Explanation about free, available and buff/cache and how to find what process is buff/cache saved for in a server in the command "free -mh "

Question

I see explanation for free -mh as:

free displays the total amount of free and used physical and swap memory in the system, as well as the buffers and caches used by the kernel. The information is gathered by parsing /proc/meminfo. The displayed columns are:

   total  Total installed memory (MemTotal and SwapTotal in
          /proc/meminfo)

   used   Used memory (calculated as total - free - buffers - cache)

   free   Unused memory (MemFree and SwapFree in /proc/meminfo)

   shared Memory used (mostly) by tmpfs (Shmem in /proc/meminfo)

   buffers
          Memory used by kernel buffers (Buffers in /proc/meminfo)

   cache  Memory used by the page cache and slabs (Cached and
          SReclaimable in /proc/meminfo)

   buff/cache
          Sum of buffers and cache

   available
          Estimation of how much memory is available for starting
          new applications, without swapping. Unlike the data
          provided by the cache or free fields, this field takes
          into account page cache and also that not all reclaimable
          memory slabs will be reclaimed due to items being in use
          (MemAvailable in /proc/meminfo, available on kernels 3.14,
          emulated on kernels 2.6.27+, otherwise the same as free)

Sometimes, I see that free memory gets allotted to buffer/cache memory. If there is high memory utilization where even the available memory is very low, I can see the processes taking a lot of memory with the help of "top".

But how to know what memory from "free" is allotted to "buffer/cache" when I have enough "available memory". Is there a way to check for which process is it getting saved for?

root@server_test:~# free -mh
              total        used        free      shared  buff/cache   available
Mem:            29G         24G        359M        398M        4.2G        3.5G
Swap:            0B          0B          0B

Regards, Tayto

Answer 1

From what I understand, the buff/cache shown by "free" can be a very big number without that memory having to belong to any process. So, in that case, you would not see a lot of memory being attributed to one process, as seen via top or ps.

That is, the buff/cache can be used as a file system cache. As files (or parts of files) are read from disk (which is slow), the data is then kept in a memory cache (which is fast). I don't think the OS kernel keeps track of what process caused that data to be put into the cache.

For example, to test this theory, you can empty the buff/cache (or most of it), and then have a process (e.g. cat) read a very large file. Once the process (cat) finishes reading the file, it will exit, and the process will not exist anymore. However, you will likely notice that your buff/cache value has gone up by about the size of the file read. So in this case, the cat process caused that data to be added to the cache, but the cat process does not "own" the cache pages in memory where the data now (temporarily) resides.

Answer 2

If the relevant programs are running in their own control groups, then perhaps you can use

cd /sys/fs/cgroup
find -name memory.stat -exec grep -HE '^(file|cache) ' | sort -nk 2

Note, I'm pretty sure each page of cache is only accounted to one cgroup. Even if multiple cgroups use the same page of cache.