalctl -u systemd-journald --since today
rpm -q systemdRed Hat documented a RHEL 7 incident involving systemd-219-19.el7_2.13 in which PID 1 reached 3.508 GiB resident memory, or 61.9% of RAM. That is an incident example, not a normal baseline for CentOS or RHEL systems. A separate Red Hat report showed example journald footprints of 152 MB and 90 MB on otherwise similar servers. Treat the difference as a reason to compare versions, message rates and configuration, not as a universal expected size.
Journal retention settings primarily constrain disk storage, not the whole memory problem. In the systemd 252 manual, the default percentage values for persistent and runtime journal limits are 10% and 15%, each capped at 4 GiB. SystemMaxUse= and RuntimeMaxUse= cap storage; SystemKeepFree= and RuntimeKeepFree= reserve free space. If journald appears to grow in RAM, pair retention checks with process, cgroup and paging measurements, then apply vendor fixes or package updates appropriate to the installed release.
Kernel slab, unreclaimable memory or swap pressure
When process RSS and PSS do not account for the total, inspect kernel memory and historical paging:
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →cat /proc/meminfo | egrep 'Slab|SReclaimable|SUnreclaim'
dmesg -T | egrep -i 'oom|out of memory|killed process'
sar -r 1 5
sar -W 1 5Slabincludes kernel caches;SReclaimableis the reclaimable portion andSUnreclaimis harder to reclaim.dmesgcan show whether the OOM killer terminated a process.sar -randsar -Wprovide short trends for memory and swapping when thesysstattools are installed.
Full RAM and swap can make a host hang from increased I/O or crash after the OOM killer terminates system processes. Red Hat explicitly warns about both outcomes. Preserve logs and identify the consuming subsystem instead of repeatedly killing unrelated processes.
Contain a service with systemd memory controls
On systemd releases that support these cgroup controls, use a drop-in so package upgrades do not overwrite the policy:
sudo systemctl edit example.serviceAdd a deliberately tested policy in the editor, for example:
[Service]
MemoryHigh=2G
MemoryMax=3GThe values above are illustrative policy values, not a recommendation for every host. Set them from the service’s measured peak, safety margin and failure behavior. MemoryHigh is a pressure boundary that causes reclaim and throttling; MemoryMax is a hard cgroup ceiling that can lead to an OOM kill within the unit. Some supported configurations also provide MemorySwapMax to constrain swap assigned to the cgroup.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitches- Measure normal and peak PSS, request latency and restart behavior.
- Create the drop-in with
sudo systemctl edit example.service; do not edit the vendor unit directly. - Reload unit definitions:
sudo systemctl daemon-reload. - Restart during a maintenance window if the service must be restarted for the setting to take effect.
- Watch
systemctl status,systemd-cgtop, logs, failed requests and OOM events.
A cgroup limit contains blast radius; it does not repair a leak. A limit set below legitimate working memory can turn a slow leak into repeated service failures, so test under representative load and keep a rollback plan by removing the drop-in and reloading systemd.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Choose a remedy by evidence, not by the percentage in top
| Remedy | Root-cause impact | Latency and failure risk | Blast radius and reversibility | Use when |
|---|---|---|---|---|
| Tune application, cache or worker count | Can fix an unbounded cache, leak trigger or excessive concurrency | Usually lowers pressure; tuning mistakes can reduce throughput | Usually limited to one service and reversible through configuration | One process or service dominates PSS or shows a growth trend. |
| Restart a leaking service | Resets resident memory but does not fix the defect | Causes interruption and may lose in-flight work | Service-level and reversible, provided a controlled restart exists | Emergency headroom is needed while a permanent fix is prepared. |
MemoryHigh/MemoryMax |
Contains consumption; does not repair the application | Reclaim, throttling or cgroup OOM can increase latency or failures | Normally limited to the unit and easy to remove from a drop-in | A service can be safely bounded and its failure mode is understood. |
| More swap | Adds virtual capacity, not physical performance | Can increase disk I/O and make an already paging host slower | Host-wide effect; configuration is reversible, but workload impact must be monitored | Short bursts need headroom and storage can sustain the I/O. |
| More RAM | Raises physical capacity but does not remove a leak | Usually avoids swap latency; migration or hardware work may be required | Broad capacity change and less quickly reversible | Measurements show sustained demand after application and workload tuning. |
| Move or reduce workload | Removes demand from the host | May add network or operational latency elsewhere | Changes placement and can be rolled back with planning | A workload can be reallocated without violating availability requirements. |
Evaluate every option on five axes: whether it fixes the cause, its I/O and latency cost, the services it can affect, how easily it can be rolled back and the quality of the evidence behind the decision. A single top snapshot is weak evidence; a trend from vmstat, sar, process PSS and cgroup counters is stronger.
Best Value
- New
- Mint Condition
- Dispatch same day for order received before 12 noon
- Guaranteed packaging
- No quibbles returns
Practical troubleshooting branches
“free shows almost no free RAM, but the server is responsive”
Check MemAvailable, swap-in/out and I/O wait. If available memory is healthy and paging is quiet, the apparent usage is probably cache. Leave the cache in place and monitor the workload rather than clearing it.
“One process is at the top of top”
Confirm its trend and PSS with smem, identify the owning systemd unit and inspect its heap, workers and backlog. Apply an application fix or a tested cgroup boundary; use a restart only as controlled short-term containment.
“No process explains the total”
Compare process PSS with Slab, SReclaimable, cgroup totals and swap history. Check kernel messages and journald/systemd versions. This branch often indicates shared memory, kernel allocations or accounting outside the process list.
“The host freezes or reports OOM kills”
Capture dmesg, sar, vmstat and cgroup data if possible, then restore service with the least destructive action: stop a noncritical workload, contain the offending unit or move traffic. Do not assume adding swap alone will cure sustained thrashing; heavy paging can increase I/O until the host becomes unusable.
When to add capacity
Increase RAM, increase swap, tune the application or move part of the workload only after measurements show sustained pressure. Red Hat lists all four as valid responses, while cautioning that additional swap can worsen performance through disk I/O. Capacity work is justified when the workload’s measured baseline and peak remain above safe available-memory margins after reclaimable cache, shared pages and kernel memory have been accounted for.
Keep a before-and-after record: free -h, /proc/meminfo, vmstat, top PSS rankings, cgroup counters, request latency and OOM logs. That record tells you whether a change removed the cause, merely postponed exhaustion or introduced a new bottleneck.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
