free
how much memory is leftfree reports memory. The column that matters is "available" — what programs can still have. The "free" column looks alarmingly small on a healthy machine, because Linux uses spare memory as disk cache and gives it back on demand.
Read available, not free. Unused memory is wasted memory, so Linux fills it with cache.
At the terminal
Read the session first, then the notes: each numbered line in the output is answered by the note with the same number.
What the numbered lines are telling you
Total installed, used by programs, completely unused, shared, used for cache, and available to new programs.
3.5Gi is disk cache. It makes file access faster and is handed back the moment a program needs the memory.
Swap is disk space used when memory runs out. Zero used means the machine has never been short.
Switches
A switch changes how the command behaves. These are the ones used day to day; man free lists the rest. Single-letter switches can usually be joined, so -l -a may be written -la.
-h- Human-readable units.
-m- Show mebibytes. -g shows gibibytes.
-s SECS- Repeat every SECS seconds.
-t- Add a line totalling memory and swap.
-w- Wide: show buffers and cache as separate columns.
Variations worth knowing
The same tool, pointed at a narrower question. These four cover most of what it is reached for day to day.
free -h -s 2Repeats every two seconds, to watch memory change.
free -mShows the figures in mebibytes.
cat /proc/meminfo | head -5The kernel’s own figures, which free reads.
ps aux --sort=-%mem | head -5Lists the processes using the most memory.
In cybersecurity
Running out of memory makes the kernel choose a process to kill.
When memory is exhausted the kernel kills a process to survive — often the database. "dmesg | grep -i oom" shows whether it has happened.
A request that makes a service allocate without limit can take the whole machine down. Limits in systemd units and containers confine the damage.
Whatever was in memory — keys, passwords — can be written to swap in plain text. Encrypted swap protects it on a stolen disk.