Updated: 17 October 2026 · Applies to: Linux kernels 6.x (tested with Linux 6.12 and procps-ng 4.0.4 on Debian 13); the same commands work on Ubuntu 24.04 and 26.04, AlmaLinux and Rocky Linux 9 and 10
Cached memory (the buff/cache column of free -h) is RAM that Linux uses to keep recently read files, so the next read does not have to go to disk. The kernel gives it back as soon as a program needs memory, so it is not lost RAM: the number to watch is available. You can empty the cache with sync; echo 3 | sudo tee /proc/sys/vm/drop_caches and move swapped-out data back into RAM with sudo swapoff -a && sudo swapon -a, but neither makes a server faster. Use them for tests or after a one-off memory spike, not as a routine fix.
1. What cached memory is
Lab example from a small test system with 512 MiB of RAM. Before and after reading a 200 MB file once:
$ free -h
total used free shared buff/cache available
Mem: 491Mi 22Mi 471Mi 0B 4.6Mi 469Mi
Swap: 255Mi 0B 255Mi
$ cat /mnt/mdata/big.bin > /dev/null
$ free -h
total used free shared buff/cache available
Mem: 491Mi 25Mi 269Mi 0B 204Mi 466Mi
Swap: 255Mi 0B 255Mi
free dropped by 200 MiB because the file is now cached, but available hardly moved (469Mi to 466Mi): Linux counts that cache as memory programs can still get. A server with little "free" memory and plenty of "available" memory is healthy. What the parts are, according to the Linux kernel documentation:
- Cached (page cache): "in-memory cache for files read from the disk (the pagecache) as well as tmpfs & shmem".
- Buffers: temporary storage for raw disk blocks, normally small.
- SReclaimable: kernel caches such as directory entries and inodes that can be freed.
- Shmem (the shared column): shared memory and tmpfs, for example files in
/dev/shm. This counts as cache but cannot be dropped while the files exist. - Swap: disk space where the kernel moves memory pages that have not been used for a while when RAM gets tight.
To see the raw numbers:
$ grep -E '^(MemTotal|MemFree|MemAvailable|Buffers|Cached|Shmem|SReclaimable|Dirty|SwapTotal|SwapFree):' /proc/meminfo MemTotal: 503228 kB MemFree: 212872 kB MemAvailable: 413792 kB Buffers: 164 kB Cached: 273652 kB SwapTotal: 262140 kB SwapFree: 262140 kB Dirty: 4 kB Shmem: 65536 kB SReclaimable: 1152 kB
This was taken after we also wrote 64 MB to /dev/shm: Shmem is 65536 kB and is part of Cached. For a full explanation of every column, see how to check memory usage in Linux.
2. Clear the page cache (when it makes sense)
Run sync first so that data waiting to be written (Dirty) is on disk; the kernel never drops dirty data. Then, as root or with sudo:
sync; echo 1 | sudo tee /proc/sys/vm/drop_caches # page cache only sync; echo 2 | sudo tee /proc/sys/vm/drop_caches # dentries and inodes (reclaimable slab) sync; echo 3 | sudo tee /proc/sys/vm/drop_caches # both sudo sysctl vm.drop_caches=3 # the same as echo 3
sudo echo 3 > /proc/sys/vm/drop_caches does not work: the redirect is done by your own shell, not by sudo, so a normal user gets Permission denied. Use tee as shown, or a root shell.
What it did in our lab (after the 200 MB file and the 64 MB in /dev/shm):
# free -h
total used free shared buff/cache available
Mem: 491Mi 87Mi 207Mi 64Mi 269Mi 404Mi
# sync; echo 1 > /proc/sys/vm/drop_caches
# free -h
total used free shared buff/cache available
Mem: 491Mi 85Mi 407Mi 64Mi 68Mi 406Mi
(Run as root; the Swap lines are left out.)
Free memory rose by 200 MiB, available memory by only 2 MiB, and 64 MiB stayed in buff/cache because tmpfs data cannot be dropped. The kernel also writes a line to its log each time, such as tee (759): drop_caches: 3 (sudo dmesg | grep drop_caches).
When dropping caches is useful: measuring cold disk reads in a benchmark, testing how an application behaves without a warm cache, or checking how much memory really comes back. When it is not: as a cron job or to "speed up" a server. Everything that was cached has to be read from disk again, so the next minutes are slower. The kernel documentation warns that it "can cause performance problems" and that use "outside of a testing or debugging environment is not recommended".
Inside a Docker or Podman container it fails (tee: /proc/sys/vm/drop_caches: Read-only file system), because the cache belongs to the host kernel. On a KVM VPS you run your own kernel, so the command works there. More on this command: clear the buffer and page cache.
3. Clear swap memory
Swap in use is not a problem by itself: after a busy period, idle data may stay in swap although RAM is free again. To move it back into RAM:
- Check that available RAM is clearly larger than the swap used:
free -h - Turn swap off and on again:
sudo swapoff -a && sudo swapon -a
- Check with
free -horswapon --showthat swap is back and its USED column is 0B.
In our lab, 155 MiB moved back from swap to RAM in about 1 to 2 seconds; with gigabytes in swap on a slow disk it takes much longer, and the server can feel slow meanwhile. Two things we saw:
swapon -aonly switches on swap that is listed in/etc/fstab. A swap area we had enabled by hand stayed off afterwards (Swap total 0B).- With too little free RAM,
swapoffstarted the kernel's OOM killer. In our test it killed the swapoff command itself (Killed, exit code 137) and swap stayed on, but do not count on that: on a real server it can end a service. See what is the Linux OOM killer.
To make the kernel swap less eagerly, lower vm.swappiness (default 60, range 0 to 200 according to the kernel documentation):
sudo sysctl vm.swappiness=10 # now echo 'vm.swappiness = 10' | sudo tee /etc/sysctl.d/99-swappiness.conf # after reboots sudo sysctl --system
To add swap, see increase swap space with a swap file; to remove it, see permanently disable swap.
4. If RAM really runs out
If available stays low and swap keeps filling, clearing caches will not help: a program needs more memory than the server has. Find it with:
ps -eo pid,user,%mem,rss,comm --sort=-rss | head -n 11
Then tune or restart that service (for example PHP-FPM workers or a database buffer), or move to a plan with more RAM. sudo journalctl -k | grep -i "killed process" shows whether the OOM killer has already stopped something.
Official documentation: kernel sysctl vm settings (drop_caches, swappiness) and /proc/meminfo fields.