Investigating Memory

A Linux host can report very little completely free memory and still be healthy. Another host can report gigabytes of available memory while one container repeatedly dies from an out-of-memory condition.

Both observations are possible because “memory usage” is not one number. Linux uses RAM for application pages, shared libraries, the page cache, kernel objects, page tables, socket buffers, and many other purposes. Some memory is easy to reclaim, some is expensive to reclaim, and some belongs to a limit smaller than the host.

A useful memory investigation asks:

Memory usage describes occupancy. Memory pressure describes the work and delay required to obtain memory. Investigate both.

This chapter builds a scope-aware memory investigation using host composition, PSI, swap activity, per-process accounting, growth analysis, page-cache and kernel memory, cgroup events, OOM evidence, NUMA placement, and bounded observations.