A high memory percentage on a CentOS server is not automatically a leak. Linux intentionally fills idle RAM with filesystem cache, so begin with MemAvailable, swap activity, and paging—not the “used” figure alone. Run free -h, rank resident processes with top and ps, correct for shared memory with smem, then inspect cgroups, systemd, journald, and kernel memory if processes do not explain the total. Only after measuring sustained pressure should you tune the application, impose service limits, add swap or RAM, or move workload.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
What “high memory use” means on CentOS
Linux reports memory differently from many desktop operating systems. The kernel uses otherwise idle RAM for page cache, directory entries, and other reclaimable data so files can be served faster. That cache appears in tools as used memory, but it can be released when an application needs it. A machine with little free memory can therefore be healthy if it still has substantial available memory and is not continually swapping.
As an Amazon Associate I earn from qualifying purchases.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsThe useful question is whether the host is under memory pressure: are allocations stalling, is the kernel reclaiming aggressively, are pages moving between RAM and swap, or are services being killed? Red Hat’s monitoring guidance treats MemAvailable, swap-in/swap-out activity, and the process/kernel breakdown as better indicators than a utilization percentage. There is no universal “normal RAM percentage” for CentOS; a database server, web server, and build host have different baselines.
First check: is the host actually under pressure?
Take a snapshot and a short time series before stopping anything. Run these commands as a normal user where possible, using sudo only when your account lacks access:
#1 Best Overall
- A-Tech 16GB RAM Module, DDR4 SO-DIMM 260-Pin, 3200MHz PC4-25600 (PC4-3200AA)
- Non-ECC Unbuffered, JEDEC DDR4 Standard 1.2V Operating Voltage
- Compatible with select Laptop, Notebook, Mini PC, and All-in-One (AIO) systems. Please verify your system's memory type, form factor, and maximum supported capacity before purchasing
- Not compatible with desktop DIMM, non DDR4 memory, or ECC memory types such as RDIMM, LRDIMM, and ECC UDIMM
- Increases available memory capacity to enhance system responsiveness, application performance, and multitasking capabilities.
free -h
cat /proc/meminfo | egrep 'MemTotal|MemFree|MemAvailable|Buffers|Cached|SReclaimable|Slab|SwapTotal|SwapFree'
vmstat 1 5Read the free -h fields together
| Field | What it tells you | How to interpret it |
|---|---|---|
total |
Physical RAM visible to the operating system. | A capacity figure, not a pressure measurement. |
used |
RAM assigned to processes, the kernel, and cache according to the tool’s accounting. | Can be high while the system remains responsive because cache is reclaimable. |
free |
Completely unused RAM. | Low values are normal on an active Linux system. |
buff/cache |
Buffers and mostly reclaimable filesystem cache. | Not equivalent to an application leak. |
available |
An estimate of RAM that can be given to new workloads without swapping heavily. | The most useful quick pressure indicator; watch its trend. |
swap |
Swap capacity and the portion currently occupied. | Some used swap can be harmless; continuous movement is a warning. |
In vmstat, the si and so columns show swap-in and swap-out per interval. Occasional activity during a burst is different from sustained nonzero values while latency rises. Also watch r (runnable tasks), wa (I/O wait), and whether the machine responds normally. A low available value combined with ongoing swap traffic is materially more urgent than a low free value accompanied by a large cache.
Find which processes hold resident memory
After establishing pressure, identify the largest resident consumers:
top -o %MEM
ps aux --sort=-%mem | head -n 20Understand the columns
- RSS in
psor RES intop: physical pages currently resident for that process, excluding pages it has swapped out. %MEM: the process’s RSS as a share of physical RAM.- SHR in
top: an estimate of pages shared with other processes. - VIRT in
top: the process’s virtual address space. It includes mappings and reserved address ranges, so it is not a measurement of RAM consumed.
Sort by resident memory, not virtual size, and record the command line, user, process ID, start time, and number of workers. A single large process may be an intentional database cache; dozens of workers may each look modest while their aggregate is the real problem. Capture several samples rather than treating one instant as proof of a leak.
Correct for shared pages with smem
RSS can make shared libraries or shared-memory segments appear to belong fully to every process that maps them. The smem utility reports physical usage while accounting for those shared pages.
smem -tk
smem -r -k -s pss | head -n 20- USS (Unique Set Size) is the private physical memory that would be released if the process exited.
- PSS (Proportional Set Size) assigns each process a proportional share of shared pages. Summing PSS gives a more realistic process total than summing RSS when many workers load the same libraries.
- RSS remains useful for seeing what is resident, but it can overstate ownership in a multi-process service.
The smem manual summarizes its purpose as reporting physical memory usage while taking shared pages into account. Install the package from your CentOS repositories if it is absent, and note the package version in your incident record.
Check services and cgroups, not just individual PIDs
A service can spread memory across worker processes, helper processes, and descendants. A process list may therefore understate the service’s aggregate footprint.
Recommended Free Tools
systemd-cgtop
systemctl status <service>
systemctl show <service> -p MemoryCurrent -p MemoryHigh -p MemoryMaxReplace <service> with the unit name, such as httpd.service or your application’s unit. systemd-cgtop displays memory by cgroup and slice, helping you find a service whose children collectively consume more than any one PID suggests. MemoryCurrent shows current cgroup usage where supported; the other properties reveal whether a policy is already constraining the unit.
Rank #2
- Compatible with select DDR4 Desktop computers + Easy to install at home, no expertise required
- Maximize your system's performance, boost loading speeds and multitask with ease
- Backed by A-Tech's Lifetime Warranty + Friendly tech support team available to help before and after your purchase
- Single 8GB RAM Module | DDR4 DIMM 288-Pin | Speeds up to 2400MHz, PC4-19200 / PC4-2400T
- NON-ECC Unbuffered | 1Rx8 or 2Rx8 - Single or Dual Rank | JEDEC DDR4 standard 1.2V
Also inspect containers and scheduled jobs. A container’s process may look ordinary from the host while its cgroup limit, page cache, or sidecar accounts for the difference. A recurring backup, compiler, or reporting job can explain a daily spike that an interactive snapshot misses.
When the process list does not explain the total
If the sum of credible PSS values is far below the RAM in use, separate cache, kernel allocations, and accounting boundaries instead of killing random processes.
Filesystem cache
Use Cached, SReclaimable, MemAvailable, and application latency together. Cache that is readily reclaimable is doing useful work. Do not routinely run:
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
echo 3 > /proc/sys/vm/drop_cachesThat command discards useful page and inode cache; it does not repair an application leak and can make the next workload slower while the cache is rebuilt. If available memory is low and reclaim appears ineffective, capture evidence first, investigate the workload and kernel state, and use cache dropping only as a controlled diagnostic action with a documented reason.
Slab and other kernel memory
Inspect kernel allocations when user-space PSS does not account for consumption:
cat /proc/meminfo | egrep 'Slab|SReclaimable|SUnreclaim'
dmesg -T | egrep -i 'oom|out of memory|killed process'Slab covers kernel caches; SReclaimable is the portion that can generally be reclaimed, while SUnreclaim is not readily reclaimable. A growing unreclaimable component, driver-related messages, or a cgroup total that differs from host totals warrants kernel, storage, networking, or vendor investigation rather than application restarts alone.
Historical paging
Install the sysstat tools if your system does not already provide them, then sample:
Rank #3
- 16GB Module ( 1x 16GB ) | DDR4 3200 MHz ( PC4-25600 / PC4-3200AA )
- DDR4 SO-DIMM ( 260-Pin ) | Non-ECC Unbuffered | 2Rx8 - Dual Rank x8 | 1.2V - DDR4 Standard Voltage
- High performance Memory RAM upgrade compatible with select DDR4 Laptop, Notebook, & All-in-One (AIO) Computers
- Boosts the performance of your system by speeding up loading times, improving system responsiveness, and increasing your system's ability to handle greater workloads
- All modules undergo quality assurance testing to ensure dependable and reliable performance
sar -r 1 5
sar -W 1 5These readings help distinguish a one-time snapshot from a recurring trend. Keep the output with timestamps, workload events, and deployment versions so an engineer can correlate growth with a release or scheduled task.
Common cause: one application or worker pool
When one service dominates RSS or PSS, examine the service on its own terms before changing host-wide settings.
- Heap growth: compare process size at a fixed request rate and after garbage collection or idle periods. Monotonic growth suggests a leak or unbounded cache; a stable plateau may be intentional caching.
- Worker count: multiply the per-worker PSS by the configured worker, thread, or process count. A safe setting on a large host can exhaust a smaller VM.
- Backlog and concurrency: queues, slow downstream services, and oversized request bodies retain objects longer. Check queue depth and timeout behavior when growth coincides with traffic.
- Application caches: set explicit bounds and expiration policies where available. Document the expected hit-rate trade-off before reducing them.
- Version and configuration: record the application package, runtime, modules, and recent deployments. A restart may restore headroom temporarily, but it does not identify or fix the cause.
If a restart is necessary to protect availability, capture top, smem, cgroup, and log evidence first, schedule the restart, and compare the growth curve afterward. Repeated restarts without measurement simply hide the leak and can create downtime.
Investigate systemd and systemd-journald anomalies
System services can be the consumer when no application explains the resident set. Check the installed versions and journal activity:
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchsystemctl --version
rpm -q systemd
journalctl --disk-usage
journalctl -u systemd-journald --since todayVersion-specific systemd behavior
Red Hat documented a RHEL 7 incident involving systemd-219-19.el7_2.13 in which PID 1 reached 3.508 GiB resident memory, or 61.9% of RAM, in 2024 documentation. That is an incident example, not a normal baseline for CentOS or RHEL. If PID 1 grows steadily, verify the exact package build, review vendor advisories and fixes for that build, and preserve logs before restarting it.
Journald workload and retention
A separate Red Hat report gives example systemd-journald footprints of 152 MB and 90 MB on otherwise similar servers. The difference illustrates why log rate, message size, forwarding, compression, and runtime conditions matter; neither value is a universal target.
Journal retention settings primarily limit disk storage, not a process’s entire RAM footprint. In the systemd 252 manual published by freedesktop.org in 2022, the default percentage values for SystemKeepFree= and RuntimeKeepFree= are 10% and 15%, each capped at 4 GiB. SystemMaxUse= and RuntimeMaxUse= cap persistent and runtime journal space, while the corresponding KeepFree options reserve free disk space. Use them to prevent disk exhaustion, and pair the change with memory and paging measurements when journald itself appears large.
Rank #4
- Compatible with select DDR4 Desktop computers + Easy to install at home, no expertise required
- Maximize your system's performance, boost loading speeds and multitask with ease
- Backed by A-Tech's Lifetime Warranty + Friendly tech support team available to help before and after your purchase
- 16GB RAM Kit ( 2 x 8GB Modules ) | DDR4 DIMM 288-Pin | Speeds up to 2666MHz (2667MHz), PC4-21300 / PC4-2666V
- NON-ECC Unbuffered | 1Rx8 or 2Rx8 - Single or Dual Rank | JEDEC DDR4 standard 1.2V
After changing journal configuration, validate the effective settings with your distribution’s systemd tools, reload or restart journald only during an appropriate maintenance window, and confirm that expected logs are still retained or forwarded.
Recognize swap exhaustion and OOM conditions
When both RAM and swap are nearly exhausted, the kernel may spend most of its time moving pages instead of serving work. Latency and I/O wait rise, the host can become unresponsive, and the OOM killer may terminate processes. Red Hat describes complete memory and swap utilization as capable of hanging a system through increased I/O workload or causing a crash when the Out-Of-Memory killer kills system processes.
Look for evidence rather than inferring an OOM from a single failed request:
dmesg -T | egrep -i 'oom|out of memory|killed process
free -h
vmstat 1 5
sar -W 1 5Correct the missing quote in the first command if copying it manually; the intended command is:
dmesg -T | egrep -i 'oom|out of memory|killed process'Check timestamps against service logs and deployment events. A killed worker, a sudden restart, and a return to normal memory can indicate an OOM event even when the offending allocation is no longer visible.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Reduce memory safely: choose the remedy by evidence
| Remedy | Root-cause impact | Latency and blast radius | Reversibility and evidence needed |
|---|---|---|---|
| Tune the application or worker pool | Can fix an unbounded heap, cache, queue, or excessive concurrency. | May reduce throughput or cache hit rate, but usually affects one service. | Configuration changes are usually reversible; use PSS, heap or queue data, and a before/after trend. |
| Set a cgroup memory policy | Contains consumption; does not repair a leak. | MemoryHigh can induce reclaim and throttling; MemoryMax can cause an OOM kill inside the unit. |
A drop-in is easy to remove; test failure behavior and monitor requests, restarts, and OOM events. |
| Increase swap | Adds emergency headroom rather than reducing demand. | Can increase disk I/O and latency, especially under sustained pressure. | Reversible at the storage layer; first verify disk performance and monitor swap traffic. |
| Add RAM | Raises capacity without changing application behavior. | Usually avoids swap-related latency but does not stop a leak from growing. | Hardware or VM changes are less reversible; justify them with sustained trend data. |
| Move or schedule workload | Reduces contention by changing placement or timing. | May affect throughput, job completion time, or network paths. | Reversible operationally; correlate pressure with the moved workload. |
Red Hat lists application tuning, additional RAM, additional swap, and workload reallocation as possible responses. More swap is not automatically safer: it can trade an OOM for severe I/O wait. Select the smallest change that addresses the measured cause and define a rollback condition before applying it.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Contain a service with systemd memory controls
On CentOS releases whose systemd and cgroup configuration support these properties, use a drop-in rather than editing the vendor unit file:
Best Value
- material: plastic
- Color: black, transparent
- Length: 128mm, wall thickness 0.3mm
- Features: Effectively protect DDR memory RAM modules, dust-proof and anti-static.
- Used for: Place a standard size DDR2 DDR3 DDR4 desktop DIMM module.
sudo systemctl edit example.serviceAdd a deliberately tested policy in the editor, for example:
[Service]
MemoryHigh=2G
MemoryMax=3GMemoryHigh is a pressure boundary: the kernel reclaims and throttles the cgroup when it crosses the value. MemoryMax is a hard ceiling; allocations that cannot be satisfied under it can trigger an OOM kill in that cgroup. Choose values from observed peak PSS plus a safety margin, not from the server’s total RAM. Include helper processes and expected traffic bursts in the estimate.
Apply and verify the policy:
sudo systemctl daemon-reload
sudo systemctl restart example.service
systemctl show example.service -p MemoryCurrent -p MemoryHigh -p MemoryMax
systemd-cgtopRestart only in a maintenance window or under a tested rolling procedure. Afterward, watch service error rates, latency, restart counts, MemoryCurrent, and kernel OOM messages. A limit that repeatedly kills workers is a containment signal, not proof that the limit is correct; raise or redesign the workload only after reviewing the evidence.
A practical incident workflow
- Record context: CentOS release, kernel, systemd package, VM or physical capacity, workload, and the time the symptom began.
- Measure pressure: save
free -h,/proc/meminfo, and five intervals ofvmstat. - Rank residents: capture
topand sortedpsoutput, then usesmemfor PSS when sharing is significant. - Group by service: inspect
systemd-cgtopand the relevant unit’s memory properties. - Account for the remainder: compare cache, slab, cgroup, and kernel figures; check
sarhistory and OOM logs. - Apply one controlled change: tune the responsible service, add a tested limit, or adjust capacity. Avoid simultaneous unexplained changes.
- Verify: compare pressure, latency, swap activity, error rates, and memory growth against the pre-change baseline.
When to escalate capacity
Escalate to more RAM, more swap, workload relocation, or deeper application profiling when measurements show sustained low available memory, recurring swap traffic, or a predictable workload peak that tuning cannot absorb. Include trend data from vmstat, sar, service cgroups, and application metrics in the capacity request. If pressure appears only during a scheduled job, rescheduling or isolating that job may be cheaper and safer than permanently enlarging the host.
Capacity does not remove a leak: a process that grows without a bound will eventually consume the additional memory. Conversely, a host that is healthy but cache-heavy does not need emergency RAM merely because free is small. The evidence—available memory, paging, ownership, and workload behavior—determines which case you have.
Bottom line
Start with available memory and swap movement, not the headline “used” percentage. Rank RSS, correct ownership with PSS, group processes by cgroup, and inspect cache, slab, journald, and historical paging when the totals do not reconcile. Then fix the measured cause: tune the service, contain it with tested systemd limits, or add capacity with the I/O and operational trade-offs understood. This sequence avoids both common mistakes—purging useful Linux cache and repeatedly restarting a leaking process.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
